GIAC GPEN Study Roadmap

Domain 1: Planning & scoping (Rules of engagement, legal considerations, methodologies)

Domain 2: Reconnaissance (OSINT, DNS recon, Google dorking, Shodan, attack surface mapping)

Domain 3: Scanning (Nmap advanced techniques, host discovery, service enumeration)

Domain 3: Enumeration (SMB, SNMP, web apps, vulnerability scanning, network mapping)

Domain 4: Exploitation (Metasploit, buffer overflows, service exploitation)

Domain 4: Web exploitation (SQL injection, XSS, authentication bypass, web shells)

Domain 4: Password & wireless (Brute force, hash cracking, WPA attacks, client-side)

Domain 5: Post-exploitation (Windows/Linux privilege escalation techniques)

Domain 5: Pivoting (Lateral movement, port forwarding, tunneling, AD attacks)

Domain 6: Reporting (Report writing, risk ratings, remediation recommendations)

Index Building: Create open-book index for exam day, organize notes by topic

Full Review: Practice exams, Index refinement, Weak areas, Exam logistics