knowledge base · offensive security

Offensive security, with authorization.

The method, the ethics and the lessons of testing systems on purpose: scope, recon, web and API testing, attack paths, phishing, red and purple teams, and reporting that gets fixed.

$ click a card for details · ctrl+k to search

learning map

Topics are laid out by level, from foundations to advanced. Arrows point from a prerequisite to what builds on it. Select a topic to preview it, or follow the highlighted next step.

Your next step

0 of 8 studied

start this topic

01 Foundations

The ideas everything else builds on.

02 Practitioner

Apply the controls and make them work in practice.

03 Advanced

Design, scale and operate at depth.

studied
ready to study
prerequisites missing
arrows go from a prerequisite to what builds on it

from permission to fixed

Scope, discover, attack safely, report: every engagement follows this path. Each chip opens the matching topic.

01scope
permission, boundaries and method
authorization, rules of engagement, ethics phases and standards
gate: nothing is touched without written authorization and a defined scope
02discover
find what is exposed
assets, services and forgotten systems two accounts and an intercepting proxy
gate: every test is reproducible and within the agreed rate and scope
03attack
show the real impact, safely
chains of small weaknesses the human attack surface can defenders stop a realistic adversary
gate: impact is proven with the least access needed, and cleaned up
04report
turn findings into fixes
findings, risk and retestlessons back into design and detection
gate: each finding has an owner, a fix and a verified retest

topics

Authorization, scope and ethics

The techniques of a penetration tester and an attacker overlap. What differs is written authorization, an agreed scope and a duty to minimize harm.

concept· stage: scope

Penetration testing methodology

A good penetration test is a method, not a bag of tools: define the goal, work through the phases systematically, record everything, and report so the client can act.

concept· stage: scope

Reconnaissance and attack surface

You cannot defend what you do not know you have. Attackers start by mapping the target; defenders who run the same discovery first find the forgotten server before it is used against them.

technique· stage: discover

Web and API security testing

Most serious web findings come from a short list of questions: who can see what, who can change what, and what happens to input that is not what the developer expected. A proxy and two accounts answer most of them.

technique· stage: discover

Attack paths and privilege escalation

Attackers rarely need a zero-day. They chain ordinary weaknesses (a reused credential, an over-broad permission, a trust relationship) until they reach something valuable. The defender's advantage is to map those paths before they are used.

concept· stage: attack

Social engineering and phishing defense

People are not the weakest link; they are the target of a skilled adversary who exploits trust and urgency. Technical controls that do not depend on perfect human judgment are the strongest defense.

practice· stage: attack

Red team, purple team and adversary emulation

A penetration test asks what is vulnerable. A red team asks whether you would notice and stop a determined adversary pursuing a goal. The point is to improve detection and response, not to win.

concept· stage: attack

Reporting findings and driving remediation

A finding that nobody understands or acts on has no value. The best testers write so that an executive sees the risk and an engineer can fix it in an afternoon.

practice· stage: report