Module 1: Introduction to VAPT

• What is VAPT?

• Difference between vulnerability assessment and penetration testing

• Legal and ethical considerations

• Scope definition and authorization

Module 2: Information Gathering & Reconnaissance

• Passive and active information gathering

• WHOIS, DNS enumeration, and Google hacking

• Network scanning using Nmap

• Service enumeration techniques

Module 3: Vulnerability Assessment

• Identifying vulnerabilities using automated tools (e.g., Nessus, OpenVAS)

• Manual vulnerability detection techniques

• Risk rating and prioritization

• Generating vulnerability reports

Module 4: Penetration Testing Fundamentals

• Exploiting identified vulnerabilities

• Exploit development basics

• Using Metasploit Framework

• Privilege escalation techniques

Module 5: Web Application Testing

• OWASP Top 10 vulnerabilities

• Cross-site scripting (XSS), SQL injection, CSRF

• Authentication and session flaws

• Tools: Burp Suite, OWASP ZAP

Module 6: Network Penetration Testing

• Network architecture and attack vectors

• Exploiting SMB, FTP, RDP, and other services

• Man-in-the-middle (MITM) attacks

• Firewall and IDS/IPS evasion techniques

Module 7: Wireless and Mobile Security Testing

• Wireless network attacks (WEP/WPA/WPA2 cracking)

• Rogue access points and sniffing

• Basics of mobile app vulnerability assessment

Module 8: Reporting and Documentation

• Writing effective penetration test reports

• Risk categorization (CVSS scoring)

• Communicating findings to technical and non-technical audiences

Module 9: Real-Time VAPT Labs and Capstone Project

• Simulated enterprise network testing

• Full-scope VAPT project

• Presentation and walkthrough of assessment findings

• Interview prep and certification guidance