Source: Juni_2026_Exams/Penetration_Testing/README.md

Penetration Testing - June 2026

Purpose

This folder turns the uploaded lectures and CTF material into a practical, open-notes exam guide. It covers Linux fundamentals, passive and active reconnaissance, Nmap, Metasploit, shells, file transfer, exploitation, and pivoting.

Use every intrusive command only against the university lab, the supplied CTF, or another system for which you have explicit authorization.

Start Here

Source Assessment

Source group	Use
`PENTEST_2026_01.pdf` through `06.pdf`	Primary lecture and exercise sources
`CTF_ExamCard_2026.pdf`	Exam-format and workflow source; historical target details are not guarantees
`PenTest_CTF_CheatSheet.pdf`	Concise supporting reference
`Penetration Testing Exercises.pdf`	Supporting exercise compilation
`pentest exams.pdf` and `pentest_exams - Ilias.pdf`	Student-authored supplements; verify before relying on them
Metasploit cheat sheets	Command reference; two uploaded files are identical

See reference_pdfs/README.md for the complete inventory and reliability notes.

Highest-Priority Skills

Enumerate a target methodically with Nmap and service-specific clients.
Inspect web source, headers, robots.txt, files, metadata, and encodings.
Use Netcat, FTP, SSH, MySQL, and HTTP without relying on a GUI.
Search, configure, run, and validate Metasploit modules.
Establish a shell, identify its limitations, and enumerate the local network.
Record each flag or finding immediately with the command and evidence.

Best Exam Files

Need	Open this
Fast exam workflow	`notes/03-exam-day-open-notes-reference.md`
Detailed "what next and why" guide	`notes/04-detailed-ctf-exam-playbook.md`
Copy-paste commands	`checklists/pentest-command-cheatsheet.md`
Automated lab reconnaissance	`scripts/ctf-recon.sh`
Fast recon plus Searchsploit triage	`scripts/ctf-fast-recon-vuln.sh`
CVE and exploit lead triage	`scripts/ctf-vuln-triage.sh`
Lecture practice	`notes/02-lecture-exercises-step-by-step.md`
Source-backed CTF strategy	`solutions/ctf-exam-2026-verified-guide.md`
Live lab evidence and target handoff	`solutions/live-lab-evidence-handoff-and-target-playbooks.md`
Successful MS17-010 exploitation example	`solutions/ms17-010-windows-xp-successful-exploitation.md`
Successful Metasploitable 2 exploitation paths	`solutions/metasploitable2-multiple-exploitation-paths.md`
Successful Ubuntu web SQLi and webshell example	`solutions/ubuntu-web-sqli-webshell-exploitation.md`

Study Plans

Two-Hour Review

Time	Activity
20 min	Read focus points and exam-day reference
30 min	Nmap scan interpretation and service triage
25 min	Web enumeration and Base64/hex/metadata practice
25 min	Metasploit module workflow and session handling
20 min	Shell, subnet discovery, and pivot workflow

Seven-Day Practical Plan

Day	Focus
1	Linux, pipes, text processing, networking commands
2	Passive reconnaissance and DNS
3	Nmap discovery, ports, versions, NSE, banner grabbing
4	Searchsploit and Metasploit fundamentals
5	Shells, Meterpreter, and file transfer
6	Web, database, brute-force, and pivot CTF drills
7	Timed CTF run using only the open-notes reference

Current Status

All uploaded PDFs inventoried and text-extracted.
Lecture exercises converted into a step-by-step workbook.
Detailed CTF playbook and command cheat sheet added for exam use.
Fast CTF reconnaissance script added for quick /24 scanning and Searchsploit triage.
Live lab evidence handoff added with successful and unsuccessful attempts.
Successful Windows XP MS17-010 exploitation walkthrough documented from lab evidence.
Successful Metasploitable 2 root bindshell and UnrealIRCd exploitation documented.
Successful Ubuntu web SQLi, backup leak, and webshell exploitation documented.
Old command syntax corrected where modern equivalents are required.
Exam workflow separated from unverified historical target details.
Live university-lab results and screenshots remain to be completed.

Last updated: June 15, 2026