PNPT - Practical Network Penetration Tester Certification - Exam Review

In this video, we'll be reviewing the PNPT Practical Network Penetration Tester Certification Exam from The Cyber Mentor Security (TCM Security).
Find the exam and course here:
academy.tcm-se...
The course content is great and gives you many of the tools and techniques needed to perform an assessment discovering common vulnerabilities within an Active Directory environment.
The challenging exam, paired with the report and technical debrief presentation, will give you an excellent foundation for nailing an interview for a pentesting position.
This video covers:
-My exam experience
-What I liked about it
-Who should take this course and exam
-A quick look at course material
If you have any questions, leave them in the comments below, and let me know if there are any other certs you are curious about.

[@hackstohack2767]

Find the exam and course here: academy.tcm-sec.com/a/aff_gk1wvv9h/external?affcode=770707_robrqlbl

[@deutschmitvkEins]

It felt like I was watching a movie, a small Documentary to be precise. Great review, loved it!!

[@b-rent4733]

Excellent review and presentation! I am currently going through the Practical Ethical Hacking course and loving it!

[@hackstohack2767]

Right on man, keep it up

[@francisdonald4298]

Hlw bro.....tc great

[@Warlock1515]

This looks incredible!!! For only 400!? Holly crap!

[@nar5848]

Taking the exam in Sep Thank you for your review!

[@hackstohack2767]

Good luck! You’ve got this

[@ShabazDraee]

Outstanding review, could you do a comparison between this and OSCP

[@hackstohack2767]

Good idea, I think that could use its own video. For now I'll say the OSCP focuses more on the methodology of vuln discovery, finding an exploit, tweaking exploit, gaining access, and escalating privileges for separate hosts. PNPT is more of a run through of an AD based pentest from start to finish - OSINT, external compromise, internal foothold, lateral movement, domain compromise, report writing, and brief - similar to what you'd see as a pentester on the job. Both highly valuable in what the exams go over, but two completely different exams

[@bogsmart5167]

Thanks ! Great video and interesting music... I plan to pass the certificate next year . ( from Cote d'ivoire)

[@Paradigm816]

Awesome review. Looking forward to more videos in the future.

[@h8handles]

I was on the fence safe to say can't even see the fence now..... I want more content!!!

[@trueperson-o2z]

Hey, great video! I have a question: the site mentions that you need to do lateral and vertical movement and I heard that you will need to pivot, are the pivoting tools and techniques shown in the PEH course enough for the exam? Because in the PEH he only shows sshuttle and proxychains for pivoting which work via SSH afaik, however in an AD environment you might not be connected via ssh. Is the lateral movement mostly based on logging in as a certain user after obtained credentials, or will there be additional tools needed for pivoting that are not shown in the course (like ligolo or chisel)?

[@rbpi]

Thank you for your review. I have obtained the OSCP certification last year, and now I plan to try this certification to supplement my AD-related technical ability.

[@hackstohack2767]

Nice, look into CRTP and a couple of the AD heavy HTB pro labs. They will cover some great AD material

[@Corvid117]

Great video! Love to see more from you!

[@surkewrasoul4711]

A lot of great contents in that course, Heath is truly experienced , Damn it now computers are from him 😅

[@gabrielcruz5187]

Great review! thanks for this, by the way is there a laboratory for you to practice each and every topic that will be provided on the modules?

[@hackstohack2767]

Hey Gabriel, there is section in the course that walks you through setting up your own AD lab to practice each of the modules

[@gabrielcruz5187]

Thanks HacksToHack, will definitely get this certification. Since it is much affordable and more realistic scenario.

[@defcon8132]

Should be interesting. Might give it a shot.

[@orestefanovic8961]

Awesome review! Can you share your specs for the MacBook and what hypervisor are you using? Did you have any problems with specific commands or graphics? And since it has passed 2 years, do you still use Mac for your daily pentesting assessments or hacking in general (Not web related)?

[@psychorockz123]

Great review! What note taking software do you use? The final report looks very professional in the video. Is there a particular tool/template you used?

