Lab Setup & Environment Preparation

• Installing and configuring Kali Linux
• Setting up virtual labs for safe testing
• Basic network configuration and security tools setup

• Understanding the phases of pen-testing
• Rules of engagement & legal considerations
• Pen-testing methodology overview

Linux & Scripting for Pen-Testers

• Linux essentials for ethical hackers
• Bash and Python scripting basics
• Automating reconnaissance and exploits

Reconnaissance & OSINT

• Active vs passive recon techniques
• Using tools like Maltego, theHarvester, Shodan
• Open-source intelligence (OSINT) gathering
• DNS, WHOIS, and network enumeration

Vulnerability Analysis & Scanning

• Vulnerability types, classification, and CVSS
• Tools: OWASP ZAP, w3af, Wapiti, Vega, Metasploit WMAP, Lynis
• Scanning and identifying weak configurations
• Manual vs automated analysis

Exploitation Techniques

• Exploiting Windows and Unix services
• Tools: SQLMap, Metasploit, Tomcat Manager, BeEF
• Bypassing security controls
• Payload delivery and shell access
• Maintaining access through spoofing and spinning

Advanced Exploitation

• Buffer overflows and stack manipulation
• Exploiting misconfigurations and unpatched systems
• Privilege escalation and persistence mechanisms
• Exploiting Windows using PowerShell Empire, Mimikatz 

Web Application Attacks

• OWASP Top 10 vulnerabilities deep dive
• Practical labs with ATutor, JuiceShop, Broken Web Apps
• XSS, CSRF, SQLi, SSTI, RCE, deserialization attacks
• Session hijacking, authentication bypass, cookie manipulation
• Advanced techniques like Magic Hashes, Loose Comparisons, and Template Injection

Social Engineering & Client-Side Attacks

• Phishing attack creation
• Using BeEF framework
• JavaScript-based browser exploitation
• Payloads and social engineering vectors

Network & Wireless Attacks

• Denial of Service (DoS) and DDoS techniques
• Wireless network cracking (WEP/WPA/WPA2)
• Spoofing
  attacks (ARP, DNS, MAC)
• Man-in-the-Middle
  (MITM) techniques

Security Hardening & Defense Evasion

• Tools: Squid Proxy, PortSentry, OSSEC, Tripwire, NST
• Evasion techniques to bypass AV/IDS/IPS
• Hardening Linux & Windows environments post-exploitation

AWS Cloud Penetration Testing

• AWS Pen-testing rules & legal scope
• Building AWS lab for testing
• Exploiting S3 buckets, IAM policies, Lambda functions
• Case Study: Capital One breach scenario
• Enumerating and attacking cloud assets

Report Writing & Documentation

• Defining methodology and report structure
• Writing executive summaries and technical details
• Including
  Proof of Concept (PoC) with screenshots
• Automating
  reports using tools
• Understanding
  risk rating factors and CVSS scoring