Practical Network Penetration Tester (PNPT) — Review

As a brief introduction — this is my very first certification. There wasn't a single second that I disliked when doing the courses, or even the exam. I have been a "TCM Security Fanboy" since it's inception. I used to use Heath's PEH YouTube videos back when I was a broke college student trying to learn as much as I could. So is there some bias? Sure…but I'll do my best to leave my actual exam review as unbiased as possible. Anyways, lets dive into my take on the PNPT, and my advice after passing on my first attempt.

If you're familiar with exam, feel free to jump down to the Preparation and Advice section at the bottom.

Background

The PNPT is an exam offered by TCM Security, and all courses and resources can be found on their academy. Full disclosure — I've done all of the recommended courses for the exam, PLUS the Movement, Pivoting and Persistence course from Joe Helle (a.k.a The Mayor). That course specifically is not required but I highly recommend it in general — it's not geared towards beginners though, so don't make that your first encounter with any of the courses. They have a variety of flavors in regards to courses, like Linux Basics, Python Courses, Mobile App Pentesting, and more. I have been sitting in the Practical Malware Analysis & Triage in my free time and you want to talk about a fun and interesting course! Plus…Heath (and the others of TCM Staff) still pump out YouTube videos that are very resourceful as well.

But in general with any of these courses, you don't just get a PowerPoint slide show, definitions and answers, and a certificate of completion. You are challenged with labs, you have step-by-step hands on walkthroughs and a plethora of resources and course designed repos that you can use at any time for reference. Those walkthroughs don't just show you "how to do something" they also show you "why you are able to perform this attack." They clearly state when you should dive into something deeper on your own time, or even specific recommendations on keeping notes (which is very useful in general…something I wish I did better back in school). You literally are learning from Heath himself in all of the recommended courses, and get to take a look into his workflow, methodology, etc. and apply those things that he uses for your own CTF or Pentesting endeavors.

There's a million and one Security related certifications…why the PNPT?

Here's a little roadmap from Paul Jerimy just for reference.

Well, that is a very valid question. Here's the true reasoning on why I went down that path:

1. I needed a certification.
2. I had many of the needed courses that I bought over time.
3. It's not going to break the bank (plus you get a free retake). $299 for the standalone exam or $399 for the exam + study materials (this is an absolute STEAL). Plus discounts for military, students, etc.
4. Without Heath's YouTube videos (and then the Academy), I wouldn't know anything about Penetration Testing. I wanted to prove (mostly to myself) that I am capable of doing what I learned and executing it at a high level. And mostly, support TCM, as they have supported not only me, but also almost 40,000 students (and that's just the amount of people in their discord) and likely hundreds of thousands more via Udemy or YouTube.

Now that all of of that is out of the way, lets take a look at what you really came here for:

The Exam

This isn't a "you have X amount of hours to root X amount of boxes" exam. This was a legitimate penetration test from start to finish, with a report and debrief. Going into this with a CTF mindset, will leave you scratching your head multiple times.

Is this exam the golden ticket? Nope. But has it become more industry recognized? Definitely. From what I saw in a recent post in their discord… Tenable (the company that makes Nessus) is accepting it as a requirement. If it's good enough for them, it's surely good enough for me.

How did the exam work?

For me personally, I was laying in bed the night before, said screw it, and booked it for the next morning. At the time of writing this, you can book it as early as four hours in advance. The next morning, I got the following email right as the exam kicked off:

So you get five (5) full days to try and compromise the domain, plus two days after to write and submit your report. Besides the VPN connection, you get your Rules of Engagement, which is very professional. This is 100% an R.O.E that you would receive in a "real" pentest — which once again is where I am saying do not go into this with a CTF mindset. It is realistic from start to finish.

Support

During the exam there were two times specifically where I encountered issues, either from my end or on the exam environment end. Not even remotely a problem with support — it was extremely fast. Usually within half an hour (at max) any question/issue I had was resolved.

You also get two environment resets, which I needed one of the two. Sent in my request for a reset, and within the next few minutes I was notified the environment was resetting.

Okay, now the real exam experience:

I gave up twice during the exam…and still passed on my first try. Read on..

So I can't (and won't) go into any detail on the environment itself, or anything specifically in regards to my environment and what I did/saw. If that's what you came for, I'm sorry (not really).

But what I can tell you — this is not a CTF. This is a penetration test. I've said it a few times already, I know. There is OSINT involved, external testing, and internal testing.

When it comes to the OSINT part (and the whole exam in general), it's a matter of not over-complicating it. Here specifically, I did believe it was very straightforward and nothing was really out of the ordinary. It did take me longer that I would've hoped to get an initial foothold but that was because I was treating it like a CTF. (Why do you think I keep reiterating this?) When I took a break, I changed my approach, and the full "kill-chain" started to become more visible to me once I changed my thinking. It took longer than I hoped, but nonetheless…I was in.

I've got some sort of foothold at this point, and here I am… trying all kinds of things I don't need to be trying because I couldn't shake the CTF mindset for the first day or two. I went back to the basics, and low and behold — I kept moving.

