ROADMAP PENTESTER - PENETRATION TESTING TOÀN DIỆN

1. FOUNDATIONS - NỀN TẢNG CƠ BẢN

1.1 Kiến thức nền tảng IT

Cách hoạt động của máy tính và kiến trúc hệ thống
Binary, Hexadecimal, ASCII
Cách lưu trữ và xử lý dữ liệu
Virtualization basics
Cloud computing fundamentals

1.2 Linux Mastery - BẮT BUỘC

Linux distributions (Kali, Parrot OS, BlackArch)
Command line mastery
File system và permissions
User và group management
Process management
Package management
Text manipulation (grep, sed, awk)
Bash scripting advanced
Cron jobs
SSH và remote access
Service management (systemd, init)
Log analysis

1.3 Windows Internals

Windows architecture
Registry deep dive
Active Directory fundamentals
PowerShell scripting
Windows services
Event logs
User và group policies
NTFS permissions
Windows authentication (NTLM, Kerberos)
Windows API basics

1.4 Networking Fundamentals

OSI Model mastery
TCP/IP stack deep dive
Subnetting và VLSM
IPv4 và IPv6
MAC addressing
ARP protocol
Routing protocols (RIP, OSPF, BGP)
Switching concepts
NAT và PAT
DNS deep dive
DHCP
VPN technologies

2. PROGRAMMING & SCRIPTING

2.1 Python cho Pentesting

Python basics
Socket programming
Network libraries (scapy, requests, urllib)
Web scraping (BeautifulSoup, Scrapy)
Cryptography libraries
Exploit development với Python
Automation scripts
Custom tool development
API interaction
Multithreading
Regex mastery

2.2 Bash Scripting

Advanced bash scripting
Automation workflows
One-liners mastery
Text processing
Network reconnaissance scripts
Exploit automation
Report generation scripts

2.3 PowerShell

PowerShell fundamentals
Active Directory enumeration
Windows exploitation scripts
Post-exploitation automation
Empire framework understanding
Obfuscation techniques

2.4 Other Languages

JavaScript (for web exploitation)
PHP (for web app testing)
Ruby (for Metasploit)
C/C++ (for exploit development)
Assembly basics (for reverse engineering)
Go (for tool development)

2.5 Regular Expressions

Regex syntax mastery
Pattern matching
Data extraction
Log parsing
Payload crafting

3. NETWORKING DEEP DIVE

3.2 Network Security Devices

Firewalls (ACLs, rules)
IDS/IPS evasion
WAF bypass techniques
Load balancers
Proxy servers
VPN configurations
Network segmentation

3.3 Wireless Networking

WiFi standards (802.11)
WEP/WPA/WPA2/WPA3
WiFi authentication protocols
Rogue AP detection
Evil twin attacks
Wireless encryption
Bluetooth security
RFID/NFC

3.4 Network Services

Web servers (Apache, Nginx, IIS)
Database servers (MySQL, PostgreSQL, MSSQL)
File servers
Email servers
DNS servers
FTP servers
Authentication servers

4. WEB APPLICATION PENETRATION TESTING

4.1 Web Fundamentals

HTTP protocol deep dive
HTTP methods (GET, POST, PUT, DELETE, OPTIONS, etc.)
HTTP headers
Status codes
Cookies và sessions
Same-Origin Policy
CORS (Cross-Origin Resource Sharing)
Content Security Policy (CSP)
WebSockets
REST APIs
GraphQL
SOAP

4.2 Web Technologies

HTML/CSS fundamentals
JavaScript deep dive
DOM manipulation
AJAX và fetch API
JSON và XML
Web frameworks (React, Angular, Vue)
Server-side languages (PHP, Python, Node.js, Java, .NET)
Template engines
CMS platforms (WordPress, Joomla, Drupal)

