Free Penetration Tester Roadmap
The offensive career: find and prove weaknesses before an attacker does. Security+ as the baseline, then the hacking courses employers look for, then PenTest+ to certify it, with OSCP as the next step.
7 steps · 350 free videos · 92 free reads
Create your free account to open all 2,396 free items
The 442 free items on this page — and every other free lesson, video and guide — open once you have a free StationX account. No card, no trial.
Before you start
Read these first
The free roadmap
7 steps, in order
The 🔒 rows show what the full roadmap adds at each step. StationX Membership opens every course and its labs: $299 / year ($24.92/mo billed annually). Infrastructure Labs labs are a separate add-on.
Start here →
Step 1 — Security foundation
The baseline every offensive job advert asks for.
Follow the free CompTIA Security+ (SY0-701) roadmap.
🔒 The full roadmap adds here: 6 full courses · hands-on labs 1–148 of 252 (courses in Membership · 71 labs in Membership · 77 labs in Infrastructure Labs)
- Course · CompTIA Security+ Certification (SY0-701): The Total Course · 🔒 Membership
- Course · Security+ (SY0-701) - Self-paced Course! · 🔒 Membership
- Course · CompTIA Security+ SY0-701: General Security Concepts · 🔒 Membership
- Course · CompTIA Security+: Viruses, Threats and Compromise Indicators · 🔒 Membership
- Course · CompTIA Security+ Labs · 🔒 Membership
- Course · Security+ Just Labs: The Ultimate Hands-On Bootcamp · 🔒 Membership
- Lab 1 of 252 · Additional Scanning Options · 🔒 Membership
- Lab 2 of 252 · Basics of Metasploit · 🔒 Membership
- Lab 3 of 252 · BCP DRP and Test Planning · 🔒 Membership
- Lab 4 of 252 · BitLocker Setup · 🔒 Membership
- Lab 5 of 252 · Block Incoming Traffic on Known Port · 🔒 Membership
- Lab 6 of 252 · Comparing Controls · 🔒 Membership
- Lab 7 of 252 · Creating a List of Installed Programs, Services and User Accounts from a WIN2K12 Server · 🔒 Membership
- Lab 8 of 252 · Creation of BCP and DRP · 🔒 Membership
- Lab 9 of 252 · Data Backup to Prep for Recovery · 🔒 Membership
- Lab 10 of 252 · Event Log · 🔒 Membership
- Lab 11 of 252 · Host Data Integrity Baselining · 🔒 Membership
- Lab 12 of 252 · Installing Patches and Testing Software · 🔒 Membership
- Lab 13 of 252 · MITRE - Attack · 🔒 Membership
- Lab 14 of 252 · MITRE - Defend · 🔒 Membership
- Lab 15 of 252 · Network Discovery · 🔒 Membership
- Lab 16 of 252 · Network Segmentation (FW/DMZ/WAN/LAN) · 🔒 Membership
- Lab 17 of 252 · Network Topology Generation · 🔒 Membership
- Lab 18 of 252 · Open Source Collection · 🔒 Membership
- Lab 19 of 252 · Open Source Password Cracking · 🔒 Membership
- Lab 20 of 252 · Scanning From Windows · 🔒 Membership
- Lab 21 of 252 · Windows Event Log Manipulation via Windows Event Viewer · 🔒 Membership
- Lab 22 of 252 · Wireshark · 🔒 Membership
- Lab 23 of 252 · Manage Users and Groups in Linux [Guided] · 🔒 Infrastructure Labs
- Lab 24 of 252 · Manage Users and Groups in Windows [Guided] · 🔒 Infrastructure Labs
- Lab 25 of 252 · Can You Manage Users and Groups in Windows and Linux? [Advanced] · 🔒 Infrastructure Labs
