Training

Cybersecurity & ethical penetration testing

Learn penetration testing fundamentals in a lab: Nmap, HTTP GET/POST, Burp Suite, IDOR, SQLmap and Metasploit, followed by remediation and reporting.

Nexorix IT training

Cybersecurity & ethical penetration testing

A practical introductory course in network and web application security. Testing takes place only on isolated training machines and intentionally vulnerable applications within an explicitly authorized scope. Basic computer skills are required; Linux, networking and HTTP concepts are introduced before the tools.

Format

200 DH / session
16 sessions total
2 sessions per week
2 hours of training
In person or remote
Nexorix training certificate

Trainer profile

Training led by our senior IT experts with 10+ years of experience on demanding projects for major companies. The approach is practical, field-tested and focused on skills you can reuse immediately.

Path objective

Move step by step with clear explanations, guided exercises and a concrete project to validate what you learn.

Request information

What you will learn

  • Read HTTP requests and responses: GET, POST, parameters, headers, cookies and status codes.
  • Map lab services with Nmap and interpret results without equating an open port with a vulnerability.
  • Use Burp Suite Community, Proxy and Repeater to observe and compare web exchanges.
  • Understand and verify IDOR, SQL injection and XSS using fictional data, then identify suitable protections.
  • Explore SQLmap and Metasploit under supervision, validate findings and explain the limits of automation.
  • Write a clear report covering scope, minimal evidence, impact, remediation and retest results.

Session-by-session program

1

Testing scope and laboratory

Define authorization, scope and stop conditions. Prepare isolated machines, fictional accounts and recovery snapshots.

2

Linux and terminal essentials

Navigate files, read a command, understand users and permissions and organize lab notes.

3

Networks, ports and services

Understand IP, DNS, TCP/UDP and ports. Observe network traffic and distinguish an exposed service from a vulnerability.

4

HTTP: GET, POST and HTTPS

Read URLs, parameters, headers, bodies and status codes. Compare GET and POST and understand that POST alone does not encrypt data.

5

Nmap: lab discovery

Discover hosts and services within the authorized scope, limit scans and interpret an inventory with appropriate precautions.

6

Burp Suite: Proxy and interception

Configure a dedicated test browser with Burp Community. Observe lab requests, restrict scope and manage the test certificate.

7

Burp Repeater: testing a hypothesis

Replay a lab request, change one parameter at a time and compare responses. Keep minimal, reproducible evidence.

8

Authentication, sessions and cookies

Distinguish identity from authorization. Observe login, logout and expiry; understand cookie attributes and the purpose of CSRF protection.

9

IDOR and access control

Compare two fictional VestiMode accounts. Verify server-side authorization for objects and actions and understand the related API term BOLA.

10

SQL injection before automation

Explore SQL queries and the separation of code and data on an intentionally vulnerable training application. Explain parameterized queries and least privilege.

11

SQLmap: supervised validation

Explore the tool on a designated test endpoint, limit checks and interpret results. No real-data extraction or out-of-scope testing.

12

XSS and safe output

Distinguish reflected and stored XSS in the lab. Observe a harmless proof and understand output encoding and browser protections.

13

Files, uploads and paths

Study file uploads and a path-control flaw using fictional files. Propose content validation, access controls and suitable storage.

14

Metasploit: isolated lab demonstration

Understand modules, options, compatibility and vulnerability verification on an intentionally vulnerable machine. Restore the lab after the exercise.

15

Remediation, logs and reporting

Prioritize risks, propose a fix and observe useful logs. Document scope, findings, impact and retesting without exposing secrets.

16

Final project: assessment and presentation

Apply the method to VestiMode and a training machine, present findings and verify a fix. Review the limits of the assessment.

Practical project

Perform a small assessment of the fictional VestiMode application and a lab machine: limited discovery, manual web checks, result analysis, prioritized fixes and a final report. All data is fictional; testing public services or third-party systems is not included. This introductory course is not a professional penetration testing certification.