PenTest+ labs
Every hands-on lab that maps to the CompTIA PenTest+ (PT0-003) certification. This is the full lab package for that certification.
Certification: CompTIA › PenTest+ PT0-003 clear · browse all certifications
55 labs
Beginner
Web App Authentication: Find, Confirm & Fix (Basic)
Hands-on with Authentication Weakness (brute force) (CWE-307) in Acme Accounts's login feature. Safely reproduce it with an inert training tool (no working exploit), classify it, score it with CVSS, then apply the correct fix and verify.
Beginner
Web App Broken Access Control: Find, Confirm & Fix (Basic)
Hands-on with Broken Access Control (IDOR) (CWE-639) in Acme Billing's invoice viewer (/invoice?id=). Safely reproduce it with an inert training tool (no working exploit), classify it, score it with CVSS, then apply the correct fix and verify.
Beginner
Web App Command Injection: Find, Confirm & Fix (Basic)
Hands-on with Command Injection (CWE-78) in Acme Ops Console's host-diagnostics (ping) feature. Safely reproduce it with an inert training tool (no working exploit), classify it, score it with CVSS, then apply the correct fix and verify.
Beginner
Web App CSRF: Find, Confirm & Fix (Basic)
Hands-on with Cross-Site Request Forgery (CSRF) (CWE-352) in Acme Bank's change-password / money-transfer actions. Safely reproduce it with an inert training tool (no working exploit), classify it, score it with CVSS, then apply the correct fix and verify.
Beginner
Web App File Inclusion: Find, Confirm & Fix (Basic)
Hands-on with File Inclusion (LFI/RFI) (CWE-98) in Acme CMS's page renderer (?page=). Safely reproduce it with an inert training tool (no working exploit), classify it, score it with CVSS, then apply the correct fix and verify.
Beginner
Web App File Upload: Find, Confirm & Fix (Basic)
Hands-on with Unrestricted File Upload (CWE-434) in Acme Portal's avatar/document upload feature. Safely reproduce it with an inert training tool (no working exploit), classify it, score it with CVSS, then apply the correct fix and verify.
Beginner
Web App SQL Injection: Find, Confirm & Fix (Basic)
Hands-on with SQL Injection (CWE-89) in Acme Store's login / product-search feature. Safely reproduce it with an inert training tool (no working exploit), classify it, score it with CVSS, then apply the correct fix and verify.
Beginner
Web App SSRF: Find, Confirm & Fix (Basic)
Hands-on with Server-Side Request Forgery (CWE-918) in a web app's URL-fetch feature. Safely reproduce it with an inert training tool (reach an internal service and the cloud metadata endpoint), classify it as SSRF, score it with CVSS, then fix it with a host allowlist that blocks link-local/metadata and disables redirects, and verify.
Beginner
Web App SSTI: Find, Confirm & Fix (Basic)
Hands-on with Server-Side Template Injection (SSTI) (CWE-1336) in Acme Mailer's greeting/personalization feature. Safely reproduce it with an inert training tool (no working exploit), classify it, score it with CVSS, then apply the correct fix and verify.
Beginner
Web App XSS: Find, Confirm & Fix (Basic)
Hands-on with Cross-Site Scripting (XSS) (CWE-79) in Acme Community's comment feature. Safely reproduce it with an inert training tool (no working exploit), classify it, score it with CVSS, then apply the correct fix and verify.
Beginner
Web App XXE: Find, Confirm & Fix (Basic)
Hands-on with XML External Entity (XXE) (CWE-611) in Acme Invoicing's XML import feature. Safely reproduce it with an inert training tool (no working exploit), classify it, score it with CVSS, then apply the correct fix and verify.
Intermediate
Authentication Attack Detection & Incident Response
Respond to a Authentication Weakness (brute force) compromise (CWE-307) in Acme Accounts. Reconstruct the timeline from the access and service logs, scope the impact, engineer a detection rule tuned past a benign look-alike, then contain, eradicate, verify and report.
