Offensive Security Field Playbook, Reporting & Ethical Practice
Executive deliverables, CVSS v3.1 scoring, developer remediation, and capstone audit
Bridge technical exploitation and executive consulting. Learn to craft professional penetration test reports that impress both CISOs and software developers, calculate exact CVSS v3.1 vector strings, provide reproducible step-by-step proofs of concept, utilize rapid field triage payload sheets, and complete a comprehensive final capstone black-box audit simulation.
Course Prerequisites
Part of Academy Track:
What You Will Master
Curriculum Modules (3 Modules)
Explore the structured module breakdown, lesson outcomes, and practical lab exercises.
Module 1: Enterprise Penetration Testing Reporting
4 Lessons • ~4.7 Study Hours (0.47 CEUs)Welcome to Module 1: Enterprise Penetration Testing Reporting. In this section of the curriculum, learners dive deep into foundational and advanced principles designed for production application. This module covers: Structure executive summaries, scope matrices, technical finding bodies, remediation summary tables, and appendices for enterprise security deliverables.; Document findings using standard finding templates: OWASP categories, affected URLs/parameters, root causes, numbered reproduction steps, and proof of concept screenshots.; Calculate CVSS v3.1 Base Metrics (Attack Vector, Complexity, Privileges Required, Impact metrics) and classify findings into Critical, High, Medium, Low, and Info tiers..
Industry-Standard Penetration Testing Report Architecture
Structure executive summaries, scope matrices, technical finding bodies, remediation summary tables, and appendices for enterprise security deliverables.
Crafting Actionable Findings & Evidence Documentation
Document findings using standard finding templates: OWASP categories, affected URLs/parameters, root causes, numbered reproduction steps, and proof of concept screenshots.
CVSS v3.1 Scoring & Severity Classification
Calculate CVSS v3.1 Base Metrics (Attack Vector, Complexity, Privileges Required, Impact metrics) and classify findings into Critical, High, Medium, Low, and Info tiers.
Remediation Advisory Writing & Secure Report Delivery
Write concrete code-level remediation guidance, prepare encrypted report deliverables, conduct stakeholder debriefings, and execute remediation verification audits.
Module 2: The Ethical Hacker's Rapid Reference Cheatsheets
4 Lessons • ~6 Study Hours (0.6 CEUs)Welcome to Module 2: The Ethical Hacker's Rapid Reference Cheatsheets. In this section of the curriculum, learners dive deep into foundational and advanced principles designed for production application. This module covers: Execute an automated 10-step triage script on a fresh target URL: technology fingerprinting, passive subdomain discovery, live port checks, and common file probing.; Rapid-reference payload library for XSS (script tags, event handlers, attribute breakouts, cookie exfiltration) and SQL Injection (auth bypass, union extraction, blind sleep).; Battle-tested payloads for OS Command Injection, SSTI detection, JWT attacks, Path Traversal, XXE, and Server-Side Request Forgery cloud metadata targets..
First 10 Commands on Any Engagement — Fast Triage Pipeline
Execute an automated 10-step triage script on a fresh target URL: technology fingerprinting, passive subdomain discovery, live port checks, and common file probing.
XSS & SQL Injection Payload Arsenal
Rapid-reference payload library for XSS (script tags, event handlers, attribute breakouts, cookie exfiltration) and SQL Injection (auth bypass, union extraction, blind sleep).
Command Injection, SSTI, JWT, Path Traversal & SSRF Payloads
Battle-tested payloads for OS Command Injection, SSTI detection, JWT attacks, Path Traversal, XXE, and Server-Side Request Forgery cloud metadata targets.
Burp Shortcuts, Default Credentials & HTTP Status Code Tables
Burp Suite essential keyboard shortcuts, common default credentials for routers and servers, HTTP response code quick reference, and useful online pentest tools.
Module 3: Engagement Scenarios & Capstone Audits
2 Lessons • ~3.5 Study Hours (0.35 CEUs)Welcome to Module 3: Engagement Scenarios & Capstone Audits. In this section of the curriculum, learners dive deep into foundational and advanced principles designed for production application. This module covers: Walk through an end-to-end black-box engagement scenario: from passive reconnaissance and DNS enumeration to exploiting an IDOR and chaining to remote code execution.; Execute a full-scope authorized penetration test against an approved lab target, document all findings using the professional reporting standard, and submit for instructor grading..
Black-Box Penetration Testing Simulation — URL to Root Compromise
Walk through an end-to-end black-box engagement scenario: from passive reconnaissance and DNS enumeration to exploiting an IDOR and chaining to remote code execution.
Capstone Assessment: Authorized Engagement & Report Submission
Execute a full-scope authorized penetration test against an approved lab target, document all findings using the professional reporting standard, and submit for instructor grading.
Offensive Security & PenTest Progression
Continue advancing through the sequential curriculum stages of this academy track: