About
In this module of the Junior Pentester learning path, the starting point of the series, you will learn penetration testing foundations: how professional assessments differ from vulnerability scanning, red teaming, and bug bounties; common engagement models (black-box, white-box, grey-box, internal vs external); pre-engagement Rules of Engagement (RoE), goal vs scope, and scheduling; industry methodologies such as PTES, OWASP WSTG, NIST SP 800-115, and MITRE ATT&CK; how activities map to governance frameworks such as NIST CSF, ISO/IEC 27001:2022, PCI DSS 4.0, HIPAA, and GDPR; and how to structure audience-driven penetration test reports with CVSS-aligned findings and remediation plans. This module is conceptual and does not require a lab. It is a good entry point if you want the why and how of professional assessments before using tools in later modules. ### How to study this module • There is no Kali or victim host here. When you see `### Goals` with Host: none (conceptual), treat the Objective line as your checklist item for that section. • Keep one running example in mind (from Mission Briefing): a cloud-hosted API business that needs PCI DSS 4.0 evidence for an authenticated API test. Use that client in every Lab Challenge. • You do not need to memorize control IDs (HIPAA §164.312, NIST PR.AC-7, and similar). Learn the pattern: technical finding → business impact → cite the client's framework when the RoE asks for it. Upon completion of the module, students will be able to: - Define penetration testing and distinguish it from vulnerability scanning, red teaming, and bug bounties. - Describe common pentest types (black-box, white-box, grey-box, internal vs external) and when each fits. - Formalize pre-engagement parameters: RoE, goal vs scope, timetable, liabilities, NDAs, and authorized techniques. - Navigate engagement phases using PTES and relate them to OWASP WSTG, NIST SP 800-115, and MITRE ATT&CK. - Map penetration testing activities to governance and compliance frameworks such as NIST CSF, ISO 27001, PCI DSS, HIPAA, and GDPR. - Structure a penetration test report for executives, operators, and developers, including severity scoring and short-term vs long-term remediation. For inquiries, please write us at https://www.darkrelay.com/cybersecurity-course-inquiry