Ethical Hacking & Penetration Testing — CEH/OSCP Preparation
Learn to think like a hacker. Master offensive security techniques used by real red teams.
About this course
The offensive security job market grows 35% through 2031, yet Malaysia faces a severe shortage of certified ethical hackers. This comprehensive course covers the full penetration testing lifecycle — reconnaissance, scanning, exploitation, privilege escalation, lateral movement, and reporting — using industry-standard tools and methodologies (OWASP, PTES, MITRE ATT&CK). Aligned with CEH and OSCP exam blueprints, with hands-on lab environments for every module.
What you'll achieve
- Execute a full penetration test following PTES and OWASP methodology
- Enumerate, scan and fingerprint targets with Nmap, Shodan and Recon-ng
- Exploit web vulnerabilities: SQLi, XSS, SSRF, IDOR, broken auth (OWASP Top 10)
- Perform network attacks: ARP spoofing, MITM, credential capture
- Conduct Active Directory attacks: BloodHound, Pass-the-Hash, Kerberoasting
- Write professional penetration testing reports for clients
- Prepare for CEH and OSCP certification exams
Curriculum
Module 1
Penetration Testing Foundations
Ethics & legal framework · Scoping & rules of engagement · PTES methodology · Lab setup: Kali Linux, VMs
Module 2
Reconnaissance & OSINT
Passive recon · Shodan · Recon-ng · theHarvester · DNS enumeration · Google dorks
Module 3
Scanning & Enumeration
Nmap deep dive · Service fingerprinting · Vulnerability scanning with Nessus · SMB & SNMP enumeration
Module 4
Exploitation Fundamentals
Metasploit framework · Exploit selection & tuning · Payload generation · Meterpreter sessions
Module 5
Web Application Penetration Testing
OWASP Top 10 deep dive · Burp Suite · SQLmap · XSS · SSRF · Auth bypass
Module 6
Network & Protocol Attacks
ARP spoofing · MITM with Bettercap · Credential capture · Wireless attacks (WPA2) · Pivoting
Module 7
Active Directory Attacks
AD enumeration with BloodHound · Pass-the-Hash · Kerberoasting · DCSync · GPO abuse
Module 8
Privilege Escalation
Linux PrivEsc · Windows PrivEsc · SUID/SUDO abuse · Token impersonation · Kernel exploits
Module 9
Post-Exploitation & Persistence
Maintaining access · Data exfiltration · Covering tracks · MITRE ATT&CK mapping
Module 10
Reporting & Remediation
Executive vs technical report · CVSS scoring · Risk rating · Remediation roadmap · Client presentation
Who this is for
- IT and security professionals seeking offensive skills
- System administrators hardening their own environments
- Career changers entering cybersecurity
- Developers wanting to understand attacker perspectives
Tools & technologies
Prerequisites
- Networking fundamentals (TCP/IP, DNS, HTTP)
- Basic Linux command line
- General IT troubleshooting experience