- Lab 26 of 252 · Configure Password Management in Windows [Guided] · 🔒 Infrastructure Labs
- Lab 27 of 252 · Configure Password Management in Linux [Guided] · 🔒 Infrastructure Labs
- Lab 28 of 252 · Can You Manage Password Requirements in Windows and Linux? [Advanced] · 🔒 Infrastructure Labs
- Lab 29 of 252 · Configure Standard Linux Permissions [Guided] · 🔒 Infrastructure Labs
- Lab 30 of 252 · Configure Standard Windows Permissions [Guided] · 🔒 Infrastructure Labs
- Lab 31 of 252 · Can You Configure Standard Linux and Windows Permissions? [Advanced] · 🔒 Infrastructure Labs
- Lab 32 of 252 · Can You Manage Access in Linux and Windows? [Expert] · 🔒 Infrastructure Labs
- Lab 33 of 252 · Can You Harden the SSH Service on a Linux Server? [Advanced} · 🔒 Infrastructure Labs
- Lab 34 of 252 · Force Users to Change Password Upon First Sign In [Guided] · 🔒 Infrastructure Labs
- Lab 35 of 252 · Remove a User Account [Guided] · 🔒 Infrastructure Labs
- Lab 36 of 252 · Can You Add Server Access for a Group? [Advanced] · 🔒 Infrastructure Labs
- Lab 37 of 252 · Examine Log Files to Block Bad Actors [Guided] · 🔒 Infrastructure Labs
- Lab 38 of 252 · Harden a Server by Limiting Access to a Single Subnet [Guided] · 🔒 Infrastructure Labs
- Lab 39 of 252 · Can You Harden a Server by Restricting Access per Protocol? [Advanced] · 🔒 Infrastructure Labs
- Lab 40 of 252 · Can You Harden a Linux Web Server? [Expert] · 🔒 Infrastructure Labs
- Lab 41 of 252 · Deploy a Private Certificate Authority [Guided] · 🔒 Infrastructure Labs
- Lab 42 of 252 · Configure Custom Certificate Templates and Deployment Options [Guided] · 🔒 Infrastructure Labs
- Lab 43 of 252 · Manually Request a PKI Certificate [Guided] · 🔒 Infrastructure Labs
- Lab 44 of 252 · Can You Deploy a Certificate Authority and Issue Certificates? [Advanced] · 🔒 Infrastructure Labs
- Lab 45 of 252 · Enable DNSSEC [Guided] · 🔒 Infrastructure Labs
- Lab 46 of 252 · Use EFS To Encrypt Files on NTFS Volumes [Guided] · 🔒 Infrastructure Labs
- Lab 47 of 252 · Can You Secure DNS Resource Records and Windows NTFS Volume File Objects? [Advanced] · 🔒 Infrastructure Labs
- Lab 48 of 252 · Enable SSL/TLS on a Website [Guided] · 🔒 Infrastructure Labs
- Lab 49 of 252 · Enable Client SSL/TLS [Guided] · 🔒 Infrastructure Labs
- Lab 50 of 252 · Can You Secure a Website with an SSL/TLS Certificate? [Advanced] · 🔒 Infrastructure Labs
- Lab 51 of 252 · Can You Use PKI to Secure a Network Environment? [Expert] · 🔒 Infrastructure Labs
- Lab 52 of 252 · Cryptography: Attacking Classic Ciphers · 🔒 Membership
- Lab 53 of 252 · Cryptography: Breaking Repeated Key XOR Cipher · 🔒 Membership
- Lab 54 of 252 · Cryptography: Breaking Weak RSA Keys · 🔒 Membership
- Lab 55 of 252 · Cryptography: Decrypting Files With a Dictionary Attack · 🔒 Membership
- Lab 56 of 252 · Cryptography: Forging Digital Signatures · 🔒 Membership
- Lab 57 of 252 · Cryptography: Forging MACs With Side Channels · 🔒 Membership
- Lab 58 of 252 · Cryptography: Hidden Veracrypt Containers · 🔒 Membership
- Lab 59 of 252 · Cryptography: Man In the Middle Attack · 🔒 Membership
