Source: Juni_2026_Exams/Penetration_Testing/notes/00-focus-points.md

Penetration Testing Focus Points

Exam Model

The uploaded CTF card describes an open-notes flag hunt launched with python3 start_ctf.py. It gives the expected answer shape as:

FLAG_XX: <32-character hexadecimal value>

The card is based on prior exams. Its exact ports, credentials, endpoints, and flag locations are not guaranteed to repeat.

Priority 1: Enumeration Before Exploitation

You should be able to:

• identify every reachable TCP service, including non-default ports
• map a version string to likely enumeration or exploitation paths
• inspect HTTP source, headers, robots.txt, files, metadata, and APIs
• connect manually to text-based services with nc
• keep a table of tested and untested services

Use notes/04-detailed-ctf-exam-playbook.md when you need the full decision-tree explanation and checklists/pentest-command-cheatsheet.md when you only need commands.

Minimum scan sequence:

TARGET=127.0.0.1
nmap -Pn -sV -p- --min-rate 1000 "$TARGET" -oA scans/all-tcp
nmap -Pn -sC -sV -p <OPEN_PORTS> "$TARGET" -oA scans/detail

Reduce --min-rate if the lab becomes unstable. -sC runs scripts and should only be used inside the authorized lab.

Priority 2: Web and Data Inspection

Master:

curl -i "http://$TARGET:<PORT>/"
curl -s "http://$TARGET:<PORT>/robots.txt"
curl -s "http://$TARGET:<PORT>/" | grep -Ein 'flag|secret|token|pass'
exiftool downloaded-file
strings -a downloaded-file | less
printf '%s' '<BASE64>' | base64 -d
printf '%s' '<HEX>' | xxd -r -p

Look for HTML comments, unusual headers, hidden paths, JavaScript endpoints, JSON fields, downloadable files, and encoded values.

Priority 3: Service-Specific Work

For each open port, know the first client to try:

Priority 4: Metasploit

Know this workflow without notes:

search <product or CVE>
info <module>
use <module>
show options
show payloads
set RHOSTS <target>
set RPORT <port>
set <required option> <value>
check
run
sessions
sessions -i <id>

Never select an exploit only because a port number matches. Confirm the service and version first.

Priority 5: Shell and Pivot Workflow

After gaining an authorized shell:

id
whoami
hostname
pwd
ip addr
ip route
ss -lntup

Then identify internal networks and enumerate only the lab range:

nmap -sn <LAB_SUBNET>
nmap -sT -sV -p- <INTERNAL_HOST>

Use -sT when scanning from a low-privilege shell that cannot send raw SYN packets.

Priority 6: Evidence and Time Control

Create an answer table immediately:

Do not spend the whole exam on one exploit. Finish quick web, banner, file, and encoding checks before long brute-force or exploit attempts.

Lower Priority

Study these after the core workflow:

• advanced OSINT framework configuration
• payload generation
• legacy TFTP/SMB transfer methods
• client-side document exploitation

They are in the lectures, but the uploaded CTF guidance emphasizes enumeration, common services, web flaws, Metasploit, and pivoting.