Home / Certifications / Penetration Tester

Hacky Certified Penetration Tester

www.hackysecurity.ae/start

HCPT · Level 2

Nmap discovery and service enumeration

Web and network vulnerability validation

Metasploit in isolated targets

Credential hygiene and authentication testing

Privilege escalation fundamentals

Active Directory discovery and identity attack paths

Web and network vulnerability validation

Self-paced · video, notes and labs

Introduction

Test company networks and write reports clients can act on. Three levels, each self-paced, each with its own exam and certificate.

Buy now

Author: Gaurav Sharma
Level: Level 2 · Practitioner
Study time: 40 hours
Certification: Hacky Certified Penetration Tester

#1Hands-on labsPractise every technique in hosted labs. No expiry or extensions.

#2Free examinationsTake as many attempts as you need. There is no charge for failing.

#3Lifetime accessCourse updates are free, so your knowledge stays current.

Curriculum

6 modules · 20 hours of guided learning · self-paced, with hands-on labs

Job-oriented, scenario-led progression in hacky certified penetration tester. Exercises are conducted only in authorized training environments. The level builds on previous levels while adding distinct techniques, deeper evidence requirements and more complex capstones.

Prerequisites: Basic IT literacy and willingness to use Linux/Windows command lines.

Tool stack: Kali Linux, Nmap, Wireshark, Metasploit, Burp Suite, BloodHound, Impacket; optional Cobalt Strike

5h guided instruction + 11h guided/independent practical labs + 4h reading, review and assessment. These are total learning hours, not 20 hours of live lectures.

Module 01Engagement scoping, authorization and evidence handling4 h

Coverage. Identify core concepts, demonstrate the workflow, and record reliable evidence.

Practical. Complete a guided lab with baseline and expected evidence.

Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.

Module 02Networking, Linux and Windows attack-surface fundamentals4 h

Coverage. Identify core concepts, demonstrate the workflow, and record reliable evidence.

Practical. Complete a guided lab with baseline and expected evidence.

Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.

Module 03Reconnaissance and asset inventory3 h

Coverage. Identify core concepts, demonstrate the workflow, and record reliable evidence.

Practical. Complete a guided lab with baseline and expected evidence.

Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.

Module 04Nmap discovery and service enumeration3 h

Coverage. Identify core concepts, demonstrate the workflow, and record reliable evidence.

Practical. Complete a guided lab with baseline and expected evidence.

Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.

Module 05Web and network vulnerability validation3 h

Coverage. Identify core concepts, demonstrate the workflow, and record reliable evidence.

Practical. Complete a guided lab with baseline and expected evidence.

Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.

Module 06Metasploit in isolated targets3 h

Coverage. Identify core concepts, demonstrate the workflow, and record reliable evidence.

Practical. Complete a guided lab with baseline and expected evidence.

Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.

Level capstone and assessment

Guided scenario: demonstrate correct methodology, collect evidence and submit a short structured report.

20% knowledge checks, 60% hands-on practical, 20% evidence-based reporting Recommended pass: 70% overall with mandatory completion of safety and evidence checkpoints.

Final exam

A 2-hour online exam with a 70% pass mark. Recommended pass: 70% overall with mandatory completion of safety and evidence checkpoints. Attempts are free until you pass. The exam opens 7 days after purchase.

Curriculum

9 modules · 40 hours of guided learning · self-paced, with hands-on labs

Prerequisites: Completion of Level 1 or demonstrably equivalent practical skills.

Tool stack: Kali Linux, Nmap, Wireshark, Metasploit, Burp Suite, BloodHound, Impacket; optional Cobalt Strike

10h guided instruction + 22h guided/independent practical labs + 8h reading, review and assessment. These are total learning hours, not 40 hours of live lectures.

Module 01Nmap discovery and service enumeration5 h

Coverage. Investigate a realistic scenario, compare alternative approaches, tune decisions and document remediation.

Practical. Complete a case-based lab using multiple evidence sources and a verification checklist.

Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.

Module 02Web and network vulnerability validation5 h

Coverage. Investigate a realistic scenario, compare alternative approaches, tune decisions and document remediation.

Practical. Complete a case-based lab using multiple evidence sources and a verification checklist.

Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.

Module 03Metasploit in isolated targets5 h

Coverage. Investigate a realistic scenario, compare alternative approaches, tune decisions and document remediation.

Practical. Complete a case-based lab using multiple evidence sources and a verification checklist.

Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.

Module 04Credential hygiene and authentication testing5 h

Coverage. Investigate a realistic scenario, compare alternative approaches, tune decisions and document remediation.

Practical. Complete a case-based lab using multiple evidence sources and a verification checklist.

Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.

Module 05Privilege escalation fundamentals4 h

Coverage. Investigate a realistic scenario, compare alternative approaches, tune decisions and document remediation.

Practical. Complete a case-based lab using multiple evidence sources and a verification checklist.

Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.

Module 06Active Directory discovery and identity attack paths4 h

Coverage. Investigate a realistic scenario, compare alternative approaches, tune decisions and document remediation.

Practical. Complete a case-based lab using multiple evidence sources and a verification checklist.

Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.

Module 07Segmentation and lateral movement validation4 h

Coverage. Investigate a realistic scenario, compare alternative approaches, tune decisions and document remediation.

Practical. Complete a case-based lab using multiple evidence sources and a verification checklist.

Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.