Intermediate
Broken Access Control (IDOR) Detection & Incident Response
Respond to a Broken Access Control (IDOR) compromise (CWE-639) in Acme Billing. Reconstruct the timeline from the access and service logs, scope the impact, engineer a detection rule tuned past a benign look-alike, then contain, eradicate, verify and report.
Intermediate
Command Injection Detection & Incident Response
Respond to a Command Injection compromise (CWE-78) in Acme Ops Console. Reconstruct the timeline from the access and service logs, scope the impact, engineer a detection rule tuned past a benign look-alike, then contain, eradicate, verify and report.
Intermediate
Cross-Site Request Forgery Detection & Incident Response
Respond to a Cross-Site Request Forgery (CSRF) compromise (CWE-352) in Acme Bank. Reconstruct the timeline from the access and service logs, scope the impact, engineer a detection rule tuned past a benign look-alike, then contain, eradicate, verify and report.
Intermediate
Cross-Site Scripting Detection & Incident Response
Respond to a Cross-Site Scripting (XSS) compromise (CWE-79) in Acme Community. Reconstruct the timeline from the access and service logs, scope the impact, engineer a detection rule tuned past a benign look-alike, then contain, eradicate, verify and report.
Intermediate
File Inclusion Detection & Incident Response
Respond to a File Inclusion (LFI/RFI) compromise (CWE-98) in Acme CMS. Reconstruct the timeline from the access and service logs, scope the impact, engineer a detection rule tuned past a benign look-alike, then contain, eradicate, verify and report.
Intermediate
Server-Side Template Injection Detection & Incident Response
Respond to a Server-Side Template Injection (SSTI) compromise (CWE-1336) in Acme Mailer. Reconstruct the timeline from the access and service logs, scope the impact, engineer a detection rule tuned past a benign look-alike, then contain, eradicate, verify and report.
Intermediate
SQL Injection Detection & Incident Response
Respond to a SQL Injection compromise (CWE-89) in Acme Store. Reconstruct the timeline from the access and service logs, scope the impact, engineer a detection rule tuned past a benign look-alike, then contain, eradicate, verify and report.
Intermediate
SSRF Detection & Incident Response
Respond to a Server-Side Request Forgery compromise (CWE-918) where a web app's URL-fetch feature was aimed at the cloud metadata endpoint and leaked IAM credentials. Reconstruct the timeline from the access and fetch logs, scope the credential exposure, engineer a detection rule for fetches aimed at internal/link-local targets (tuned past a benign look-alike), then contain with an allowlist, rotate the exposed credentials, verify and report.
Intermediate
Unrestricted File Upload Detection & Incident Response
Respond to a Unrestricted File Upload compromise (CWE-434) in Acme Portal. Reconstruct the timeline from the access and service logs, scope the impact, engineer a detection rule tuned past a benign look-alike, then contain, eradicate, verify and report.
Intermediate
XML External Entity Detection & Incident Response
Respond to a XML External Entity (XXE) compromise (CWE-611) in Acme Invoicing. Reconstruct the timeline from the access and service logs, scope the impact, engineer a detection rule tuned past a benign look-alike, then contain, eradicate, verify and report.
