Attacks and Exploits · Topic 10 of 10
Scripting and Attack Automation
Learn how testers automate attack tasks with PowerShell, Bash and Python modules, and what breach and attack simulation tools like Caldera are for.
- 4 min
- Automation makes attack tasks repeatable, logged and consistent, at the cost of more noise.
- PowerSploit, PowerView and PowerUpSQL are PowerShell collections, and AD search uses LDAP queries.
- Impacket and Scapy are Python libraries, for Windows protocols and for packet building.
What it is
Automation lets a tester repeat an action across many hosts, chain steps together and run a task consistently. The exam does not ask you to write exploits; it asks you to recognise the scripting languages, the named module collections and the simulation platforms, and to know what each is for.
This page stays at tool-purpose level. The scripting fundamentals, such as loops and variables, are covered on the reconnaissance script page.
How it works
Why automate
Manual steps are slow and easy to get wrong across a large environment. A script runs the same checks everywhere, records what it did, and makes the work repeatable for the report and for a later retest.
The trade-off is noise and risk: automated tasks generate many events and can hit the wrong target if scope is not checked. Testers keep automation inside the approved address list and the testing window.
PowerShell module collections
PowerShell is the Windows automation shell, so many assessment modules are written for it.
| Module | Purpose |
|---|---|
| PowerSploit | A collection of PowerShell modules for reconnaissance and post-exploitation tasks in assessments |
| PowerView | A module for Active Directory enumeration, such as users, groups and trust relationships |
| PowerUpSQL | A toolkit for finding and assessing Microsoft SQL Server instances |
| AD search scripts | Scripted Lightweight Directory Access Protocol (LDAP) queries for users, groups and service principal names |
These modules mostly gather information so the tester can plan, and defenders watch for them through script-block logging and endpoint detection.
Bash and Python
Bash automates tasks on Linux, handling input and output and simple data manipulation such as filtering scan results. Python is favoured for larger tools because of its libraries.
| Python library | Purpose |
|---|---|
| Impacket | A library and scripts for Windows network protocols such as Server Message Block (SMB) and Kerberos, used to automate protocol tasks |
| Scapy | A library for building, sending and decoding custom network packets |
Breach and attack simulation
Breach and attack simulation (BAS) tools automate safe, repeatable emulation of attacker behaviour so that an organisation can test whether its detections and controls work.
| Tool | Purpose |
|---|---|
| MITRE Caldera | Automated adversary emulation mapped to the MITRE ATT&CK framework |
| Infection Monkey | Open-source BAS tool that tests lateral movement and network segmentation |
| Atomic Red Team | A library of small ATT&CK-mapped tests for checking whether detections fire |
BAS differs from a penetration test: it runs known, scripted behaviours to measure detection, rather than creatively finding new paths. The two are complementary.
If a question asks which tool checks whether your detections fire against known ATT&CK techniques, think of a breach and attack simulation tool such as Atomic Red Team or Caldera.
What to remember for the exam
- Automation makes attack tasks repeatable, logged and consistent, at the cost of more noise.
- PowerSploit, PowerView and PowerUpSQL are PowerShell collections, and AD search uses LDAP queries.
- Impacket and Scapy are Python libraries, for Windows protocols and for packet building.
- Bash handles input, output and data manipulation on Linux.
- Breach and attack simulation emulates attacker behaviour to test detections.
- Caldera and Atomic Red Team map their tests to MITRE ATT&CK.
- Infection Monkey tests lateral movement and segmentation.
- Scripts must stay inside scope and the testing window just like any other tool.
Common mistakes
Confusing BAS with a penetration test. BAS runs known scripted behaviours to measure detection, while a test seeks new paths.
Assuming automation is safe by default. A script can hit out-of-scope hosts or overload a service, so scope and rate limits still apply.
Mixing up the module languages. PowerSploit and PowerView are PowerShell, while Impacket and Scapy are Python.
Forgetting logging. Automated runs are noisy, which is useful for the report but also quick to alert defenders.
Treating AD enumeration modules as exploits. They mainly gather information to plan later steps.
Check yourself
Which Python library automates Windows protocol tasks such as SMB and Kerberos?
Impacket.
What is breach and attack simulation used for?
Running known, repeatable attacker behaviours to test whether an organisation's detections and controls work.
Which framework do Caldera and Atomic Red Team map their tests to?
The MITRE ATT&CK framework.
Topic 10 of 10 in Attacks and Exploits
Test yourself on Attacks and Exploits
The full CompTIA PenTest+ PT0-003 question bank has 653 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by CompTIA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.