Applied Track · Penetration Testing

Offensive Security

The fundamentals teach you how each control works. This track puts them to work. You will move through a real penetration-testing engagement from end to end — the same arc a professional follows on a live assessment: agree on scope and rules, find the targets, map their weaknesses, gain access, dig in, and write the report that makes the whole effort worth something. Every phase is hands-on, and every phase points back to the fundamentals it builds on.

00

About this track

A penetration test is not a single trick — it is a disciplined process. You do not start by firing exploits; you start by agreeing, in writing, on what you are allowed to touch. From there the work follows a predictable lifecycle: reconnaissance, scanning and enumeration, vulnerability analysis, exploitation, post-exploitation, and finally the deliverable. This track follows that lifecycle phase by phase.

It is the offensive counterpart to the fundamentals modules. Where Network Security taught you how traffic moves, here you scan it for a way in. Where Web Application Security taught you what XSS is, here you chain it into an engagement. Many phases reuse labs you have already met — the port-scanning lab, the SQL-injection suite, the WPA2 handshake crack — now framed as steps in one continuous attack story.

Phases
9 + capstone
Track
Applied / Offensive
Status
Complete

Authorized testing only. Everything here is taught for defensive understanding and for legal, authorized engagements — the kind performed under a signed scope against systems you own or have explicit written permission to test. The first phase covers exactly where that line is.

01

The engagement, phase by phase

PHASE 00 Foundations & Methodology Why we test, who the threat actors are, the law and ethics that bound the work, rules of engagement, and the methodologies (PTES, MITRE ATT&CK) that give an engagement structure. Kali · PTES · Rules of Engagement PHASE 01 Reconnaissance & OSINT Build a picture of the target before touching it. Passive OSINT, footprinting, people and infrastructure discovery — what the internet already knows about an organization. OSINT · whois · DNS · Google dorking PHASE 02 Scanning & Enumeration Move from passive to active. Discover live hosts, open ports, and the exact services and versions behind them — the raw material every later phase depends on. Nmap · host discovery · service/version detection PHASE 03 Vulnerability Analysis Turn a service inventory into a ranked list of weaknesses. Automated scanners, manual validation, and scoring findings with CVSS so the highest-impact issues rise to the top. OpenVAS · Nessus · CVSS · CIS benchmarks PHASE 04 Exploitation Prove the risk is real. Use the Metasploit Framework and targeted techniques to gain a foothold — attacking unpatched services, weak credentials, and the human layer. Metasploit · payloads · password cracking · SET PHASE 05 Post-Exploitation & Priv-Esc A foothold is the beginning, not the end. Escalate privileges, establish persistence, pivot, loot, and — just as importantly — clean up so the environment is left as you found it. Meterpreter · Windows/Linux priv-esc · pivoting · cleanup PHASE 06 Web & Database Attacks Web apps are the largest attack surface most organizations expose. Map the app, intercept and manipulate requests, and exploit the classic flaws — tying together the existing web and SQL-injection labs. Burp Suite · OWASP ZAP · DVWA · XSS · SQLi PHASE 07 Wireless Attacks The perimeter has no cable. Scan for access points, capture handshakes, and exploit weak wireless configurations — the offensive view of the Wireless & IoT fundamentals. airodump · handshake capture · WPA cracking PHASE 08 Reporting & Deliverables The report is the product. Translate findings into an executive summary, technical detail, risk ratings, and clear remediation — the phase that turns access into business value. executive summary · findings · risk rating · remediation CAPSTONE Full Engagement One target, one scope, the whole lifecycle. Thread every phase into a single guided engagement — recon to report — against a self-contained scenario. end-to-end · guided scenario
02

How this connects to the fundamentals

This track does not replace the fundamentals modules — it weaponizes them. Each phase leans on material you can study in depth elsewhere on the site:

FoundationsCodes of Ethics · Threat Modeling · Terminal Fundamentals
Scanning & EnumerationPort Scanning Lab · Wireshark-Lite · OSI Model
Vulnerability AnalysisCVE & CVSS · NIST SP 800-115
ExploitationSoftware Vulnerabilities · Password Attack Racer · Social Engineering
Post-ExploitationLinux Administration · Host Forensics · The Kill Chain
Web & Database AttacksWeb App Security · SQL Injection
Wireless AttacksWireless & IoT · WPA2 Handshake Crack