Penetration

Testing

—

Technical

Skills

Core

technical

skills

Organised

engagement

phase

Reconnaissance

Open

Source

Intelligence

PASSIVE

Network

Infrastructure

Testing

INTERNAL

EXTERNAL

Subdomain

enumeration

with

Amass

Subfinder

and

dnsx

DNS

record

enumeration

and

zone

transfer

testing

Certificate

Transparency

log

mining

via

crt.sh

and

Certspotter

Internet

facing

asset

discovery

with

Shodan

Censys

and

FOFA

Advanced

operators

and

Google

dorking

Document

metadata

extraction

with

ExifTool

and

Metagoofil

harvesting

and

breach

corpus

lookup

ASN

netblock

and

WHOIS

mapping

the

target

estate

Secret

scanning

public

repositories

with

TruffleHog

and

gitleaks

Technology

fingerprinting

with

Wappalyzer

and

WhatWeb

TCP

and

UDP

port

scanning

with

Nmap

Masscan

and

RustScan

Service

versioning

and

banner

grabbing

via

NSE

scripts

SMB

and

NetBIOS

enumeration

with

enum

linux

and

smbclient

SNMP

enumeration

and

community

string

brute

forcing

Layer

attacks

—

ARP

spoofing

MAC

flooding

VLAN

hopping

Man

the

middle

positioning

with

Responder

Bettercap

and

Ettercap

IPv

attack

surface

discovery

with

mitm

and

THC

IPv

Firewall

rule

set

probing

and

evasion

techniques

Traffic

capture

and

analysis

with

Wireshark

tcpdump

and

Zeek

TLS

configuration

review

using

testssl

and

sslyze

1 / 4

Penetration Testing Technical Skills — page 2

Web

Application

Security

DEEP

DIVE

Exploitation

Post

Exploitation

OFFENSIVE

Active

Directory

Windows

Environments

ENTERPRISE

OWASP

Top

and

Web

Security

Testing

Guide

methodology

SQL

injection

—

band

blind

and

out

band

with

sqlmap

Reflected

stored

and

DOM

based

cross

site

scripting

Server

side

request

forgery

and

XML

external

entity

injection

Server

side

template

injection

across

Twig

Jinja

and

Freemarker

Insecure

deserialisation

Java

, .

