Core technical questions specific to penetration testing and offensive security.
OSINT tools, DNS enumeration, WHOIS lookups, social media analysis
Nmap, Masscan, Angry IP Scanner, network discovery
Wappalyzer, builtwith.com, HTTP headers, response analysis
DNS bruteforcing, certificate transparency, search engines
Union-based, boolean-based, time-based, error-based techniques
Kernel exploits, misconfigurations, credential harvesting
Encoding techniques, alternative payloads, timing analysis
Exploit development, payload generation, post-exploitation
Burp Suite, OWASP ZAP, custom scripts, automation
Python scripts, bash automation, tool integration
Exploit development, shellcode, proof-of-concepts
Blogs, conferences, CTFs, research papers
Planning, reconnaissance, scanning, exploitation, reporting
Asset identification, rules of engagement, timeline
CVSS scoring, business impact, exploitability
Manual verification, proof-of-concepts, documentation
Real-world scenarios to test your practical penetration testing skills.
Payment processing, user authentication, data protection
Authentication bypass, rate limiting, input validation
Reverse engineering, API analysis, data storage
IAM misconfigurations, storage access, network security
Lateral movement, privilege escalation, persistence
WiFi security, rogue access points, encryption
Phishing campaigns, physical security, awareness
Access control, surveillance, environmental controls
Essential tools and frameworks every penetration tester should know.