[@hackstohack2767]

I use a combination of one note to sync across platforms, cherry tree for local, and sublime for just text. TCM has a pretty thorough template that I use: github.com/hmaverickadams/TCM-Security-Sample-Pentest-Report Also this GitHub repo has quite a few: github.com/juliocesarfort/public-pentesting-reports

[@alirezahussaini7248]

we should do pivoting in exam because in the course he didn't speak more about pivoting?

[@jareda8943]

Thank you for the video. I just purchased the voucher and I'm excited to start. Just curious if you think owning the following courses should be enough to help pass the exam? Thanks in advance if you have the time to see this! Practical Ethical Hacking - The Complete course | Windows Priv Escalation for beg | Linux Priv Escalation for beg | OSINT Fundamentals | External Pentest playbook.

[@hackstohack2767]

Focus on the practical ethical hacking course. It should cover all of the concepts and techniques. Of course, having hands on practice will help you a ton. The other course content is excellent as well and you should definitely work through them, but if your goal is to get the PNPT cert and pass the exam focus on “the Complete Course”

[@MarktheShark69]

Regarding your setup, what mac/mac specs are you running, what VM application are you using, and do you have any trouble running hashcat on it at all?

[@jbond5614]

Make video on how did you get Started in Cybersecurity and how can i start and make my career in Cybersecurity because i love breaking things and also share some tip's and suggestions Love from 127.0.0.1

[@hxglemur9466]

Every review I read/hear they mentioned pivoting from external to internal, but the course mater literally only has on video on this and it's a "this is how you would do it" type of video. Should I seek out other material? Even tho it's mentioned that what's provided is enough

[@hackstohack2767]

Pivoting between networks can be as simple as compromising a host that has access to another network. The key is tunneling your traffic through the compromised host to touch the other assets within the target network. This can be done through a variety of different methods including ssh, sshuttle, or a c2 socks proxy (like meterpreter) and proxychains. Hopefully these give you a good research start

[@That_Guy_You_Know]

Great review. Thanks!

[@NickelCityPixels]

What labs, if any, at THM or HTB would you recommend in prep for this?

[@Cybersecpeople765]

I have a MacBook M2 and I'm wondering if it's suitable for handling all practical performance tasks. Additionally, does the exam require any coding language skills?

[@Caesar1N]

Nice review , I'm trying to start my career in Cybersecurity - enrolled in practical ethical hacking course.

[@hackstohack2767]

Right on. How are you liking it so far?

[@Caesar1N]

@@hackstohack2767 going slow (me) going good

[@hackstohack2767]

Take it at your pace, but be consistent with it. This material gets easier to consume as you keep growing and learning. My only suggestion would be to touch it everyday, even if it’s just a little

[@Caesar1N]

@@hackstohack2767 gonna do that , thanks bud

[@cybercrib3393]

please post more content!

[@user-eh1vi3jz1c]

To me the part of cracking passwords with wordlist is just unreal, like if the pwd is 14 digits (or longer) long and uses uppercase, lowercase, numbers and symbols it never gonna be on whatever list.

[@hackstohack2767]

You’d be amazed at just how many passwords inside corporations are on wordlists like seclists and even rockyou.txt. I’d be more surprised if I didn’t crack a single one on an engagement with a wordlist and added rule set. Happens all too frequently and is very real-world

[@RaveyDavey]

Correct. but then you're never going to crack a 14 digit random password. If the target company effectively enforces such passwords then that particular attack vector is closed off. But of course pen testing is about showing them the weaknesses in their protocols and systems. If the company has none then they would get a report telling them that. There would be no point insetting an exam testing network with perfect security - you'd have to engineer some kind of zero day exploit. You're being given one with weaknesses to see if you can find them. Companies struggle to enforce password rules. Must be 12 characters including capitals, lowercase, numbers and alphaumeric? Password-123 fits all those requirements. If there is a lazy way to get around a company rule, it will be used.

[@gahlol7069]

You should upload more!

[@clivoa]

Great review, thanks ! Which tool is that you use for notes ?