- Lab 60 of 252 · Cryptography: Password Cracking · 🔒 Membership
- Lab 61 of 252 · Cryptography: Setting Up HTTPS in Windows and Linux · 🔒 Membership
- Lab 62 of 252 · Cryptography: Setting Up Two Factor Authentication · 🔒 Membership
- Lab 63 of 252 · Cryptography: Steganography · 🔒 Membership
- Lab 64 of 252 · Cryptography: Using GPG for Encryption and Key Management · 🔒 Membership
- Lab 65 of 252 · Cryptography: Using the OpenSSL CLI Tool · 🔒 Membership
- Lab 66 of 252 · Getting Started with Security Concepts in Windows and Linux Environments [Getting Started] · 🔒 Infrastructure Labs
- Lab 67 of 252 · Configure Windows Firewall ACL Rules [Guided] · 🔒 Infrastructure Labs
- Lab 68 of 252 · Configure Linux Firewall ACL Rules [Guided] · 🔒 Infrastructure Labs
- Lab 69 of 252 · Configure Security Settings by Using Microsoft Group Policy [Guided] · 🔒 Infrastructure Labs
- Lab 70 of 252 · Identify Non-secure Network Traffic [Guided] · 🔒 Infrastructure Labs
- Lab 71 of 252 · Can You Secure Host Settings Through Firewall Settings and Group Policy? [Advanced] · 🔒 Infrastructure Labs
- Lab 72 of 252 · Configure IPSec [Guided] · 🔒 Infrastructure Labs
- Lab 73 of 252 · Configure a Windows PPTP VPN [Guided] · 🔒 Infrastructure Labs
- Lab 74 of 252 · Can You Secure Network Access? [Advanced] · 🔒 Infrastructure Labs
- Lab 75 of 252 · Can You Harden Windows Hosts? [Expert] · 🔒 Infrastructure Labs
- Lab 76 of 252 · Back Up and Restore Data in Linux [Guided] · 🔒 Infrastructure Labs
- Lab 77 of 252 · Back Up and Restore Data in Windows [Guided] · 🔒 Infrastructure Labs
- Lab 78 of 252 · Can You Back Up and Restore Data in Windows and Linux? [Advanced] · 🔒 Infrastructure Labs
- Lab 79 of 252 · Configure and Test the Firewall in Linux [Guided] · 🔒 Infrastructure Labs
- Lab 80 of 252 · Configure and Test the Firewall in Windows [Guided] · 🔒 Infrastructure Labs
- Lab 81 of 252 · Can You Configure the Firewall in Linux and Windows? [Advanced] · 🔒 Infrastructure Labs
- Lab 82 of 252 · Configure Patch Management in Linux [Guided] · 🔒 Infrastructure Labs
- Lab 83 of 252 · Configure Update Management in Windows [Guided] · 🔒 Infrastructure Labs
- Lab 84 of 252 · Can You Configure Update Management in Linux and Windows? [Advanced] · 🔒 Infrastructure Labs
- Lab 85 of 252 · Can You Manage Windows and Linux Systems? [Expert] · 🔒 Infrastructure Labs
- Lab 86 of 252 · Applying Filters to TCPDump and Wireshark · 🔒 Membership
- Lab 87 of 252 · DNS as a Remote Shell · 🔒 Membership
- Lab 88 of 252 · Firewall Setup and Configuration · 🔒 Membership
- Lab 89 of 252 · Gap Analysis of Firewall Rules · 🔒 Membership
- Lab 90 of 252 · Implementing Least-Privilege on Windows · 🔒 Membership
- Lab 91 of 252 · Setting Up Zones in a Firewall · 🔒 Membership
- Lab 92 of 252 · Snorby Setup and Operation · 🔒 Membership
- Lab 93 of 252 · TCPDump · 🔒 Membership
- Lab 94 of 252 · Tweaking Firewall Rules for Detection · 🔒 Membership
- Lab 95 of 252 · Using Snort and Wireshark to Analyze Traffic · 🔒 Membership
- Lab 96 of 252 · Getting Started with Cybersecurity Defensive Tools [Getting Started] · 🔒 Infrastructure Labs
