Card image
Junior Penetration Tester

Medium 404 Sections +630

Cubes Required: 2870

The Junior Penetration Tester Job Role Path is for newcomers to information security who aspire to become professional penetration testers. This path covers core security assessment concepts and provides a deep understanding of the specialized tools, attack tactics, and methodology used during penetration testing. Armed with the necessary theoretical background and multiple practical exercises, students will go through all penetration testing stages, from reconnaissance and enumeration to documentation and reporting. Upon completing our first job role path, you will have obtained the practical skills and mindset necessary to perform professional security assessments against enterprise-level infrastructure at a basic to intermediate level.

 The Penetration Testing Process

Easy 1 Sections +10 COMING SOON

This module teaches the entire penetration testing process and its stages, which will be discussed in detail as this will be an essential part of our work. We cover many aspects of the role of a penetration tester in a penetration test, explained and illustrated with detailed examples. The module also covers pre-engagement steps like the criteria for establishing a contract with a client for a penetration testing engagement.

 Getting Started

Fundamental 23 Sections +10

This module covers the fundamentals of penetration testing and an introduction to Hack The Box.

 Vulnerability Assessment

Easy 17 Sections +10 NEW

This module introduces the concept of Vulnerability Assessments. We will review the differences between vulnerability assessments and penetration tests, how to carry out a vulnerability assessment, how to interpret the assessment results, and how to deliver an effective vulnerability assessment report.

 Shells & Payloads

Medium 17 Sections +10

Gain the knowledge and skills to identify and use shells & payloads to establish a foothold on vulnerable Windows & Linux systems. This module utilizes a fictitious scenario where the learner will place themselves in the perspective of a sysadmin trying out for a position on CAT5 Security's network penetration testing team.

 Using the Metasploit Framework

Easy 15 Sections +10 NEW

The Metasploit Framework is an open-source set of tools used for network enumeration, attacks, testing security vulnerabilities, evading detection, performing privilege escalation attacks, and performing post-exploitation.


Medium 20 Sections +20

This module covers techniques for footprinting the most commonly used services in almost all enterprise and business IT infrastructures. Footprinting is an essential phase of any penetration test or security audit to identify and prevent information disclosure. Using this process, we examine the individual services and attempt to obtain as much information from them as possible.

 Network Enumeration with Nmap

Easy 12 Sections +10

Nmap is one of the most used networking mapping and discovery tools because of its accurate results and efficiency. The tool is widely used by both offensive and defensive security practitioners. This module covers fundamentals that will be needed to use the Nmap tool for performing effective network enumeration.

 Attacking Common Services

Medium 19 Sections +20 NEW

Organizations regularly use a standard set of services for different purposes. It is vital to conduct penetration testing activities on each service internally and externally to ensure that they are not introducing security threats. This module will cover how to enumerate each service and test it against known vulnerabilities and exploits with a standard set of tools.

 Using Web Proxies

Easy 15 Sections +20

Web application penetration testing frameworks are an essential part of any web penetration test. This module will teach you two of the best frameworks: Burp Suite and OWASP ZAP.

 Login Brute Forcing

Easy 11 Sections +20

Learn how to brute force logins for various types of services and create custom wordlists based on your target.

 Attacking Web Applications with Ffuf

Easy 13 Sections +10

This module covers the fundamental enumeration skills of web fuzzing and directory brute forcing using the Ffuf tool. The techniques learned in this module will help us in locating hidden pages, directories, and parameters when targeting web applications.

 SQL Injection Fundamentals

Medium 17 Sections +10

Databases are an important part of web application infrastructure and SQL (Structured Query Language) to store, retrieve, and manipulate information stored in them. SQL injection is a code injection technique used to take advantage of coding vulnerabilities and inject SQL queries via an application to bypass authentication, retrieve data from the back-end database, or achieve code execution on the underlying server.

 SQLMap Essentials

Easy 11 Sections +20

The SQLMap Essentials module will teach you the basics of using SQLMap to discover various types of SQL Injection vulnerabilities, all the way to the advanced enumeration of databases to retrieve all data of interest.

 File Inclusion

Medium 11 Sections +10 UPDATED

File Inclusion is a common web application vulnerability, which can be easily overlooked as part of a web application's functionality.

 Cross-Site Scripting (XSS)

Easy 10 Sections +20

Cross-Site Scripting (XSS) vulnerabilities are among the most common web application vulnerabilities. An XSS vulnerability may allow an attacker to execute arbitrary JavaScript code within the target's browser and result in complete web application compromise if chained together with other vulnerabilities. This module will teach you how to identify XSS vulnerabilities and exploit them.

 File Upload Attacks

Medium 11 Sections +20

Arbitrary file uploads are among the most critical web vulnerabilities. These flaws enable attackers to upload malicious files, execute arbitrary commands on the back-end server, and even take control over the entire server and all web applications hosted on it and potentially gain access to sensitive data or cause a service disruption.

 Command Injections

Medium 12 Sections +20

Command injection vulnerabilities can be leveraged to compromise a hosting server and its entire network. This module will teach you how to identify and exploit command injection vulnerabilities and how to use various filter bypassing techniques to avoid security mitigations.

