Vulnerability Assessment & Penetration Testing (VAPT)

Module 1: VAPT Overview and Methodology

• Vulnerability Assessment vs. Penetration Testing
• VAPT methodology: PTES, OWASP, NIST SP 800-115
• Types of VAPT: Black box, grey box, white box
• VAPT scope definition and rules of engagement
• VAPT deliverables: Report types and formats

Module 2: Network VAPT

• External network VAPT workflow
• Internal network VAPT workflow
• Network scanning: Nmap, Masscan, Nessus
• Firewall and IDS bypass in VAPT
• Network service exploitation

Module 3: Web Application VAPT

• OWASP Top 10 testing workflow
• Manual testing vs. automated scanning
• Burp Suite Professional for web VAPT
• OWASP ZAP for web application scanning
• API VAPT methodology

Module 4: Mobile Application VAPT

• OWASP Mobile Top 10 testing
• Android VAPT with MobSF and Frida
• iOS VAPT methodology
• Mobile API and backend VAPT
• Mobile VAPT report structure

Module 5: Cloud VAPT

• AWS VAPT: IAM, S3, EC2, Lambda testing
• Azure VAPT: Entra ID, storage, VMs
• GCP VAPT basics
• Cloud misconfiguration assessment: ScoutSuite, Prowler
• Cloud VAPT reporting and cloud-specific findings

Module 6: Vulnerability Scanning Tools

• Nessus Professional: Advanced configuration
• Qualys VMDR overview
• Rapid7 InsightVM
• OpenVAS/Greenbone
• Authenticated vs. unauthenticated scanning

Module 7: Exploitation in VAPT Context

• Confirming vulnerabilities through exploitation
• Metasploit for validation
• Safe exploitation in production environments
• Documenting exploitation evidence
• Avoiding unintended damage during VAPT

Module 8: Post-Exploitation in VAPT

• Demonstrating business impact
• Data access without actual data extraction
• Privilege escalation evidence
• Lateral movement documentation
• Post-exploitation evidence for reports

Module 9: VAPT Reporting

• Executive summary writing
• Technical vulnerability findings: Description, evidence, CVSS, remediation
• Risk rating matrix
• Report presentation to client
• Re-test and verification process

Module 10: Automated VAPT Tools

• Automated vulnerability scanners in VAPT
• Limitations of automation in VAPT
• Combining automation with manual testing
• CI/CD integration for application VAPT
• Continuous VAPT programmes

Module 11: Compliance-Driven VAPT

• PCI DSS VAPT requirements
• ISO 27001 VAPT requirements
• CERT-In empanelled auditor requirements for VAPT
• RBI-mandated VAPT for banks
• VAPT as part of ISMS

Module 12: Capstone Projects

• Full-scope VAPT of a lab environment: Network + Web + Cloud
• Professional VAPT report preparation
• Re-test and verification exercise
• CERT-In empanelled auditor career pathway
• Certification preparation: CEH, OSCP, eJPT, CompTIA PenTest+

Experience in the Industry Learn from CERT-In empanelled auditor-track professionals with extensive VAPT experience across network, web application, mobile, and cloud environments for enterprise clients.

Backgrounds at the Top Our instructors have delivered VAPT engagements for RBI-regulated entities, SEBI-registered intermediaries, healthcare organisations, and large IT companies, following CERT-In and industry methodologies.

Clear & Effective Teaching VAPT methodology, tools, and report writing are taught as an integrated workflow, preparing students for real-world client engagements from day one.

Hands-On Learning Focus Students complete full VAPT projects across network, web, mobile, and cloud targets, producing professional-quality reports that mirror industry deliverables.

Up-to-Date Knowledge Instructors stay current with updated CERT-In empanelment requirements, PCI DSS v4.0 VAPT mandates, new cloud VAPT tools, and the latest CVE exploitation techniques.