NET

and

PHP

Authentication

flaws

—

JWT

abuse

OAuth

misconfiguration

session

fixation

Access

control

testing

—

IDOR

BOLA

and

vertical

privilege

escalation

API

testing

for

REST

GraphQL

introspection

and

gRPC

endpoints

File

upload

bypass

LFI

RFI

and

path

traversal

Business

logic

abuse

and

race

condition

exploitation

Burp

Suite

and

ZAP

proxy

configuration

macros

and

match

replace

rules

Metasploit

Framework

usage

and

custom

module

development

Custom

exploit

development

Python

and

Buffer

overflow

memory

corruption

and

ROP

chain

construction

Payload

generation

and

obfuscation

with

msfvenom

and

Shellter

and

EDR

evasion

—

AMSI

bypass

reflective

syscall

unhooking

Command

and

control

deployment

with

Cobalt

Strike

Sliver

and

Mythic

Credential

dumping

with

Mimikatz

secretsdump

and

LSASS

access

Pivoting

and

tunnelling

with

Chisel

ligolo

and

SOCKS

proxies

Linux

and

Windows

local

privilege

escalation

Persistence

mechanisms

looting

and

artefact

cleanup

Kerberoasting

REP

roasting

and

golden

silver

ticket

abuse

NTLM

relay

and

authentication

coercion

—

PetitPotam

PrinterBug

ADCS

template

abuse

(

ESC

1–

ESC

with

Certipy

BloodHound

collection

and

attack

path

analysis

ACL

and

ACE

misconfiguration

exploitation

Domain

and

forest

trust

enumeration

including

cross

forest

attacks

Group

Policy

Preferences

credential

recovery

LDAP

enumeration

and

custom

query

construction

Delegation

abuse

—

unconstrained

constrained

and

RBCD

2 / 4

Penetration Testing Technical Skills — page 3

Cloud

Container

Security

MODERN

ESTATE

Mobile

Wireless

Hardware

SPECIALIST

Scripting

Tooling

Engineering

AUTOMATION

AWS

Azure

and

GCP

IAM

policy

review

and

privilege

escalation

paths

bucket

and

blob

storage

misconfiguration

testing

Instance

metadata

service

abuse

and

role

assumption

via

SSRF

Kubernetes

RBAC

kubelet

and

etcd

exposure

assessment

Container

escape

techniques

—

privileged

pods

hostPath

docker

sock

Serverless

function

review

for

Lambda

and

Azure

Functions

pipeline

attack

surface

GitHub

Actions

and

Jenkins

Infrastructure

code

scanning

with

Checkov

and

tfsec

Cloud

logging

GuardDuty

and

Defender

for

Cloud

detection

review

Android

application

testing

with

MobSF

Frida

and

objection

iOS

application

testing

including

keychain

and

data

storage

analysis

Certificate

pinning

bypass

and

mobile

traffic

interception

attacks

—

WPA

handshake

capture

PMKID

and

evil

twin

Bluetooth

and

BLE

reconnaissance

and

pairing

abuse

RFID

and

NFC

analysis

with

Proxmark

and

Flipper

Zero

Firmware

extraction

and

analysis

with

binwalk

UART

and

JTAG

Python

for

tooling

parsing

and

exploit

development

Bash

and

PowerShell

for

automation

and

living

off

the

land

for

network

implants

and

concurrent

tooling

Burp

Suite

extension

development

Java

and

Python

Nuclei

template

authoring

for

repeatable

detection

Docker

and

Ansible

for

lab

and

target

orchestration

Git

workflow

code

review

and

safe

handling

offensive

tooling

SIEM

query

languages

—

Splunk

SPL

and

Microsoft

KQL

3 / 4

Penetration Testing Technical Skills — page 4

Methodology

Reporting

Compliance

DELIVERY

PTES

OWASP

WSTG

and

NIST

800-115

frameworks

MITRE

ATT

technique

mapping

for

findings

Scoping

workshops

and

rules

engagement

drafting

CVSS

3.1

and

4.0

scoring

with

justification

Risk

based

finding

prioritisation

and

business

impact

framing

Executive

summary

writing

and

technical

remediation

guidance

Retesting

and

remediation

validation

with

clear

pass

fail

evidence

Regulatory

context

—

PCI

DSS

SOC

HIPAA

and

GDPR

4 / 4

Penetration Testing Technical Skills

Prompt to Clone This Penetration Testing Technical Skills

Apply this example's core structure, strategic pacing, and structural hierarchy directly to your own topic.

What are you generating today?

Data Analysis Technical Skills

Data Science Technical Skills

Artificial Intelligence Technical Skills

Machine Learning Technical Skills

Deep Learning Technical Skills

Data Engineering Technical Skills

Big Data Technical Skills

Data Visualization Technical Skills

Business Intelligence Technical Skills

Database Management Technical Skills

Cybersecurity Technical Skills

Information Security Technical Skills

Network Security Technical Skills

Ethical Hacking Technical Skills

Network Administration Technical Skills

Computer Networking Technical Skills

Cloud Security Technical Skills

Incident Response Technical Skills

Security Analysis Technical Skills

Mechanical Engineering Technical Skills

Civil Engineering Technical Skills

Electrical Engineering Technical Skills

Electronics Engineering Technical Skills

Chemical Engineering Technical Skills

Industrial Engineering Technical Skills

Manufacturing Technical Skills

Automotive Engineering Technical Skills

Robotics Technical Skills

Automation Technical Skills

Similar Examples