Cybersecurity Offensive Security and Penetration Testing Syllabus

Offensive Security and Penetration Testing syllabus — full chapter and topic list

Expand any chapter to see its topics and sub-topics. This is the whole examinable outline for Offensive Security and Penetration Testing in Cybersecurity, not a summary of it.

1. 1

   Penetration Testing Methodology

   3 topics

   • Rules of Engagement and Scoping
   • Testing Types
   • Methodologies
2. 2

   Reconnaissance and Footprinting

   3 topics

   • Passive vs Active Reconnaissance
   • OSINT Techniques
   • DNS and WHOIS Enumeration
3. 3

   Scanning and Enumeration

   3 topics

   • Network Scanning with Nmap
   • Port and Service Enumeration
   • Banner Grabbing and Fingerprinting
4. 4

   Exploitation

   3 topics

   • Exploit Frameworks (Metasploit)
   • Password Attacks
   • Web Application Exploitation
5. 5

   Post-Exploitation

   4 topics

   • Privilege Escalation
   • Lateral Movement and Pivoting
   • Persistence Mechanisms
   • Covering Tracks and Anti-Forensics
6. 6

   Reporting and Tooling

   3 topics

   • Penetration Test Reporting
   • Kali Linux Toolset
   • Bug Bounty and Responsible Disclosure

Offensive Security and Penetration Testing flashcards for Cybersecurity

18 of 76 cards from the Offensive Security and Penetration Testing deck — real questions with worked answers.

1. What are the Rules of Engagement (RoE) in a penetration test?

   A formal document agreed before testing that defines the scope, targets (IP ranges/domains), permitted techniques, timing windows, points of contact, escalation and stop-conditions, and legal authorization. It sets the boundaries and expectations that keep the test lawful and controlled.

2. In scoping, what is the difference between an 'in-scope' and 'out-of-scope' asset?

   In-scope assets are the systems, networks, and applications the tester is explicitly authorized to attack. Out-of-scope assets must never be targeted, even if reachable. Testing out-of-scope systems can be illegal and voids the engagement's authorization.

3. Why is a written 'authorization to test' (get-out-of-jail letter) essential before a pentest?

   It is signed proof from the asset owner that the tester has legal permission to perform intrusive activity. Without it, the same actions constitute unauthorized access (a crime under laws like the CFAA); it protects the tester legally and defines liability.

4. Compare black-box, white-box, and gray-box penetration testing.

   Black-box: tester gets no internal knowledge, simulating an external attacker. White-box: tester gets full information (source, credentials, architecture) for maximum coverage. Gray-box: partial knowledge (e.g., a low-privilege account), balancing realism and efficiency.

5. Distinguish a vulnerability assessment from a penetration test.

   A vulnerability assessment identifies and catalogs weaknesses (breadth, usually automated scanning) without exploiting them. A penetration test actively exploits vulnerabilities to demonstrate real impact and chained attacks (depth), proving what an attacker could achieve.

6. What is the difference between a Red Team engagement and a standard penetration test?

   A standard pentest finds as many vulnerabilities as possible in a defined scope within a set time. A Red Team engagement is objective-based and stealthy (e.g., reach specific 'crown jewel' data), tests detection/response (Blue Team), and mimics a real adversary's TTPs over a longer period.

7. Name the phases of the PTES (Penetration Testing Execution Standard).

   1) Pre-engagement Interactions, 2) Intelligence Gathering, 3) Threat Modeling, 4) Vulnerability Analysis, 5) Exploitation, 6) Post-Exploitation, 7) Reporting.

8. What are the four phases of the OWASP / classic ethical-hacking attack lifecycle used in web/pentest methodology?

   Reconnaissance, Scanning & Enumeration, Exploitation (Gaining Access), and Post-Exploitation (Maintaining Access / Covering Tracks). Reporting frames the whole process. The Cyber Kill Chain and MITRE ATT&CK are related structured models.

9. What is the MITRE ATT&CK framework and how is it used in pentesting?

   A globally accessible knowledge base of adversary tactics (the 'why', e.g., Initial Access, Persistence) and techniques (the 'how'). Pentesters and Red Teams map their actions to ATT&CK to structure engagements and help defenders measure detection coverage.

10. Contrast passive reconnaissance with active reconnaissance.

    Passive recon gathers information without directly interacting with the target's systems (OSINT, WHOIS, search engines), leaving no logs on the target. Active recon directly engages the target (port scans, banner grabbing, DNS queries to their servers), which can be detected/logged.

11. Why do attackers prefer passive reconnaissance early in an engagement?

    Because it does not touch the target's infrastructure, it generates no logs or alerts on the target side, keeping the attacker undetected while still building a detailed profile of the organization, its people, and its exposed assets.

12. What does OSINT stand for and what is its goal in a pentest?

    Open-Source Intelligence. It is the collection of information from publicly available sources (websites, social media, DNS records, breach data, public documents, code repos) to profile the target, find attack surface, and gather data for social engineering and password attacks.

13. Name three common OSINT tools/techniques and what each yields.

    theHarvester (emails, subdomains, hosts from search engines), Shodan (Internet-exposed devices/services and banners), and Google dorking (advanced search operators to find exposed files/pages). Maltego and Recon-ng are also widely used for link analysis and automation.

14. What is a Google dork? Give an example operator.

    A crafted search query using advanced operators to find sensitive exposed information. Examples: site: (limit to a domain), filetype: (find specific file types), inurl: (match URL text). E.g., site:example.com filetype:pdf confidential.

15. What information does a WHOIS lookup provide?

    Domain registration data: registrant/organization details (unless privacy-protected), registrar, creation/expiry dates, name servers, and administrative/technical contacts. Useful for identifying ownership, related domains, and contact info for social engineering.

16. What is a DNS zone transfer (AXFR) and why is it a security concern?

    An AXFR request asks a DNS server to replicate its entire zone file. If a misconfigured server allows it to arbitrary clients, an attacker obtains all DNS records (hostnames, IPs, mail servers), mapping the internal/external network. Servers should restrict AXFR to authorized secondaries only.

17. Match these DNS record types to their purpose: A, MX, NS, TXT, CNAME.

    A: maps a hostname to an IPv4 address. MX: mail exchange servers for the domain. NS: authoritative name servers. TXT: arbitrary text (SPF, DKIM, verification). CNAME: alias pointing one name to another canonical name.

18. Which tools perform DNS enumeration in Kali, and what do they find?

    dnsenum, dnsrecon, fierce, and dig/host/nslookup. They enumerate records, attempt zone transfers, brute-force subdomains, and perform reverse lookups to discover hosts and map the target's DNS footprint.

See more Offensive Security and Penetration Testing flashcards →

Planning Offensive Security and Penetration Testing for Cybersecurity

Offensive Security and Penetration Testing (Cybersecurity) FAQ