Junior Penetration Tester Class – Hands-On Web & OSINT Exploitation

Junior Penetration Tester – Hands-On Web & OSINT Exploitation
Course Description
This 4-hour hands-on workshop introduces participants to the fundamentals of penetration testing with a focus on OSINT and web application exploitation. Attendees will learn how to gather intelligence, identify vulnerabilities, and exploit common flaws such as XSS, SQL Injection, Remote Code Execution (RCE), and Local File Inclusion (LFI) in a lab environment.
Through guided exercises, participants will perform reconnaissance, craft payloads, and execute attacks in simulated real-world scenarios—building a solid foundation for further offensive security training.

NOTE: $50 Paid Class, you must buy a ticket. All money supports Nullspace Labs and our volunteer teachers.
Venmo @nullspacelabs
Zelle/Paypal nofoxresearch@gmail.com
Cash at the door
--
Course Duration
4 hours – fully interactive, hands-on
--
Course Outline
Module 1 – Introduction to Penetration Testing

• Pentest methodology (recon → exploitation → post-exploitation)
• Scoping & rules of engagement
• Quick intro to lab setup

--
Module 2 – OSINT & Reconnaissance

• Understanding OSINT in pentests
• Finding target information without touching the network
• Tools: theHarvester, nmap, Shodan, Hunter.io
• Google Dorks

--
Module 3 – Cross-Site Scripting (XSS)

• Reflected vs Stored XSS
• Crafting payloads & bypassing filters
• Hands-on: Exploiting a vulnerable search form

--
Module 4 – SQL Injection (SQLi)

• Identifying injectable parameters
• Manual exploitation vs automated tools (sqlmap)
• Extracting database contents
• Hands-on: Dumping user credentials from a vulnerable app

--
Module 5 – Local File Inclusion (LFI)

• File inclusion basics (LFI vs RFI)
• Path traversal & filter evasion
• LFI to RCE escalation techniques
• Hands-on: Reading /etc/passwd & PHP logs

--
Module 6 – Remote Code Execution (RCE)

• Common injection points leading to RCE
• Reverse shell basics
• Hands-on: Spawning a shell through a vulnerable file upload

--
Module 7 – Linux Privilege Escalation

• Enumerating system information with linpeas.sh and manual checks
• Exploiting SUID binaries, misconfigured sudo permissions
• Kernel exploits (low-hanging fruit)
• Hands-on: Escalating privileges on a vulnerable Linux target

--
Module 8 – Persistence Techniques

• Creating backdoors for long-term access
• Cron job abuse
• Adding SSH keys for persistence
• Web shell persistence in vulnerable applications
• Hands-on: Setting up persistence and regaining access after reboot

--
Module 9 – Wrap-up & Next Steps

• Mapping vulnerabilities to OWASP Top 10 and MITRE ATT&CK
• Resources for further learning

PREREQUISITES

• Laptop With Kali Linux on VM, or host, or bootable USB.