Cybersecurity line, station 4 of 4
Offensive Security: Ethical Hacking and Pentesting
Plan and run a legal penetration test: scoping, reconnaissance, web and network attacks, privilege escalation and reporting.
- 6lessons
- 3.5 hto read and do
- Advancedlevel
- 6podcast episodes
- 6checked exercises
Tools you'll use in this course
The lessons open these with a template ready. They work for your own job too, no course needed.
About this course
Penetration testers are hired to break in before criminals do, and to explain clearly how to stop them. This course teaches the full engagement: agreeing scope and written permission, finding attack surface, finding and safely proving weaknesses in web apps, networks and directory services, showing how one foothold spreads, and writing a report that leads to fixes.
Every example runs against practice targets built for this course: a sandboxed copy of Mangrove Market's Partner app, a small practice network of store servers and a lab directory domain. You will never touch a real system, and lesson one makes the ethics and the law the ground rule for everything after it. The course teaches methodology, evidence and remediation, not ready-made exploits, and it follows the structure of professional penetration tests.
Each lesson has a podcast episode, diagrams, checkpoints, a quiz, flashcards and hands-on SQL or JavaScript exercises that build the analysis and reporting skills a tester uses. The capstone is a full engagement on the practice environment, from signed scope to a report an executive and an engineer can both act on.
What you will be able to do
- Scope an engagement with written authorisation and rules of engagement
- Map attack surface with passive and active reconnaissance
- Find and exploit web application and network weaknesses in a lab
- Escalate privileges and move laterally in a practice directory domain
- Write a report with risk ratings, evidence and fixes that executives and engineers both understand
Syllabus
6 stops, about 3.5 h in total. Each stop fills in when you complete the lesson.
Ethics, law and scoping
A penetration test is the same actions a criminal takes, made legal by one thing: written permission for a defined target. This first lesson is the one that keeps you out of prison and out of trouble. You will learn how to get real authorisation, write a scope and rules of engagement that protect both sides, and set the hard limits you never cross, before you touch anything.
ScopingRules of engagementAuthorisation and law
Reconnaissance
Before you test anything, you map what is there. This lesson turns the practice environment into an accurate, in-scope inventory of attack surface: what an attacker can learn about an organisation without touching it, what careful probing of in-scope hosts reveals, how to organise it into a target list and a service matrix with evidence, and how a defender sees you doing it.
ReconnaissanceAttack surface managementOSINTService enumeration
Attacking web applications
A web test is not clicking buttons until something breaks. It is walking every feature, every parameter and every role on purpose, watching what the server does, and proving each flaw with evidence a developer can reproduce. This lesson shows how a tester finds access control, injection and business-logic flaws in the lab Partner app, and captures them. The fixes live in the application-security course; here the angle is how you find and demonstrate the gap.
Web app testingOWASP WSTGAccess control testingEvidence and reporting
Attacking networks and services
Recon in Reconnaissance gave you a list of hosts and open ports on the lab store-server network. This lesson turns that into a ranked list of services worth testing, shows you how to read what each service exposes, how a vulnerability scanner maps a version to a known weakness, and the difference between a scanner flag and a finding you have safely confirmed. Every target here is the practice network built for the course.
Network attacksService enumerationCVSS
Privilege escalation and lateral movement
A single low-privileged foothold on one store server is where most real breaches begin, not where they end. This lesson shows how an attacker turns that foothold into control of the lab directory domain, step by step, and pairs every step with the defensive control that breaks it, so you can test a path and then help close it.
Privilege escalationLateral movementActive Directory
Reporting that gets things fixed
A penetration test only reduces risk when someone changes the system because of it. That change starts with your report. This lesson shows you how to structure a report for two audiences at once, write a single finding that a developer can act on, rate it with CVSS without pretending to a precision you do not have, rank by business risk, and close the loop with a de-brief and a retest.
ReportingCVSSRisk ratingRetesting
Capstone: Pentest the practice Partner app and store network
A realistic project with a rubric and a model answer.
Final exam and certificate
10 questions drawn at random, 70% to pass.
Capstone project
Pentest the practice Partner app and store network
You are contracted to test the practice Partner app and the lab store network over a simulated two-week engagement. Everything you test is the course's practice environment, which you are authorised to test; you never touch a real system. Agree and write down the scope and rules of engagement, run the testing in a safe and methodical way, keep evidence, and deliver a professional report. The report must let Mangrove's leadership understand the business risk and let the engineers reproduce and fix each finding.
You will hand in
- Signed-off scope and rules of engagement for the practice environment
- Testing notes with reproducible evidence for each finding, kept in scope
- A findings table with consistent risk ratings (CVSS plus business context)
- A full report with an executive summary, detailed findings and a retest plan
Check what you know
Already know some of this? Answer 6 quick questions, one from each lesson, and we will mark the lessons you can skim. It takes about 3 minutes and nothing is graded.
Questions
Is this legal?
Yes, because every target is a practice system built for the course. Testing a system without written permission is a crime in most countries; lesson one covers this first, and the course never uses a real target.
Which certifications does it help with?
It covers much of the practical ground of entry-level pentest certificates such as CompTIA PenTest+ and is a good base before hands-on exams such as the OSCP. Check each body's current objectives.
Do I need my own hacking lab?
No. The exercises in each lesson run in your browser. The practice environment is described for the capstone; you work through it as a scenario and write the report.
Does it teach ready-made exploits?
No. It teaches methodology, how to safely confirm and evidence a weakness, risk rating and remediation. It does not hand out working exploit code or ways to evade defences.
Is it really free?
Yes. Every lesson, podcast episode, exercise, quiz, final exam and certificate is free. The labs and their templates for real work are free too. Plus and Premium add every lab challenge, weekly extras and a mentor on top, and they never lock the tools or the courses.
How long does it take?
Each lesson shows an honest time for reading and doing. Most people finish a course in two to four weeks at three or four hours a week.
How does the final exam work?
You get 15 questions drawn at random from a larger bank. You need 70% to pass. If you do not pass, you can try again after 24 hours. The exam is graded on the server and you never see the answer key.