Skip to main content
Dantes.io Logo
Dantes.io

Best resources to learnPenetration Testing

Study sheet

Penetration testing is the practice of authorized simulated attacks on computer systems to evaluate security. You will understand how to identify vulnerabilities, exploit weaknesses, and recommend remediation steps to secure digital infrastructure.

15 resources · · How we curate

📺YouTube(1)

youtube

IppSec (YouTube)

Weekly full-length walkthroughs of retired Hack The Box machines showing a complete attack chain: enumeration, foothold, privilege escalation, and the reasoning behind each step. Several hundred videos, searchable by technique via the companion ippsec.rocks index.

intermediate🇬🇧

🎓Courses(3)

course

Pre Security Learning Path

Start your penetration testing journey! Learn essential cybersecurity & networking skills with TryHackMe's Pre Security Learning Path.

beginner🇬🇧
course

Practical Ethical Hacking

Practitioner video course on network penetration testing, covering reconnaissance, scanning and enumeration, exploitation, Active Directory attacks, post-exploitation, web application basics and report writing using Kali Linux. Learners finish able to run a small internal pentest in a lab and document findings for a client.

intermediate🇬🇧
course

Practical Ethical Hacking

Heath Adams's 25-hour course, the paid and maintained version of his free YouTube series. Covers networking and Linux, Python scripting, external and internal penetration testing methodology, Active Directory attacks, web application testing, and report writing, with a lab you build yourself.

intermediate🇬🇧

📚Books(5)

scroll for more →
bookPaid

The Web Application Hacker's Handbook, 2nd Edition

Stuttard and Pinto's 900-page methodology for attacking web applications: mapping, bypassing client-side controls, authentication and session flaws, access control, injection, logic bugs, and a step-by-step testing checklist. Written by Burp Suite's creator.

intermediate🇬🇧
bookPaid

Penetration Testing: A Hands-On Introduction

A No Starch Press introduction to penetration testing built around a home lab of virtual machines. Covers reconnaissance, exploitation with Metasploit, password attacks, web and wireless attacks, post-exploitation, and basic exploit development, so readers can run a full assessment end to end.

intermediate🇬🇧
bookPaid

The Hacker Playbook 3

A practitioner's guide to red team engagements, organized like a game playbook from reconnaissance through lateral movement. Explains Active Directory attacks, evading endpoint defenses, privilege escalation, and post-exploitation, preparing readers to emulate realistic adversaries rather than run scanner-driven tests.

intermediate🇬🇧
bookPaid

Hacking Exposed: Network Security Secrets and Solutions

Long-running reference on network attack techniques, organized around the attacker's workflow: footprinting, scanning and enumeration, then exploitation of Windows, UNIX, remote-access and wireless systems, each paired with countermeasures. Readers learn how intrusions unfold so they can harden networks; some tool coverage is dated.

intermediate🇬🇧
bookPaid

Metasploit: The Penetration Tester’s Guide

A No Starch Press guide to the Metasploit Framework by experienced penetration testers. Walks through intelligence gathering, vulnerability scanning, exploitation, Meterpreter, client-side attacks, and writing custom modules, so readers can use Metasploit across every phase of a penetration test.

intermediate🇬🇧

🌐Websites(6)

scroll for more →
website

NetSec Focus

Community-run site pairing a large Mattermost chat server with study guides, most notably TJnull's OSCP preparation list. Use it to find vetted practice boxes, certification study paths, and peers working through the same offensive security material.

intermediate🇬🇧
website

VulnHub

Community-maintained catalogue of downloadable, intentionally vulnerable virtual machines you run locally in VirtualBox or VMware. Working through boxes teaches enumeration, exploitation, and privilege escalation end to end, and most have public walkthroughs to check your approach against.

intermediate🇬🇧
website

HackTricks

Community-maintained open-source pentesting knowledge base by Carlos Polop, organized by methodology: pentesting network services by port, web vulnerabilities, Linux and Windows privilege escalation, Active Directory, and cloud, with concrete commands and checklists.

intermediate🇬🇧
website

PortSwigger Web Security Academy

Free interactive web-hacking curriculum from the makers of Burp Suite, with written learning paths and over 250 deliberately vulnerable labs covering SQL injection, XSS, SSRF, authentication flaws, access control, and other web vulnerability classes.

intermediate🇬🇧
website

tryhackme.com

TryHackMe is an online cybersecurity training platform offering hands-on labs, guided learning paths, and real-world scenarios (rooms and challenges) to practice penetration testing, web security, and network defense in an interactive, gamified environment.

intermediate🇬🇧
website

pentesterlab.com

PentesterLab is an online platform offering hands-on penetration testing and web security labs. It provides guided, real-world exercises across web app vulnerabilities (e.g., SQL injection, XSS, CSRF, authentication flaws) with progress tracking and completion certificates.

intermediate🇬🇧
Share this topic

More in Cybersecurity

See all 17 topics in Cybersecurity →

Frequently Asked Questions

What are the best free resources to learn Penetration Testing?

Dantes has curated 15 resources for Penetration Testing, including 1 YouTube videos, 5 books, 3 courses, 6 websites. All resources are hand-picked for quality — no algorithmic filler. Browse the full list above to find the format that works best for you.

Is Penetration Testing hard to learn?

Penetration Testing is approachable at the beginner level — there are resources here specifically for those starting from scratch. As you progress, intermediate and advanced material is also available to take your skills further.

What types of Penetration Testing learning resources are available on Dantes?

For Penetration Testing, Dantes has curated 1 YouTube videos, 5 books, 3 courses, 6 websites. Each resource type serves a different learning style: videos and YouTube for visual learners, books for depth, courses for structured progression, and websites for quick reference.

How does Dantes select Penetration Testing resources?

Dantes is an algorithm-free learning directory. Resources are hand-curated based on quality, accuracy, and usefulness — not engagement metrics or paid placements. The goal is to surface the best learning material for Penetration Testing, whether it's a free YouTube series, a classic textbook, or an open courseware from a top university.

Go deeper

Test your understanding of Penetration Testing

Explain it out loud. An AI tutor listens and asks questions that expose gaps you didn't know you had.