Expert
Root-Cause & Secure-Code Remediation: Authentication
Fix Authentication Weakness (brute force) (CWE-307) at the source. Read the vulnerable handler, see the sink, reject a denylist, apply the real fix, record defense-in-depth hardening, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: Broken Access Control
Fix Broken Access Control (IDOR) (CWE-639) at the source. Read the vulnerable handler, see the sink, reject a denylist, apply the real fix, record defense-in-depth hardening, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: Command Injection
Fix Command Injection (CWE-78) at the source. Read the vulnerable handler, see the sink, reject a denylist, apply the real fix, record defense-in-depth hardening, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: CSRF
Fix Cross-Site Request Forgery (CSRF) (CWE-352) at the source. Read the vulnerable handler, see the sink, reject a denylist, apply the real fix, record defense-in-depth hardening, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: CVE-2023-27350
Fix CVE-2023-27350 at the source. Read the vulnerable PaperCut NG/MF code, see how an unauthenticated request reached the admin console and ran a device script as SYSTEM (CWE-284 Improper Access Control), reject a denylist, require an authenticated admin session for every admin page, record hardening, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: CVE-2023-34960
Fix CVE-2023-34960 at the source. Read the vulnerable Chamilo LMS code, see how a crafted file name in a SOAP call was passed to a shell (CWE-78 OS Command Injection), reject a denylist, run the converter with an argument vector (no shell) and validate the file name, record hardening, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: CVE-2023-38646
Fix CVE-2023-38646 at the source. Read the vulnerable Metabase code, see how an H2 JDBC connection string executed code at connect time, pre-auth (CWE-94 Code Injection), reject a denylist, require auth, reject user H2 connections and build the URL from a property allowlist, record hardening, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: CVE-2023-43208
Fix CVE-2023-43208 at the source. Read the vulnerable NextGen Healthcare Mirth Connect code, see how an unauthenticated XML body was deserialized into a gadget chain and ran code (CWE-502 Deserialization of Untrusted Data), reject a denylist, require auth and lock XStream to an allowlist of expected types, record hardening, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: CVE-2024-2044
Fix CVE-2024-2044 at the source. Read the vulnerable pgAdmin 4 session loader, see how the id builds the path (CWE-31) and pickle.load runs code, reject a dot-stripping attempt, validate/canonicalize the path and use json instead of pickle, record session hardening, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: CVE-2024-23897
Fix CVE-2024-23897 at the source. Read the vulnerable Jenkins CLI parser, see how the args4j '@' file-expansion feature is left enabled (CWE-27 arbitrary file read), reject a path denylist, disable the feature with setExpandAtFiles(false), record CLI hardening, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: CVE-2024-27348
Fix CVE-2024-27348 at the source. Read the vulnerable Apache HugeGraph-Server code, see how a Gremlin query bypassed the sandbox via reflection and ran OS commands (CWE-77 Command Injection), reject a denylist, deny reflection and OS execution in the sandbox (allowlist of safe classes), record hardening, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: CVE-2024-3400
Fix CVE-2024-3400 at the source. Read the vulnerable PAN-OS GlobalProtect telemetry helper, see how it passes the SESSID value into a shell command run as root (CWE-77), reject a metacharacter denylist, run the helper with an argument vector (execve, no shell) with input validation, restrict exposure, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: CVE-2024-36401
Fix CVE-2024-36401 at the source. Read the vulnerable GeoServer code, see how a request property name was evaluated as an expression and ran code (CWE-94 Code Injection), reject a denylist, stop evaluating names as expressions and look them up as literal attributes, record hardening, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: CVE-2025-29927
Fix CVE-2025-29927 at the source. Read the vulnerable Next.js request pipeline, see how it skips middleware based on the client x-middleware-subrequest header (CWE-285), reject a known-value comparison, derive the skip decision from an internal server-set signal and strip the header at the edge, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: CVE-2025-31131
Fix CVE-2025-31131 at the source. Read the vulnerable YesWiki template loader, see how the squelette value is concatenated into the file path (CWE-22), reject a dot-stripping attempt, deploy a validated loader (basename + extension allowlist + realpath), add a WAF rule, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: CVE-2025-32463
Fix CVE-2025-32463 at the source. Read the vulnerable sudo chroot setup, see how it loads nsswitch.conf from the user-supplied chroot dir while privileged (CWE-829), reject a world-writable check, load config from the trusted real root instead, retire the deprecated chroot feature in sudoers, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: CVE-2025-3248