Module 08Post-exploitation impact assessment and cleanup4 h

Coverage. Investigate a realistic scenario, compare alternative approaches, tune decisions and document remediation.

Practical. Complete a case-based lab using multiple evidence sources and a verification checklist.

Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.

Module 09Professional pentest reporting and remediation4 h

Coverage. Investigate a realistic scenario, compare alternative approaches, tune decisions and document remediation.

Practical. Complete a case-based lab using multiple evidence sources and a verification checklist.

Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.

Level capstone and assessment

Multi-system case: independently correlate artifacts, prioritize findings and propose tested remediation.

20% knowledge checks, 60% hands-on practical, 20% evidence-based reporting Recommended pass: 70% overall with mandatory completion of safety and evidence checkpoints.

Final exam

A 24-hour practical exam in a hosted lab, then 24 hours to submit your report. Recommended pass: 70% overall with mandatory completion of safety and evidence checkpoints. Attempts are free until you pass. The exam opens 7 days after purchase.

Curriculum

9 modules · 60 hours of guided learning · self-paced, with hands-on labs

Prerequisites: Completion of Level 2 or equivalent professional experience; comfortable with independent investigations.

Tool stack: Kali Linux, Nmap, Wireshark, Metasploit, Burp Suite, BloodHound, Impacket; optional Cobalt Strike

15h guided instruction + 33h guided/independent practical labs + 12h reading, review and assessment. These are total learning hours, not 60 hours of live lectures.

Module 01Privilege escalation fundamentals7 h

Coverage. Lead an integrated assessment, validate assumptions, automate repeatable checks and produce defensible findings.

Practical. Complete a scenario-driven challenge, defend findings, and validate controls or mitigations.

Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.

Module 02Active Directory discovery and identity attack paths7 h

Coverage. Lead an integrated assessment, validate assumptions, automate repeatable checks and produce defensible findings.

Practical. Complete a scenario-driven challenge, defend findings, and validate controls or mitigations.

Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.

Module 03Segmentation and lateral movement validation7 h

Coverage. Lead an integrated assessment, validate assumptions, automate repeatable checks and produce defensible findings.

Practical. Complete a scenario-driven challenge, defend findings, and validate controls or mitigations.

Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.

Module 04Post-exploitation impact assessment and cleanup7 h

Coverage. Lead an integrated assessment, validate assumptions, automate repeatable checks and produce defensible findings.

Practical. Complete a scenario-driven challenge, defend findings, and validate controls or mitigations.

Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.

Module 05Professional pentest reporting and remediation7 h

Coverage. Lead an integrated assessment, validate assumptions, automate repeatable checks and produce defensible findings.

Practical. Complete a scenario-driven challenge, defend findings, and validate controls or mitigations.

Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.

Module 06Advanced enterprise attack-path chaining7 h

Coverage. Lead an integrated assessment, validate assumptions, automate repeatable checks and produce defensible findings.

Practical. Complete a scenario-driven challenge, defend findings, and validate controls or mitigations.

Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.

Module 07Adversary emulation with controlled C26 h

Coverage. Lead an integrated assessment, validate assumptions, automate repeatable checks and produce defensible findings.

Practical. Complete a scenario-driven challenge, defend findings, and validate controls or mitigations.

Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.

Module 08Detection-aware purple-team assessment6 h

Coverage. Lead an integrated assessment, validate assumptions, automate repeatable checks and produce defensible findings.

Practical. Complete a scenario-driven challenge, defend findings, and validate controls or mitigations.

Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.

Module 09Full-scope penetration test capstone6 h

Coverage. Lead an integrated assessment, validate assumptions, automate repeatable checks and produce defensible findings.

Practical. Complete a scenario-driven challenge, defend findings, and validate controls or mitigations.

Evidence. annotated observations, reproducible steps, risk/impact notes and a concise technical recommendation.

Level capstone and assessment

Professional engagement: plan, execute and defend a complex scenario with peer review and executive/technical reporting. HACKY SECURITY | CERTIFICATION CURRICULUM | 2026 3

20% knowledge checks, 60% hands-on practical, 20% evidence-based reporting Recommended pass: 70% overall with mandatory completion of safety and evidence checkpoints.

Final exam

A 48-hour scenario exam, assessed on your written report. Recommended pass: 70% overall with mandatory completion of safety and evidence checkpoints. Attempts are free until you pass. The exam opens 7 days after purchase.

What you receive

When you finish the courseCertificate of Course CompletionIssued once you complete every lesson and lab.

When you pass the examHacky Certified Penetration TesterShows your level and an ID anyone can verify. It does not expire.

Course author

Gaurav Sharma

Founder & CISO, Hacky Security

Offensive and Defensive Security Expert

Gaurav founded Hacky Security and leads its SOC, curriculum and AI security work. He has trained more than 40,000 professionals and has taught AI security at IIT Madras.

OSCPOSCECISSPOSAI

Frequently asked questions

Do I need to buy any software?

No. All the tools you need are already set up in the course labs.

When does my course open?

48 hours after payment. We email you when it is ready.

Can I start at Level 2?

Yes. If you already have the experience, buy Level 2 or Level 3 directly.

Hacky Certified Penetration Tester

Introduction

Curriculum

Final exam

Curriculum

Final exam

Curriculum

Final exam

What you receive

Course author

Gaurav Sharma

Frequently asked questions

More from the offensive track

Hacky Certified Web Application Pentester

Hacky Certified Mobile Pentester

Hacky Certified Social Engineering Analyst