Welcome to the Penetration Testing Roadmap repository! This guide provides a comprehensive collection of resources, certifications, tools, and methodologies to help you become proficient in penetration testing.
Web UI - https://securitycipher.com/penetration-testing-roadmap/
- Certifications
- Cloud
- Compliance
- Cryptography
- Labs
- Networking
- OWASP Top 10
- OWASP Top 10 LLM
- Operating System
- Security Testing Approaches
- Terminology
- Threat Modeling
- Tools
- Vulnerabilities
Explore various certifications that are valuable for penetration testers:
Learn about cloud security and related technologies:
- AWS
- Azure
- CIS Benchmark
- CloudSploit
- Conformity Knowledge Base
- Content Delivery Network (CDN)
- GCP
- Hybrid Cloud
- IaaS
- OCI
- PaaS
- Private Cloud
- Public Cloud
- SaaS
- ScoutSuite
- Serverless
- Top Cloud Security Risks
Understand the various compliance frameworks:
Explore cryptographic concepts and techniques:
- Certificate Authority (CA)
- Digital Signature
- Encryption and Decryption
- Hashing
- Obfuscation
- Public Key Infrastructure (PKI)
- SSL Handshake
- Salting
Get hands-on experience with various labs:
Understand networking fundamentals and security:
Explore the OWASP Top 10 vulnerabilities:
- Broken Access Control
- Cryptographic Failures
- Identification and Authentication Failures
- Injection
- Insecure Design
- OWASP Top 10
- SSRF
- Security Logging and Monitoring Failures
- Security Misconfiguration
- Software and Data Integrity Failures
- Vulnerable and Outdated Components
Understand the OWASP Top 10 for Language Model Security:
- Excessive Agency
- Insecure Output Handling
- Insecure Plugin Design
- LLM OWASP Top 10
- Model Denial of Service
- Model Theft
- Overreliance
- Prompt Injection
- Sensitive Information Disclosure
- Supply Chain Vulnerabilities
- Training Data Poisoning
Learn about different operating systems and their security:
Explore various security testing methodologies:
Understand key terminology used in security:
- CVE
- CVSS
- DMZ
- Defense in Depth
- Honeypots
- Jump Server
- MFA vs 2FA
- NIST Cybersecurity Framework
- OAuth 2.0
- SAML
- SIEM
- SSO
Learn about threat modeling methodologies:
Discover tools commonly used in penetration testing:
Understand different types of vulnerabilities:
- Buffer Overflow
- CSRF
- Clickjacking
- DNS Cache Poisoning
- Directory Traversal
- HTTP Parameter Pollution
- HTTP Request Smuggling
- Host Header Injection
- IDOR
- Insecure Deserialization
- LDAP Injection
- Open Redirect
- Privilege Escalation
- RCE
- Race Condition
- SQL Injection
- Server-Side Template Injection
- Session Fixation
- Session Hijacking
- Unrestricted File Upload
- XML Injection
- XSS
- XXE
Contributions are welcome! If you would like to add more content or suggest improvements, please submit a pull request. All contributions will be reviewed by me before merging.