STUDY HALL MODULE

Introduction to Penetration Testing

Learn how authorised penetration testers find and prove the weaknesses in an organisation's systems, and how they do it lawfully. You follow a test from end to end: agreeing scope and authorisation, gathering information, scanning and enumerating services, confirming vulnerabilities, demonstrating impact with care, escalating privilege, and writing a report the client can act on. A hands-on lab has you test an authorised staging server from first scan to findings. A starting point for anyone moving into offensive security.

4 topics 15 pages

What you'll study

1 Penetration testing and the law 3 pages · 6 learning objectives

What a penetration test is, the methodologies and standards that shape it, and the authorisation and scope that make it lawful.

Learning Objectives

Learning objectives

  • Explain what a penetration test is and how it differs from vulnerability scanning, red teaming and bug bounties.
  • Describe the main types of test and the black, grey and white box approaches.
  • Outline the published methodologies and the phases a test moves through.
  • Describe the UK assurance schemes and the standards that require testing.
  • Explain why written authorisation matters under the Computer Misuse Act 1990.
  • Define a scope and rules of engagement, including systems a client does not own.

In this topic

  1. What is penetration testing?
  2. Methodologies and standards
  3. Scoping, authorisation and rules of engagement
2 Reconnaissance and enumeration 3 pages · 6 learning objectives

How a tester learns about a target, from public sources to active scanning, and identifies the services it runs.

Learning Objectives

Learning objectives

  • Distinguish passive from active reconnaissance and explain why passive comes first.
  • Build a picture of a target from DNS, WHOIS, certificate transparency and archives.
  • Discover live hosts and scan their ports with Nmap, and read the results.
  • Explain the difference between a connect scan and a SYN scan, and when each is used.
  • Enumerate services to confirm the software and version behind each open port.
  • Record enumeration findings in a form the next phase can use.

In this topic

  1. Passive reconnaissance
  2. Host discovery and port scanning
  3. Service enumeration
3 Finding and validating vulnerabilities 4 pages · 7 learning objectives

How a tester turns services into a list of real weaknesses, and proves their impact without harming the client.

Learning Objectives

Learning objectives

  • Match software versions to known vulnerabilities using CVE and the National Vulnerability Database.
  • Explain what a vulnerability scanner does well, and where false positives and negatives arise.
  • Confirm a finding by hand before acting on it.
  • Explain what exploitation proves and how to choose the safest demonstration.
  • Describe the role of exploitation frameworks and the duty of care they demand.
  • Find and safely test weak, default and leaked credentials.
  • Recognise common web application flaws using the OWASP Top 10.

In this topic

  1. From services to vulnerabilities
  2. Exploitation in a controlled test
  3. Weak and default credentials
  4. Web application testing basics
4 Post-exploitation and reporting 5 pages · 7 learning objectives

What a tester does after gaining access: raising privilege, assessing impact, cleaning up, and reporting findings the client can act on. The topic ends with a hands-on lab.

Learning Objectives

Learning objectives

  • Explain privilege escalation and the common Linux and Windows misconfigurations that allow it.
  • Assess the impact of a foothold while staying in scope.
  • Gather evidence safely and clean up so the client is left no worse off.
  • Describe the structure of a penetration test report and its audiences.
  • Rate the severity of a finding and write a finding an engineer can fix.
  • Explain why a retest closes an engagement and why a test is only a snapshot.
  • Apply the whole testing process to an authorised staging server in a lab.

In this topic

  1. Privilege escalation
  2. Post-exploitation and clean-up
  3. Reporting and retesting
  4. Lab: Testing a staging server
  5. Lab walkthrough: Testing a staging server

Subscribe to study this module

Study Hall modules come with a subscription. Subscribe to work through every topic at your own pace, with quizzes and hands-on labs along the way.

Subscribe to access

Already subscribed? Log in