- Lab 97 of 252 · Managing Log Files on a Windows Server [Guided] · 🔒 Infrastructure Labs
- Lab 98 of 252 · Configure Windows Defender on a Windows System [Guided] · 🔒 Infrastructure Labs
- Lab 99 of 252 · Configure a Local Security Policy on Server 2016 [Guided] · 🔒 Infrastructure Labs
- Lab 100 of 252 · Can You Use the Sysinternals Suite to Review Permissions on a Windows System? [Advanced] · 🔒 Infrastructure Labs
- Lab 101 of 252 · Using Encryption to Secure Information [Guided] · 🔒 Infrastructure Labs
- Lab 102 of 252 · Can You Configure Drive Encryption by Using LUKS and BitLocker? [Advanced] · 🔒 Infrastructure Labs
- Lab 103 of 252 · Can You Configure Remote Administration by Using PuTTY and SSH? [Expert] · 🔒 Infrastructure Labs
- Lab 104 of 252 · Use a Password Cracking Utility in Linux [Guided] · 🔒 Infrastructure Labs
- Lab 105 of 252 · Can You Use PowerShell to Gather Computer Information in Windows? [Advanced] · 🔒 Infrastructure Labs
- Lab 106 of 252 · Escalate Privileges in Linux [Guided] · 🔒 Infrastructure Labs
- Lab 107 of 252 · Can You Enumerate Network Services by Using Port Scanning in Linux? [Advanced] · 🔒 Infrastructure Labs
- Lab 108 of 252 · Auditing Service Accounts and Setting Up Automated Log Collection · 🔒 Membership
- Lab 109 of 252 · Centralized Monitoring · 🔒 Membership
- Lab 110 of 252 · CIRP Creation and Disaster · 🔒 Membership
- Lab 111 of 252 · Creation of Standard Operating Procedures for Recovery · 🔒 Membership
- Lab 112 of 252 · Data Downloads and Validation · 🔒 Membership
- Lab 113 of 252 · Force Point: DLP Email Overview · 🔒 Membership
- Lab 114 of 252 · Force Point: DLP Network Overview · 🔒 Membership
- Lab 115 of 252 · Identifying Key Assets · 🔒 Membership
- Lab 116 of 252 · Leveraging Internal Intelligence Resources · 🔒 Membership
- Lab 117 of 252 · Log Correlation & Analysis to Identify Potential IOC · 🔒 Membership
- Lab 118 of 252 · Monitoring and Verifying Management Systems · 🔒 Membership
- Lab 119 of 252 · Open and Close Ports on Windows 7 · 🔒 Membership
- Lab 120 of 252 · Phishing · 🔒 Membership
- Lab 121 of 252 · Post Incident Service Restoration · 🔒 Membership
- Lab 122 of 252 · Ransomware · 🔒 Membership
- Lab 123 of 252 · Recover from SQL Injection Attack · 🔒 Membership
- Lab 124 of 252 · Sensitive Information Identification · 🔒 Membership
- Lab 125 of 252 · Vulnerability Identification and Remediation · 🔒 Membership
- Lab 126 of 252 · Use Git to Manage Code [Guided] · 🔒 Infrastructure Labs
- Lab 127 of 252 · Analyze Log Files for Malicious Activity [Guided] · 🔒 Infrastructure Labs
- Lab 128 of 252 · Identify and Manage Old Software [Guided] · 🔒 Infrastructure Labs
- Lab 129 of 252 · Deploy a Docker Container [Guided] · 🔒 Infrastructure Labs
- Lab 130 of 252 · Deploy a Virtual Machine [Guided] · 🔒 Infrastructure Labs
- Lab 131 of 252 · Configure a Jump Box [Guided] · 🔒 Infrastructure Labs
- Lab 132 of 252 · Manage File Redundancy for Resilience and Recovery [Guided] · 🔒 Infrastructure Labs
- Lab 133 of 252 · Manage System Restore Using Windows 11 [Guided] · 🔒 Infrastructure Labs
