Module 1 — Penetration Testing Fundamentals

• Introduction to Penetration Testing

• Vulnerability Assessment vs Penetration Testing

• Black Box, Grey Box & White Box Testing

• Internal vs External Penetration Testing

• Penetration Testing Methodologies

• PTES & OWASP Methodologies

• Rules of Engagement

• Scope Definition & Authorization

• Legal & Ethical Considerations

• Setting Up a Professional Pentesting Lab

Practical Labs

• Kali Linux & Vulnerable VM Setup

• Attacker–Target Network Configuration

• Basic Lab Environment Validation

Module 2 — Linux & Networking Fundamentals

• Linux Filesystem & Commands

• Users, Groups & Permissions

• Processes & Services

• SSH & Remote Access

• Bash Fundamentals

• TCP/IP & OSI Model

• TCP vs UDP

• Ports & Protocols

• DNS, HTTP/HTTPS, ICMP & ARP

• Routing, NAT & Firewalls

Practical Labs

• Linux System Enumeration

• Network Traffic Analysis with Wireshark

• TCP Handshake & Protocol Analysis

• DNS & HTTP Traffic Analysis

• Bash-Based Reconnaissance Scripts

Module 3 — Reconnaissance & Information Gathering

• Passive Reconnaissance

• Active Reconnaissance

• OSINT Fundamentals

• WHOIS & DNS Reconnaissance

• Subdomain Enumeration

• Email & User Enumeration

• Technology Fingerprinting

• Host Discovery

• Port Scanning

• Service & Version Enumeration

• Nmap Scripting Engine

Tools

• Nmap

• Amass

• Subfinder

• theHarvester

• Netcat

• Search Engine Operators

Practical Labs

• Complete Target Reconnaissance

• Subdomain Discovery

• Port & Service Enumeration

• Attack Surface Mapping

Module 4 — Vulnerability Assessment

• Vulnerability Identification

• CVE & CVSS

• Vulnerability Validation

• False Positives & False Negatives

• Automated vs Manual Testing

• Vulnerability Research

• Exploit Research

Tools

• Nessus / OpenVAS

• Nmap NSE

• SearchSploit

Practical Labs

• Vulnerability Scanning

• Manual Validation of Findings

• CVE Research

• Vulnerability-to-Exploit Mapping

Module 5 — Exploitation Fundamentals

• Exploitation Concepts

• Exploit Lifecycle

• Payloads

• Reverse Shells & Bind Shells

• Staged vs Stageless Payloads

• Listeners

• Exploit Selection

• Public Exploit Analysis

Tools

• Metasploit Framework

• SearchSploit

• Netcat

Practical Labs

• Service Exploitation

• Reverse Shell Establishment

• Meterpreter Sessions

• Manual Exploit Execution

• Exploit Modification in a Controlled Lab

Module 6 — Password Attacks & Credential Security

• Password Security Fundamentals

• Password Hashes

• Hash Identification

• Dictionary Attacks

• Brute-Force Concepts

• Password Spraying

• Credential Reuse

• Custom Wordlist Generation

Tools

• Hydra

• John the Ripper

• Hashcat

• CeWL

Practical Labs

• SSH/FTP Credential Testing

• Password Hash Cracking

• Custom Wordlist Creation

• Credential Security Assessment

Module 7 — Linux Privilege Escalation

• Linux Enumeration Methodology

• SUID & SGID

• Sudo Misconfigurations

• Cron Jobs

• Writable Files & Directories

• PATH Hijacking

• Linux Capabilities

• Service Misconfigurations

• Kernel Vulnerabilities

• Credential & Key Discovery

Practical Labs

• Local Enumeration

• SUID Exploitation

• Sudo Abuse

• Cron Job Exploitation

• Low-Privilege User → Root

Module 8 — Windows Pentesting

• Windows Architecture

• Users & Groups

• Windows Services

• Registry

• Scheduled Tasks

• PowerShell Fundamentals

• Windows Networking

• SMB

• Windows Authentication

Practical Labs

• Windows Host Enumeration

• User & Group Enumeration

• Service Enumeration

• PowerShell-Based Enumeration

• Windows Attack Surface Mapping

Module 9 — Windows Privilege Escalation

• Windows Privilege Escalation Methodology

• Weak Service Permissions

• Unquoted Service Paths

• Scheduled Task Abuse

• AlwaysInstallElevated

• Registry Misconfigurations

• Token Privileges

• Credential Hunting

• Automated Enumeration

Tools

• WinPEAS

• PowerView

