The Penetration tester path
You are paid to break in — with permission and in writing — and then explain exactly how. It is open without a degree and cares about demonstrable skill more than almost any other field here, but it is rarely entry-level: people tend to arrive from help desk, networking, sysadmin, or defensive security. The hardest part is the report, not the exploit.
Published 2026-10-09 · generated from the lesson data · serves Penetration tester
Work the groups in order. Each checkpoint is a gate: do not move on until you can do it unaided. The capstone is level 4 — original work, made public, verifiable by a stranger.
Foundations, full depth
1. Linux command line for security work
Stage A · Foundations
2. TCP/IP and ports
Stage A · Foundations
3. DNS in depth
Stage A · Foundations
4. HTTP in depth
Stage A · Foundations
5. Python for security tooling
Stage A · Foundations
6. Reading code through a vulnerability
Stage A · Foundations
7. OSINT and research discipline
Stage A · Foundations
8. Git and GitHub
Stage A · Foundations
9. Windows concepts for security
Stage A · Foundations
Practitioner, full
10. Authorization, scope, and the hard rules
Stage B · Practitioner
11. Engagement methodology: WSTG, PTES, and NIST SP 800-115
Stage B · Practitioner
12. The toolbench: fifteen phases, one question each
Stage B · Practitioner
13. Setting up practice targets locally
Stage B · Practitioner
14. IDOR: Insecure Direct Object References
Stage B · Practitioner
15. API abuse: the flaws that live behind the JSON
Stage B · Practitioner
16. SQL injection: when your input becomes the query
Stage B · Practitioner
17. OS command injection: when your input reaches a shell
Stage B · Practitioner
18. SSRF: when the server fetches what you tell it to
Stage B · Practitioner
19. CSRF: when the victim's browser does the attacker's work
Stage B · Practitioner
20. Cross-site scripting: when the browser can't tell your code from the attacker's
Stage B · Practitioner
21. Server-side template injection: when your input becomes the program
Stage B · Practitioner
22. XXE: when the parser works for the attacker
Stage B · Practitioner
23. Insecure deserialization: when data builds the objects
Stage B · Practitioner
24. GraphQL abuse: the query language that trusts the querier
Stage B · Practitioner
25. Race conditions: when "check, then act" isn't atomic
Stage B · Practitioner
26. Business-logic flaws: when the code works and the rules don't
Stage B · Practitioner
27. Broken authentication and session management: proving who you are, and staying proven
Stage B · Practitioner
28. JWT and OAuth flaws: trusting the token more than the verifier deserves
Stage B · Practitioner
29. Security headers and browser defenses: telling the browser what "safe" means
Stage B · Practitioner
30. Bug bounty mechanics: how authorized testing is actually offered to beginners
Stage B · Practitioner
Professional, full
31. Coordinated vulnerability disclosure
Stage C · Professional
32. The CVE Program
Stage C · Professional
33. CVSS v3.1 and v4.0, scored by hand
Stage C · Professional
34. The surrounding catalogs: CWE, CAPEC, KEV, EPSS — and where enrichment comes from now
Stage C · Professional
35. Building a public track record: write-ups that teach
Stage C · Professional
Specialist
36. Red team operations: concepts
Stage D · Specialist
37. Exploit development and reverse engineering: concepts
Stage D · Specialist
Exploit development stays at concepts plus mitigations here; hands-on technique is reader-side on pwn.college, per the safety line.
Checkpoints
- The PortSwigger Web Security Academy core labs, completed — the free standard the industry actually respects.
- A first valid finding submitted to a program that authorizes testing — in scope, reproducible, impact argued honestly.
- A full pentest report on a lab target: the scope record, findings with business impact, remediation, and proof you stayed in scope.
The capstone
Level 4 — Extend: Published original work at professional standard. One of: a coordinated disclosure with CVE credit, a novel technique-variation write-up, or a meaningful open-source tool contribution — with the full engagement report (scope record, findings, business impact, remediation) as the artifact. That is what a hiring stranger checks.