Roadmaps

Kali Linux for security artisans

  1. Kali Linux Fundamentals

    1. Kali Linux installation
    2. Virtual machines
    3. Kali Linux filesystem
    4. Terminal
    5. Shell
    6. APT package management
    7. Users and permissions
    8. sudo
    9. Processes
    10. Services
    11. Environment variables
    12. SSH
    13. Bash basics
    14. Kali Linux tool organization
    15. Man pages
    16. Kali documentation
    17. Updating Kali
    18. Installing security tools

  2. Linux Skills for Pentesting

    1. Essential Linux commands
    2. File permissions
    3. Processes
    4. Services
    5. Networking commands
    6. ip
    7. ss
    8. ping
    9. traceroute
    10. curl
    11. wget
    12. grep
    13. find
    14. awk
    15. sed
    16. sort
    17. cut
    18. xargs
    19. Pipes and redirection
    20. Bash scripting

  3. Networking for Pentesting

    1. TCP/IP
    2. IPv4
    3. IPv6
    4. MAC addresses
    5. ARP
    6. TCP
    7. UDP
    8. Ports
    9. Sockets
    10. DNS
    11. DHCP
    12. ICMP
    13. Routing
    14. NAT
    15. CIDR
    16. Subnets
    17. Firewalls
    18. Proxies
    19. VPNs

  4. Network Reconnaissance

    1. Passive reconnaissance
    2. Active reconnaissance
    3. OSINT
    4. WHOIS
    5. DNS enumeration
    6. Subdomain enumeration
    7. Certificate Transparency
    8. Search engine reconnaissance
    9. theHarvester
    10. Amass
    11. Subfinder

  5. Network Scanning

    1. Nmap
    2. Host discovery
    3. Port scanning
    4. TCP scanning
    5. UDP scanning
    6. SYN scanning
    7. Service detection
    8. Version detection
    9. OS detection
    10. Nmap NSE
    11. Nmap scripting
    12. Masscan
    13. RustScan
    14. Netcat

  6. Network Traffic Analysis

    1. Wireshark
    2. tcpdump
    3. Packet capture
    4. TCP analysis
    5. UDP analysis
    6. DNS analysis
    7. HTTP analysis
    8. ARP analysis
    9. Network troubleshooting

  7. Vulnerability Scanning

    1. CVE
    2. CVSS
    3. Vulnerability identification
    4. Vulnerability validation
    5. Nuclei
    6. Nikto
    7. Greenbone / OpenVAS
    8. Searchsploit
    9. Exploit-DB

  8. Web Reconnaissance

    1. HTTP
    2. HTTPS
    3. HTTP methods
    4. HTTP headers
    5. Cookies
    6. Sessions
    7. Web technologies
    8. Directory enumeration
    9. File enumeration
    10. ffuf
    11. Gobuster
    12. Feroxbuster
    13. WhatWeb
    14. JavaScript reconnaissance
    15. API endpoint discovery

  9. Web Pentesting with Burp Suite

    1. Burp Suite
    2. Proxy
    3. HTTP interception
    4. Repeater
    5. Intruder
    6. Decoder
    7. Request manipulation
    8. Response analysis
    9. Authentication testing
    10. Authorization testing
    11. Session testing
    12. Parameter testing
    13. Burp extensions

  10. Basic Web Vulnerabilities

    1. SQL Injection
    2. XSS
    3. CSRF
    4. IDOR
    5. Path Traversal
    6. File Inclusion
    7. File Upload
    8. Command Injection
    9. SSRF
    10. SSTI
    11. XXE
    12. Authentication vulnerabilities
    13. Authorization vulnerabilities
    14. Security misconfiguration

  11. Password Attacks

    1. Password hashes
    2. Hash identification
    3. Wordlists
    4. Hashcat
    5. John the Ripper
    6. Hydra
    7. Password spraying
    8. Brute-force concepts
    9. Credential stuffing concepts

  12. Exploitation

    1. Exploit concepts
    2. Exploit-DB
    3. Searchsploit
    4. Metasploit
    5. Metasploit modules
    6. Payloads
    7. Auxiliary modules
    8. Exploit validation
    9. Manual exploitation
    10. Meterpreter

  13. Linux Privilege Escalation

    1. Linux permissions
    2. SUID
    3. SGID
    4. sudo
    5. Capabilities
    6. Cron jobs
    7. PATH hijacking
    8. Writable files
    9. Writable services
    10. Environment variables
    11. Kernel vulnerabilities
    12. LinPEAS
    13. Manual enumeration

  14. Windows Pentesting from Kali

    1. SMB
    2. RDP
    3. WinRM
    4. Windows enumeration
    5. Windows authentication
    6. Windows users
    7. Windows services
    8. PowerShell
    9. CrackMapExec / NetExec
    10. Impacket
    11. Evil-WinRM
    12. BloodHound

  15. Active Directory Basics

    1. Domain enumeration
    2. LDAP
    3. Kerberos
    4. SMB
    5. Domain users
    6. Domain groups
    7. Domain controllers
    8. BloodHound
    9. Kerberoasting
    10. AS-REP Roasting
    11. Password spraying
    12. Lateral movement

  16. Pivoting

    1. Network pivoting
    2. Port forwarding
    3. SSH tunneling
    4. SOCKS proxies
    5. Proxychains
    6. Chisel
    7. Ligolo-ng
    8. Internal network enumeration

  17. Wireless Pentesting

    1. Wireless fundamentals
    2. 802.11
    3. Monitor mode
    4. Wireless interfaces
    5. Packet capture
    6. Aircrack-ng
    7. Wireshark
    8. WPA/WPA2/WPA3
    9. Wireless reconnaissance

  18. Pentesting Automation

    1. Bash scripting
    2. Python for pentesting
    3. Requests
    4. Scapy
    5. Nmap automation
    6. API automation
    7. Custom enumeration scripts
    8. Parsing scan results
    9. Automated reconnaissance

  19. Pentesting Methodology

    1. Scope
    2. Rules of engagement
    3. Reconnaissance
    4. Enumeration
    5. Scanning
    6. Vulnerability identification
    7. Exploitation
    8. Privilege escalation
    9. Lateral movement
    10. Pivoting
    11. Evidence collection
    12. Cleanup
    13. Reporting

  20. Pentest Reporting

    1. Finding identification
    2. Evidence
    3. Proof of Concept
    4. Risk rating
    5. CVSS
    6. Business impact
    7. Remediation
    8. Technical report
    9. Executive summary
    10. Retesting

  21. Practical Pentesting

    1. Vulnerable Linux machines
    2. Vulnerable Windows machines
    3. Web application labs
    4. Network penetration testing labs
    5. OWASP Juice Shop
    6. DVWA
    7. Metasploitable
    8. Hack The Box
    9. TryHackMe
    10. PortSwigger Web Security Academy
    11. Full penetration test simulation