Few days in, and I am stuck. Entirely stuck and I wish I could tell you where. I can't believe it, thinking back to that point of the exam. In fact… I sat at this point for a full day of testing. This was where I unofficially gave up for the first time. The second time I unofficially gave up? Not long after that. I still had the drafted email to TCM saying I quit and that they can terminate my environment. I'm really glad I never hit send.

Between my two "quits" I sacrificed about eight hours and started my report. Both times I remember thinking "there is no way I've tried what I've learned and there's nothing left to try?" and decided to hop back in. Realizing I missed some key parts, I took a step back, understood what I needed to do and executed it up to a full Domain Compromise. Why was I continuously getting stuck? It's not a CTF. It's okay to slow down…there's 5 days. You don't get extra points for the speed at which you get a compromise.

I remember seeing someone else's review stating "you will run out of ideas before you ever run out of time." That is 100% accurate. You have more than enough time, where you can go find an article/academy lesson/YouTube video on what you are trying to do and hop back in the environment to try it.

When it came to actually hands-on testing, that really equated to a bit over 3 days (not factoring in the 8 hours where I "quit"). And by 3 days I don't mean 72 hours straight… I mean standard "8 hour workday" type of thing...well a little longer than an 8 hour day because I ran the environment the full five days just to be sure I got everything I needed. So truthfully, it was really "Day 4" when I was done with the meat and potatoes of the technical portion.

With some free time after the compromise, I went back to verify I still had my notes and screenshots I needed, and checked to see what else could be found and deemed "vulnerable". It's a real engagement right? Why not provide a legitimate report and debrief of everything you were able to find?

After I compiled my report (around 40 pages) and submitted it within the required time-frame, I received an email a few hours later:

I consider myself to be fairly good at public speaking, and I've never been nervous to stand up and present something. But this was by far the most nervous I've ever been for a presentation. And I was nervous for no reason at all — the debrief was actually my favorite part of the exam (maybe because it was the end?). I was mainly intimidated at the fact that I had to present the findings to someone that knows the ins-and-outs of exactly what I did.

Disclaimer:_ I'm also a lose cannon when it comes to presentations…I don't practice. I'm very comfortable in general when I need to present something. I don't really keep notes to speak on because I don't want to take attention away from what I'm trying to get across. What I put on my slide is exactly what I plan to talk about (in as few bullet points as possible) and can deviate if questions are asked. Don't be like me. Practice. Keep notes. All that good stuff._

I booked my debrief for later in the week, reported my findings and not too long after that, I received my very first certification.

Preparation and Advice

For anyone that is looking to take the exam, here is what I did and some tips I would like to share. I did pass it on my first go, but that means absolutely nothing. Following exactly what I did will not ensure that you even pass. These are just some things I've discovered or picked up from others.

Prep

This part was on and off for about a month. Maybe a tad longer, but I completed one of the suggested courses before every deciding to take the exam. I studied when I could, and dipped into the MPP Course mentioned earlier. Aside from the courses, there wasn't much other prep that needed to be done. But don't get me wrong..it wasn't like I messed around or did other things for a month. All day on Saturday and Sunday, every night after work until I went to bed, was spent studying the course material. Zero social life.

A lot of people ask about what's available on TryHackMe, HackTheBox, or other platforms that can be used as practice that replicates the exam. Here's my true answer:

Honestly nothing.

But…that doesn't mean there isn't practice available! In fact I used both of those platforms. Aside from the capstones you complete in the study materials, I would take a few breaks after each full course and hit a couple of boxes on either platform from the OSCP testing list and did a write up on each one. You really don't need this, but I just wanted a little more hands on and a learning break.

What I will recommend from TryHackMe is one of their AD Environments (Wreath, Holo, or Throwback). I did Throwback — I had already completed the other two before. Throwback did cost money, but others are free and will suffice in terms of applying some things you've learned in a full environment. Yes they are CTFs. Try and focus on the methodology — not the tools and attacks you learn from doing these rooms. I planned on doing this the week before my exam.

There are also specific AD rooms on TryHackMe now. I didn't use them, but I'm willing to bet that they would help, so I'll blindly recommend it if you want the practice. Plus the discord channel has some other specific boxes they recommend as well.

TLDR: All five (5) recommended courses (optionally the MPP course), Throwback, Wreath, or Holo, and Google when I didn't understand something.

Advice

Here is my ultimate advice to help yourself gain that shiny certification:

• Do the PEH Course. IF you only do three courses: PEH, OSINT, and External Pentest Course.
• THIS IS NOT A CTF. I feel like I've gotten that point across.
• Be very confident in understanding AD attack vectors and the methodology behind them.
• Use Google. All the time. (And learn how to do it effectively). Especially if you don't understand something during the courses. This is more life advice than anything.
• Take a break! You have plenty of time. I "quit" twice, remember?
• Believe in yourself. Believe what you have learned is what you need.
• Remember the basics. Take what you have learned or gathered, and apply that to your specific environment. Do not focus on "how" — focus on "why" both in prep and the exam.

With all of this being said, I recommend this certification to anybody, as well as any of their courses. Whether you take the exam or not, you will walk away learning something. Even if you it takes you two, three, or 10 attempts — the TCM community wants to see you succeed and will do anything to help you accomplish your goals.

If you made it this far, thank you for reading.

Best of luck on your exam.