Dive Into Pentesting

Penetration testing is a proactive security practice that helps organisations uncover weaknesses in their systems, applications, and networks before attackers can exploit them. The value of a penetration test continues to increase as modern environments become more complex. Testers that understand the fundamentals of penetration testing can produce meaningful results and effectively communicate risk to stakeholders.

This room introduces the core concepts that every aspiring penetration tester should be familiar with. It covers what penetration testing is and how it differs from malicious hacking, the areas of focus during a penetration test, and the relationship between vulnerability, threat, and risk. It also explores why vulnerabilities exist in the first place, the mindset and habits that shape effective testers, and the ethical principles that strengthens client relationships.

Learning Objectives

• Distinguish between penetration testing and malicious hacking based on authorisation, scope, coverage, and responsibility.
• Describe the core focus areas of web application and network penetration testing.
• Define vulnerability, threat, and risk, and apply the Vulnerability x Threat = Risk relationship to evaluate real-world scenarios.
• Outline the four stages of the risk management cycle, and recognise when risks are mitigated, accepted, or transferred.
• Identify the common reasons why vulnerabilities exist, including human assumptions, software bugs, system complexity, over customisation, and technical or design flaws.
• Apply the mindset and habits of an effective penetration tester, such as attention to detail, contextual thinking, and avoiding tool over-reliance or tunnel vision.
• Follow best practices during an engagement, including maintaining good notes, collecting evidence, managing time, communicating proactively, and staying professional.
• Uphold the principles of ethics, permission, and trust throughout an engagement to protect both the organisation and the tester.

Prerequisites

This room requires knowledge of offensive security concepts. If you haven't done so, complete the following module before continuing:

• Introduction to Offensive Security