Penetration Testing

The Social Engineering Toolkit (SET) is one of the most important tools in a red teamer’s arsenal — and also one of the most misunderstood. Built specifically for social engineering attacks, it’s not just a script kiddie toy. Used properly, SET simulates the exact attack chains that real threat actors use to compromise organizations. This guide covers everything: installation, attack modules, credential harvesting, spear phishing campaigns, website cloning, and the OPSEC considerations that separate a successful engagement from a burned infrastructure. ...

A red team report is the only thing that survives the engagement. The access you got, the shells you dropped, the domain admin you owned — none of it matters if the report doesn’t communicate it clearly to the people who need to act on it. Most red team reports fail in one of two ways: they’re written for other red teamers (and executives ignore them), or they’re dumbed down for executives (and the technical team can’t remediate). A good report speaks to both audiences at once. ...

HackTheBox’s CPTS has been quietly building a reputation as the most technically demanding — and best-priced — penetration testing certification in the market. In 2026, it’s no longer a quiet alternative to OSCP. It’s a direct competitor. Here’s the real breakdown. What Is HTB CPTS? The HTB Certified Penetration Testing Specialist (CPTS) is HackTheBox Academy’s flagship professional certification. It’s built on the Penetration Tester learning path — 28 modules covering everything from network enumeration to Active Directory attacks to enterprise-level reporting. ...

Two certifications. One practical, affordable, and designed for real-world pentesting. The other expensive, industry-standard, and still the most recognized name on a resume. If you’re choosing between PNPT and OSCP in 2026, you need the honest answer — not the Reddit echo chamber, not the sponsored review. Here’s what both certs actually are, who they’re for, and which one belongs in your roadmap first. What Is PNPT? The Practical Network Penetration Tester (PNPT) is a certification from TCM Security , built by Heath Adams (The Cyber Mentor). It’s entirely practical — no multiple choice, no CTF gimmicks. ...

Reading shapes how you think. Tools change every year — the mindset behind using them doesn’t. The best red teamers I’ve seen aren’t just tool runners. They understand why attacks work, and that understanding comes from deep reading, not just lab time. This is the list I’d hand someone serious about red teaming in 2026. Not everything published. Not what looks impressive on a shelf. What actually moves the needle. ...

This article is written from 14+ years of offensive security practice. Some links are affiliate links that help keep this site running — I only recommend tools and services I’d use myself. Kali Linux comes loaded with over 600 security tools. If you’re new to penetration testing, that’s not empowering — that’s paralyzing. Here’s the honest truth: working pentesters don’t use most of what’s installed. They use a tight core of tools extremely well, and add specialized ones when a specific engagement calls for it. The practitioners who get hired aren’t the ones who can name every tool — they’re the ones who can actually use ten of them. ...

Metasploit is the exploitation framework everyone knows and half the people actually understand. This cheat sheet covers everything from first-time msfconsole navigation to post-exploitation pivoting — organized by how you actually use it on an engagement, not alphabetically by command. Updated for 2026. Bookmark it. Starting Metasploit # Start msfconsole msfconsole # Start with quiet mode (skip banner) msfconsole -q # Start with a resource script msfconsole -r setup.rc # Start with a specific database msfconsole -y /path/to/database.yml # Update Metasploit msfupdate Database Setup Metasploit’s database stores hosts, services, credentials, and loot. Worth setting up. ...

There’s a specific moment in a red teamer’s career when OSCP stops feeling like the ceiling and starts feeling like the floor. You’ve got your shells. You can pivot. You understand the methodology. But real engagements don’t look like OSCP machines. They look like hardened Active Directory environments with EDR, segmented networks, and defenders who are actually watching. That’s exactly the gap the CRTO fills. The Certified Red Team Operator from Zero-Point Security is the most practical red team certification I’ve seen in the mid-level space. It’s taught by Daniel Duggan (known in the community as RastaMouse), covers Cobalt Strike end-to-end, and teaches you how to operate inside a defended environment — not just pop boxes. ...

You don’t memorize Nmap. Nobody does. You keep a cheat sheet, you use it constantly, and eventually the important stuff sticks. This is that cheat sheet — updated for 2026, organized by what you actually do on engagements, not alphabetically by flag name. Covers everything from basic discovery to NSE scripting to firewall evasion. If it’s not here, you probably don’t need it in the field. Target Specification These go at the end of any Nmap command. Mix and match as needed. ...

Every week someone asks me what certification to start with. Not what to get after two years of HTB and home lab practice. Not what comes after OSCP. The first one — the one for people who know they want to break into offensive security but don’t know where to start. My answer in 2026 is still the eJPT. Not because it’s prestigious. Not because it’ll make a hiring manager’s eyes light up. Because it does something more important than that: it teaches you what a penetration test actually feels like, before you’re in over your head. ...