Roadmap

Network Pentester

Internal and external network assessment: discovery, enumeration, exposure review, evidence and the conversations that follow.

Intermediate7 stages8–12 weeks

Prerequisites

Infrastructure testers, sysadmins moving into assessment work

Outcome: You can map an authorized segment, describe exposure accurately, and prioritise by reachability rather than by scanner score.

Work them in order the first time. Ticking a stage only records your own progress, in this browser.

Progress0 / 70%

Stored in this browser only. No account, no sync.

01
The network model
Layering, routing, switching, NAT, segmentation.
1 weekMark done
Learn
Toolstcpdump
02
Host and service discovery
Live hosts first, then ports, then services — in that order.
1–2 weeksMark done
Learn
- Ping sweep vs ARP vs SYN discovery
- Reading filtered vs closed
Do
- Compare `nmap -sn` with `nmap -Pn -p443` on the same host and explain the difference.
ToolsNmap Masscan
03
Service enumeration
Versions, banners, defaults, and what a banner does not tell you.
1–2 weeksMark done
Learn
- Banner grabbing and its limits
- Script categories and what they send
ToolsNmap Netcat
04
Traffic analysis
Read the wire: handshakes, retries, cleartext protocols.
1 weekMark done
Do
- Identify whether a slow service is a network or application problem.
ToolsWireshark tcpdump
05
Exposure review
What is reachable from where, and who should hear about it first.
1 weekMark done
Learn
- Management interfaces and forgotten hosts
- Firewall rule verification
ToolsNmap
06
Credential policy in authorized scope
How policy testing is agreed, executed and reported without causing lockouts.
1 weekMark done
Learn
- Agreeing accounts, windows and rates
- Why offline hash review is often kinder
ToolsHydra Hashcat
Hardening loop and retest
Turn findings into configuration changes and prove them.
1–2 weeksMark done
ToolsNmap Checkov

Each tool page carries installation steps, commands and the errors you will hit.