Milestone map
Milestone map
3 milestones
Complete Structured Penetration Testing Training
10–18 weeks
Complete a structured penetration testing curriculum covering the core methodology phases: reconnaissance, scanning and enumeration, exploitation, post-exploitation, and reporting. Use PortSwigger Web Security Academy (all free) and solve at least fifteen labs across at least five vulnerability categories (SQLi, XSS, SSRF, authentication vulnerabilities, access control). Document each lab with: the vulnerability found, how it was exploited, and the correct remediation.
Proof required
Submit: screenshots of at least fifteen completed PortSwigger Web Security Academy labs (the completion badge for each, not just the lab page) spanning at least five vulnerability categories; a written lab journal (at least 100 words per lab) documenting the vulnerability, exploitation approach, and remediation; and evidence the labs were completed by you (your PortSwigger account username visible in the screenshots). A security practitioner, penetration tester, or CS lecturer with security experience must confirm the lab journal is accurate.
What gets checked
- At least fifteen PortSwigger labs completed across at least five vulnerability categories — screenshots showing completion badges
- Lab journal entries explain the exploitation approach, not just describe what the vulnerability is
- A security practitioner has confirmed the lab journal is accurate
Common mistakes
- Lab journal entries that describe what the vulnerability type is without explaining how the specific lab was exploited
- Screenshots showing the lab page without the completion confirmation — must show the completed state
Resources
Foundationstart here
Depthgo deeper
What a verifier looks for
- Are at least fifteen labs complete across at least five categories — completion badges visible?
- Does each lab journal entry explain the exploitation approach — not just the vulnerability type?
- Ask: 'in the SQLi lab, what prevented you from using a boolean-based approach instead of error-based?' — tests genuine engagement with the lab
Conduct a Full Penetration Test on a Controlled Target
8–14 weeks (after milestone 1)
Set up a deliberately vulnerable target (Metasploitable 2, DVWA, or a custom Docker environment you configure) and conduct a full penetration test: reconnaissance, scanning and enumeration, vulnerability identification, exploitation, post-exploitation (privilege escalation attempt), and cleanup. Document every step in timestamped working notes as you go.
Proof required
Submit: timestamped working notes covering every phase of the penetration test (reconnaissance through cleanup); screenshots of the nmap scan output, the vulnerability identified, the exploitation step with terminal showing your controlled target IP (private range), and the post-exploitation privileges achieved; and a one-paragraph explanation of what access you achieved and what would have been the highest-risk next step. A security practitioner or penetration tester must confirm the methodology is sound.
What gets checked
- Working notes are timestamped and cover every phase — not a retrospective write-up after the fact
- Screenshots confirm the controlled target's private IP — proving you own the target
- A security practitioner has confirmed the methodology is sound
Common mistakes
- Testing on a target you do not own — all testing must be on systems in your controlled environment
- Retrospective documentation written after the test rather than timestamped working notes taken during it
Resources
Foundationstart here
Depthgo deeper
What a verifier looks for
- Are working notes timestamped and cover every phase — not a retrospective write-up?
- Do screenshots confirm the controlled target's private IP?
- Ask: 'what would the highest-risk post-exploitation step have been, and why?' — tests understanding of the attack chain
Write a Professional Penetration Test Report
4–8 weeks (after milestone 2)
Write a professional penetration test report: executive summary for a non-technical audience, technical findings with CVSS scores, proof of exploitation, and specific remediation recommendations. Present to a security practitioner who challenges the severity ratings.
Proof required
Submit: a professional penetration test report (at least 1,200 words) with executive summary, CVSS-scored findings with vector string and sub-score justification, proof of exploitation with screenshots and reproducing steps, and specific remediation recommendations; and a recording or transcript of a presentation to a security practitioner who challenged at least two severity ratings or remediations.
What gets checked
- CVSS scores include the vector string and sub-score justification — not just the overall score
- Reproducing steps are specific enough that a different person could follow them on the same target
- A security practitioner challenged at least two severity ratings in the documented presentation
Common mistakes
- CVSS scores without the vector string or without justifying individual sub-scores
- Reproducing steps that describe the general approach without the specific commands and inputs used
Resources
Foundationstart here
Depthgo deeper
What a verifier looks for
- Do CVSS scores include the vector string with sub-score justification?
- Are reproducing steps specific enough to follow independently?
- Were at least two severity ratings challenged in the documented presentation?