Project at a Glance
Pwned: 1 was my first complete penetration test as part of the Application Security specialization in my Advanced Federal Diploma studies in Computer Science. The goal was to assess an intentionally vulnerable Linux environment as a black box, systematically identify and exploit vulnerabilities, and progressively escalate access to root privileges.
The deliberately simple lab was primarily intended to provide hands-on experience with the complete penetration testing process – from reconnaissance and enumeration to exploitation and privilege escalation. The assessment followed the OWASP Web Security Testing Guide and combined automated tools with manual analysis.
The test environment consisted of Kali Linux as the attacking system and the vulnerable target VM running in an isolated KVM network. Tools used during the assessment included Nmap, arp-scan, Gobuster, SSH, and various Linux utilities.
The results were documented in a penetration test report created with LaTeX. It covers the complete attack path, identified findings and their risk assessment, as well as recommended measures for hardening the system.
The penetration test report is unfortunately only available in German.
Key Learnings
The project gave me my first practical experience with the structured execution of a complete penetration test. One of the key takeaways was how the individual phases build on each other: information gathered during enumeration enabled initial access, which in turn provided the basis for further privilege escalation.
It also demonstrated that the impact of vulnerabilities should not only be considered individually, but especially in terms of how they can be chained into a complete attack path. Equally important was the reporting process: documenting findings reproducibly, assessing their risks, and deriving concrete remediation measures are essential parts of a penetration test.
The complete technical process, including findings, evidence, and remediation measures, is documented in the penetration test report.