4.3 OWASP Top 10 Mastery

Injection (SQL, NoSQL, LDAP, OS Command, XXE)
Broken Authentication
Sensitive Data Exposure
XML External Entities (XXE)
Broken Access Control (IDOR, Path Traversal)
Security Misconfiguration
Cross-Site Scripting (XSS - Reflected, Stored, DOM-based)
Insecure Deserialization
Using Components with Known Vulnerabilities
Insufficient Logging và Monitoring

4.4 Advanced Web Attacks

SQL Injection advanced (Blind, Time-based, Error-based, Union-based)
NoSQL injection
LDAP injection
XPath injection
Template injection (SSTI)
Server-Side Request Forgery (SSRF)
Cross-Site Request Forgery (CSRF)
Clickjacking
HTTP Request Smuggling
HTTP Parameter Pollution
Host Header attacks
Web Cache Poisoning
OAuth vulnerabilities
JWT attacks
SAML vulnerabilities
File upload vulnerabilities
Local File Inclusion (LFI)
Remote File Inclusion (RFI)
XML External Entity (XXE) advanced
Insecure Direct Object References (IDOR)
Business Logic flaws
Race conditions
Type juggling
Mass assignment
Prototype pollution

4.5 Authentication & Session Management

Password attacks
Session fixation
Session hijacking
Cookie security
Token-based authentication attacks
Multi-factor authentication bypass
Captcha bypass
OAuth 2.0 exploitation
SAML exploitation

4.6 Client-Side Attacks

XSS payloads crafting
XSS filter bypass
DOM-based vulnerabilities
PostMessage vulnerabilities
WebSocket hijacking
Browser exploitation
Tabnabbing

4.7 API Security Testing

REST API testing
GraphQL testing
SOAP API testing
API authentication bypass
API rate limiting bypass
API parameter tampering
Mass assignment in APIs
GraphQL introspection
API versioning issues

5. NETWORK PENETRATION TESTING

5.1 Reconnaissance

Passive reconnaissance (OSINT)
Active reconnaissance
Google dorking advanced
Shodan, Censys, ZoomEye
DNS enumeration (zone transfers, subdomain brute-forcing)
WHOIS lookup
Email harvesting
Metadata extraction
Social media intelligence
Certificate transparency logs
Wayback machine analysis

5.2 Scanning & Enumeration

Port scanning (Nmap mastery)
Service enumeration
Version detection
OS fingerprinting
Vulnerability scanning (Nessus, OpenVAS, Nexpose)
SMB enumeration
SNMP enumeration
LDAP enumeration
NFS enumeration
RPC enumeration
Banner grabbing
Network mapping

5.3 Exploitation

Metasploit Framework mastery
Exploit development basics
Buffer overflow exploitation
Return-oriented programming (ROP)
Shellcode development
Custom exploit modification
Public exploit databases (Exploit-DB, NVD)
Vulnerability research
0-day exploitation concepts

5.4 Post-Exploitation

Privilege escalation (Linux và Windows)
Maintaining access
Backdoors và persistence
Data exfiltration
Lateral movement
Pivoting và tunneling
Credential dumping
Pass-the-Hash
Pass-the-Ticket
Kerberoasting
Golden Ticket attacks
Silver Ticket attacks
Mimikatz mastery
BloodHound for AD enumeration
Living off the land binaries (LOLBins)

5.5 Active Directory Attacks

AD enumeration
Kerberos attacks
NTLM relay attacks
DCSync attacks
DCShadow attacks
GPO abuse
ACL abuse
Trust relationship exploitation
Domain controller compromise
Forest escalation

6. WIRELESS PENETRATION TESTING

6.1 WiFi Attacks

WiFi reconnaissance (airodump-ng, Kismet)
WEP cracking
WPA/WPA2 cracking (Dictionary, Brute-force)
WPS attacks (Pixie Dust, Reaver)
Evil twin attacks
Rogue AP setup
Deauthentication attacks
KRACK attack
Captive portal bypass
WPA3 attacks

