StationX
Start free

← Free roadmaps

Free CompTIA PenTest+ (PT0-003) Roadmap

The offensive counterpart to CySA+. Scoping, reconnaissance, exploitation, post-exploitation and — the part most people underrate — writing the report.

7 steps · 167 free videos · 89 free reads

Start step 1 →

Create your free account to open all 2,396 free items

The 256 free items on this page — and every other free lesson, video and guide — open once you have a free StationX account. No card, no trial.

Create free account →Already have an account? Sign in

Before you start

Read these first

The free roadmap

7 steps, in order

The 🔒 rows show what the full roadmap adds at each step. StationX Membership opens every course and its labs: $299 / year ($24.92/mo billed annually). Infrastructure Labs labs are a separate add-on.

  1. Start here →

    Step 1 — Learn the methodology

    Plan and scope an engagement legally and professionally.

    🔒 The full roadmap adds here: 1 full course (Membership)
    • Course · Total: CompTIA PenTest+ v3 · 🔒 Membership
    See this step on the full roadmap →

  2. Step 2 — Reconnaissance and scanning

    Map an estate and find what is exposed.

    🔒 The full roadmap adds here: hands-on labs 1–29 of 99 (18 labs in Membership · 11 labs in Infrastructure Labs)
    • Lab 1 of 99 · Additional Scanning Options · 🔒 Membership
    • Lab 2 of 99 · Automated Vulnerability Assessments · 🔒 Membership
    • Lab 3 of 99 · Basics of Metasploit · 🔒 Membership
    • Lab 4 of 99 · Core Impact Vulnerability Scan · 🔒 Membership
    • Lab 5 of 99 · Creating Recommendations Based on Vulnerability Assessments · 🔒 Membership
    • Lab 6 of 99 · Host Identification Scanning via Windows · 🔒 Membership
    • Lab 7 of 99 · Host Identification Scanning with Linux · 🔒 Membership
    • Lab 8 of 99 · Identifying System Vulnerabilities with OpenVAS · 🔒 Membership
    • Lab 9 of 99 · Manual Vulnerability Assessment · 🔒 Membership
    • Lab 10 of 99 · Nessus Scanning and Reporting · 🔒 Membership
    • Lab 11 of 99 · Nessus Setup and Config · 🔒 Membership
    • Lab 12 of 99 · Network Discovery · 🔒 Membership
    • Lab 13 of 99 · Open Source Collection · 🔒 Membership
    • Lab 14 of 99 · Scanning and Enumeration · 🔒 Membership
    • Lab 15 of 99 · Scanning and Enumeration · 🔒 Membership
    • Lab 16 of 99 · Scanning and Mapping Networks · 🔒 Membership
    • Lab 17 of 99 · Scanning From Windows · 🔒 Membership
    • Lab 18 of 99 · Vulnerability Scanner Set-up and Configuration · 🔒 Membership
    • Lab 19 of 99 · Perform Open Source Intelligence [Guided] · 🔒 Infrastructure Labs
    • Lab 20 of 99 · Execute Network Reconnaissance [Guided] · 🔒 Infrastructure Labs
    • Lab 21 of 99 · Perform Vulnerability Scans [Guided] · 🔒 Infrastructure Labs
    • Lab 22 of 99 · Monitor Network Traffic by Using Wireshark [Guided] · 🔒 Infrastructure Labs
    • Lab 23 of 99 · Intercept and Obtain Passwords [Guided] · 🔒 Infrastructure Labs
    • Lab 24 of 99 · Perform DOS Attacks [Guided] · 🔒 Infrastructure Labs
    • Lab 25 of 99 · Perform an Attacker-in-the-Middle (AitM) Exploitation [Guided] · 🔒 Infrastructure Labs
    • Lab 26 of 99 · Can You Perform OSINT and Host Discovery? [Advanced] · 🔒 Infrastructure Labs
    • Lab 27 of 99 · Can You Explore Vulnerabilities in Systems, Network Traffic, and Passwords? [Advanced] · 🔒 Infrastructure Labs
    • Lab 28 of 99 · Can You Perform DOS and AitM Attacks? [Advanced] · 🔒 Infrastructure Labs
    • Lab 29 of 99 · Can You Perform OSINT by Using recon-ng, Perform Scans with Nmap & GSA, and Perform AitM Attacks? [Expert] · 🔒 Infrastructure Labs
    See this step on the full roadmap →

  3. Step 3 — Exploitation

    Turn a finding into proven impact.

