Penetration Testing
Learn systematic approaches to testing security of systems, networks, and applications through simulated attacks.
10 Topics
Key concepts
3 Levels
Beginner to Advanced
12 Tools
Curated for this track
8 Questions
Test yourself
About this track
A repeatable method for finding what an attacker would find.
Penetration testing is the discipline of simulating a real attack under rules of engagement and then explaining it well enough that it gets fixed. The skill is less about knowing exploits and more about method: reconnaissance, enumeration, exploitation, and post-exploitation applied consistently until something gives.
This track follows that kill chain in order. You will spend real time on enumeration, which is where most engagements are actually won, then move through exploitation and privilege escalation on both Linux and Windows before reaching Active Directory — the environment where most corporate testing happens.
Reporting is treated as a first-class skill here, not an afterthought. A finding nobody can reproduce has no value.
Key topics
10 topics grouped into three modules, in the order you should meet them.
- 01
Method & recon
4 topics- 1.
Reconnaissance
Passive and active information gathering before you touch anything that logs.
- 2.
Scanning & Enumeration
The phase that decides the engagement. Slow, exhaustive, and endlessly revisited.
- 3.
Vulnerability Assessment
Separating the scanner's noise from the handful of findings that actually chain.
- 4.
Exploitation
Turning a known weakness into reliable, repeatable access.
- 1.
- 02
Exploitation
4 topics- 5.
Post-Exploitation
Situational awareness, credential harvesting, and deciding where to go next.
- 6.
Privilege Escalation
Local misconfigurations and kernel paths that take you from user to root or SYSTEM.
- 7.
Lateral Movement
Reusing credentials and trust relationships to spread across a network.
- 8.
Reporting
Reproduction steps, impact, and remediation — the deliverable the client actually pays for.
- 5.
- 03
Post-exploitation & AD
2 topics- 9.
Web App Pentesting
Applying the same method to applications; overlaps heavily with the Web Security track.
- 10.
Active Directory Attacks
Kerberoasting, delegation abuse, and ACL paths — where most corporate engagements are decided.
- 9.
What you'll be able to do
- Run a full engagement from scoping through to a written report
- Enumerate a host or network exhaustively rather than stopping at the first open port
- Escalate privileges reliably on both Linux and Windows targets
- Attack a realistic Active Directory environment and explain the blast radius