6.2 Bluetooth Attacks

Bluetooth enumeration
Bluejacking
Bluesnarfing
BlueBorne vulnerabilities
BLE (Bluetooth Low Energy) attacks

6.3 RFID/NFC

RFID cloning
NFC relay attacks
Access card cloning
Proximity card attacks

7. MOBILE PENETRATION TESTING

7.1 Android Security

Android architecture
APK reverse engineering
Smali code analysis
Android debugging (ADB)
Frida framework
Objection
SSL pinning bypass
Root detection bypass
Android malware analysis
Intent vulnerabilities
Content provider exploitation
Insecure data storage
Insecure communication

7.2 iOS Security

iOS architecture
IPA analysis
Jailbreak detection bypass
SSL pinning bypass iOS
Objective-C/Swift basics
iOS app testing tools
Keychain analysis
iOS malware analysis

7.3 Mobile OWASP Top 10

Improper Platform Usage
Insecure Data Storage
Insecure Communication
Insecure Authentication
Insufficient Cryptography
Insecure Authorization
Client Code Quality
Code Tampering
Reverse Engineering
Extraneous Functionality

Pretexting
Phishing
Spear phishing
Whaling
Vishing (voice phishing)
Smishing (SMS phishing)
Baiting
Quid pro quo
Tailgating
Impersonation

Social-Engineer Toolkit (SET)
Gophish
King Phisher
HiddenEye
Email spoofing
Credential harvesting
Fake login pages
Malicious document creation

8.3 Physical Security

Lock picking basics
Badge cloning
RFID skimming
Dumpster diving
Shoulder surfing
USB drop attacks
Rogue device planting

8.4 OSINT (Open Source Intelligence)

Information gathering frameworks (Maltego, Recon-ng, SpiderFoot)
Social media profiling
People search engines
Company intelligence
Data breach databases
Dark web monitoring
Metadata analysis (FOCA, ExifTool)
Google dorking mastery
Email OSINT
Username enumeration

9. CLOUD PENETRATION TESTING

9.1 AWS Security Testing

AWS architecture
S3 bucket enumeration
IAM misconfigurations
EC2 instance attacks
Lambda function testing
API Gateway security
RDS security
CloudTrail analysis
AWS CLI mastery
AWS exploitation tools (Pacu, ScoutSuite)

9.2 Azure Security Testing

Azure architecture
Azure AD attacks
Blob storage enumeration
Azure VM exploitation
Azure Function testing
Key Vault attacks
Azure CLI
Azure exploitation tools (ROADtools, Stormspotter)

9.3 GCP Security Testing

GCP architecture
GCS bucket enumeration
IAM privilege escalation
Compute Engine attacks
Cloud Functions testing
GCP CLI (gcloud)
GCP exploitation tools (GCPBucketBrute)

9.4 Container Security

Docker security assessment
Kubernetes penetration testing
Container escape techniques
Registry vulnerabilities
Orchestration attacks
Secrets management testing

9.5 Cloud-Specific Attacks

Server-Side Request Forgery (SSRF) to metadata
Instance metadata service abuse
Storage misconfigurations
Serverless function exploitation
API key exposure
Cloud credential theft

10. EXPLOITATION & EXPLOIT DEVELOPMENT

10.1 Assembly Language

x86/x64 assembly
ARM assembly
Registers và memory
Stack operations
Instruction set
Calling conventions

10.2 Reverse Engineering

Static analysis (IDA Pro, Ghidra, Radare2)
Dynamic analysis (GDB, WinDbg, x64dbg)
Binary analysis
Decompilation
Obfuscation techniques
Packing/unpacking
Anti-debugging techniques
Anti-reversing techniques

10.3 Buffer Overflow

Stack-based buffer overflow
Heap-based buffer overflow
Return-to-libc
ROP chains (Return-Oriented Programming)
Format string vulnerabilities
Integer overflow
Use-after-free
Double-free vulnerabilities

