The scope document says one web application and the /24 behind it. Nothing else. You are six hours in when a forgotten staging subdomain answers on port 8080 — an admin panel that was supposed to be decommissioned two years ago, still running, still trusting an internal token nobody has rotated since.
You do not touch it. Not yet. You check the scope again, confirm the host is actually in range, capture the evidence, log the exact timestamp, and keep moving.
That restraint — knowing what you are authorized to touch, and proving what you found without breaking it — is what separates a penetration tester from someone who just runs tools.
That is a Wednesday afternoon on an engagement.
Penetration testing is one of the few roles in security where the job is to be adversarial on purpose, under contract, with a report at the end. It pays well, it stays interesting, and it is harder to break into than most people expect — because employers are not hiring tool operators. They are hiring people who can find a problem, prove it, and explain it to someone who has to fix it.
This is the complete roadmap. The order that actually works, the certs that actually matter, and the parts most people skip.
What Penetration Testers Actually Do
A penetration test is an authorized, scoped, time-boxed simulation of a real attack. Every word in that sentence carries weight:
- Authorized. There is a signed agreement naming what you may touch. Without it, the same actions are a crime. This is not a formality — it is the whole legal foundation of the profession.
- Scoped. Specific hosts, applications, and ranges. Finding something interesting outside scope means documenting it and asking — not pursuing it.
- Time-boxed. Real engagements run days or weeks, not indefinitely. You are always trading depth against coverage.
- Simulation. The goal is evidence, not damage. You prove a vulnerability is exploitable; you do not exfiltrate the customer database to make a point.
And the deliverable is not the shell. The deliverable is the report. A finding nobody can reproduce, rate, or remediate is worth nothing to the client. Newer testers spend ninety percent of their energy on getting access and ten percent on writing it up. Experienced testers know the split runs closer to even — and that the writing is what gets them hired again.
The work splits into specializations, and most testers end up strongest in one or two:
| Network & Infrastructure | Internal and external ranges, services, misconfigurations, network-level trust relationships |
| Web Application (WAPT) | Authentication, authorization, injection, business-logic flaws — the largest slice of commercial demand |
| Cloud | Identity and permission sprawl, storage exposure, and the misconfigurations that come with cloud-native architecture |
| Wireless | Enterprise wireless authentication, segmentation, and rogue infrastructure |
| Social Engineering | Phishing and pretext campaigns run under strict rules of engagement |
| Red Team | Longer, stealth-oriented, objective-driven operations that test detection and response — not just whether a flaw exists |
The Offensive Security Ladder
Unlike the SOC, which has a clean tier structure, offensive security titles vary a lot between firms. The progression underneath them is consistent:
| Junior / Associate Pentester | You work inside someone else’s scope. You run the methodology, capture evidence, and draft findings that a senior reviews and rewrites. |
| Penetration Tester | You own an engagement end to end — kickoff, testing, report, and the readout call where the client asks why it matters. |
| Senior Pentester | You handle the messy environments, build the tooling the team reuses, and your findings survive client pushback because the evidence is airtight. |
| Lead / Principal | You scope the work, set methodology, manage client relationships, and are accountable for quality across engagements. |
| Red Team Operator | Objective-driven, detection-aware operations. This is a different discipline layered on top of testing skill, not simply the next rung. |
Compensation varies more in this field than in almost any other security role — metro, clearance requirements, consulting versus in-house, and specialization all move the number substantially. Treat any single published figure with suspicion and check current listings in your own market.
The Pentester Roadmap — Phase by Phase
The most common way people stall is starting at Phase 2. Exploitation is the fun part, so that is where they begin — and then they cannot explain why an attack worked, cannot adapt when the environment differs from the walkthrough, and cannot write a finding a network engineer will respect. Do these in order.
Phase 1: Build the Foundation (0–3 Months)
You cannot attack what you do not understand. This phase is unglamorous and non-negotiable.
- Networking. Routing, switching, DNS, TCP/IP, NAT, and what actually happens between a client and a server. Every network finding you ever write depends on this.
- Linux. Not just commands — the filesystem, permissions, processes, services, and how privilege is structured. Your tooling lives here.
- Windows and Active Directory basics. Most enterprise internal testing is an AD problem. Learn how authentication and trust work before you learn how they break.
- Scripting. Enough Python and Bash to automate the boring parts and read someone else’s tool well enough to know what it is doing.
Build a home lab now, not later. Break your own machines. It is the cheapest environment you will ever have where mistakes cost nothing.
Cover6 resources for this phase: Intro to Cyber (free) and Home Lab Setup (free). If you are starting from zero, read the Breaking Into Cybersecurity roadmap first.
Phase 2: Learn to Think Like an Attacker (3–6 Months)
Now you learn methodology — the repeatable process that turns a target into a set of findings. Tools change constantly; the method does not.
