Pentesting for Dummies and Kindergarteners

An open educational resource covering all layers of penetration testing with an AI-assisted workflow, written for junior cybersecurity engineers operating under white-hat and bug bounty principles.

For authorized testing only. Always obtain written permission before testing any system. Never test systems you do not own or have explicit scope for.

---

What is this?

A structured, layer-by-layer guide to ethical penetration testing — from reconnaissance to reporting. Every topic is framed around white-hat principles and includes ready-to-use AI prompt templates so you can work faster and learn as you go.

Built for junior security engineers who want a clear methodology, not a wall of jargon.

---

The Seven Layers

Phase	Layer	Topics
01	Reconnaissance	Passive OSINT, subdomain enumeration, tech stack fingerprinting, Google dorking, stealth techniques
02	Network	Port scanning, service detection, firewall rule testing, SSL/TLS review
03	Application	SQL injection, XSS, auth flaws, API testing, business logic, misconfigurations
04	Authentication & Session	Login flow review, token handling, MFA bypass, session fixation
05	Business Logic	Race conditions, IDOR, price tampering, privilege escalation via feature chains
06	Infrastructure & Cloud	Cloud misconfiguration, metadata services, container escapes, server-side vulns
07	Reporting & Disclosure	CVSS scoring, finding templates, executive summaries, responsible disclosure

---

Tech Stack

• Astro — static site framework
• Vue 3 — interactive components (nav dropdown, theme toggle, mobile menu)
• Shiki — syntax highlighting with dual light/dark themes
• Mermaid — diagrams rendered client-side from code blocks
• Content authored in Markdown with YAML frontmatter
• Site-wide config driven by a single src/content.yml file

---

Local Development

Prerequisites: Node.js 18+

npm install
npm run dev        # dev server at http://localhost:4321
npm run build      # production build → dist/
npm run preview    # preview the production build locally
npm run check      # TypeScript / Astro type checking

Deployment base path

The site deploys to / by default. To host on a GitHub Pages subdirectory, change the base field in astro.config.mjs:

base: '/your-repo-name/',

All internal links use the url() / layerUrl() helpers in src/utils/url.ts and will update automatically.

---

Project Structure

src/
├── content/
│   └── layers/          # one .md file per pentest layer
├── content.yml          # all site copy, nav, layers config — edit here
├── components/          # Astro + Vue components
├── layouts/
│   └── BaseLayout.astro
├── pages/
│   ├── index.astro
│   ├── learn/
│   │   ├── index.astro
│   │   └── [layer].astro
│   └── contribute.astro
├── styles/
│   └── global.css
└── utils/
    └── url.ts           # base-aware link helpers

---

Contributing

Contributions are welcome: new layer topics, improved AI prompt templates, tool references, ethical edge cases, or translations.

All content must maintain white-hat framing. Material that could facilitate unauthorized access, even framed as educational, will be rejected.

Adding a topic

1. Open the relevant file in src/content/layers/
2. Add a topic entry in the file's frontmatter (topics: array)
3. Write the topic section in the Markdown body
4. No changes to astro.config.mjs or other files needed

Adding a new layer

1. Create src/content/layers/<id>.md following the existing format
2. Register it under learn.layers in src/content.yml
3. Set enabled: true to make it visible

See CONTRIBUTING.md for the full code of conduct and PR checklist.

---

License

CC BY-NC-SA 4.0 — Share with attribution, non-commercial, same license.