10.4 Exploit Development

Fuzzing (AFL, libFuzzer, Honggfuzz)
Shellcode development
Egg hunters
Exploit mitigation bypass (DEP, ASLR, Stack Canaries)
Heap spraying
JIT spraying
Kernel exploitation basics
Windows exploitation
Linux exploitation
MacOS exploitation

10.5 Malware Development

Trojan development
Backdoor creation
Rootkit basics
Persistence mechanisms
Anti-analysis techniques
Code obfuscation
Packing và crypting
C2 (Command and Control) frameworks

11. RED TEAM OPERATIONS

11.1 Red Team Methodology

Kill Chain methodology
MITRE ATT&CK framework
Initial access techniques
Execution techniques
Persistence mechanisms
Privilege escalation
Defense evasion
Credential access
Discovery
Lateral movement
Collection
Exfiltration
Impact

11.2 Advanced Evasion

AV/EDR evasion
Signature evasion
Behavioral evasion
Sandbox evasion
IDS/IPS evasion
Firewall bypass
WAF bypass techniques
DLP evasion
Logging evasion

11.3 C2 Frameworks

Cobalt Strike
Empire/Starkiller
Covenant
Merlin
Mythic
Sliver
Koadic
Custom C2 development

11.4 Living off the Land

PowerShell exploitation
WMI abuse
Windows binaries (LOLBins)
Linux binaries (GTFOBins)
Fileless malware
Registry-only persistence
Memory-only attacks

11.5 Adversary Simulation

APT emulation
Threat modeling
Custom attack scenarios
Purple team collaboration
Attack simulation frameworks (Atomic Red Team, Caldera)

12. PENTESTING TOOLS MASTERY

12.1 Reconnaissance Tools

Nmap
Masscan
RustScan
Amass
Subfinder
Assetfinder
DNSRecon
Fierce
theHarvester
Recon-ng
Maltego
Shodan
SpiderFoot

12.2 Web Application Tools

Burp Suite Professional (mastery required)
OWASP ZAP
Nikto
WPScan
Wfuzz
ffuf
Gobuster
Dirbuster
SQLMap
Commix
XSStrike
Nuclei
Arjun
ParamSpider

12.4 Password Attacks

Hashcat
John the Ripper
Hydra
Medusa
Patator
CeWL
Crunch
Mentalist
Cain & Abel
Ophcrack
Rainbow tables

12.5 Wireless Tools

Aircrack-ng suite
Wifite
Reaver
Bully
Kismet
Fern WiFi Cracker
WiFi Pumpkin
Cowpatty
Pyrit

12.6 Mobile Tools

MobSF (Mobile Security Framework)
Frida
Objection
APKTool
Jadx
Dex2jar
Android Studio
Xcode
Burp Suite Mobile Assistant

12.7 Exploitation Frameworks

Metasploit Framework
ExploitDB
SearchSploit
Social-Engineer Toolkit (SET)
BeEF (Browser Exploitation Framework)
RouterSploit
Commix

12.8 Post-Exploitation Tools

Mimikatz
BloodHound
PowerView
SharpHound
Rubeus
Certify
ADRecon
PowerUp
LinPEAS
WinPEAS
PEASS-ng suite

13. REPORTING & DOCUMENTATION

13.1 Report Writing

Executive summary
Technical findings
Vulnerability assessment
Risk rating (CVSS scoring)
Proof of concept
Remediation recommendations
Evidence collection
Screenshots và logs
Reproduction steps
Attack narratives

13.2 Documentation Tools

CherryTree
KeepNote
Dradis
Obsidian
Notion
Joplin
Markdown mastery
LaTeX basics
Screenshot tools (Flameshot, Greenshot)

13.3 Reporting Frameworks

PTES (Penetration Testing Execution Standard)
OWASP Testing Guide
NIST SP 800-115
OSSTMM
Penetration Testing Framework

13.4 Communication Skills

Technical writing
Stakeholder communication
Presentation skills
Debriefing sessions
Finding prioritization
Remediation guidance