• PowerShell

Practical Labs

• Local Privilege Escalation

• Service Exploitation

• Registry-Based Escalation

• User → Administrator

Module 10 — Active Directory Fundamentals

• Active Directory Architecture

• Domains & Domain Controllers

• Users, Groups & Computers

• Organizational Units

• LDAP

• Kerberos

• NTLM

• Group Policy

• Trust Relationships

• Active Directory Authentication

Practical Labs

• Active Directory Lab Setup

• Domain Enumeration

• User & Group Enumeration

• AD Object Discovery

Module 11 — Active Directory Enumeration & Attacks

• AD Enumeration Methodology

• SMB Enumeration

• LDAP Enumeration

• BloodHound

• SharpHound

• PowerView

• Kerberoasting

• AS-REP Roasting

• Password Spraying

• Credential Reuse

• Pass-the-Hash Concepts

• NTLM Relay Concepts

• ACL Abuse

• Delegation Concepts

• DCSync Concepts

• Lateral Movement

Practical Labs

• BloodHound Attack Path Analysis

• Kerberoasting

• AS-REP Roasting

• Credential-Based Attacks

• Lateral Movement

• Domain User → Domain Admin Attack Chain

Module 12 — Web Application Penetration Testing

• Web Application Architecture

• HTTP Requests & Responses

• HTTP Methods & Status Codes

• Headers

• Cookies & Sessions

• Parameters & Inputs

• Attack Surface Mapping

• Web Reconnaissance

• Technology Fingerprinting

• Directory & Endpoint Enumeration

• JavaScript Analysis

Tools

• Burp Suite

• ffuf

• Gobuster

• WhatWeb

• Browser Developer Tools

Practical Labs

• HTTP Request Interception

• Parameter Manipulation

• Endpoint Discovery

• Directory Enumeration

• Complete Web Application Reconnaissance

Module 13 — Web Authentication & Session Testing

• Authentication Mechanisms

• Username Enumeration

• Weak Passwords

• Brute-Force Protection

• Account Lockout

• Password Reset Vulnerabilities

• MFA Security Testing

• Authentication Bypass

• Session Management

• Session Fixation

• Session Hijacking Concepts

• Cookie Security

• Session Expiration & Logout Testing

Practical Labs

• Authentication Testing

• Password Reset Testing

• Session Manipulation

• Authentication Bypass Labs

Module 14 — Authorization & Access Control

• Authorization Concepts

• Role-Based Access Control

• IDOR / BOLA

• Horizontal Privilege Escalation

• Vertical Privilege Escalation

• Forced Browsing

• Missing Access Controls

• Parameter Tampering

Practical Labs

• User-to-User Access Testing

• User-to-Admin Escalation

• IDOR/BOLA Exploitation

• Role Manipulation

Module 15 — Injection Vulnerabilities

• SQL Injection Fundamentals

• Error-Based SQL Injection

• Union-Based SQL Injection

• Boolean-Based Blind SQL Injection

• Time-Based Blind SQL Injection

• SQL Injection Detection & Validation

• Command Injection

• Blind Command Injection

Tools

• Burp Suite

• SQLMap

Practical Labs

• Manual SQL Injection

• SQL Injection Through Burp Suite

• SQLMap-Based Validation

• Command Injection Labs

Module 16 — XSS & Client-Side Vulnerabilities

• Cross-Site Scripting Fundamentals

• Reflected XSS

• Stored XSS

• DOM-Based XSS

• XSS Contexts

• Encoding & Filtering

• Client-Side Attack Surface

Practical Labs

• Reflected XSS

• Stored XSS

• DOM XSS

• Filter Bypass Labs

• XSS Impact Demonstration in Controlled Environments

Module 17 — File & Server-Side Vulnerabilities

• Path Traversal

• Local File Inclusion

• Remote File Inclusion Concepts

• File Upload Vulnerabilities

• Unrestricted File Upload

• Server-Side Template Injection

• XXE

• Insecure Deserialization Concepts

Practical Labs

• Path Traversal

• LFI Exploitation

• File Upload Testing

• XXE Labs

• SSTI Labs

• Deserialization Vulnerability Labs

Module 18 — SSRF & Web Security Misconfigurations

• Server-Side Request Forgery

• Internal Service Access

• Cloud Metadata Concepts

• Security Headers

• CORS Misconfigurations

• HTTP Method Testing

• TLS Configuration

• Debug Mode

• Default Credentials