- Lab 134 of 252 · Use Alerting and Monitoring Tools [Guided] · 🔒 Infrastructure Labs
- Lab 135 of 252 · Digitally Sign Code To Verify Authenticity [Guided] · 🔒 Infrastructure Labs
- Lab 136 of 252 · Configure a Wireless Access Point [Guided] · 🔒 Infrastructure Labs
- Lab 137 of 252 · Sanitize Storage Disks [Guided] · 🔒 Infrastructure Labs
- Lab 138 of 252 · Enhance Security by Using SELinux [Guided] · 🔒 Infrastructure Labs
- Lab 139 of 252 · Manage Configurations by Using Ansible [Guided] · 🔒 Infrastructure Labs
- Lab 140 of 252 · Configure Devices by Using Ansible [Guided] · 🔒 Infrastructure Labs
- Lab 141 of 252 · Perform Security Audits on Linux Services [Guided] · 🔒 Infrastructure Labs
- Lab 142 of 252 · Baseline Systems in Accordance with Policy Documentation · 🔒 Membership
- Lab 143 of 252 · Conduct Baseline Comparison for Indicators of Compromise · 🔒 Membership
- Lab 144 of 252 · Creating a Baseline Using Autopsy · 🔒 Membership
- Lab 145 of 252 · Creating a Secondary Baseline and Conducting Comparison · 🔒 Membership
- Lab 146 of 252 · Manually Creating a Baseline with MD5Deep · 🔒 Membership
- Lab 147 of 252 · Recovering Data and Data Integrity Checks · 🔒 Membership
- Lab 148 of 252 · Windows Deployment Services · 🔒 Membership
Try a free hacking lab: Recon to shell (~5 min) → A scripted simulation in your browser. No account needed.
Step 2 — Hacking foundations
The attacker mindset, the toolkit and a first full hack, end to end.
🔒 The full roadmap adds here: 2 full courses (Membership)
- Course · Ethical Hacking - Hands-On Training - Part I · 🔒 Membership
- Course · Learn Ethical Hacking From Scratch · 🔒 Membership
Step 3 — Network attacks
Scan, enumerate, sniff and crack your way into a network, then find what's vulnerable.
🔒 The full roadmap adds here: hands-on labs 149–159 of 252 (Infrastructure Labs)
- Lab 149 of 252 · Perform Discovery Scanning and Network Reconnaissance [Guided] · 🔒 Infrastructure Labs
- Lab 150 of 252 · Perform Vulnerability Scanning [Guided] · 🔒 Infrastructure Labs
- Lab 151 of 252 · Perform Network Sniffing [Guided] · 🔒 Infrastructure Labs
- Lab 152 of 252 · Perform Password Cracking [Guided] · 🔒 Infrastructure Labs
- Lab 153 of 252 · Manage Shared Folder Access and ICMP Ping Communications by Using Windows Firewall [Guided] · 🔒 Infrastructure Labs
- Lab 154 of 252 · Manage Linux User Accounts, Folder Sharing, and Access Control [Guided] · 🔒 Infrastructure Labs
- Lab 155 of 252 · Manage Auditing [Guided] · 🔒 Infrastructure Labs
- Lab 156 of 252 · Can You Discover Vulnerabilities Over a Network? [Advanced] · 🔒 Infrastructure Labs
- Lab 157 of 252 · Can You Evaluate Weaknesses in Network Traffic and Passwords? [Advanced] · 🔒 Infrastructure Labs
- Lab 158 of 252 · Can You Manage Access and Permissions on Windows and Linux? [Advanced] · 🔒 Infrastructure Labs
- Lab 159 of 252 · Can You Discover Vulnerabilities, Evaluate Weaknesses in Network Traffic and Manage Access and Permissions on Windows and Linux? [Expert] · 🔒 Infrastructure Labs
Step 4 — Web application attacks
Work the OWASP Top Ten with Burp in hand.