14. COMPLIANCE & FRAMEWORKS

14.1 Compliance Standards

PCI DSS penetration testing requirements
HIPAA security assessments
ISO 27001
SOC 2
GDPR
NIST Cybersecurity Framework
FISMA

14.2 Testing Methodologies

OWASP Testing Guide
PTES (Penetration Testing Execution Standard)
OSSTMM (Open Source Security Testing Methodology Manual)
NIST SP 800-115
CEH methodology
SANS penetration testing methodology

14.3 Scope Definition

Rules of engagement
Legal considerations
Authorization documents
Scope boundaries
Testing windows
Communication protocols
Emergency contacts

15. ADVANCED TOPICS

15.1 IoT/ICS/SCADA Security

IoT device testing
Firmware analysis
Hardware hacking basics
UART/JTAG debugging
ICS protocols (Modbus, DNP3, BACnet)
SCADA system testing
OT network security
PLC exploitation

15.2 Blockchain Security

Smart contract auditing
Cryptocurrency wallet testing
Blockchain network analysis
DeFi security testing
NFT vulnerabilities
Consensus mechanism attacks

15.3 Thick Client Testing

Desktop application testing
.NET application testing
Java application testing
Electron app testing
Binary analysis
Memory analysis
Network traffic analysis

15.4 VoIP Security

SIP protocol exploitation
VoIP enumeration
Eavesdropping attacks
VoIP fuzzing
Asterisk testing

15.5 Database Security

SQL Server exploitation
MySQL exploitation
PostgreSQL exploitation
Oracle exploitation
MongoDB exploitation
Redis exploitation
NoSQL injection techniques

15.6 Mainframe Security

Mainframe basics
z/OS security
RACF exploitation
TSO testing
CICS exploitation

16. BUG BOUNTY & RESPONSIBLE DISCLOSURE

16.1 Bug Bounty Platforms

HackerOne
Bugcrowd
Intigriti
YesWeHack
Synack
Open Bug Bounty
Platform rules và etiquette

16.2 Bug Bounty Methodology

Asset discovery
Scope analysis
Vulnerability prioritization
Report writing for bounties
Communication with programs
Disclosure timelines
Payment processes

16.3 Automation for Bug Bounties

Recon automation
Nuclei templates
Custom workflow automation
Continuous monitoring
Notification systems
Mass scanning ethics

16.4 Responsible Disclosure

Disclosure policies
CVE process
Coordinated disclosure
Vendor communication
Public disclosure timing
Legal protections

17. LEGAL & ETHICAL CONSIDERATIONS

17.1 Legal Framework

Computer Fraud and Abuse Act (CFAA)
DMCA
GDPR implications
Local cybersecurity laws
Authorization requirements
Contracts và NDAs
Liability insurance

17.2 Ethical Hacking

Code of ethics
Professional conduct
Data handling
Client confidentiality
Conflict of interest
Scope adherence
Responsible disclosure

17.3 Authorization

Written authorization
Scope documentation
IP range verification
Third-party services
Out-of-scope handling
Emergency procedures

18. CERTIFICATIONS

18.1 Entry Level

CompTIA Security+
CompTIA PenTest+
eLearnSecurity eJPT (Junior Penetration Tester)
TCM Security PNPT (Practical Network Penetration Tester)

18.2 Intermediate

CEH (Certified Ethical Hacker)
GIAC GPEN (Penetration Tester)
eLearnSecurity eCPPT
CREST CRT/CCT
CompTIA CySA+

18.3 Advanced

OSCP (Offensive Security Certified Professional) - MANDATORY
GIAC GXPN (Exploit Researcher and Advanced Penetration Tester)
eLearnSecurity eCPTX
CREST CCT INF/APP

18.4 Expert Level

OSEP (Offensive Security Experienced Penetration Tester)
OSED (Offensive Security Exploit Developer)
OSWE (Offensive Security Web Expert)
OSCE³ (Offensive Security Certified Expert)
GIAC GREM (Reverse Engineering Malware)
SANS SEC660 GXPN

