Complete a CTF Challenge and Publish a Methodology Write-Up
8 weeks · 0 milestones
Complete a minimum medium-difficulty CTF challenge on a recognised platform — HackTheBox, PicoCTF, or a CTFtime-listed event with 100+ participating teams — and publish a write-up explaining every exploit used: the specific vulnerability class, how you identified it (what indicator told you the target was vulnerable), the exact exploitation technique, and what the vulnerability reveals about the underlying system's security model. The flag submission proves completion; the write-up proves understanding of the exploit chain. ALL testing must be within the sanctioned CTF platform — never test systems you do not own or lack explicit written authorisation to test.
Milestone map
Milestone map
3 milestones
Complete a structured penetration testing curriculum covering the core methodology phases: reconnaissance, scanning and enumeration, exploitation, post-exploitation, and reporting. Use PortSwigger Web Security Academy (all free) and solve at least fifteen labs across at least five vulnerability categories (SQLi, XSS, SSRF, authentication vulnerabilities, access control). Document each lab with: the vulnerability found, how it was exploited, and the correct remediation.
Proof required
Submit: screenshots of at least fifteen completed PortSwigger Web Security Academy labs (the completion badge for each, not just the lab page) spanning at least five vulnerability categories; a written lab journal (at least 100 words per lab) documenting the vulnerability, exploitation approach, and remediation; and evidence the labs were completed by you (your PortSwigger account username visible in the screenshots). A security practitioner, penetration tester, or CS lecturer with security experience must confirm the lab journal is accurate.
What gets checked
- At least fifteen PortSwigger labs completed across at least five vulnerability categories — screenshots showing completion badges
- Lab journal entries explain the exploitation approach, not just describe what the vulnerability is
- A security practitioner has confirmed the lab journal is accurate