Skip to content

Level 4 · Professional Practice

Technique gets you findings. Professionalism gets you hired again. Level 4 is the part of the job that clients actually pay for: a clear report that drives fixes, a scope and contract that protect everyone, and the judgement to work safely in cloud and mobile contexts and inside the law.

This level is deliberately lighter on new offensive technique and heavier on craft, because the gap between a hobbyist and a professional is almost never raw skill — it is the write-up, the scoping conversation, the evidence handling, and knowing exactly where the legal line is. The capstone ties the whole course together into one engagement run start to finish.

Modules

  1. Post-Exploitation & Evidence Handling — what to do after access, what to collect, and the ethics of looking around.
  2. Writing the Penetration Test Report — executive summary, findings, risk ratings and remediation that gets read.
  3. Scoping, Contracts & Rules of Engagement — defining the target, authorization letters, and the emergency contact.
  4. Threat Modeling & Attack Surface Mapping — STRIDE, data flows and prioritising where to look.
  5. Cloud Penetration Testing Basics — the shared-responsibility model, provider rules, and testing your own account.
  6. Mobile Application Testing Basics — Android and iOS app surfaces, storage, and traffic interception.
  7. Red Team, Pentest & Bug Bounty Compared — three different jobs with different goals, scopes and rules.
  8. Certifications & Career Path — OSCP, PNPT, CEH and others, and how to actually get the first role.
  9. Staying Legal: Law, Disclosure & Ethics — the statutes, responsible disclosure, and bug-bounty scope.
  10. Capstone — A Complete Engagement End to End — scope, test, and report a full lab engagement.