18.5 Specialized

GWAPT (Web Application Penetration Tester)
GMOB (Mobile Security)
GCIH (Incident Handler)
Cloud certifications (AWS Security, Azure Security)
CREST certifications

19. CONTINUOUS LEARNING

19.1 Practice Platforms

HackTheBox
TryHackMe
PentesterLab
Offensive Security Proving Grounds
VulnHub
Root-Me
OverTheWire
PicoCTF
CTFtime
PentesterAcademy

19.2 Resources

Books (Web Application Hacker’s Handbook, Metasploit, Real-World Bug Hunting)
Blogs (PortSwigger, PentestMonkey, PayloadsAllTheThings)
YouTube channels (IppSec, Nahamsec, STÖK, LiveOverflow)
Podcasts (Darknet Diaries, Security Weekly)
Twitter security community
Discord servers
Reddit (r/netsec, r/AskNetsec, r/HowToHack)

19.3 Conferences

DEF CON
Black Hat
BSides events
OWASP conferences
Nullcon
44Con
SecTor

19.4 Staying Current

CVE databases
Exploit databases
Security advisories
Vulnerability research papers
New tool releases
Attack technique evolution
Framework updates

20. CAREER PATH

20.1 Entry Positions

Junior Penetration Tester
Security Analyst (offensive focus)
Vulnerability Assessor
Bug Bounty Hunter

20.2 Mid-Level

Penetration Tester
Security Consultant
Application Security Tester
Red Team Operator

20.3 Senior Positions

Senior Penetration Tester
Lead Penetration Tester
Security Research Engineer
Red Team Lead
Exploit Developer

20.4 Expert/Leadership

Principal Security Consultant
Security Architect (offensive)
Head of Red Team
Security Research Director
Independent Consultant/Freelancer

20.5 Specializations

Web Application Specialist
Mobile Security Specialist
Cloud Security Specialist
IoT/ICS Security Specialist
Exploit Developer
Malware Analyst
Wireless Security Specialist

LỘ TRÌNH HỌC ĐỀ XUẤT

Tháng 1-3: Foundations (Linux, Windows, Networking, Programming basics) Tháng 4-6: Web Application Testing (OWASP Top 10, Burp Suite mastery) Tháng 7-9: Network Penetration Testing (Nmap, Metasploit, Post-exploitation) Tháng 10-12: Active Directory, Privilege Escalation, Lateral Movement Tháng 13-15: Wireless, Mobile, Cloud Penetration Testing Tháng 16-18: Exploit Development basics, Assembly, Reverse Engineering Tháng 19-21: Red Team Operations, C2 frameworks, Advanced Evasion Tháng 22-24: OSCP preparation, Advanced topics, Specialization Ongoing: Bug bounties, CTFs, Certifications, Continuous learning

TIPS ĐỂ THÀNH CÔNG

Practice Daily

Làm labs hàng ngày (HTB, THM)
Write-ups sau mỗi box
Document mọi kỹ thuật mới học

Build Portfolio

GitHub với tools và scripts
Blog write-ups
YouTube videos (optional)
CTF achievements
Bug bounty hall of fame

Mindset

Think like an attacker
Never stop at first finding
Always dig deeper
Automate repetitive tasks
Share knowledge với community

Networking

Join Discord servers
Twitter infosec community
Local meetups
Conference attendance
Mentor và được mentor

Stay Legal

Always get written authorization
Respect scope boundaries
Practice trên legal platforms only
Understand local laws
Professional ethics first

Exam Preparation

OSCP là gold standard
Làm nhiều boxes tương tự OSCP (TJNull’s list)
Try Harder mindset
Time management
Report writing practice

Real-World Experience

Internships
Junior positions
Bug bounties
Open source contributions
Personal projects

Chúc bạn thành công trên con đường trở thành Penetration Tester chuyên nghiệp!