00
About this phase
A penetration test is a simulated attack with permission. The "with permission" part is not a formality — it is the entire difference between a paid engagement and a federal crime. Before any technical work, a tester and client agree on scope, timing, targets, and what happens if something breaks. This phase covers that agreement, the legal framework behind it, and the structured methodologies that keep an engagement thorough and defensible.
Authorized testing only. The techniques in this track are taught for defensive understanding and for engagements you are explicitly authorized to perform. Running them against systems you do not own or have written permission to test is illegal in most jurisdictions.
Lessons
7 live
Phase
00 of 08
Status
Complete
01
Lessons in this phase
00.01
Live →
00.02
Live →
00.03
Live →
00.04
Live →
00.05
Live →
00.06
Live →
00.07
Live →
Why Penetration Testing
The business case: where pentesting sits relative to vulnerability scanning, red teaming, and audits — and what a test can and cannot prove.
Threat Actors & Motivations
Who we simulate: script kiddies to nation-states, their goals and capabilities, how MITRE ATT&CK describes their behavior, and how AI rewrote the hierarchy.
Engagement Types & Rules of Engagement
Black, grey, and white box; scope documents; timing windows; emergency contacts; and the get-out-of-jail authorization letter.
Law & Ethics: CFAA and Authorization
The legal boundary, the major statutes, and professional codes of ethics. Cross-links to the Codes of Ethics fundamentals page.
Methodologies: PTES, OSSTMM, MITRE ATT&CK
The frameworks that give an engagement structure and a shared vocabulary. Cross-links to the Threat Modeling module.
The Attacker's Toolkit: Kali Linux
Orienting in a Kali environment and the command-line fluency every later phase assumes. Cross-links to Terminal Fundamentals.
Building a Practice Lab
Standing up a safe, legal target environment to practice the rest of this track without touching anything you should not.