StationX
Start free

← All paths

Penetration Tester — career path

StationX Intermediate

The offensive career: find and prove weaknesses before an attacker does. Security+ as the baseline, then the hacking courses employers look for, then PenTest+ to certify it, with OSCP as the next step.

7 courses · 118 sections · 649 lectures · 38 labs · ≈ 40 h of hands-on labs

Free to start: the free lessons and guides for this roadmap →

Try a free hacking lab: Recon to shell (~5 min) → A scripted simulation in your browser. No account needed.

The path

Start here →

Step 1 — Security foundation

The baseline every offensive job advert asks for.

follows the whole CompTIA Security+ (SY0-701) roadmap: 11 courses · 76 sections · 867 lectures · 148 labs · ≈ 172 h of hands-on labs

Learn

CompTIA Security+ badge

11 courses · 76 sections · 867 lectures · 148 labs · ≈ 172 h of hands-on labs

9 steps — The industry-standard entry certification for a cyber security role.

Open the full CompTIA Security+ (SY0-701) roadmap →

Step 2 — Hacking foundations

The attacker mindset, the toolkit and a first full hack, end to end.

2 courses · 47 sections · 220 lectures

Learn

  • CourseEthical Hacking - Hands-On Training - Part I (opens in a new tab)opens on courses.stationx.net 🔒 StationX Membership — $299 / year ($24.92/mo billed annually)
    20 sections · 74 lectures
    1. Course Overview 1
    2. Building Your Virtual Lab Environment Using VirtualBox 8
    3. Section: Troubleshooting VirtualBox 4
    4. Section: Passive Reconnaissance 6
    5. Active Scanning with Nmap 8
    6. Section: Scanning for Vulnerabilities Using Nessus 3
    7. Scanning for Vulnerabilities Using OpenVAS 2
    8. Section: Exploiting Microsoft Windows 3
    9. Section: MSFVENOM 5
    10. Section: Exploiting Linux 5
    11. Section: Social Engineering 1
    12. Section: BASH Scripting for Pentesters 2
    13. Section: Password Cracking 3
    14. Section: Pentesting Wireless Networks 5
    15. Section: Web Based Application Attacks 4
    16. Section: Browser Exploitation Framework (BeEF) 2
    17. Section: Remaining Anonymous 3
    18. Capture the Flag Walkthrough - Mr. Robot 4
    19. Capture the Flag Walkthrough – Stapler 4
    20. Audio Version of Training 1
  • CourseLearn Ethical Hacking From Scratch (opens in a new tab)opens on courses.stationx.net 🔒 StationX Membership — $299 / year ($24.92/mo billed annually)
    27 sections · 146 lectures
    1. Training Overview 2
    2. 1. Course Introduction 3
    3. 2. Setting up a Hacking Lab 6
    4. 3. Linux Basics 3
    5. 4. Network Hacking 5
    6. 5. Network Hacking - Pre Connection Attacks 4
    7. 6. Network Hacking - Gaining Access - WEP Cracking 5
    8. 7. Network Hacking - Gaining Access - WPA / WPA2 Cracking 5
    9. 8. Network Hacking - Gaining Access - Security 2
    10. 9. Network Hacking - Post Connection Attacks 1
    11. 10. Network Hacking - Post-Connection Attacks - Information Gathering 5
    12. 11. Network Hacking - Post Connection Attacks - MITM Attacks 16
    13. 12. Network Hacking - Detection & Security 4
    14. 13. Gaining Access To Computers 1
    15. 14. Gaining Access - Server Side Attacks 9
    16. 15. Gaining Access - Client Side Attacks 6
    17. 16. Gaining Access - Client Side Attacks - Social Engineering 20
    18. 17. Gaining Access - Hacking Outside The Local Network 4
    19. 18. Post Exploitation 7
    20. 19. Website Hacking 2
    21. 20. Website Hacking - Information Gathering 7
    22. 21. Website Hacking - File Upload, Code Execution & File Inclusion Vulns 6
    23. 22. Website Hacking - SQL Injection Vulnerabilities 11
    24. 23. Website Hacking - Cross Site Scripting (XSS) Vulnerabilities 5
    25. 24. Website Hacking - Discovering Vulnerabilities Automatically 5
    26. 25. Bonus Section 1
    27. Audio Version of Training 1
Free resources

Step 3 — Network attacks

Scan, enumerate, sniff and crack your way into a network, then find what's vulnerable.

1 course · 15 sections · 57 lectures · 11 labs

Learn

Practise

Step 4 — Web application attacks

Work the OWASP Top Ten with Burp in hand.

2 courses · 25 sections · 115 lectures · 27 labs

Learn

Practise

Step 5 — Privilege escalation and Active Directory

Go from a foothold to root or SYSTEM, then move through Active Directory — the part interviews probe hardest. The exploitation and lateral-movement labs are on Step 7, the PenTest+ step. The AD attack guides here are free; no Active Directory attack lab is sold yet.

1 course · 10 sections · 63 lectures

Learn

Free resources

Step 6 — Scripting for testers

Write the tools instead of waiting for them. The Python scripting labs are on Step 7, the PenTest+ step.

1 course · 21 sections · 194 lectures

Learn

  • CourseLearn Python & Ethical Hacking From Scratch (opens in a new tab)opens on courses.stationx.net 🔒 StationX Membership — $299 / year ($24.92/mo billed annually)
    21 sections · 194 lectures
    1. Training Overview 2
    2. Section 1: Introduction 13
    3. Section 2: Writing a MAC Address Changer - Python Basics 13
    4. Section 3: MAC Changer - Algorithm Design 7
    5. Section 4: Programming a Network Scanner 16
    6. Section 5: Writing an ARP Spoofer 12
    7. Section 6: Writing a Packet Sniffer 8
    8. Section 7: Writing a DNS Spoofer 8
    9. Section 8: Writing a File Interceptor 7
    10. Section 9: Writing a Code Injector 14
    11. Section 10: Bypassing HTTPS 4
    12. Section 11: Writing an ARP Spoof Detector 3
    13. Section 12: Writing Malware 10
    14. Section 13: Writing Malware - Keylogger 8
    15. Section 14: Writing Malware - Backdoors 22
    16. Section 15: Writing Malware - Packaging 15
    17. Section 16: Website / Web Application Hacking 3
    18. Section 17: Website Hacking - Writing a Crawler 9
    19. Section 18: Writing a Program To Guess Login Information 3
    20. Section 19: Writing a Vulnerability Scanner 16
    21. Audio Version of Training 1

Step 7 — Certify it

The methodology, the labs and the report — proven in an exam.

follows the whole CompTIA PenTest+ (PT0-003) roadmap: 4 courses · 23 sections · 159 lectures · 99 labs · ≈ 117 h of hands-on labs

Learn

CompTIA PenTest+ badge
  • PathFollow the CompTIA PenTest+ (PT0-003) path — the recon, exploitation, web, post-exploitation and scripting labs for the steps above live on this path

4 courses · 23 sections · 159 lectures · 99 labs · ≈ 117 h of hands-on labs

7 steps — The offensive counterpart to CySA+. Scoping, reconnaissance, exploitation, post-exploitation and — the part most people underrate — writing the report.

Open the full CompTIA PenTest+ (PT0-003) roadmap →

Where this leads

Choose your next roadmap

Advanced · after the job

The AI-Driven Penetration Tester

Senior roles are going to the people who can direct AI to build security solutions. When you're working in the role and ready for that step, the AI Master's Program is where it's taught — an advanced, application-only programme.

See the AI Master's Program →Application-only. A separate programme for when you're ready.