Penetration Testing — Hands-On Workshop with Kali Linux
A five-day hands-on workshop taking you from zero to running an independent penetration test with Kali Linux — the full cycle: reconnaissance, scanning, vulnerability exploitation, privilege escalation, and reporting, in a lab with real practice targets.
From OWASP theory to a hands-on attack on a real target
Many security trainings teach you to spot vulnerabilities on slides. From day one, this workshop puts participants in front of a prepared lab environment where they must independently run reconnaissance, find a vulnerability, exploit it, and document the attack path — exactly what a real penetration tester’s work looks like.
A complete Kali Linux toolset, not just Nmap
Instead of narrowly focusing on one tool, the programme walks through the full chain: Nmap for reconnaissance, Metasploit and Burp Suite for exploitation, John the Ripper and Hashcat for password cracking, BloodHound for mapping Active Directory. Every tool is introduced in the context of a specific test phase, not as an isolated demo.
A practical exam instead of a theory quiz
The workshop closes with an independent penetration test of a prepared environment — no hints, full ownership of every phase and the final report. It is the closest experience to a real pentester’s job you can get in a training format, and a solid starting point for further independent practice ahead of OSCP.
Benefits
- Independently run a complete network infrastructure penetration test from reconnaissance to final report
- Master the key Kali Linux tools: Nmap, Metasploit, Burp Suite, John the Ripper, BloodHound
- Practice vulnerability exploitation and privilege escalation techniques in a lab environment
- Write a professional penetration test report that both management and the technical team can understand
Who is this training for?
Prerequisites
- Basic knowledge of computer networks (TCP/IP, protocols) and Linux systems
- Ability to work at the command line (no prior penetration testing experience required)
Training program
Penetration testing methodology and setting up Kali Linux
- Phases of a penetration test: planning, reconnaissance, scanning, exploitation, post-exploitation, reporting
- Setting up your own Kali Linux environment and a test lab (vulnerable VMs)
- Legal and ethical aspects of penetration testing — scope, consent, rules of engagement
- How penetration testing differs from red teaming and bug bounty work
Reconnaissance and scanning
- OSINT and passive reconnaissance of a target's infrastructure
- Port and service scanning with Nmap — advanced techniques and evading detection
- Enumerating network services (SMB, LDAP, DNS, web)
- Automated vulnerability scanning (Nessus/OpenVAS) and validating results
Exploitation
- The Metasploit framework — exploit modules, payloads, post-exploitation
- Testing web application security with Burp Suite (OWASP Top 10 in practice)
- Attacking authentication: password cracking (John the Ripper, Hashcat), Active Directory attacks
- Exploiting vulnerabilities in network services on prepared lab targets
Privilege escalation and lateral movement (post-exploitation)
- Privilege escalation techniques on Linux and Windows systems
- Mapping Active Directory relationships with BloodHound and planning attack paths
- Lateral movement and maintaining access within the test environment
- Gathering evidence and documenting the attack path for the final report
Reporting and the final practical exam
- Structure of a professional penetration test report: executive summary, technical details, recommendations
- Vulnerability classification (CVSS) and prioritizing remediation recommendations
- A practical exam — an independent penetration test of a prepared lab environment
- Your next steps: preparing for OSCP, CEH, and other offensive certifications
Delivery Methods
Online
- Convenience of participating from anywhere
- Interactive live sessions with trainer
- Materials available for 30 days
- No travel costs
On-site
- Direct contact with trainer and group
- Intensive hands-on workshops
- Networking with other participants
- Full focus on learning
Frequently asked questions
How does this workshop differ from the other penetration testing trainings in our catalog (Nmap, Python + Kali Linux, 5G networks, intermediate level)?
Those trainings focus on narrow tools or environments (Nmap alone, a specific programming language, telecom networks) or assume prior experience (intermediate level). This workshop is a complete path from zero to an independent penetration test — the full methodology cycle, every key Kali Linux tool, and a final practical exam, designed as the foundation before specializing.
Am I ready for the OSCP exam after this training?
The training builds a solid methodological and practical foundation aligned with the OSCP approach (hands-on exploitation, documenting the attack path, reporting), but the OSCP exam itself requires additional intensive independent practice in OffSec's dedicated lab (typically several months). The workshop shows exactly what that practice looks like and how to prepare for it systematically.
Is testing someone else's infrastructure without consent legal?
No — penetration testing without the explicit written consent of the infrastructure owner is a criminal offense in Poland (unauthorized access to an information system, Article 267 of the Penal Code) and in most jurisdictions. In the workshop we work exclusively in a prepared lab environment and cover the legal aspects: test scope, rules of engagement, and the consent documentation required before starting a real test.
What programming skills are required?
The workshop requires no prior programming experience — tools like Metasploit and Burp Suite have operational interfaces that let you test effectively without writing code. Basic familiarity with bash scripting and the Linux command line is helpful, though, and is introduced at the start of the workshop.
What do I get after completing the workshop beyond knowledge?
Participants receive access to the lab environment used during the training (for independent practice afterward), a professional penetration test report template ready for use in real engagements, and a personalized development path toward the offensive certification of their choice.
Request a quote
Funding Options
Check funding options for your company
Development Services Database
An instrument for micro, small and medium-sized companies — check whether it applies to your organisation
Check availabilityNational Training Fund
An instrument for employers — we help you check whether it can be applied
Learn moreTrusted by
We train teams at Poland's largest companies
Interested in this training?
Contact us - we'll prepare an offer tailored to your organization's needs.