Source: Juni_2026_Exams/Penetration_Testing/HANDOUT.md

Handout - Penetration Testing Exam Preparation

Scope

This is the collaboration guide for the June 2026 Penetration Testing exam material. All practical work must remain inside the supplied university lab/CTF or another explicitly authorized environment.

Repository Map

Recommended Reading Order

1. notes/00-focus-points.md
2. notes/03-exam-day-open-notes-reference.md
3. notes/04-detailed-ctf-exam-playbook.md
4. checklists/pentest-command-cheatsheet.md
5. notes/01-tooling-overview.md
6. notes/02-lecture-exercises-step-by-step.md
7. solutions/ctf-exam-2026-verified-guide.md
8. checklists/pentest-ctf-exam-checklist.md

Live Lab Handoff - June 2026

Before continuing the live CTF/lab work, read:

solutions/live-lab-evidence-handoff-and-target-playbooks.md

That file records the real terminal evidence collected so far, including:

• 192.168.2.163: Windows XP MS17-010 exploitation to SYSTEM.
• 192.168.2.197: Metasploitable 2 root bind shell, UnrealIRCd, Samba,

distccd, NFS discovery, and failed vsftpd attempt.

• 192.168.2.198: backup leak, SQL injection login bypass, uploaded webshell

RCE as www-data, writable web directory proof, and failed/unfinished MySQL and browser-login attempts.

• 192.168.2.102, 192.168.2.195, and 192.168.2.1: current triage and

next-step playbooks.

When the recon script report is ready, paste/summarize it into the handoff file under Script Report Snapshot - <UTC date/time>.

How Other Workers Should Contribute

For every completed lab exercise:

1. Cite the PDF and page.
2. Record the date, lab target, and authorization context.
3. Record the exact command and tool version.
4. Separate the observed output from your interpretation.
5. Add a sanitized screenshot or transcript when useful.
6. Replace credentials, flags, tokens, and public IPs with placeholders.
7. Update the relevant exercise in the workbook.

Do not commit:

• real credentials, VPN profiles, flags, or student identifiers
• private keys, tokens, or cookies
• packet captures containing unrelated personal data
• VM disks, large wordlists, generated payloads, or malware

Source Reliability Rules

• Lecture decks are the primary source for course scope and exercises.
• The 2026 CTF card is useful for format and workflow.
• Ports, passwords, paths, subnets, and flag locations from prior material are

historical examples, not guaranteed 2026 answers.

• Student-authored PDFs can contain mistakes. Confirm commands with --help,

man, or the tool itself.

• Never report a guessed flag or credential as an observed result.

Exercise Status

Definition of Done

An exercise is complete only when another student can reproduce it from the notes, understand why each command was used, and distinguish evidence from assumption.

Last updated: June 16, 2026