Skip to main content
All roadmapsStart free
Offensive Security

Offensive Security: Penetration Testing

Hack legally and ethically: from recon to report, red team ready

160h total10 courses4 stages
Start this roadmap free

What you'll be able to do

  • Run the phases of a penetration test methodically
  • Exploit common web and network vulnerabilities in a lab
  • Use industry tooling (Burp, Metasploit, nmap)
  • Write clear, actionable security reports

Before you start

  • Solid networking and Linux fundamentals
  • Comfort with the command line and basic scripting
  • A safe, legal lab environment to practice in

Phase 1 · Technical Foundations

Networking for Hackers

beginner16h

TCP/IP internals, Wireshark packet analysis, Scapy for crafting packets, common protocols (DNS, SMTP, FTP, SMB, LDAP), and how they are exploited.

  • Capture and decode an HTTP form submission in Wireshark
  • Craft a custom TCP packet with Scapy
  • Identify SMB version from packet capture
  • DNS zone transfer with dig axfr

Linux & Windows for Pentesting

beginner16h

Kali Linux setup, directory traversal, file permissions, AD fundamentals (users, groups, GPO, Kerberos), PowerShell for red team, and LOLBAS.

  • Privilege escalation via misconfigured SUID
  • PowerShell: enumerate local users and groups
  • Identify Kerberoastable accounts with GetUserSPNs
  • LOLBAS: execute code via certutil

Python for Offensive Security

beginner14h

Write reverse shells, port scanners, brute-forcers, payload encoders, and C2 POC scripts. Focus on practical exploit development skills.

  • TCP port scanner with threading
  • Simple reverse shell with socket + subprocess
  • Password brute-forcer for SSH (lab VM only)
  • XOR encoder to evade basic AV

Phase 2 · Web Application Pentesting

OWASP Top 10: Hands-On Exploitation

intermediate22h

Injection (SQL, command, LDAP), XSS (reflected, stored, DOM), CSRF, SSRF, XXE, IDOR, broken auth, and security misconfigurations. All labs in safe environments.

  • SQL injection: blind boolean-based extraction
  • Stored XSS: steal session cookie
  • SSRF: reach internal metadata endpoint
  • XXE: read /etc/passwd
  • IDOR: access another user's order history
  • Complete 25 PortSwigger Web Security labs

Burp Suite Professional: Full Workflow

intermediate14h

Intercept proxy, Repeater, Intruder, Scanner, Decoder, Comparer, Collaborator, and BApp Store extensions. Professional-grade web application testing workflow.

  • Intercept and modify a JWT token
  • Intruder: credential stuffing attack on a lab
  • Collaborator: detect out-of-band XXE/SSRF
  • Scan a target: triage and report findings

API Penetration Testing

intermediate12h

REST and GraphQL API security: BOLA/IDOR, mass assignment, broken function-level auth, JWT attacks, and API fuzzing with ffuf and Postman.

  • BOLA: access other user resources via API
  • Mass assignment: elevate privileges via POST body
  • JWT alg=none attack
  • GraphQL introspection: map schema and find hidden endpoints

Phase 3 · Network & Infrastructure Pentesting

Internal Network Pentesting

intermediate20h

Nmap advanced scanning, service enumeration, Metasploit framework, post-exploitation (Meterpreter), pivoting, port forwarding, and lateral movement.

  • Nmap: stealth scan, OS detection, service fingerprint
  • Exploit EternalBlue with Metasploit (lab VM)
  • Meterpreter: dump hashes, screenshot, keylog
  • Pivot: reach isolated network via compromised host

Active Directory Attacks

advanced20h

Kerberoasting, AS-REP Roasting, Pass-the-Hash, Pass-the-Ticket, DCSync, BloodHound attack paths, and Golden/Silver Ticket attacks.

  • Kerberoasting: extract and crack a service ticket
  • BloodHound: find shortest path to Domain Admin
  • DCSync: dump all domain hashes
  • Golden Ticket: forge a Kerberos TGT

Phase 4 · Certifications & Report Writing

Penetration Testing Report Writing

intermediate8h

Professional pentest report structure: executive summary, risk ratings (CVSS), findings (description, evidence, PoC, remediation), and client communication.

  • Write an executive summary non-technical readers can act on
  • CVSS score 3 real findings correctly
  • Peer-reviewed report: no technical errors

OSCP Preparation & Exam Strategy

advanced18h

Offensive Security Certified Professional (OSCP) exam strategy, time management, enumeration methodology, 24-hour lab simulation, and buffer overflow basics.

  • Exploit a basic stack buffer overflow
  • Complete 10 OSCP-like machines from TJNull list
  • 24-hour lab simulation: 3 machines in time
  • Pass OSCP exam (target certification)

Frequently asked

Is the Offensive Security: Penetration Testing roadmap free?+

Yes. The entire Offensive Security: Penetration Testing roadmap and every curated resource is free to follow on Commit. You can track your progress, keep a daily streak, and earn a shareable certificate at no cost — there is no paywall.

How long does the Offensive Security: Penetration Testing roadmap take to complete?+

About 160 hours of focused study across 10 courses and 4 stages. At roughly one hour a day that is about 6 months; you can move faster by studying more each day.

Do I get a certificate for finishing the Offensive Security: Penetration Testing roadmap?+

Yes. When you complete the roadmap on Commit you receive a verifiable certificate of completion that you can add to LinkedIn and your public Commit profile as proof of what you finished.

Related roadmaps

Backend Engineering

Backend Engineering: Node.js

From zero to shipping production REST APIs

View Frontend / UI

Frontend React Developer

Build polished, interactive UIs from first principles

View Full-Stack

Full-Stack Next.js Engineer

One codebase, zero compromises: frontend + backend + DB

View

Make it stick

Copy this roadmap into Commit and turn it into a tracked program with a streak graph, study logging, and a shareable certificate when you finish. Free forever.

Start Offensive Security: Penetration Testing free