Ethical Hacking & Penetration Testing — Practical

About this course

Real pen testing isn't memorizing tool names; it's a methodical workflow you apply against unknown systems. We work through OWASP-vulnerable web apps, deliberately weak networks (HackTheBox-style), and real-world recon techniques. Every session ends with a finding you'd write up for a client report. By the end you can run a structured pen test and produce a deliverable that survives client legal review.

What you'll cover

• 1

  The pen-tester's methodology

  PTES, OWASP. Recon → enum → exploit → post-ex → report.

• 2

  Reconnaissance and OSINT

  Subdomain enum, Shodan, GitHub leaks. The recon that shapes the test.

• 3

  Web app pen testing

  Burp Suite. SQLi, XSS, IDOR, SSRF in practice on broken apps.

• 4

  Network pen testing basics

  Nmap, banner grabbing, service exploitation. Pivoting between hosts.

• 5

  Active Directory attacks

  Kerberoasting, BloodHound, lateral movement. The MENA enterprise reality.

• 6

  Reporting — the deliverable that gets you paid

  Executive summary. Findings. CVSS scoring. The template that scales.

Skills you'll build

• pen testing
• ethical hacking
• OWASP
• Burp Suite
• Nmap
• BloodHound
• OSINT
• red team