Penetration Testing
THE G OOD AND BAD OF PENT ESTING
What is Penetration Testing?
Introduction Importance of Ethical Hacking
to Differences between Penetration Testing and Vulnerability
Penetration Assessment
Testing Legal and Ethical Considerations (e.g., laws, contracts,
permissions)
Limitations
PTES (Penetration Testing
Execution Standard)
OWASP Testing Guide (for
Penetration web applications)
Testing
Methodologies NIST Cybersecurity
Framework
MITRE ATT&CK Framework
The Penetration Testing Lifecycle
Planning & Scanning &
Exploitation
Reconnaissance Enumeration
Reporting &
Post-Exploitation
Remediation
Planning & Reconnaissance
Defining scope and rules of engagement Passive and active information gathering
(OSINT, WHOIS, DNS enumeration)
Identifying live hosts (Nmap, Masscan)
Scanning & Scanning for open ports and services
Enumeration
Banner grabbing and service identification
Common vulnerabilities (SQL
Injection, XSS, LFI/RFI, Buffer
Overflow)
Exploitation Exploiting misconfigurations
Social engineering techniques
Privilege escalation
Post-
Exploitation Lateral movement
Data exfiltration
Reporting & Remediation
Writing Writing a professional penetration test report
Providing Providing recommendations for mitigation
Network scanning (Nmap, Wireshark)
Web application testing (Burp Suite, OWASP ZAP)
Tools of the Exploitation frameworks (Metasploit, SQLmap)
Trade
Password cracking (John the Ripper, Hashcat)
OSINT tools (theHarvester, Maltego)
Online Labs & Virtual
Environments
Hack The Box (HTB) - Free Tier
TryHackMe
OverTheWire: Wargames
PentesterLab - Free Challenges
Root Me
VulnHub
Cybrary - Ethical Hacking & Penetration
Testing Course. Covers ethical hacking
basics, reconnaissance, and exploitation.
PortSwigger Web Security Academy.
Hands-on labs to practice web security
Free Courses attacks (e.g., SQL Injection, XSS).
& Training MIT OpenCourseWare - Computer and
Network Security. A free university-level
cybersecurity course.
OpenSecurityTraining2. Advanced
cybersecurity and penetration testing
courses.
[The Web Application Hacker’s Handbook
(PDF version may be found online)]:
Comprehensive guide on web security
Free Books testing.
& Reading OWASP Testing Guide: Official manual for
Material web application security testing.
NIST Special Publication 800-115: NIST’s
official penetration testing methodology.
Kali Linux – The go-to OS for ethical
hackers, preloaded with pentesting tools.
Parrot Security OS – Another great
alternative to Kali.
Free Tools Metasploit Framework – Essential for
for exploit development and testing.
Penetration Burp Suite Community Edition – Web
Testing application security testing tool.
Wireshark – Network traffic analysis.
Nmap – Network discovery and security
auditing.
Capture The
Flag (CTF)
Platforms
CTFtime – Lists ongoing
cybersecurity CTF events
worldwide.
PicoCTF – Beginner-friendly CTF
challenges.
Hack The Box CTF – Competitive
hacking challenges.
Thank you!
[email protected]X: @miguelguirao
