We have gone through the entire toolkit: Kali as the working environment (07-01), Metasploit for exploitation (07-02), and Burp and ZAP for the web (07-03 and 07-04). You now know what a pentester works with. But pentesting is a discipline that changes every week: new vulnerabilities, techniques, and tools appear constantly, and no certification or course (not even this one) leaves you "finished." The question that closes your training is not which tool do I use, but how do I keep growing legally and ethically throughout my career.

This final lesson is a map for that growth: the legal practice platforms where you can train (Hack The Box, TryHackMe, VulnHub, PortSwigger Web Security Academy, OWASP Juice Shop, DVWA), the certifications that structure and validate your progress (eJPT, PNPT, OSCP, CEH...), CTFs, communities, bug bounty with its legal framework, and a suggested study roadmap. All under the principle that has guided the entire course: practice only in authorized environments. And because this is the close of the course, we will end by recapping the complete journey of the TechNova audit, from start to finish.

1. Why learning never ends
2. Legal practice platforms
3. Industry certifications
4. CTFs and competitions
5. Communities and staying current
6. Bug bounty: earning while practicing (with its legal framework)
7. A suggested study roadmap
8. Common Mistakes and Tips
9. Exercises
10. Conclusion (course wrap-up)

In offensive security, knowledge expires. Today's exploit is tomorrow's patch; an evasion technique stops working once defenders learn it. Three practical consequences:

• Constant practice is not optional, it is the profession. Skills rust without use.
• Always learn in legal environments. The only ethical way to stay sharp is in your own labs or platforms designed for it. What you learned in 07-01 about building an isolated lab is the base habit of an entire career.
• Document and share. Writing writeups of what you solve cements the learning and builds your professional reputation.

These platforms give you targets that are authorized by design: machines and applications built to be attacked, with explicit permission. They are the legal substitute for "testing on real systems."

Tips for using them:

• Start with TryHackMe if you are starting from scratch: it takes you by the hand. Move to Hack The Box when you want challenges without hints.
• VulnHub, Juice Shop, and DVWA are downloaded and set up in the isolated lab from 07-01: perfect for practicing offline. DVWA in particular is almost a clone of the PHP/MySQL profile of tienda.technova.lab.
• PortSwigger's Web Security Academy is free and probably the best resource in the world for web vulnerabilities, and it dovetails with what you learned about Burp.

Certifications structure your study, validate your level to employers, and set clear goals. General guidance (details change over time; always verify on the official website):

How to read this table:

• To get started and demonstrate real practice: eJPT is an excellent first practical certification and affordable.
• The most valued in technical pentesting: OSCP, a very demanding de facto standard (24-hour practical exam plus report). Its "Try Harder" philosophy is the mindset of the trade.
• PNPT stands out because its exam includes delivering a report and a debrief, exactly the work from Module 6.
• CEH is broad and recognized in corporate and compliance settings, though more theoretical.

A certification does not replace practice: it validates it. The logical order is usually to practice on platforms, then certify the level you have reached.

CTFs (Capture The Flag) are competitions where you solve security challenges to find "flags" (hidden strings). They are gym and community at the same time.

• Jeopardy: independent challenges by category (web, crypto, forensics, reversing, pwn). The most common format.
• Attack-Defense: each team defends its own services while attacking those of others. Very realistic.

Where to find them: CTFtime.org lists competitions and team rankings. Platforms like Hack The Box and TryHackMe also run their own CTFs. Even if you do not win, the later writeups (yours and other people's) are gold for learning new techniques.

Nobody grows alone in security. Keeping up to date and surrounding yourself with people who know more than you accelerates learning:

• Communities: platform forums (HTB, THM), Discord servers, subreddits such as r/netsec, your country or city community.
• Sources for staying current: researcher blogs, the CVE feed, vendor advisories, security newsletters, technical accounts on social media.
• Conferences: DEF CON, Black Hat, and local ones (in the Spanish-speaking world, RootedCON, Navaja Negra, Ekoparty...). Many publish their talks for free.
• Learn in the open: writing writeups and sharing findings (within what is permitted) builds reputation and reinforces what you have learned.

Bug bounty programs let researchers look for vulnerabilities in real companies' systems and earn rewards for valid findings. Platforms like HackerOne, Bugcrowd, or Intigriti coordinate them. It is the way to apply your skills in the real world legally.

The key word is scope, and it is what separates legal bug bounty from crime:

• Every program defines an explicit scope: which domains, applications, and types of testing are authorized. That scope is your authorization.
• Outside the scope there is no permission. Testing an unlisted domain, even if it belongs to the same company, is unauthorized access: a crime, not research.
• Respect the program's rules: forbidden techniques (no DoS or social engineering unless expressly permitted), intensity limits, and the responsible disclosure policy (report privately, do not publish until it is fixed).