    🔒 The full roadmap adds here: hands-on labs 30–54 of 99 (14 labs in Membership · 11 labs in Infrastructure Labs)
    • Lab 30 of 99 · Client-Side Exploitation with Social Engineering · 🔒 Membership
    • Lab 31 of 99 · Cybersecurity Testing with Core Impact · 🔒 Membership
    • Lab 32 of 99 · Evasive Maneuvers and Post Exploitation · 🔒 Membership
    • Lab 33 of 99 · Intro To Linux - Backing Up, Compression, and Scheduling · 🔒 Membership
    • Lab 34 of 99 · Intro to Linux - Routing and SSH Tunnels · 🔒 Membership
    • Lab 35 of 99 · Linux Exploitation · 🔒 Membership
    • Lab 36 of 99 · Network Miner · 🔒 Membership
    • Lab 37 of 99 · Open Source Password Cracking · 🔒 Membership
    • Lab 38 of 99 · Pentesting & Network Exploitation - Linux Target Analysis Labs · 🔒 Membership
    • Lab 39 of 99 · Pentesting & Network Exploitation: DMZ Exploitation · 🔒 Membership
    • Lab 40 of 99 · Pentesting & Network Exploitation: LAN Exploitation · 🔒 Membership
    • Lab 41 of 99 · Pentesting & Network Exploitation: Windows Target Analysis Labs · 🔒 Membership
    • Lab 42 of 99 · Post Exploitation and Pivoting · 🔒 Membership
    • Lab 43 of 99 · Windows Exploitation · 🔒 Membership
    • Lab 44 of 99 · Perform Open System Intelligence (OSINT) Gathering [Guided] · 🔒 Infrastructure Labs
    • Lab 45 of 99 · Exploit Common Windows Flaws [Guided] · 🔒 Infrastructure Labs
    • Lab 46 of 99 · Gain Remote Access to a Windows System [Guided] · 🔒 Infrastructure Labs
    • Lab 47 of 99 · Perform Post-Exploit Activities [Guided] · 🔒 Infrastructure Labs
    • Lab 48 of 99 · Exploit Flawed Code [Guided] · 🔒 Infrastructure Labs
    • Lab 49 of 99 · Discover and Exploit Targets by Using Metasploit [Guided] · 🔒 Infrastructure Labs
    • Lab 50 of 99 · Schedule and Perform Network Vulnerability Scans [Guided] · 🔒 Infrastructure Labs
    • Lab 51 of 99 · Can You Find Flaws with OSINT and Vulnerability Scanning? [Advanced] · 🔒 Infrastructure Labs
    • Lab 52 of 99 · Can You Exploit Windows? [Advanced] · 🔒 Infrastructure Labs
    • Lab 53 of 99 · Can You Exploit Windows with Metasploit and Code Analysis? [Advanced] · 🔒 Infrastructure Labs
    • Lab 54 of 99 · Can You Perform Open-source Intelligence (OSINT)-Gathering Operations? [Expert] · 🔒 Infrastructure Labs
    See this step on the full roadmap →

  4. Step 4 — Web application testing

    Work the OWASP Top Ten by hand.

    🔒 The full roadmap adds here: hands-on labs 55–81 of 99 (Membership)
    • Lab 55 of 99 · OWASP Top Ten 2025 - A01 Broken Access Controls · 🔒 Membership
    • Lab 56 of 99 · OWASP Top Ten 2025 - A02 Security Misconfiguration · 🔒 Membership
    • Lab 57 of 99 · OWASP Top Ten 2025 - A03 Software Supply Chain Failures · 🔒 Membership
    • Lab 58 of 99 · OWASP Top Ten 2025 - A04 Cryptographic Failures · 🔒 Membership
    • Lab 59 of 99 · OWASP Top Ten 2025 - A05 Injection · 🔒 Membership
    • Lab 60 of 99 · OWASP Top Ten 2025 - A06 Insecure Design · 🔒 Membership
    • Lab 61 of 99 · OWASP Top Ten 2025 - A07 Authentication Failures · 🔒 Membership
    • Lab 62 of 99 · OWASP Top Ten 2025 - A08 Software or Data Integrity Failures · 🔒 Membership
    • Lab 63 of 99 · OWASP Top Ten 2025 - A09 Security Logging & Alerting Failures · 🔒 Membership
    • Lab 64 of 99 · OWASP Top Ten 2025 - A10 Mishandling of Exceptional Conditions · 🔒 Membership
    • Lab 65 of 99 · OWASP Top Ten 2025 - Capstone · 🔒 Membership
    • Lab 66 of 99 · OWASP Top Ten 2025 - Capstone (pt.1) · 🔒 Membership
    • Lab 67 of 99 · OWASP Top Ten 2025 - Capstone (pt.2) · 🔒 Membership
    • Lab 68 of 99 · Web 201 - Lab 1: Recon Tools · 🔒 Membership
    • Lab 69 of 99 · Web 201 - Lab 2.1: Detecting and Exploiting Hard to Find SQL injections · 🔒 Membership
    • Lab 70 of 99 · Web 201 - Lab 2.2: Advanced Sqlmap · 🔒 Membership
    • Lab 71 of 99 · Web 201 - Lab 2.3: Manual Blind SQL Injection · 🔒 Membership
    • Lab 72 of 99 · Web 201 - Lab 2.4: NoSQL Injection · 🔒 Membership
    • Lab 73 of 99 · Web 201 - Lab 3.1: Cross Site Scripting Filter Evasion · 🔒 Membership
    • Lab 74 of 99 · Web 201 - Lab 3.2: Exploiting Misconfigured CORS · 🔒 Membership
    • Lab 75 of 99 · Web 201 - Lab 4: Advanced OS Command Injection · 🔒 Membership
    • Lab 76 of 99 · Web 201 - Lab 5: Advanced Local File Inclusion · 🔒 Membership
    • Lab 77 of 99 · Web 201 - Lab 6: Advanced CSRF · 🔒 Membership
    • Lab 78 of 99 · Web 201 - Lab 7.1: XXE to Obtain Arbitrary Files · 🔒 Membership
    • Lab 79 of 99 · Web 201 - Lab 7.2: Out of Band XXE Attacks · 🔒 Membership
    • Lab 80 of 99 · Web 201 - Lab 8: Server Side Request Forgery · 🔒 Membership
    • Lab 81 of 99 · Web 201 - Lab 9: Insecure Deserialization in Python and Java · 🔒 Membership
    See this step on the full roadmap →