[@hackstohack2767]

Mixture of OneNote, cherry tree, and sublime

[@headinthekloudz]

Nice review bro. Just wondering for someone who has no IT experience besides watching KZbin lol, do you think I should learn security+ material first or I can jump right in his bundle course and pass this exam and the ceh?

[@hackstohack2767]

You’re going to want to start applying what you’ve learned so far from KZbin, and get your hands on keyboard. Tryhackme is a great place to start, and definitely hackthebox. If you’re looking for a beginner friendly cert, ejpt is awesome, and the course is available for free from INE I believe. I generally recommend against the sec+ and CEH because you’re learning to pass their test and answer multiple choice questions, which is far from real world. Practical and technical hands on experience is king. You’re going to want some before taking on PNPT. That being said, his practical ethical hacking course is very beginner friendly, and everything you need to pass the test is in the course. But it might be like riding a bike the first time if you’ve never applied these concepts before.

[@overyourbed666]

This was a good review, good job! Quick question: will there be simulated users in the lab environment? Also, how does one know they're "ready" to take the exam? Thanks in advance.

[@hackstohack2767]

This is a full simulated environment with multiple users. If you’re comfortable with the course content after running through it, and your notes are good, take a stab at it! There is no “right time”. Worst case you saddle up again and take a retest. In my experience, the more practicals and labs you do, the better you become. It’s all just added experience

[@ezeadnahc]

I enjoyed this.

[@MishkataPingvin]

Thank you!

[@learnwithshahzebb]

Can you share your notes that you showed in video?

[@itsm3dud39]

form where can i imporve pivoting?? the course doesnt teach much about it

thanks

[@JohnTurner313]

Nice work!

[@hackstohack2767]

Thanks John!

[@wilrivera2987]

Thank you for the review. Quick question. on the laptop where those screen shots of the test? for the report?

[@hackstohack2767]

Yep, you write a full report as part of the exam. Technical evidence and screenshots are part of it

[@b33tleosint15]

ITS NOT THE ONLY ONE....THIS IDEA TCM HAS BECAUSE CYBER MENTOR HAS OSCP CERT.

[@hackstohack2767]

OSCP does not have a brief where you present your report to a live board. It was definitely a cool addition

[@whoisPremier]

Great review! May I ask, during your exam, were you able to use Google for help with certain situations?

[@hackstohack2767]

Oh yeah, it’s open book and open internet. If you’re not googling as a pentester you’re probably missing something. That or you’re a wizard

[@whoisPremier]

@@hackstohack2767 Thank you very much for the response. I am currently preparing for the exam as well, so that is very good to know!

[@hellokid2590]

KIndly, Upload more TCM Certification review videos sir. Subscribed and eagerly waiting for them. and BTW love from INDIA .!

[@mohammadrasheed8402]

Thanks for the review. I'm planning to take this exam however I've no experience in infosec but I'm an experienced Testing professional. Can you suggest how long will it take to cover the course material?

[@hackstohack2767]

It’s all self paced so it’s really up to your learning style. The material is definitely beginner friendly so you’re starting in a good place. Take your time with it and move at a speed where you’re digesting the material. You want a strong foundation for pentesting knowledge because it only ramps up in difficulty. Good luck with your studies!

[@ibnathebeliever2665]

Watching from your video, I'm really interested to take this exam (I just passed my CYSA+ and works in SOC). However, when I looked up online for the review of this certification, some doesn't recommend it as it is a new certification and doesn't weight much on my portfolio. What do you think?

[@hackstohack2767]

You can get a cert for two reasons: 1. To get the recognition of completion, 2. To learn some incredible knowledge. This cert is heavy on number 2. The best certs out there (few and far between) are the ones that combine reasons 1 and 2. There is no doubt in my mind that this one will get there. Hope that helps

[@anupamjaiswal7714]

Awesome review!, can you tell me, is peh is enough for this certification? and the syllabus?

[@hackstohack2767]

Should be. All the topics and techniques are in the PEH course. It does help to have additional AD experience, and know what to look for, but the PEH should give you the foundation for the exam

[@anupamjaiswal7714]

@@hackstohack2767 thanks for the info, 🙃. Can you provide me your any of your social media detail where I can contact you :)

[@exploiter_soloo]

After completing certificate they will send to our house ?