🔒 The full roadmap adds here: 2 full courses · hands-on labs 160–186 of 252 (Membership)
- Course · Learn Website Hacking / Penetration Testing From Scratch · 🔒 Membership
- Course · Learn Burp Suite, the Nr. 1 Web Hacking Tool · 🔒 Membership
- Lab 160 of 252 · OWASP Top Ten 2025 - A01 Broken Access Controls · 🔒 Membership
- Lab 161 of 252 · OWASP Top Ten 2025 - A02 Security Misconfiguration · 🔒 Membership
- Lab 162 of 252 · OWASP Top Ten 2025 - A03 Software Supply Chain Failures · 🔒 Membership
- Lab 163 of 252 · OWASP Top Ten 2025 - A04 Cryptographic Failures · 🔒 Membership
- Lab 164 of 252 · OWASP Top Ten 2025 - A05 Injection · 🔒 Membership
- Lab 165 of 252 · OWASP Top Ten 2025 - A06 Insecure Design · 🔒 Membership
- Lab 166 of 252 · OWASP Top Ten 2025 - A07 Authentication Failures · 🔒 Membership
- Lab 167 of 252 · OWASP Top Ten 2025 - A08 Software or Data Integrity Failures · 🔒 Membership
- Lab 168 of 252 · OWASP Top Ten 2025 - A09 Security Logging & Alerting Failures · 🔒 Membership
- Lab 169 of 252 · OWASP Top Ten 2025 - A10 Mishandling of Exceptional Conditions · 🔒 Membership
- Lab 170 of 252 · OWASP Top Ten 2025 - Capstone · 🔒 Membership
- Lab 171 of 252 · OWASP Top Ten 2025 - Capstone (pt.1) · 🔒 Membership
- Lab 172 of 252 · OWASP Top Ten 2025 - Capstone (pt.2) · 🔒 Membership
- Lab 173 of 252 · Web 201 - Lab 1: Recon Tools · 🔒 Membership
- Lab 174 of 252 · Web 201 - Lab 2.1: Detecting and Exploiting Hard to Find SQL injections · 🔒 Membership
- Lab 175 of 252 · Web 201 - Lab 2.2: Advanced Sqlmap · 🔒 Membership
- Lab 176 of 252 · Web 201 - Lab 2.3: Manual Blind SQL Injection · 🔒 Membership
- Lab 177 of 252 · Web 201 - Lab 2.4: NoSQL Injection · 🔒 Membership
- Lab 178 of 252 · Web 201 - Lab 3.1: Cross Site Scripting Filter Evasion · 🔒 Membership
- Lab 179 of 252 · Web 201 - Lab 3.2: Exploiting Misconfigured CORS · 🔒 Membership
- Lab 180 of 252 · Web 201 - Lab 4: Advanced OS Command Injection · 🔒 Membership
- Lab 181 of 252 · Web 201 - Lab 5: Advanced Local File Inclusion · 🔒 Membership
- Lab 182 of 252 · Web 201 - Lab 6: Advanced CSRF · 🔒 Membership
- Lab 183 of 252 · Web 201 - Lab 7.1: XXE to Obtain Arbitrary Files · 🔒 Membership
- Lab 184 of 252 · Web 201 - Lab 7.2: Out of Band XXE Attacks · 🔒 Membership
- Lab 185 of 252 · Web 201 - Lab 8: Server Side Request Forgery · 🔒 Membership
- Lab 186 of 252 · Web 201 - Lab 9: Insecure Deserialization in Python and Java · 🔒 Membership
Step 5 — Privilege escalation and Active Directory
Go from a foothold to root or SYSTEM, then move through Active Directory — the part interviews probe hardest. The exploitation and lateral-movement labs are on Step 7, the PenTest+ step. The AD attack guides here are free; no Active Directory attack lab is sold yet.
🔒 The full roadmap adds here: 1 full course (Membership)
- Course · The Complete Pentesting & Privilege Escalation Course · 🔒 Membership
Step 6 — Scripting for testers
Write the tools instead of waiting for them. The Python scripting labs are on Step 7, the PenTest+ step.
🔒 The full roadmap adds here: 1 full course (Membership)
- Course · Learn Python & Ethical Hacking From Scratch · 🔒 Membership
Step 7 — Certify it
The methodology, the labs and the report — proven in an exam.
Follow the free CompTIA PenTest+ (PT0-003) roadmap.