  5. Step 5 — Post-exploitation and lateral movement

    Escalate, persist, move laterally and cover your tracks once you are in.

    Hands-on step: the labs for it are on the full roadmap.

    🔒 The full roadmap adds here: hands-on labs 82–92 of 99 (Infrastructure Labs)
    • Lab 82 of 99 · Perform Open Source Intelligence [Guided] · 🔒 Infrastructure Labs
    • Lab 83 of 99 · Use Network Tools to Perform Discovery Scanning and Network Reconnaissance [Guided] · 🔒 Infrastructure Labs
    • Lab 84 of 99 · Perform Vulnerability Scanning by using Greenbone Security Assistant (GSA) [Guided] · 🔒 Infrastructure Labs
    • Lab 85 of 99 · Explore Network Traffic by Using Wireshark [Guided] · 🔒 Infrastructure Labs
    • Lab 86 of 99 · Evaluate the Risk of Password Cracking to Your IT Environment [Guided] · 🔒 Infrastructure Labs
    • Lab 87 of 99 · Perform Lateral Movement [Guided] · 🔒 Infrastructure Labs
    • Lab 88 of 99 · Take Advantage of Anti-Forensic Techniques [Guided] · 🔒 Infrastructure Labs
    • Lab 89 of 99 · Can You Perform OSINT Techniques to Unveil Hidden Network Details and Service Information? [Advanced] · 🔒 Infrastructure Labs
    • Lab 90 of 99 · Can You Explore Vulnerabilities in Systems, Network Traffic, and Passwords? [Advanced] · 🔒 Infrastructure Labs
    • Lab 91 of 99 · Can You Perform Lateral Movement and Post-exploit Activities? [Advanced] · 🔒 Infrastructure Labs
    • Lab 92 of 99 · Can You Perform Information Gathering, Credentialed Vulnerability Access, and Attack a Boundary Server? [Expert] · 🔒 Infrastructure Labs
    See this step on the full roadmap →

    Try a free hacking lab: Recon to shell (~5 min) → A scripted simulation in your browser. No account needed.

  6. Step 6 — Write the report

    Turn findings into a report with risk ratings, remediation advice and an executive summary.

    Hands-on step: the labs for it are on the full roadmap.

  7. Step 7 — Scripting for testers

    Automate the boring parts.

    🔒 The full roadmap adds here: hands-on labs 93–99 of 99 (Membership)
    • Lab 93 of 99 · Intro to Python · 🔒 Membership
    • Lab 94 of 99 · Python · 🔒 Membership
    • Lab 95 of 99 · Python Tool Building - Authenticated SQLi · 🔒 Membership
    • Lab 96 of 99 · Python Tool Building - Banner Grabber · 🔒 Membership
    • Lab 97 of 99 · Python Tool Building - C2 · 🔒 Membership
    • Lab 98 of 99 · Python Tool Building - Local File Inclusion · 🔒 Membership
    • Lab 99 of 99 · Windows Rootkits With Python · 🔒 Membership
    See this step on the full roadmap →
Exam and next steps

Before the exam

Do it hands-on

The full CompTIA PenTest+ (PT0-003) roadmap

The same steps with every course and the hands-on labs, and your progress tracked.

The full roadmap with labs →What Membership includes · Full refund within 30 days if you haven't started a lab · cancel anytime
Advanced

AI-Driven Security Engineering

Become the Cyber Security Expert the AI Era Needs.

StationX’s AI Master’s teaches you to create and deploy security solutions by directing AI. “No coding background required. You direct the AI; the AI does the building.”

Explore the AI Master’s →
2,396 free items open with a free accountCreate free accountSign in