- Reconnaissance and enumeration. Passive and active. This is where engagements are won. The best testers are the most thorough enumerators, not the fastest exploiters.
- Vulnerability identification. Distinguishing a real, exploitable issue from scanner noise. Learning to validate is what makes you useful.
- Web application fundamentals. The OWASP Top 10 as a starting point, then the business-logic flaws no scanner will ever catch.
- Structured frameworks. MITRE ATT&CK for adversary behavior, PTES and the OWASP Testing Guide for engagement structure. These give your work a shape a client can follow.
Cover6 resources for this phase: Cover6: First Shell — a free guided lab that walks you from recon to first access on a live target, in a scoped environment where you are meant to break things.
Phase 3: Get Hands-On (6–9 Months)
Reps. There is no substitute and no shortcut.
- Work targets end to end. Not walkthroughs — targets you have to figure out. The frustration is the learning.
- Write a report for every single one. This is the step almost everyone skips, and it is the step that gets you hired. Finding, severity, evidence, reproduction steps, business impact, remediation. Every time.
- Learn Active Directory attack paths. Enterprise internal testing lives here.
- Get comfortable being stuck. Real engagements involve long stretches where nothing works. Building tolerance for that is a genuine skill.
Cover6 resources for this phase: Pentester Prep Labs — extended hands-on lab access built for exactly this stretch, where you need volume and variety rather than another tutorial.
Phase 4: Land the Role (9–12 Months)
- Certify. CompTIA PenTest+ is the most efficient credential for clearing HR filters and proving methodology. It maps closely to how commercial engagements actually run.
- Build a portfolio. Two or three sanitized reports from lab work demonstrate more than any certificate. Show your writing.
- Apply wider than feels comfortable. Junior offensive roles are competitive. Consultancies hire more juniors than in-house teams do — and they train you faster.
- Interview honestly. “I have not seen that, here is how I would approach it” beats bluffing. Every experienced tester on that panel has been stuck for days.
The Pentester Toolkit
Learn the category before the tool. Tools get replaced; the reason you reach for them does not.
| Recon & OSINT | Mapping the attack surface before you touch it — often the highest-value hours of an engagement |
| Network Scanning | Turning an IP range into a service inventory you can reason about |
| Web Proxy | Intercepting and manipulating requests — the core of all web application testing |
| Exploitation Frameworks | Validating that a vulnerability is genuinely exploitable, not theoretical |
| Credential Attacks | Testing password and authentication weakness under agreed rules of engagement |
| Active Directory Tooling | Mapping trust relationships and privilege paths across an enterprise domain |
| Reporting | The actual deliverable — findings, evidence, severity, and remediation the client can act on |
Pentest or SOC? How to Choose
These two tracks pull on different instincts, and picking the wrong one costs months.
Defense suits you if you like pattern recognition, sustained vigilance, and being the person who catches what everyone else missed. Offense suits you if you like open-ended problems, tolerate long stretches of failure, and enjoy explaining uncomfortable findings to people who did not want to hear them.
Neither is more advanced than the other, and the strongest practitioners eventually understand both. If you are unsure, read the SOC Analyst Roadmap and notice which one you actually want to start tomorrow. Or take the short assessment on Find Your Path in Cybersecurity.
Cover6 Practice Exams for Your Pentest Path
Every cert on this roadmap has a matching Cover6 practice exam — full question sets with detailed explanations, written to the real cut scores. You do not need any of them to start. They are here when you get to that part of the path.
Core credential
CompTIA PenTest+ (PT0-003)
The central offensive credential. Methodology, scoping, and reporting — the parts of the job hiring managers ask about. $39.
Foundation
CompTIA Network+ (N10-009)
Every network finding you write depends on understanding what you are looking at. $39.
Foundation
CompTIA Linux+ (XK0-005)
Your tooling runs on Linux. So do most of your targets. $34.
Widely requested
EC-Council CEH
Common in job listings, and in government and contractor requirements. $49.
For senior roles
CompTIA CASP+ (CAS-004)
For testers moving toward architecture and lead work. $49.
Three certs together
Cybersecurity Career Path Bundle
Security+, CySA+ and PenTest+ — the three-cert spine of a security career. $99.
Start Here
You do not need to buy anything to begin. Start with the free lab, get your hands on a real target, and find out whether this work fits you before you spend a dollar.
Start Cover6: First Shell — free
When you are ready for volume, Pentester Prep Labs is where the reps live.
One last thing, and it matters more than anything else on this page: everything here assumes written authorization. The techniques are identical on both sides of that line. The authorization is the entire difference between a career and a criminal record. Learn in labs built for it, and never test a system you do not have documented permission to test.