[@albertobarbieri8280]

I just ended the practical ethical hacking course and was easy in my opinion. At this point, do you think this certification is pretty easy? I have an experience of 30 HTB machine and I work as pentester. What do you think?

[@hackstohack2767]

If you work as a pentester, this is a good refresher and a fun challenge. I think this course and cert are most beneficial to those who are just starting out and want to land that first pentesting job

[@brandonpollard3620]

I am just trying to get into cybersecurity I have A+, N+, and security + completed. I am like a week away form finishing my Linux+. I am trying to plan for my first pen test cert. Should I go for this one or do I need to start with something like Pentest+, EJPT, or CEH any advice would be greatly appreciated?

[@hackstohack2767]

Hands on technical certs are king in terms of leaning and demonstrating knowledge. I’ve never found the material for a multiple choice exam stick around and it certainly doesn’t give the experience needed for day 1 on a pentesting job. I trialed the pentest+ new exam version, and didn’t like it. They want you to know their specific answers rather than being able to figure it out and utilize whatever you can to get your desired output. A lot of pentesting is hacking your own methodology and processes to be able to figure out the solution in any way possible. I’d say put your sights on ejpt first as that one is a great introduction, and look into getting TCMs practical ethical hacking course to read through and practice on the side. It sounds like you have a great base with comptia right now, but it’s time to beef up your hands on technical approach. Hack the box and tryhackme are excellent as well

[@brandonpollard3620]

@@hackstohack2767 Thank you very much I really appreciate the advice!

[@siddharthraychaudhuri7250]

For a beginner is the Practical Ethical Hacking course enough to prepare for this exam ?

[@hackstohack2767]

Everything from the exam is covered in the course material

[@rohanmadiratta6421]

How much time does it take to go through the complete course ?

[@hackstohack2767]

Really depends on your experience and confidence level. I do this stuff at work, so I breezed through it pretty quick. I’d encourage you to take it at your own pace until you’re comfortable with what’s covered

[@leandrokogan141]

It looks interesting. Question, from what you encountered in the exam, what requires further learning from what's in the course itself?

[@hackstohack2767]

Hey Leandro, great question. From what I experienced, all the tools and techniques you need to pass this exam are in the course material, plus thorough enumeration, good note taking, and a little creative thinking. I would focus on "Practical Ethical Hacking - The Complete Course" for the PNPT exam.

[@leandrokogan141]

@@hackstohack2767 thank you for the answer

[@hackstohack2767]

Of course!

[@recon0x7f16]

whats the app u used to take notes

[@olivert.7192]

Indeed interesting. What do you do as a profession - are you already a pentester? What experience did you have before going into this certification?

[@hackstohack2767]

Hey Oliver. I am already a full time pentester with background in network pentesting, web pentesting, and mobile pentesting. The exam is great for all levels - If you are a beginner, the course and exam will give you a great foundation. If you are junior to mid level, it gives you a good challenge and some great examples of pentesting tools and techniques, and if you are senior level, the exam is a good refresher and a way to sharpen your methodology.

[@zephyfoxy]

He said right at the start that he's been pentesting for 3 years lol

[@olivert.7192]

@@zephyfoxy :SadKitty: maybe I didn’t pay attention

[@crazyman7659]

Thanks for he review I am planning to buy the voucher and searching for some reviews I got u thanks I'm a student of btech completed my first year I'm gonna start my career in cybersec I have gained the knowledge of Comptia Network+ Penteste+ Linux+ I did this courses but haven't done certifications and I am doing and scrolling over the thm and HTB and portswigger I know TCM from around 4 months I took his peh now I'm gonna be a part of em

[@crazyman7659]

Any improvement or any other courses are hearty welcome

[@hackstohack2767]

If you’ve got the skills, go for the technical certs. I’m not a huge fan of comptia because you’re learning to pass their test. If you’re looking to just get past HR, knock out your pentest+ then keep buffing your technical skills (THM, HTB, PNPT). Getting the course content is one thing, but proving that you can apply the concepts and pass the test will really help you

