Week 1 — Introduction and working environment

Learning objectives

• Understand the role of the penetration tester and the difference between red team, pentest and audit.
• Set your ethical posture: test nothing without written authorization.
• Have an isolated attacker workstation, ready for the following weeks.

Penetration testing in one page

A pentest is an authorized and framed attack simulation. Its value does not come from the number of vulnerabilities found, but from the quality of the evidence and the recommendations handed to the client. A report without reproduction carries no weight in a remediation meeting.

Three notions never to confuse:

Notion	What it is	What it is not
Vulnerability	A weakness identified in a system	A successful exploitation
Exploitation	Concrete use of the weakness	Proof that it is critical
Impact	Real business consequence	The CVSS score taken alone

Lab — Deploy your Kali VM

1. Install a hypervisor: VirtualBox or VMware Workstation Player.
2. Download the official Kali Linux image from kali.org. Verify the SHA-256 checksum before any installation: this is a habit, not a formality.
3. Create the machine: 4 GB of RAM, 2 vCPUs, 40 GB of disk, NAT networking (never bridged on a public network without thinking it through).
4. Once installed, update it and take a clean baseline snapshot so you can start over between exercises:

sudo apt update && sudo apt full-upgrade -y
sudo apt autoremove --purge -y

Exploring Kali

Open the Applications menu, then browse the categories: Information Gathering, Vulnerability Analysis, Web Application Analysis, Exploitation Tools. You will only use about ten tools per category: knowing them thoroughly beats skimming them all.

Checklist

• Clean baseline snapshot taken after the first update.
• Networking verified: only the attacker workstation is NATed to the host.
• File ~/notes/course.md created to track your work from week 1.