• Backup Files

• Information Disclosure

Practical Labs

• SSRF Exploitation

• Internal Service Discovery

• CORS Testing

• Security Header Assessment

• Misconfiguration Auditing

Module 19 — API Penetration Testing

• REST API Architecture

• JSON & HTTP Methods

• API Reconnaissance

• API Authentication

• API Authorization

• JWT Authentication

• BOLA

• Broken Authentication

• Excessive Data Exposure

• Mass Assignment

• Rate Limiting

• Parameter Tampering

• JWT Security Testing

Practical Labs

• API Endpoint Discovery

• API Request Manipulation

• BOLA Testing

• JWT Analysis

• API Authentication & Authorization Testing

• Rate-Limit Testing

Module 20 — Network & Infrastructure Penetration Testing

• External Network Pentesting

• Internal Network Pentesting

• Firewall Assessment

• Network Service Enumeration

• SMB Security Testing

• FTP Security Testing

• SSH Security Testing

• SNMP Enumeration

• DNS Security Testing

• SMTP Enumeration

• Credential-Based Network Attacks

Practical Labs

• External Network Assessment

• Internal Network Enumeration

• Service Exploitation

• Credential Attack Simulation

Module 21 — Pivoting & Lateral Movement

• Network Pivoting Concepts

• Internal Network Discovery

• Port Forwarding

• SOCKS Proxy

• SSH Tunneling

• ProxyChains

• Chisel

• Lateral Movement Concepts

Practical Labs

• Compromised Host as Pivot

• Internal Network Access

• Port Forwarding

• SOCKS Proxy Setup

• Multi-Network Attack Path

Module 22 — Exploit Development Fundamentals

• Vulnerability Research

• Memory Management

• Stack & Heap

• Registers

• Buffer Overflow Fundamentals

• EIP/RIP

• Shellcode Concepts

• Exploit Development Methodology

Practical Labs

• Controlled Buffer Overflow

• Basic Exploit Development

• Crash Analysis

• Offset Discovery

• Proof-of-Concept Development

Module 23 — Wireless Security Fundamentals

• Wireless Network Architecture

• Wi-Fi Security

• WPA/WPA2/WPA3 Concepts

• Wireless Reconnaissance

• Monitor Mode

• Wireless Attack Surface

• Authentication & Encryption Concepts

Practical Labs

• Authorized Wireless Reconnaissance

• Wireless Traffic Analysis

• Controlled Wireless Security Assessment

Module 24 — Professional Penetration Testing & Reporting

• Pentest Planning

• Scope & Rules of Engagement

• Evidence Collection

• Vulnerability Classification

• CVSS Scoring

• Risk Rating

• Business Impact Analysis

• Proof of Concept Documentation

• Screenshots & Evidence

• Remediation Recommendations

• Executive Summary

• Technical Findings

• Retesting & Validation

Practical Labs

• Create a Professional Pentest Report

• Document Complete Attack Chains

• Prepare Executive & Technical Reports

• Present Findings to a Mock Client

Final Capstone Project

Students will perform a complete real-world style penetration testing engagement against a controlled lab environment.

Assessment Areas

• External Reconnaissance

• Network Enumeration

• Vulnerability Assessment

• Web Application Testing

• API Testing

• Exploitation

• Linux Privilege Escalation

• Windows Privilege Escalation

• Active Directory Enumeration

• Credential Attacks

• Lateral Movement

• Pivoting

• Domain Compromise

• Evidence Collection

• Risk Assessment

• Professional Reporting

Final Deliverables

• Executive Summary

• Technical Penetration Testing Report

• Vulnerability Assessment

• CVSS-Based Severity Classification

• Proof-of-Concept Evidence

• Attack Chain Documentation

• Business Impact

• Remediation Recommendations

• Retest Checklist

Course Outcome

By the end of the program, learners will be able to conduct structured penetration tests across Network, Web Applications, APIs, Linux, Windows and Active Directory environments, identify and validate vulnerabilities, perform controlled exploitation and privilege escalation, document attack paths, and produce professional penetration testing reports.