PNPT Study Plan

A real pentest: OSINT, external, AD, report, and a live debrief. A free, day-by-day PNPT schedule built from the official Practical Ethical Hacking + supporting courses syllabus, scaled to your exam date and weekly hours.

Approx. cost: $499
Difficulty: ♥♥♥♥♥
Study time: about 172h
Start level: Junior

▶ Build my PNPT plan

> How long does PNPT take?

The plan assumes about 172 study hours. Here is how that stretches across different weekly schedules.

Hours per week	Time to finish
5 hours	about 35 weeks (8.1 months)
10 hours	about 18 weeks (4.2 months)
15 hours	about 12 weeks (2.8 months)
20 hours	about 9 weeks (2.1 months)
30 hours	about 6 weeks (1.4 months)

> PNPT exam format

TCM Security · Practical Ethical Hacking + supporting courses

5 days to complete the assessment + 2 days to write the report
OSINT, external footprint, then Active Directory to Domain Controller
Zero CTF flags, zero multiple-choice questions
Live 15-minute report debrief with senior pentester assessors
Voucher valid 12 months; one free retake included

Official PNPT page ↗

> PNPT syllabus and study hours

Every topic in the plan, in order, with its baseline hours. The planner shrinks or stretches these to fit your dates.

OSINT & External Recon

Gather intel and map the attack surface before touching internal systems.

Open-Source Intelligence (OSINT) Fundamentals9h · learn
External Pentest Playbook4h · learn

Practical Ethical Hacking Core

The flagship course: networking, scripting, exploitation, web, and buffer overflows.

Networking, Linux & Python refresher8h · learn
Hacking methodology & notekeeping3h · learn
Information gathering (recon)4h · learn
Scanning, enumeration & vulnerability scanning6h · learn
Exploitation basics (Metasploit, manual, brute force)6h · learn
Intro to exploit development (buffer overflows)8h · learn
Web application pentesting & OWASP Top 108h · learn
Wireless attacks (WPA2)3h · learn
Legal documentation & report writing4h · learn
Capstone boxes (Blue, Academy, Dev, Butler, Blackpearl)10h · lab

Active Directory

Build your own domain, then attack it end to end.

Active Directory overview & lab build6h · learn
Initial attack vectors (LLMNR, SMB relay, IPv6/mitm6)8h · learn
Post-compromise enumeration (BloodHound, PingCastle)4h · learn
Post-compromise attacks (Kerberoasting, pass attacks, Mimikatz)8h · learn
Domain compromise (NTDS.dit, Golden Tickets)4h · learn

Privilege Escalation

Go from a shell to full control on Windows and Linux.

Windows Privilege Escalation6h · learn
Linux Privilege Escalation6h · learn

Training Grounds

Rehearse the whole chain without a walkthrough.

Rebuild and re-attack your own AD lab20h · lab
Extra HTB / Proving Grounds boxes20h · lab

Final Boss Prep

Methodology, reporting, and the live debrief.

Consolidate an external + AD methodology checklist6h · review
Write a full sample report end to end8h · review
Practice a 15-minute live findings debrief3h · review

> Where to practise for PNPT

Each task in your plan lists practice labs for its own topic. These are the best places to put in extra hands-on hours:

TJ Null lists of OSCP-like boxes (HTB, PG, VulnHub) (Community)
PG Practice (OffSec practice machines) (Proving Grounds)
Retired machines and Pro Labs (Hack The Box)
Offensive Pentesting path (TryHackMe)

> PNPT exam-day checklist

General logistics for exam week. The official exam guide always takes priority if it differs.

