Ethical Hacking & Penetration Testing
Find it before they do — legally, methodically, and with a report a client can act on. Real targets in a real lab, from reconnaissance to remediation advice. The offensive-security specialisation that turns security knowledge into a professional consulting skill.
Authorised Testing Only — Read This First
- Every technique on this course is taught for authorised security testing only, performed exclusively in isolated lab environments and against deliberately vulnerable targets provided for the course.
- You must never test any system you do not own or lack explicit written authorisation to test. Unauthorised access to computer systems is a criminal offence — including under Indian law — and this course covers that legal framework and its consequences.
- Professional engagements begin with scoping, rules of engagement and a signed authorisation document. This course teaches that process as the required first step of every engagement — not paperwork to skip — and covers responsible disclosure as professional practice.
This is the offensive-security specialisation of our security track — a professional path into penetration testing and security consulting. It assumes the defensive foundation and goes deep on methodology, exploitation, chaining, post-exploitation, and the part that separates a practitioner from a lab-solver: the professional engagement lifecycle and the report that is the actual deliverable. It is written for people who want to become professional security consultants — the kind an organisation invites in, under contract, to find what is broken before someone unauthorised does.
The recommended prerequisite is our Cybersecurity course (or equivalent experience). That course is the defensive foundation — threats, cryptography, identity, network and endpoint security, security operations, incident response and governance. This is the offensive specialisation that builds on it: we do not re-teach cryptography, identity or SOC operations here; we assume them, and spend the time on finding and safely proving real weaknesses, then writing them up so a client can act.
It is designed for two audiences at once. If you are a fresh IT graduate who has completed security foundations, this is a route into a consulting-shaped profession where employers hire on demonstrated ability — lab write-ups, disclosed findings and a professional report portfolio, which this course is built to produce. If you are a working professional — a SOC analyst moving from defence to offence, or especially a developer moving into application security, a strong and under-recognised path — you already understand how systems are built, which is a direct advantage in web, API and AI testing. The program runs 12 weeks (~90 hours), live and lab-heavy: isolated environments, assessed reports, and a capstone engagement.
The Report Is the Product
Clients do not buy exploitation; they buy a document that tells them what is broken, how badly, and what to do about it. The industry's most respected practical certification enforces this directly — an inadequate report scores zero, regardless of how many machines were compromised. So professional reporting, evidence capture, risk rating and client communication get a full module and a real assessed deliverable here. It is the single biggest gap between people who can pass a lab and people who can be billed to a client, and almost no competing course treats it seriously. This one does.
AI Red Teaming — Where This Course Is Different
AI red teaming has become a distinct offensive discipline, with dedicated certifications now emerging from the same organisations behind the established practical penetration-testing credentials. Organisations are deploying language models, retrieval pipelines, copilots and autonomous agents faster than they can assess them, and traditional penetration-testing methodology does not cover the resulting attack surface. This course gives it a full module: direct and indirect prompt injection, system prompt extraction, retrieval-pipeline exploitation, multi-agent attack chaining, tool and integration-layer abuse, insecure output handling, and mapping findings to the recognised industry vulnerability list for LLM applications.
Here is our genuine advantage, stated plainly: understanding how agent and retrieval systems are built is what makes someone effective at breaking them — and this catalogue already teaches that. Our Generative AI & LLM Engineering, AI Agent Development and Prompt Engineering courses build the exact systems this module teaches you to assess. That combination is a defensible reason to choose this over a generic penetration-testing bootcamp. And we are honest about AI as a tool for the tester: it accelerates reconnaissance, payload generation and report drafting, but it does not replace methodology, creativity, or the judgment to know when a finding actually matters.
Course at a Glance
- Duration: 12 weeks | ~90 hours | live + hands-on
- Format: Live online · lab-heavy · isolated environments, assessed reports, capstone engagement
- Prerequisite: Security fundamentals (our Cybersecurity course or equivalent), comfort with Linux and networking, and basic scripting. Programming experience is an advantage, particularly for web and API testing.
