Penetration › Module 1 › Lesson 1
What Pentest Is
Penetration testing simulates adversaries under written scope — methodology literacy on $LAB_HOST you own, not stranger exploitation.
Visual · pentest_what_is
Pentest = simulate attacker under RoE. $LAB_HOST only. Original Cyberlium.
Opening
Pentest is not a license to Metasploit the dorm. It is disciplined simulation on hosts you operate.
Penetration testing validates security controls by simulating realistic attack paths — recon, enumeration, exploitation, privilege escalation — under narrow scope and strict Rules of Engagement. Pentesters produce evidence of impact and remediation guidance for defenders. They do not treat every reachable IP as homework or drop exploit PoCs on production strangers. Cyberlium Topic 19 teaches pentest methodology literacy on YOUR intentional lab VM — placeholder $LAB_HOST. You will NOT scan a classmate's laptop, sweep café Wi-Fi, or chain exploits on internet ranges because a tutorial did. You will NOT confuse OSCP-style learning with authorization to harm strangers. Next: RoE Written.
1. Simulate, prove, report — under scope
Pentest follows a methodology: reconnaissance, service enumeration, vulnerability validation, exploitation proof, post-exploitation within RoE, and reporting. Each phase produces evidence defenders can act on — not trophy screenshots from unauthorized targets.
OSCP-style literacy means understanding the workflow on disposable lab VMs you control at $LAB_HOST. Attackers hope you skip scope and treat curiosity as permission — you won't.
Command guide
Try these commands — Simulate, prove, report — under scope
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
PTES — http://www.pentest-standard.org/ (methodology literacy) MITRE ATT&CK — https://attack.mitre.org/ (defender technique pages only) OSCP — https://www.offensive-security.com/pentesting/ (lab RoE framing)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Built-in (PowerShell: Invoke-WebRequest) Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
python3 -c "print('Pentest = prove impact on named lab assets with written RoE')"
curl -sS https://attack.mitre.org/ | head -8Primary tools to practice this lesson: curl, python3. Reference sites: PTES (http://www.pentest-standard.org/); MITRE ATT&CK (https://attack.mitre.org/); OSCP (https://www.offensive-security.com/pentesting/). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Pentest requires assets you are authorized to test
Legitimate pentest work requires written authorization: your lab VM, your personal test server, hosts named in a signed engagement letter. A responsive port does not grant permission. A YouTube title saying 'hack any box' is not authorization.
Cyberlium labs assume a disposable vulnerable VM you can revert at $LAB_HOST. If the target is not in your RoE file, offensive tools stay closed.
3. What this topic will never call practice
nmap sweeps on dorm /24, exploit PoCs against café gateways, Metasploit on employer production without contract, or sharing shells that expose classmate IPs. Those harm strangers and violate law or policy — not homework.
Ship a sentence: pentest literacy here means methodology on MY $LAB_HOST under written RoE. Next lesson writes that RoE.
4. What you ship: pentest definition that excludes stranger exploitation
Write pentest = simulate/prove/report under written RoE. Lab dest = $LAB_HOST you control. NEVER stranger LANs, café Wi-Fi, internet ranges. Notes chmod 600.
5. What you record before the next lesson
Date (UTC). Pentest vs misuse. Lab = $LAB_HOST you own. NEVER stranger hosts, café Wi-Fi, classmate IPs. Path: $HOME/cyberlium-lab/t19-m01-l01-what-pentest.txt chmod 600.
6. Wrong vs right: stranger nets vs YOUR lab VMs
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Metasploit the dorm subnet 'to learn pentest.' Run exploit-db scripts on a café router. Share classmate shells to Discord.
Right
Define pentest workflow and owned assets. Name $LAB_HOST as the only dest. Next: RoE Written.
Mission: define pentest as authorized simulation
1) Write simulate/prove/report in one paragraph. 2) Write a NEVER list (stranger LANs, café Wi-Fi, internet ranges, weaponized PoCs on strangers). 3) Name $LAB_HOST as your lab placeholder. Never exploit hosts you do not administer.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: 'Hint only: what is pentest scope?' — not how to exploit a dorm /24.
Knowledge Check
APPLY: Penetration testing on Cyberlium means:
Multiple choice
Knowledge Check
APPLY: True or False: Curiosity about a neighbor's open port authorizes a pentest.
True or False
Knowledge Check
APPLY: A pentester produces evidence mainly to:
Multiple choice