🔒 The full roadmap adds here: 1 full course · hands-on labs 187–252 of 252 (course in Membership · 33 labs in Membership · 33 labs in Infrastructure Labs)
- Course · Total: CompTIA PenTest+ v3 · 🔒 Membership
- Lab 187 of 252 · Automated Vulnerability Assessments · 🔒 Membership
- Lab 188 of 252 · Core Impact Vulnerability Scan · 🔒 Membership
- Lab 189 of 252 · Creating Recommendations Based on Vulnerability Assessments · 🔒 Membership
- Lab 190 of 252 · Host Identification Scanning via Windows · 🔒 Membership
- Lab 191 of 252 · Host Identification Scanning with Linux · 🔒 Membership
- Lab 192 of 252 · Identifying System Vulnerabilities with OpenVAS · 🔒 Membership
- Lab 193 of 252 · Manual Vulnerability Assessment · 🔒 Membership
- Lab 194 of 252 · Nessus Scanning and Reporting · 🔒 Membership
- Lab 195 of 252 · Nessus Setup and Config · 🔒 Membership
- Lab 196 of 252 · Scanning and Enumeration · 🔒 Membership
- Lab 197 of 252 · Scanning and Enumeration · 🔒 Membership
- Lab 198 of 252 · Scanning and Mapping Networks · 🔒 Membership
- Lab 199 of 252 · Vulnerability Scanner Set-up and Configuration · 🔒 Membership
- Lab 200 of 252 · Perform Open Source Intelligence [Guided] · 🔒 Infrastructure Labs
- Lab 201 of 252 · Execute Network Reconnaissance [Guided] · 🔒 Infrastructure Labs
- Lab 202 of 252 · Perform Vulnerability Scans [Guided] · 🔒 Infrastructure Labs
- Lab 203 of 252 · Monitor Network Traffic by Using Wireshark [Guided] · 🔒 Infrastructure Labs
- Lab 204 of 252 · Intercept and Obtain Passwords [Guided] · 🔒 Infrastructure Labs
- Lab 205 of 252 · Perform DOS Attacks [Guided] · 🔒 Infrastructure Labs
- Lab 206 of 252 · Perform an Attacker-in-the-Middle (AitM) Exploitation [Guided] · 🔒 Infrastructure Labs
- Lab 207 of 252 · Can You Perform OSINT and Host Discovery? [Advanced] · 🔒 Infrastructure Labs
- Lab 208 of 252 · Can You Explore Vulnerabilities in Systems, Network Traffic, and Passwords? [Advanced] · 🔒 Infrastructure Labs
- Lab 209 of 252 · Can You Perform DOS and AitM Attacks? [Advanced] · 🔒 Infrastructure Labs
- Lab 210 of 252 · Can You Perform OSINT by Using recon-ng, Perform Scans with Nmap & GSA, and Perform AitM Attacks? [Expert] · 🔒 Infrastructure Labs
- Lab 211 of 252 · Client-Side Exploitation with Social Engineering · 🔒 Membership
- Lab 212 of 252 · Cybersecurity Testing with Core Impact · 🔒 Membership
- Lab 213 of 252 · Evasive Maneuvers and Post Exploitation · 🔒 Membership
- Lab 214 of 252 · Intro To Linux - Backing Up, Compression, and Scheduling · 🔒 Membership
- Lab 215 of 252 · Intro to Linux - Routing and SSH Tunnels · 🔒 Membership
- Lab 216 of 252 · Linux Exploitation · 🔒 Membership
- Lab 217 of 252 · Network Miner · 🔒 Membership
- Lab 218 of 252 · Pentesting & Network Exploitation - Linux Target Analysis Labs · 🔒 Membership
- Lab 219 of 252 · Pentesting & Network Exploitation: DMZ Exploitation · 🔒 Membership
- Lab 220 of 252 · Pentesting & Network Exploitation: LAN Exploitation · 🔒 Membership
- Lab 221 of 252 · Pentesting & Network Exploitation: Windows Target Analysis Labs · 🔒 Membership
- Lab 222 of 252 · Post Exploitation and Pivoting · 🔒 Membership
- Lab 223 of 252 · Windows Exploitation · 🔒 Membership
- Lab 224 of 252 · Perform Open System Intelligence (OSINT) Gathering [Guided] · 🔒 Infrastructure Labs
- Lab 225 of 252 · Exploit Common Windows Flaws [Guided] · 🔒 Infrastructure Labs