- Curriculum: 11 modules, from the professional engagement to reporting and a capstone engagement
- Certification: Mapped to the recognised progression — entry-level practical, the leading hands-on penetration-testing certification, and the emerging AI red teaming credentials
- Curriculum reviewed: July 2026 — offensive tooling and the AI attack surface move fast; this syllabus is checked against official sources
Course Highlights
- Every module leads with what you do, exploit, chain or report — not what you "learn about"
- The engagement lifecycle taught as a profession — scoping, written authorisation, rules of engagement, disclosure
- The report as the deliverable — a full module and a real assessed professional report
- A dedicated AI red teaming module — the discipline generic bootcamps don't cover
- Active Directory to real depth — the single most valuable enterprise skill in the field
- Web and API testing driven by proxy-based manual technique, not scanner output
- Every technique in isolated labs against deliberately vulnerable targets — authorised testing only
- A capstone engagement scoped, executed, reported and presented end to end
Hands-on Projects & Portfolio
Full reconnaissance and attack-surface map of a lab target organisation.
Against deliberately vulnerable applications, documented to client standard.
Authorisation, token handling and business logic abuse.
Compromise a realistic multi-host domain and map the full attack path.
Across Linux and Windows targets.
Identity escalation in an isolated account.
Assess a retrieval-based agent application, chain a prompt injection to a real impact, and recommend guardrails.
Designed, executed in lab and analysed within scope.
The deliverable that decides whether you're employable.
Complete simulated engagement — scoped, executed, reported and presented.
Tools & Stack
Kali Linux Nmap Burp Suite Metasploit BloodHound Impacket Responder CrackMapExec Hashcat John the Ripper ffuf sqlmap Nuclei Nessus or OpenVAS Wireshark PowerShell & Bash Python Sliver or Covenant Gophish Pacu or ScoutSuite Garak or PyRIT MITRE ATT&CK OWASP Testing Guide OWASP LLM Top 10 Docker
Certification Alignment
- Mapped to the recognised progression in offensive security — an entry-level practical credential, the leading hands-on penetration-testing certification (OffSec OSCP / OSCP+), and the emerging AI red teaming credentials (such as OffSec's AI Red Teamer and HackTheBox's Certified Offensive AI Expert)
- Honest note: the leading practical certification is genuinely demanding, and most candidates build foundations first. This course is designed to get you ready to attempt it — not to promise a shortcut
- Presented as preparation and alignment — no official partnership or accreditation implied, and no exam outcome guaranteed
Career Outcomes
Offensive security is a consulting-shaped profession — demand is driven by regulatory requirements, client assurance and annual testing obligations, which makes it steady work concentrated in consultancies, managed security providers and large in-house security teams. Two honest points: employers hire on demonstrated ability rather than coursework, so lab write-ups, disclosed findings and a professional report portfolio matter more than a certificate alone — which is why this course produces exactly those artefacts; and developers are unusually well positioned to enter this field, because understanding how applications are built is a direct advantage in web, API and AI testing. This course targets:
- Penetration Tester
- Security Consultant
- Application Security Engineer
- Red Team Operator (with experience)
- Vulnerability Assessment Analyst
- Bug Bounty Hunter
- Security Researcher
- AI Red Teamer
- Purple Team Engineer
Who This Course Is For
- Security analysts and SOC professionals moving from defence into offensive work
- Developers moving into application security — a strong, under-recognised path that connects directly to the development courses in this catalogue
- System and network administrators with strong infrastructure knowledge
- Final-year students and fresh IT graduates who have completed security foundations
- AI and ML engineers who need to assess the systems they build — an emerging and underserved audience
- Consultants and auditors who need genuine technical testing capability
- Anyone preparing for a practical, hands-on penetration-testing certification
Material Includes
- Class recordings
- Isolated lab access & deliberately vulnerable practice targets
- Report templates, methodology checklists & engagement paperwork
- Certificate
Prerequisites
- Security fundamentals — our Cybersecurity course or equivalent
- Comfort with Linux and networking; basic scripting
- Programming experience an advantage, especially for web and API testing
Estimated Time: 7 Hours
You produce:- A complete engagement scope with rules of engagement and a written authorisation document — the required first step of every real test, drafted before any tooling is touched
- What a penetration test actually is and how it differs from a vulnerability scan; engagement types (black, grey and white box; internal, external, red team, purple team)
- Scoping, rules of engagement and written authorisation; legal frameworks and liability; established testing methodologies and standards