[@crazyman7659]

@@hackstohack2767 hey forgot to check the msg sorry for that , brought his standalone exam I have done his lpe course and doing AD part of his PEH course and wpe simultaneously , and also brought his epp course . Gonna take his exam around this December and test my self (my first cert ) . And I am a btech student completed my 1st year so rn I am not planning on certs like OSCP that bypass the HR maybe in future? Idk . And I want u to review eccptv2 cert and CRTO certified red team operator ❤️, If possible.

[@javiporras3396]

How would you compare this with others certs??

[@hackstohack2767]

Introductory to intermediate pentest difficulty, focusing on a complete pentest from external, to internal, to DA, to report and delivery. Different in its own way from any cert that I’m aware of. Definitely worth the experience

[@defcon8132]

How long did it take you to ho through the course material?

[@hackstohack2767]

You can go through the material at your own pace. I watched the videos at x2 speed cause I learn best that way. All of the Active Directory material took me a couple nights to get through, but I’m pretty familiar with the content. I think overall there are over 50 hours of course material total

[@nmmorette]

Hi, there is Bof during the PNPT?

[@hackstohack2767]

Nope!

[@gianfrancocaisido265]

Any coupons for this August?

[@hackstohack2767]

DEFCON2021 should work for a little while. 50% off site wide on everything but the exam

[@skinnyelephant7351]

how many BOXES we have to compromise?

[@hackstohack2767]

Depends on your recon :) the exam/client objectives just say you need to compromise the domain controller. If you follow the intended pathway, there are a good handful

[@skinnyelephant7351]

@@hackstohack2767 how good one needs to be for "AD Attacks", i have the COURSE by TCM and the "AD" attacks covered are pretty basic e.g. LLMNR poision, responder usage etc. How hard the exam gets ?

[@hackstohack2767]

@@skinnyelephant7351 Depends on your experience. What's your background and how familiar are you with AD? If you can compromise a windows host, know how to get the info from it that you need, and know how to utilize that to move through an AD environment, you should be good to go. I don't want to get too specific and spoil any of the challenge. If you've gone through the course and have a good understanding of what is mentioned under the AD sections, you should be ready to go. He doesn't try and trick you in the exam, more of an application of the concepts in the course

[@andreas_tech]

wow. 16 hours....

[@recon0x7f16]

goodlord

[@cyberpirate007]

Lotta googling skills needed i see

[@hackstohack2767]

Lol can never have enough of those

[@mansoorali1903]

OSCP LAB EXAM

[@gametech9649]

Can this get me a job

[@hackstohack2767]

You can get you a job. This course and cert could help

[@gametech9649]

@@hackstohack2767 bro ceh exams are bad but I can take them books to learn buy will not attend exam I have that pdf of the book is that good

[@hackstohack2767]

Certs show that you have mastered the material and can see something through to completion. I agree that the CEH exam isn’t the best, but it will at least get you past a HR barrier. There are plenty of other ones, like the PNPT, that I would recommend over CEH. If your goal is an entry level pentest position, get as much technical lab experience and technical certs that you can. Hands on keyboard is everything

[@JohnSmith-ps4uk]

Bullshit.

[@kibspoker]

Hi Mike @HacksToHack , i subscribed to your channel and looking forward to see new vids. I am interested to know your opinion on eLearn Security courses - one of which I am currently taking right now ejPT (PTS course). Hope to hear back from you take care and keep posting!

[@hackstohack2767]

I really enjoy elearnsecurity, especially with their newer updated payment model. The ejpt is a fantastic intro to get first introduced to pentesting topics at an affordable. The ecpptv2 was a very beneficial course and the exam is a good stepping stone on the path to OSCP. I’m looking into their expptx exam now and have heard mixed reviews. I’m going to try and put a video out on that one in the future.

[@kibspoker]

@@hackstohack2767 Thank you so much for this reply. Really appreciate hope to see more vids. Your channel is awesome!