Module 1 — Planning & Scoping Penetration Tests

• Overview: Establish the legal, contractual, and technical foundation for a safe, repeatable penetration test.
  Learning objectives: define scope, legal/ethical boundaries, success criteria; create test plans and rules of engagement; select tools and assessment types.
  Key topics: client intake & scoping questionnaires; authorization, non-disclosure agreements, and laws; risk assessment and impact analysis; test types (black/grey/white box); scheduling, rollback & contingency planning; resource & tool selection.
  Practical work / labs: write a sample rules-of-engagement document; build a risk-based test plan for a fictional organization; create a scoping questionnaire.
  Skills gained: professional test planning, legal/compliance awareness, stakeholder communication.

Module 2 — Conducting Passive Reconnaissance

• Overview: Collect publicly available intelligence without directly interacting with target systems.
  Learning objectives: map digital footprint, identify attack surface, harvest metadata and public exposures, discover third-party risks.
  Key topics: OSINT techniques (search engines, social media, public registries), WHOIS/DNS/Passive DNS, public code repositories, metadata analysis, cloud and third-party exposure discovery, data aggregation & correlation.
  Practical work / labs: OSINT exercise on a mock company; extract and analyze metadata from documents; build an attack surface inventory.
  Skills gained: efficient data collection, correlation of disparate public data, building reconnaissance reports.

Module 3 — Performing Non-Technical Tests

• Overview: Test human and organizational weaknesses that technology alone won’t reveal.
  Learning objectives: design and run social-engineering campaigns, assess physical security, evaluate policy and process adherence.
  Key topics: phishing and vishing concepts, social-engineering frameworks, pretexting, physical access assessments, insider threat scenarios, security awareness measurement, policy review techniques.
  Practical work / labs: craft a simulated phishing email (non-malicious), conduct a reception/visitor procedure audit, create a security awareness scorecard.
  Skills gained: social-engineering planning, human vulnerability assessment, organizational control evaluation.

Module 4 — Conducting Active Reconnaissance

• Overview: Use direct interaction to discover live hosts, services, and configuration details while minimizing detection and impact.
  Learning objectives: perform network discovery, service enumeration, banner grabbing, fingerprinting and mapping of infrastructure.
  Key topics: TCP/UDP scanning strategies, network mapping, service and OS fingerprinting, application discovery, IDS/IPS awareness, scanning ethics and throttling.
  Practical work / labs: run scanning workflows against a lab network; correlate scan results to produce an asset inventory; tune scans to avoid service disruption.
  Skills gained: safe active discovery, accurate host/service enumeration, reconnaissance report generation.

Module 5 — Analyzing Vulnerabilities

• Overview: Identify, verify, and prioritize vulnerabilities in hosts, services, and applications.
  Learning objectives: analyze scan output, validate findings, assess likelihood and impact, and prioritize remediation using risk models.
  Key topics: vulnerability scanners and interpretation, false positive/negative handling, manual verification techniques, CVE/CWE mapping, risk scoring (CVSS), prioritization strategies.
  Practical work / labs: triage scanner results from multiple tools; manually verify selected findings; map vulnerabilities to remediation actions.
  Skills gained: critical analysis of automated results, vulnerability validation, remediation prioritization.

Module 6 — Penetrating Networks

• Overview: Exploit network-level weaknesses to gain access to internal resources while maintaining operational safety.
  Learning objectives: execute network exploitation techniques, pivoting, and maintain stealth and persistence where appropriate for tests.
  Key topics: network protocol weaknesses, misconfigurations (open shares, weak SMB), exploitation of services, man-in-the-middle techniques, tunneling and pivoting, use of proxies and pivot hosts.
  Practical work / labs: perform controlled exploitation of vulnerable lab services; demonstrate pivoting from a compromised host to additional subnets; document containment steps.
  Skills gained: practical exploitation of network weaknesses, lateral movement basics, safe escalation techniques.

Module 7 — Exploiting Host-Based Vulnerabilities

• Overview: Attack host machines to escalate privileges, access sensitive data, and demonstrate impact.
  Learning objectives: exploit host vulnerabilities, escalate privileges, bypass common protections, and cleanly document evidence.
  Key topics: privilege escalation (Windows/Linux), service exploitation, credential harvesting, patch-level exploitation, anti-forensics considerations, endpoint security bypass methods (with legal/ethical limits).
  Practical work / labs: exploit lab hosts to gain user and then admin/root access; capture and document proof-of-concepts; practice safe cleanup.
  Skills gained: host exploitation, post-compromise evidence collection, responsible reporting of impact.

Module 8 — Testing Applications

• Overview: Identify and exploit weaknesses in web, mobile, and API applications using secure testing methodologies.
  Learning objectives: test for common application vulnerabilities, chain bugs into exploits, and recommend secure remediations.
  Key topics: OWASP Top 10 and beyond, input validation flaws, authentication/authorization issues, session management, server-side vulnerabilities, API testing, mobile app testing basics, secure coding remediation.
  Practical work / labs: hands-on web app testing (SQLi, XSS, auth flaws), API fuzzing and exploitation, report secure fixes for discovered bugs.
  Skills gained: systematic web/API testing, exploit chaining, developer-facing remediation guidance.

Module 9 — Completing Post-Exploit Tasks

• Overview: After gaining access, perform controlled tasks to demonstrate impact while preserving evidence and respecting scope.
  Learning objectives: collect and analyze evidence, maintain minimal persistence only if authorized, exfiltrate sample data safely, and restore systems to original state.
  Key topics: evidence preservation and chain-of-custody basics, credential and secret discovery, data discovery/exfiltration techniques (simulated), safe persistence strategies (for tests), cleanup procedures and rollback.
  Practical work / labs: evidence capture exercises, simulated data discovery and secure reporting, restore lab systems to baseline.
  Skills gained: ethical post-exploit operations, forensic mindfulness, responsible restoration.

Module 10 — Analyzing & Reporting Pen Test Results

• Overview: Turn technical findings into clear, actionable, and prioritized reports for technical teams and leadership.
  Learning objectives: synthesize findings into remediation-focused reports, produce executive summaries, quantify business impact, and present results to stakeholders.
  Key topics: report structure (exec summary, technical findings, PoC, remediation guidance), risk remediation plans, metrics/KPIs, presentation skills, creating repeatable delivery artifacts (templates, trackers), legal disclosure considerations.
  Practical work / labs: produce a full pentest report from a previous lab engagement; prepare an executive slide deck; role-play presenting findings to technical and non-technical audiences.
  Skills gained: professional reporting, stakeholder communication, remediation planning.

Final notes & suggested course add-ons

• Capstone project: a full-life-cycle pentest on a controlled lab that includes planning, reconnaissance, exploitation, post-exploit tasks, and final reporting.

• Assessments: practical labs, a written exam section, and a final report/presentation graded for clarity, accuracy, and remediation quality.

• Duration guidance (optional): each module typically fits a 1–2 day workshop; combine into a 3–5 week bootcamp or a semester-length course depending on depth.