Penetration testing fundamentals
Scope, method, reporting and the legal framework.
Level 101 · 17 lessons · 15 practice labs
Lessons
What a penetration test is and is not
- What a pentest is: scope and rules: You will understand what a penetration test is, why written scope and rules are essential, and how an authorised test differs from a real attack.
- Penetration test, vulnerability scan and audit: the difference
- Written authorisation: who may test what, and when
- Phases and methodology: You will be able to list the phases of a test from discovery to report and explain what each phase gives the defender.
- Short task: write the scope statement for a fictional assessment
Getting to know the target
- Reachability and port scanning: You will see which machines in your own lab are reachable and which ports are open, and understand why that list is a map of your attack surface.
- Identifying service versions: You will identify which service and version runs behind an open port, and understand why an old version is a sign that patching is needed.
- Enumerating FTP and SMB: You will inspect what FTP and SMB file shares reveal on your own lab server, and learn how to close shares that do not need to be open.
- SSH and Telnet: You will learn the difference between SSH and Telnet, why Telnet's lack of encryption is risky, and how to review remote-access settings.
- HTTP and RDP: You will see what information web services and remote desktop (RDP) give away, and learn how to limit and monitor them.
- Rsync and other services: You will learn what lesser-known services such as rsync can expose when misconfigured, and how to find and close them on your own systems.
- Short task: build the service inventory table of the lab target
Validating, evidencing and reporting a finding
- Wordlists and Hydra (lab): On your own lab account you will see why weak passwords fall quickly to wordlists, and learn to spot this in logs and prevent it with password rules.
- Key-based SSH and private key permissions: You will learn to set up key-based SSH login instead of passwords, and why the private key file must have strict permissions.
- Collecting evidence and capturing the flag: You will learn to collect clear evidence of what you find on a lab target, and why a finding must be repeatable by someone else.
- Rating how serious a finding is, simply
- Capstone: write a findings report: You will review the lab server of a fictional company within an agreed scope and write up the findings, ranked by risk, with evidence and fixes.
Practice labs
- Write the scope statement for a fictional assessment: Read Karaçam Mobilya's request and write a one-paragraph scope with targets, address range, dates and prohibitions.
- Decide whether three requests need a scan, an audit or a penetration test: Read three fictional requests, choose the right assessment type for each and explain the difference in two sentences.
- Find and fix the gaps in this authorisation document: Find the missing signing authority, time window and emergency contact in Kumsal Turizm's authorisation and write the corrected version.
- Add the lab target's open ports to the inventory: Confirm the lab target is reachable, find its open TCP ports and record them in the inventory table.
- Identify service versions and flag the outdated ones: Determine each service's version on the lab target, flag the unsupported ones and note them in the inventory.
- Add the undocumented service on this network to the inventory: Compare Kuzeyyıldızı Kargo's documented service list with a lab scan, find the service missing from it and write a note asking for its owner.
- Audit and disable anonymous access on this FTP server: Confirm anonymous login is enabled on the lab FTP server, fix the configuration and test again.
- Move a Telnet-enabled server to SSH and verify the result: Disable Telnet on the lab server, keep SSH with safe settings and prove the change with a port scan.
- Find and restrict the unauthenticated rsync module: List the rsync modules on the lab server, identify the one readable without a password, add authentication and retest.
- Audit and fix the permissions of a private key file: The lab user's SSH private key is world-readable; fix its permissions and show the SSH client warning disappears.
- Find the service that accepts its default password and change it: Test the lab services' default accounts from a checklist, document the one that accepts, change the password and retest.
- Measure the lab service's resistance to password guessing and add a lockout: Test your own lab service with a small wordlist, measure that no lockout kicks in, add a lockout setting and measure again.
- Rate three findings on a simple severity scale: Rate three findings from the lab notes as low, medium or high by impact and ease, with a reason for each.
- Collect a finding's evidence and record it with the flag: Validate the finding on the lab target, write the command, output and timestamp to the evidence file and submit the flag.
- Write a report entry with title, impact, evidence and fix for this finding: Write a one-page report entry for the finding you validated on the lab target, apply the fix and add the retest result.
About this course
Scope, method, reporting and the legal framework.
What you will learn
- What a penetration test is and is not
- Getting to know the target
- Validating, evidencing and reporting a finding
Prerequisites
No prior knowledge is needed; the course starts from zero.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at beginner level; every term is explained where it first appears.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.