- Lab 226 of 252 · Gain Remote Access to a Windows System [Guided] · 🔒 Infrastructure Labs
- Lab 227 of 252 · Perform Post-Exploit Activities [Guided] · 🔒 Infrastructure Labs
- Lab 228 of 252 · Exploit Flawed Code [Guided] · 🔒 Infrastructure Labs
- Lab 229 of 252 · Discover and Exploit Targets by Using Metasploit [Guided] · 🔒 Infrastructure Labs
- Lab 230 of 252 · Schedule and Perform Network Vulnerability Scans [Guided] · 🔒 Infrastructure Labs
- Lab 231 of 252 · Can You Find Flaws with OSINT and Vulnerability Scanning? [Advanced] · 🔒 Infrastructure Labs
- Lab 232 of 252 · Can You Exploit Windows? [Advanced] · 🔒 Infrastructure Labs
- Lab 233 of 252 · Can You Exploit Windows with Metasploit and Code Analysis? [Advanced] · 🔒 Infrastructure Labs
- Lab 234 of 252 · Can You Perform Open-source Intelligence (OSINT)-Gathering Operations? [Expert] · 🔒 Infrastructure Labs
- Lab 235 of 252 · Perform Open Source Intelligence [Guided] · 🔒 Infrastructure Labs
- Lab 236 of 252 · Use Network Tools to Perform Discovery Scanning and Network Reconnaissance [Guided] · 🔒 Infrastructure Labs
- Lab 237 of 252 · Perform Vulnerability Scanning by using Greenbone Security Assistant (GSA) [Guided] · 🔒 Infrastructure Labs
- Lab 238 of 252 · Explore Network Traffic by Using Wireshark [Guided] · 🔒 Infrastructure Labs
- Lab 239 of 252 · Evaluate the Risk of Password Cracking to Your IT Environment [Guided] · 🔒 Infrastructure Labs
- Lab 240 of 252 · Perform Lateral Movement [Guided] · 🔒 Infrastructure Labs
- Lab 241 of 252 · Take Advantage of Anti-Forensic Techniques [Guided] · 🔒 Infrastructure Labs
- Lab 242 of 252 · Can You Perform OSINT Techniques to Unveil Hidden Network Details and Service Information? [Advanced] · 🔒 Infrastructure Labs
- Lab 243 of 252 · Can You Explore Vulnerabilities in Systems, Network Traffic, and Passwords? [Advanced] · 🔒 Infrastructure Labs
- Lab 244 of 252 · Can You Perform Lateral Movement and Post-exploit Activities? [Advanced] · 🔒 Infrastructure Labs
- Lab 245 of 252 · Can You Perform Information Gathering, Credentialed Vulnerability Access, and Attack a Boundary Server? [Expert] · 🔒 Infrastructure Labs
- Lab 246 of 252 · Intro to Python · 🔒 Membership
- Lab 247 of 252 · Python · 🔒 Membership
- Lab 248 of 252 · Python Tool Building - Authenticated SQLi · 🔒 Membership
- Lab 249 of 252 · Python Tool Building - Banner Grabber · 🔒 Membership
- Lab 250 of 252 · Python Tool Building - C2 · 🔒 Membership
- Lab 251 of 252 · Python Tool Building - Local File Inclusion · 🔒 Membership
- Lab 252 of 252 · Windows Rootkits With Python · 🔒 Membership
Where it leads
Where this career leads
Do it hands-on
The full Penetration Tester roadmap
The same steps with every course and the hands-on labs, and your progress tracked.
The full roadmap with labs →What Membership includes · Full refund within 30 days if you haven't started a lab · cancel anytimeAdvanced
AI-Driven Security Engineering
Become the Cyber Security Expert the AI Era Needs.
StationX’s AI Master’s teaches you to create and deploy security solutions by directing AI. “No coding background required. You direct the AI; the AI does the building.”
Explore the AI Master’s →Create your free account to open all 2,396 free items
The 442 free items on this page — and every other free lesson, video and guide — open once you have a free StationX account. No card, no trial.