FM-O200 — Penetration Testing: The Five Stages
Offensive security, hands-on — from recon to root.
Offensive security the way real attacks unfold — the five stages of hacking, from reconnaissance to clearing tracks. 79 lessons across 14 units: recon, scanning & enumeration, the full web-exploitation set, authentication & password attacks, system exploitation, post-exploitation & Active Directory, anti-forensics, and professional reporting — taught in isolated, browser-based labs. Every lesson in English and Arabic. For learners who've completed the foundations.
- LevelIntermediate
- Lessons81
- Hands-on labs23
- Machines31
- Units14
How the course flows
- 1Reconnaissance
- 2Scanning & Enumeration
- 3Gaining Access
- 4Maintaining Access
- 5Clearing Tracks
What you will learn
- ReconnaissanceOSINT, WHOIS/DNS, email & people harvesting, metadata OSINT, breached-credential discovery, email security & spoofability, historical recon, and offensive phishing
- Scanning & EnumerationNmap, Gobuster, traffic analysis with Wireshark and tcpdump, service enumeration, vulnerability scanning, subdomain enumeration, and technology fingerprinting
- Gaining AccessWeb Foundations (how the web, JavaScript and SQL work), then the full web-vulnerability set (SQL injection, XSS, IDOR, command injection, file upload, XXE, SSRF, CSRF, path traversal) with Burp Suite and SQLMap; authentication & password attacks (Hydra, John the Ripper); and system exploitation (Metasploit, payloads, shells, classic CVEs)
- Maintaining Accessprivilege escalation, persistence, pivoting & tunnelling, command-and-control concepts, and a full Active Directory attack track (enumeration, Kerberos attacks, credential theft, lateral movement, domain dominance)
- Clearing Tracksanti-forensics, log tampering, steganography, and why defenders still catch it
- Methodology & Reportingscoping, note-taking, and writing a report a client can act on
- An OWASP Top 10 (2025) reference unit and three unguided capstones
Who it's for
Learners who've completed FM-F100 — Cyber Security Foundations (or have equivalent Linux, Windows, networking, and crypto basics) and want a practical, structured offensive-security path toward penetration testing or red teaming.
Prerequisites
FM-F100 — Cyber Security Foundations, or equivalent fundamentals, and a willingness to work methodically.
Outcome
You'll be able to reason through a structured engagement end to end — recon, exploitation, post-exploitation, and reporting — and you'll be ready to pair it with our defensive blue-team training, where every attack here has its detection story.
Format
- Self-paced
- 79 bilingual lessons (English/Arabic)
- 14 units across the five stages
- isolated, browser-based labs with capture-the-flag checks
- new hands-on labs rolling out across the curriculum
About this course+
FM-O200 takes you through a penetration test the way it actually happens, structured on the five stages of hacking:
and finished by a professional Methodology & Reporting unit. Its 79 lessons are organised into 14 units — with dedicated sub-units for Web Foundations, Web Vulnerabilities, Authentication & Password Attacks, System Exploitation, and a full Active Directory track — so a large syllabus stays easy to navigate. Hands-on lessons run in isolated, browser-based labs, and every lesson is available in English and Arabic.