- Ethics and responsible disclosure
Estimated Time: 8 Hours
You do:- A full reconnaissance and attack-surface map of a lab target organisation — the enumeration discipline that quietly decides most engagements
- Passive intelligence gathering and open-source reconnaissance; attack surface mapping; DNS and infrastructure discovery
- Active scanning and service enumeration; fingerprinting
- The discipline that decides most engagements: thorough enumeration beats clever exploitation
Estimated Time: 8 Hours
You exploit:- A validated vulnerability on a lab target — researched, safely adapted and understood well enough to explain exactly what it does and why it works
- Vulnerability identification and validation; separating real findings from scanner noise; public exploit research and safe adaptation
- Exploitation frameworks; manual exploitation; payloads and shells; evading basic defences
- Understanding an exploit well enough to explain what it does
Estimated Time: 9 Hours
You do:- A proxy-driven manual assessment of a deliberately vulnerable application — the dominant vulnerability classes found, proven and documented to client standard
- Injection; authentication and session flaws; access control failures; server-side request forgery
- Deserialisation; file upload abuse; business logic flaws; client-side issues
- Proxy-driven manual testing throughout
Estimated Time: 8 Hours
You do:- An API assessment covering authorisation, token handling and business logic abuse — where more risk now lives than in the interfaces in front of it
- REST and GraphQL testing; authentication and token handling flaws including JWT and OAuth misuse
- Broken object and function level authorisation; mass assignment; rate limiting and abuse
- Why APIs now carry more risk than the interfaces in front of them
Estimated Time: 8 Hours
You exploit:- A chained path across a lab network — initial foothold to privilege escalation to pivot — on both Linux and Windows targets
- Service-specific attacks; credential attacks and password cracking; man-in-the-middle and network-level techniques
- Pivoting and tunnelling; privilege escalation on Linux and Windows
- Persistence concepts; living-off-the-land techniques
Estimated Time: 9 Hours
You do:- A realistic multi-host domain compromise with the full attack path mapped — the single most valuable enterprise skill in this field
- Domain enumeration; Kerberos attack techniques; credential theft and reuse; delegation abuse
- Access control weaknesses; lateral movement; domain privilege escalation
- Attack-path mapping across a realistic multi-host domain
Estimated Time: 7 Hours
You do:- An identity-escalation and misconfiguration exercise in an isolated cloud account — staying strictly within what provider testing policies permit
- Cloud attack surface; identity and permission escalation paths as the dominant cloud risk; metadata and instance exposure
- Storage misconfiguration; serverless considerations; container escape concepts and orchestrator misconfiguration
- What is and is not permitted under provider testing policies
Estimated Time: 9 Hours
You do:- A red-team assessment of a retrieval-based agent application — chain an indirect prompt injection to a real impact, then write up the finding and recommend guardrails, mapped to the LLM application vulnerability list
- Assessing language model applications, retrieval pipelines, copilots and autonomous agents; direct and indirect prompt injection; system prompt extraction
- Retrieval boundary and data exfiltration failures; multi-agent chaining; tool and integration-layer abuse; insecure output handling
- Model and data poisoning concepts; guardrail evasion; mapping findings to the recognised industry vulnerability list for LLM applications
Estimated Time: 6 Hours
Consent & scope: when the target is a person, the ethical and consent boundaries are stricter, not looser. Every activity here is performed only within an authorised engagement scope agreed in writing.
You design:- An authorised phishing simulation — designed, executed in the lab and analysed — within a scope agreed in writing, never against unconsenting people
- Phishing campaign design within authorised scope; pretexting; awareness testing
- AI-assisted lure generation and what it changes; physical security concepts
- The strict ethical and consent boundaries that apply when the target is a person rather than a system
Estimated Time: 11 Hours
You deliver:- One full simulated engagement, end to end — scoped, tested, findings chained — delivered as a professional report and a stakeholder presentation: the assessed deliverable that decides employability
- Evidence capture and note discipline during testing; writing findings developers can act on; risk rating and prioritisation
- Executive summaries for non-technical stakeholders; remediation advice; retesting and verification
- Client debriefs and difficult conversations; the full end-to-end capstone engagement
- What's App: +91 73-01-11-21-31 for immediate assistance during business hours.
- Email: Send your inquiries to hello@progmatrix.com, and one of our representatives will get back to you as soon as possible.
- Website: You can also use the contact form on our website to send us a message directly.