Penetration Tester

// curriculum path

1. 1
   Network / Infra PentestBeginneravailable · start

   Recon basics — Nmap, service enum, weak credentials.

2. 2

   Web App PentestBeginnerlocked

   Web app foothold — most OSCP boxes start here.

3. 3

   Network / Infra PentestIntermediatelocked

   Linux & Windows privesc — kernel exploits, sudo abuse, SUIDs.

4. 4

   Internal / AD PentestBeginnerlocked

   AD fundamentals — Kerberoasting, GPP, basic lateral movement.

5. 5

   Web App PentestIntermediatelocked

   Chained exploitation — SSRF→AWS, IDOR→admin, deserialization.

6. 6

   Internal / AD PentestIntermediatelocked

   Full domain compromise — DCSync, golden tickets, persistence.

7. 7

   Cloud PentestBeginnerlocked

   Cloud touchpoints in modern pentests — IMDS, S3, IAM enum.