security
How to Create Custom Password Wordlists with CeWL, Crunch, and CUPP
Build targeted Kali password wordlists with CeWL, CUPP, and Crunch: choose the right strategy, clean and merge seeds, and know when hashcat masks beat storing every candidate.
security
Hashcat Tutorial: Crack Hashes with Wordlists, Rules, and Masks
Learn hashcat on Kali: pick -m hash mode and -a attack mode, run wordlist rules and mask attacks, read Cracked vs Exhausted status, and fix Token length exception and No hashes loaded.
security
John the Ripper Tutorial: Hash Formats, Wordlists, Rules, and Cracking Modes
Learn John the Ripper on Kali Jumbo: prepare hashes, fix format detection, run wordlist rules mask and single modes, crack ZIP SSH and PDF with *2john, and read john.pot with --show.
security
Physical Penetration Testing: Methods, Scope, and Security Checklist
Learn physical penetration testing methodology end to end: define scope and RoE, run authorized site surveys, tailgating and badge tests, USB canary drops, and internal objective checks — then document findings and …
security
How to Validate Vulnerability Scan Results and Find Matching Exploits
Learn how to validate vulnerability scan results, identify Nessus/OpenVAS false positives, verify affected CVE versions, and find matching exploits with SearchSploit and Metasploit.
security
kube-hunter Tutorial: Scan the Kubernetes Attack Surface
Use kube-hunter on an authorized lab cluster to probe Kubernetes attack surfaces from remote, host, and in-pod vantage points, interpret findings, and compare it with kube-bench and Trivy for CompTIA PenTest+.
security
Nessus Vulnerability Scanner Tutorial: Install, Scan, and Analyze Results
Install Nessus Essentials on Kali Linux, register at port 8834, wait for plugins, run a Basic Network Scan against Metasploitable 2, and read plugin output without treating every severity as confirmed impact.
security
Nikto Web Scanner Tutorial: Scan and Interpret Results
Use Nikto on Kali Linux to scan web servers for misconfigurations and exposed paths on Metasploitable 2, choose the right target URL, read findings, and spot false positives and incomplete scans.
security
Vulnerability Scanning Concepts and Scan Types
Compare authenticated vs unauthenticated, internal vs external, network and host vulnerability scans, plus SAST, DAST, IAST and SCA with Nmap and Nikto examples on Kali Linux.
security
PowerView Active Directory Enumeration with PowerShell
PowerView AD enumeration on GOAD-Light — load PowerSploit PowerView on castelblack, run Get-Domain, Get-DomainUser -SPN, trusts, GPOs, and ACL queries with atexec, and compare PowerView to Get-ADUser and SharpView.
security
NTLM Relay Attacks on Active Directory
Relay captured NetNTLM authentication from Responder LLMNR poisoning to an unsigned SMB host with ntlmrelayx on Kali — find relay targets, disable Responder SMB, and verify the chain on GOAD-Light.
security
NetExec Remote Command Execution with SMB, WinRM, and Impacket
Use NetExec on Kali to validate AD credentials, enumerate SMB shares, confirm (Pwn3d!), execute commands over SMB and WinRM, and open an Impacket wmiexec shell.
security
Credential Dumping with Mimikatz on Active Directory Hosts
Dump LSASS logon secrets, local SAM accounts, and DPAPI keys with Mimikatz on GOAD-Light castelblack — stage from Kali with NetExec, run sekurlsa::logonpasswords, and overview Rubeus and Certify for PenTest+.
security
LLMNR and NBT-NS Poisoning with Responder on Kali Linux
Learn LLMNR and NBT-NS poisoning with Responder on Kali Linux. Capture NetNTLMv1/v2 authentication hashes in an AD lab, inspect logs, and optionally crack weak passwords.
linux
Install and Trust a CA Certificate in the Linux System Trust Store
Install a private CA certificate into the Linux system trust store with update-ca-certificates on Debian and Ubuntu or update-ca-trust on RHEL and Fedora, verify the anchor landed, remove it again, and fix the …
security
Scan Git Repositories for Secrets with TruffleHog
Scan Git repositories for secrets with TruffleHog on Kali Linux. Find API keys, private keys, and credentials in Git history, verify findings, and validate with git pickaxe in an authorized lab.
security
theHarvester Tutorial: Email and Domain OSINT on Kali Linux
theHarvester tutorial for Kali Linux: passive reconnaissance with email enumeration, subdomain discovery, Hunter API key setup in api-keys.yaml, source selection, CLI commands, and JSON/XML export on Rolling 2026.2.
security
SpiderFoot Tutorial: How to Install and Use SpiderFoot on Kali Linux
Learn how to install and run SpiderFoot on Kali Linux, start the web UI, run a passive OSINT scan, and read Summary, Browse, and Graph results, with CLI and deployment options.
security
Open Source Intelligence (OSINT) Tools for Pentesters
OSINT tools for pentesters, organized by what you investigate — domain/IP, email, username, image metadata, and breach data. Compare theHarvester, Shodan, Censys, Sherlock, ExifTool, SpiderFoot, and more, with tested …
security
How to Write a Penetration Test Report
Learn how to write a professional penetration test report, with an executive summary, technical finding example, CVSS guidance, remediation steps, and a copyable pentest report template.
security
Collaboration, Communication, and Risk Articulation in Penetration Testing
Learn pentest collaboration and communication: peer review, stakeholder alignment, escalation paths, secure distribution, business impact analysis, and client acceptance for PenTest+ and client work.
security
Manage Pentest Projects with Cervantes
Install Cervantes with Docker Compose, log findings per client and project, and export penetration test reports while you track engagement status from one workspace.
security
Analyze Pentest Findings and Recommend Remediation
Learn how to analyze penetration test findings and recommend remediation across technical, administrative, operational, and physical controls, with prioritization guidance and worked mapping examples for CompTIA …
security
Pentest Methodologies and Frameworks Compared
Compare PTES, OSSTMM, CREST, MITRE ATT&CK, OWASP and other pentest frameworks. Learn what each is for, their differences, and which to use for your engagement.
security
Penetration Testing Rules of Engagement: Scope, Authorization, and Legal Boundaries
Learn penetration testing rules of engagement: scope, authorization, permitted techniques, testing windows, escalation, data handling, and a practical RoE outline.
security
OpenSSL Create Certificate Chain: Root, Intermediate and Leaf
Create an OpenSSL certificate chain with a root CA, intermediate CA, and leaf certificate. Build fullchain.pem, set pathlen, and verify the chain.
linux
Configure Fail2ban to Protect SSH on Linux
Install Fail2ban, enable the sshd jail with sane bantime and ignoreip values, verify bans after failed SSH logins on RHEL and Debian, and unban trusted client addresses when needed.
linux
Disable SELinux in Linux (Runtime, Permissive, and Permanent)
Change or disable SELinux on Linux with setenforce for runtime permissive mode, semanage for one domain, grubby --args selinux=0 for permanent disable on RHEL 9 and 10, and a one-time GRUB edit when the system will not …
linux
Disable ICMP Timestamp Responses in Linux
Block ICMP timestamp request (type 13) and reply (type 14) on Linux with firewalld rich rules, nftables, iptables, or UFW, then verify from a second host with nping before compliance scans run again.
security
SSH Config File: ~/.ssh/config Examples for Linux
The OpenSSH client reads ~/.ssh/config for host aliases, keys, ports, ProxyJump bastions, and connection reuse—this guide walks through examples and how to verify them with ssh -G.