Fix CVE-2025-3248 at the source. Read the vulnerable Langflow /api/v1/validate/code endpoint, see how it has no auth and execs posted code (CWE-306 + code injection), reject a name denylist, require authentication and validate by ast.parse instead of exec, restrict the service, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: CVE-2025-49113
Fix CVE-2025-49113 at the source. Read the vulnerable Roundcube Webmail upload.php handler, see how it unserializes the _from value (CWE-502 object injection), reject a string blacklist, validate _from as an identifier instead of unserializing, harden PHP, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: CVE-2025-55182
Fix CVE-2025-55182 at the source. Read the vulnerable React Server Components server-action handler, see how it resolves the action reference from the deserialized payload (CWE-502), reject a string denylist, deploy an allowlist/registry lookup with strict decoding, enforce an origin/CSRF check, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: CVE-2025-68613
Fix CVE-2025-68613 at the source. Read the vulnerable n8n expression evaluator, see how it compiles user expressions with new Function so require()/process reach the server runtime (CWE-913), reject a string denylist, deploy an isolated-vm sandbox with no Node globals, harden the runtime (restricted editing + least privilege), and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: CVE-2026-10520
Fix CVE-2026-10520 at the source. Read the vulnerable Ivanti Sentry report helper, see how it passes the host value into a shell command run as root (CWE-78), reject a metacharacter denylist, run the program with an argument vector (execve, no shell) with input validation, restrict the management interface, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: CVE-2026-1357
Fix CVE-2026-1357 at the source. Read the vulnerable WPvivid upload handler, see how the request filename is concatenated into the destination path (CWE-434), reject a dot-stripping attempt, deploy a validated handler (basename + extension allowlist + realpath), deny PHP execution in uploads so an upload cannot reach RCE, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: CVE-2026-42167
Fix CVE-2026-42167 at the source. Read the vulnerable ProFTPD mod_sql handler, see how the username is formatted into the SQL (CWE-89), reject a quote-escaping attempt, deploy a parameterized query, restrict the database role so injection cannot reach RCE, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: CVE-2026-48282
Fix CVE-2026-48282 at the source. Read the vulnerable Adobe ColdFusion template-include handler, see how the tpl value is concatenated into the include path (CWE-22) and executed, reject a dot-stripping attempt, deploy a validated handler (getFileFromPath + allowlist + getCanonicalPath), record the lockdown and upload deny-exec, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: CVE-2026-72898
Fix CVE-2026-72898 at the source. Read the vulnerable Metabase /reset_password handler, see how it concatenates the email into SQL (CWE-89), reject a quote-stripping attempt, deploy a parameterized query, restrict the app DB role to least privilege, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: File Inclusion
Fix File Inclusion (LFI/RFI) (CWE-98) at the source. Read the vulnerable handler, see the sink, reject a denylist, apply the real fix, record defense-in-depth hardening, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: File Upload
Fix Unrestricted File Upload (CWE-434) at the source. Read the vulnerable handler, see the sink, reject a denylist, apply the real fix, record defense-in-depth hardening, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: SQL Injection
Fix SQL Injection (CWE-89) at the source. Read the vulnerable handler, see the sink, reject a denylist, apply the real fix, record defense-in-depth hardening, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: SSRF
Fix Server-Side Request Forgery (CWE-918) at the source. Read the vulnerable URL-fetch handler, see how it fetches any user URL and follows redirects, reject a substring blocklist, and apply the real fix: allowlist the host, resolve it and reject loopback/link-local/private IPs, and disable redirects. Record IMDSv2 + egress hardening and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: SSTI
Fix Server-Side Template Injection (SSTI) (CWE-1336) at the source. Read the vulnerable handler, see the sink, reject a denylist, apply the real fix, record defense-in-depth hardening, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: XSS
Fix Cross-Site Scripting (XSS) (CWE-79) at the source. Read the vulnerable handler, see the sink, reject a denylist, apply the real fix, record defense-in-depth hardening, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Code Remediation: XXE
Fix XML External Entity (XXE) (CWE-611) at the source. Read the vulnerable handler, see the sink, reject a denylist, apply the real fix, record defense-in-depth hardening, and verify with audit and vulnscan.
Expert
Root-Cause & Secure-Configuration: CVE-2025-24813
Fix CVE-2025-24813 at the deployment. Understand the partial-PUT path-equivalence parsing flaw (CWE-44) and how FileStore session deserialization (CWE-502) turns it into RCE, reject a .jsp extension blacklist, deploy a hardened config (read-only Default Servlet, partial PUT disabled, no FileStore) alongside the upgrade, and verify with audit and vulnscan.