One to two weeks before

Schedule your exam and add the start time, time zone and deadline to your calendar
Read the official exam guide end to end: rules, allowed and banned tools, and what counts as proof
Plan the 5 days for the assessment and 2 days for the report
Rehearse the 15-minute live debrief: key findings, business impact, fixes
Complete a full-length timed practice run on your exam setup
Finalize your note-taking setup and templates (see the notes starter below)
Build and review your cheat sheets and command references
Arrange time off, tell people you will be unavailable, and plan your meals ahead

Machine and network

Charge and test a backup device or phone hotspot, and know how to contact support if your connection drops
Plug in your laptop and turn off sleep, updates and notifications for the exam
Test the VPN or lab connection early and know how to reconnect after a drop
Update your attack VM, take a clean snapshot and keep a spare
Install and test every tool you plan to use, and check none of them are banned
Test your screenshot hotkeys and make sure you have plenty of free disk space

During the exam

Sleep well the night before, and skip last-minute cramming
Prepare food and water, and set timers for break reminders
Read the brief and scope carefully before you touch anything
Write notes and capture proof as you go, not at the end
Time-box each target and move on when stuck. You can come back later
Stop new attacks with enough time left to verify your evidence

Report and submission

Copy your report template and fill in the easy parts (scope, methodology) while you work
Check every finding has reproducible steps and screenshots
Proofread: could someone else follow each step?
Export in the exact format and naming the exam guide requires
Submit with a buffer before the deadline and confirm it was received
Rehearse the live debrief out loud with a timer

Suggested exam-day rhythm

Day 1. Read the brief, set up notes and enumerate everything. Do not rush into exploitation.
Days 2 to 3. Fixed daily rhythm: two or three focused blocks of about 3 hours, breaks between them, and a proper stop at night.
End of each day. Update notes, list your next three ideas and back up your evidence.
Last day or two. Stop new attacks. Verify every finding, then write and proofread the report.
Submission. Submit with a buffer before the deadline and confirm it was received.

▶ Open the interactive PNPT exam kit

The kit lets you tick items off, download a notes starter and report template, and see a readiness score from your plan progress.

> Passed PNPT with PWN PATH

No PNPT debriefs yet

Passed a cert? A short debrief helps the next learner plan their own run, and it only takes a couple of minutes.

▶ Share my debrief

Debriefs are self-reported. See all pass stories.

> Frequently asked questions

How long does it take to prepare for PNPT?

PWN PATH builds the PNPT plan on about 172 study hours. At 10 hours a week that is roughly 18 weeks, and at 20 hours a week roughly 9 weeks. Your own timeline depends on how much of the material you already know.

What is the PNPT exam like?

5 days to complete the assessment + 2 days to write the report. OSINT, external footprint, then Active Directory to Domain Controller. Zero CTF flags, zero multiple-choice questions. Live 15-minute report debrief with senior pentester assessors. Voucher valid 12 months; one free retake included.

How hard is PNPT?

We rate PNPT 2 out of 5. It suits learners who want a realistic, report-and-debrief style exam that mirrors a real engagement. Networking and Linux basics. eJPT-level knowledge helps.

How much does PNPT cost?

Exam voucher plus training is about $499, with one free retake. Prices are approximate, in US dollars unless a currency is shown, and change often. Confirm with the vendor before you buy.

What should I study first for PNPT?

Start with the "OSINT & External Recon" phase: Open-Source Intelligence (OSINT) Fundamentals, External Pentest Playbook. The planner puts topics in a sensible order and scales the hours to the time you have.

What are the prerequisites for PNPT?

Networking and Linux basics. eJPT-level knowledge helps.

What should I do the week before the PNPT exam?

Re-read the official exam guide for rules and banned tools, test your machine, network and VPN or lab connection, finish a full timed practice run, finalize your notes and cheat sheets, and plan your meals, breaks and sleep. The exam-day checklist on this page covers it step by step.

How should I handle breaks and sleep during the PNPT exam?

Day 1: Read the brief, set up notes and enumerate everything. Do not rush into exploitation. Days 2 to 3: Fixed daily rhythm: two or three focused blocks of about 3 hours, breaks between them, and a proper stop at night. End of each day: Update notes, list your next three ideas and back up your evidence. Last day or two: Stop new attacks. Verify every finding, then write and proofread the report.

What should I take after PNPT?

Common next steps are OSCP+, CRTP. See the roadmap to compare them.

Is the PWN PATH study planner free?

Yes. There are no accounts and no sign-up. Your plan and progress are saved in your browser, and you can export a backup file, add the schedule to your calendar or print it.

> Plan your path

Good stepping stones before PNPT:

Where it leads: