Project 09 · of 11
Offensive cybersecurity
This page brings together my upskilling in offensive security as part of the cybersecurity track (“Cybert” module) and my personal practice on training platforms (Root-Me, TryHackMe). It is based on the pentest course material and presents the full process of a penetration test carried out within a legal framework — from the scope defined in the rules of engagement to the report and recommendations.
Legal framework — pentesting only makes sense within a controlled framework: the Godfrain Act (French law 88-19 of 5 January 1988) on attacks against automated data processing systems, the Black Hat / White Hat distinction, the requirement for an audit agreement (scope, means, terms, duration) and the PASSI framework of ANSSI, the French national cybersecurity agency.
Methodology — the audit follows five steps: audit agreement (authorisation, scope), preparation, execution, writing a report, then conclusions and recommendations. Each technical phase is tooled with Kali Linux.
Toolbox — reconnaissance and scanning (netdiscover, Nmap, masscan, OpenVAS); online password attacks (hydra, ncrack) and offline ones (hashcat, John the Ripper, Aircrack-ng for Wi-Fi) with wordlist generation (Cewl, Crunch); exploitation with Metasploit (building payloads with msfvenom, Meterpreter sessions), pivoting (proxychains) and persistence; web auditing (sqlmap, OWASP ZAP, dirb, Burp Suite); social engineering (SET) and OSINT (holehe, Maltego).
Learn the full process of a legal penetration test and know how to use the Kali Linux offensive toolbox at each phase of the audit (reconnaissance, scanning, exploitation, post-exploitation), while respecting the legal framework (Godfrain Act, ANSSI's PASSI framework).
- Legal framework: Godfrain Act, Black/White Hat distinction, audit agreement, ANSSI's PASSI framework.
- Reconnaissance and scanning: host discovery (netdiscover), network and service mapping (Nmap, masscan), OS detection, vulnerability scanning (OpenVAS).
- Password attacks: wordlists (Cewl, Crunch), online attacks (hydra, ncrack) and offline attacks (hashcat, John, Aircrack-ng on WPA/WPA2).
- Exploitation with Metasploit: msfvenom payloads (reverse shell, reverse HTTPS), Meterpreter sessions.
- Post-exploitation: pivoting (proxychains / SOCKS tunnel), persistence, data extraction.
- Web auditing: SQL injection (sqlmap), vulnerability scanning (OWASP ZAP), directory enumeration (dirb), interception (Burp Suite).
- Going further: social engineering (SET) and OSINT (holehe, Maltego).
- Strictly respecting the legal framework: no “unauthorised” pentesting, an audit agreement and a defined scope are required.
- Choosing between online attacks (noisy, detectable) and offline attacks (stealthy, to be preferred) depending on the context.
- Identifying the right hash type and the right mode/strategy (dictionary, mask, hybrid) for password cracking.
- Capturing a WPA handshake (monitor mode, deauthentication) with an injection-capable Wi-Fi card.
Interactive demo · how a pentest unfolds
The 5 steps of a legal penetration test, from reconnaissance to reporting. Click a step to see the tools and an example command.
The interactive demo needs JavaScript.
Document
The PDF below is the course material of the cybersecurity module (pentest methodology and tooling) that this page is based on; it is not a personal audit report.