 Web Attacks

Medium 18 Sections +20

This module covers three common web vulnerabilities, HTTP Verb Tampering, IDOR, and XXE, each of which can have a significant impact on a company's systems. We will cover how to identify, exploit, and prevent each of them through various methods.

 Attacking Common Applications

Medium 22 Sections +20

Penetration Testers can come across various applications, such as Content Management Systems, custom web applications, internal portals used by developers and sysadmins, and more. It's common to find the same applications across many different environments. While an application may not be vulnerable in one environment, it may be misconfigured or unpatched in the next. It is important as an assessor to have a firm grasp of enumerating and attacking the common applications discussed in this module. This knowledge will help when encountering other types of applications during assessments.

 File Transfers

Medium 8 Sections +10

During an assessment, it is very common for us to transfer files to and from a target system. This module covers file transfer techniques leveraging tools commonly available across all versions of Windows and Linux systems.

 Linux Privilege Escalation

Easy 15 Sections +100

Privilege escalation is a crucial phase during any security assessment. During this phase, we attempt to gain access to additional users, hosts, and resources to move closer to the assessment's overall goal. There are many ways to escalate privileges. This module aims to cover the most common methods emphasizing real-world misconfigurations and flaws that we may encounter in a client environment. The techniques covered in this module are not an exhaustive list of all possibilities and aim to avoid extreme "edge-case" tactics that may be seen in a Capture the Flag (CTF) exercise.

 Windows Privilege Escalation

Medium 30 Sections +100

After gaining a foothold, elevating our privileges will provide more options for persistence and may reveal information stored locally that can further our access in the environment. Enumeration is the key to privilege escalation. When you gain initial shell access to the host, it is important to gain situational awareness and uncover details relating to the OS version, patch level, any installed software, our current privileges, group memberships, and more. Windows presents an enormous attack surface and, being that most companies run Windows hosts in some way, we will more often than not find ourselves gaining access to Windows machines during our assessments. This covers common methods while emphasizing real-world misconfigurations and flaws that we may encounter during an assessment. There are many additional "edge-case" possibilities not covered in this module. We will cover both modern and legacy Windows Server and Desktop versions that may be present in a client environment.

 Password Attacks

Medium 18 Sections +10

Passwords are still the primary method of authentication in corporate networks. If strong password policies are not in place, users will often opt for weak, easy-to-remember passwords that can often be cracked offline and used to further our access. We will encounter passwords in many forms during our assessments. We must understand the various ways they are stored, how they can be retrieved, methods to crack weak passwords, ways to use hashes that cannot be cracked, and hunting for weak/default password usage.

 Pivoting, Tunneling & Port Forwarding

Medium 19 Sections +20 COMING SOON

Once a foothold is gained during assessments, it may be in scope to move laterally and vertically within a target network. Using one compromised machine to access another is called pivoting and allows us to access networks and resources that are not directly accessible to us through the compromised host. Port forwarding accepts the traffic on a given IP address and port and redirects it to a different IP address and port combination. Tunneling is a technique that allows us to encapsulate traffic within another protocol so that it looks like a benign traffic stream.

 Active Directory Enumeration & Attacks

Medium 35 Sections +20 NEW

Active Directory (AD) is the leading enterprise domain management suite, providing identity and access management, centralized domain administration, authentication, and much more. Due to the many features and complexity of AD, it presents a large attack surface that is difficult to secure properly. To be successful as infosec professionals, we must understand AD architectures and how to secure our enterprise environments. As Penetration testers, having a firm grasp of what tools, techniques, and procedures are available to us for enumerating and attacking AD environments and commonly seen AD misconfigurations is a must.

 AD Lateral Movement Fundamentals

Medium 1 Sections +20 COMING SOON

Once an initial foothold is gained during Active Directory penetration testing assessments, we usually look for ways to move laterally within a target network. Many techniques can be used for lateral movement, including credential theft and reuse, using protocols for system management and administration, remote exploits, password guessing attacks, and more. This module showcases various Active Directory lateral movement techniques that can be used depending on the technologies present within the host and network.


Medium 1 Sections +20 COMING SOON

Pillaging is the process of obtaining information from a compromised system. It can be personal information, corporate blueprints, credit card details or passwords, and other credentials. These may help in gaining further access to the network or in completing goals defined in the pre-engagement process of penetration testing. This data may be stored in a wide range of different applications, services, and device types, which may require specific tools to obtain them.

 Documentation & Reporting

Easy 1 Sections +20 COMING SOON

Proper documentation is paramount during any engagement. The end goal of a technical assessment is the report deliverable which will often be presented to a broad audience within the target organization. We must take detailed notes and be very organized in our documentation, which will help us in the event of an incident during the assessment. This will help ensure that our reports contain enough detail to illustrate the impact of our findings properly.

 Attacking Enterprise Networks

Medium 1 Sections +20 COMING SOON

We often encounter large and complex networks during our assessments. We must be comfortable approaching an internal or external network, regardless of the size, and be able to work through each phase of the penetration testing process to reach our goal. This module will guide students through a simulated penetration testing engagement, from start to finish, with an emphasis on hands-on testing steps that are directly applicable to real-world engagements.

To start this course Sign Up!