Bug bounty is the same ethical principle of the course taken to the real world: written permission (here, the program's scope) is what makes the test legal. It is the natural continuation of the framework we applied with TechNova, where everything started from an authorization.

An indicative roadmap for going from beginner to professional, chaining together what you have learned:

The phases explained:

1. Fundamentals first. Without networking, Linux, HTTP, and some scripting (Python/Bash), the rest stands on shaky ground.
2. Your lab (07-01) as a permanent training ground.
3. Guided paths to add structure; the Web Security Academy to master the web side.
4. eJPT to validate the practical base.
5. HTB and CTFs to loosen up without hints.
6. OSCP/PNPT as the professional jump, now with a report included.
7. Specialize in an area and, optionally, get into bug bounty, never stopping learning.

There is no single valid path; adapt it to your starting point and your goals. What stays constant is the direction: legal practice, increasing difficulty, continuous learning.

• Skipping the fundamentals. Without networking, Linux, and HTTP, the tools are magic you do not understand. Build the base before you run.
• Collecting courses without practicing. Watching videos is not learning pentesting; solving machines is. Prioritize the lab and the platforms.
• Practicing outside authorized environments. No "testing" on real sites, and no going out of scope in bug bounty. It is the line that separates the profession from crime.
• Obsessing over a certification as the final goal. The certification validates; learning does not end with it. Keep going afterward.
• Learning in isolation. Join communities and read writeups: they accelerate years of progress.
• Tip: write writeups of everything you solve. Teaching what you learn is the fastest way to cement it and to build your reputation.

Exercise 1. Design your own study plan for the next 6 months starting from your current level. State which platform you would use to begin, which certification you would set as your first goal, and how you would integrate the lab from 07-01 into your routine.

Exercise 2. An acquaintance tells you they found a flaw in a bank's website "out of curiosity" and want to warn them by sending proof that they got in. Explain why that can be illegal even if their intention is good, and what the correct and legal path would have been to research the security of real applications.

Exercise 3. You are about to start in a bug bounty program. List the three documents/sections you must read before launching the first request and explain what each tells you and why it is your "authorization."

Solution 1. (Indicative answer.) Months 1-2: reinforce the fundamentals (networking, Linux, HTTP) and set up my isolated lab with Kali and DVWA/Juice Shop; start guided paths on TryHackMe and the PortSwigger Web Security Academy for the web side. Months 3-4: continue with harder rooms and prepare for the eJPT as my first goal for a practical, affordable certification. Months 5-6: move on to Hack The Box and some CTF to loosen up without guidance, writing writeups of each machine. The lab from 07-01 is my continuous testing ground: I replicate every new technique there, on machines that are mine, before applying it on the platforms.

Solution 2. Accessing the bank's website and "getting in" without authorization is unauthorized access to a computer system, a crime in most jurisdictions regardless of intent: good faith does not grant permission, and sending proof that they got in documents them as the author. The correct and legal path to research the security of real applications is: practice on authorized platforms (HTB, THM, Juice Shop) and, for real systems, take part only in bug bounty or disclosure (VDP) programs where the company explicitly authorizes the test within a defined scope, respecting its rules and responsible disclosure.

Solution 3. Before the first request I must read: (1) the Scope —which domains and applications are in-scope—, because that scope is my authorization: only there do I have permission to test. (2) The program's Rules —forbidden techniques (DoS, social engineering), intensity limits—, which define how I can test without breaking the rules. (3) The Disclosure policy —how and when to report—, which requires me to communicate privately and not publish until it is fixed. Acting outside those limits stops being authorized research and becomes an illegal intrusion.

With this lesson we close Module 7 and, with it, the complete Pentesting course. Continuous learning is not an appendix: it is the essence of a profession where knowledge expires. You take away a map for growing always in a legal and ethical way: platforms like TryHackMe, Hack The Box, the PortSwigger Web Security Academy, or DVWA to practice against targets authorized by design; certifications like eJPT, PNPT, or OSCP to structure and validate your level; CTFs and communities to keep sharp; bug bounty as a legal bridge to the real world, where the scope is your authorization; and a roadmap that chains fundamentals, lab, platforms, certification, and specialization.

And here it is worth looking back at the complete journey. We began (Module 1) by understanding what pentesting is, its types and phases, and the ethical and legal framework that holds it all together. Against the fictional TechNova S.L. we performed reconnaissance of its attack surface (Module 2), scanned and enumerated its services on the 10.10.10.0/24 (Module 3), exploited the SQL injection in producto.php?id= and its systems and credentials (Module 4), carried out post-exploitation —escalation, pivoting, persistence, and covering tracks— (Module 5), and turned it all into a report classified by risk with CVSS, with remediations and a constructive debrief (Module 6). Finally, in this Module 7, we came back to the tooling —Kali, Metasploit, Burp, ZAP— to master it in depth, and we traced the path to never stop learning.

From start to finish, one thread has tied it all together: authorization. We started with written permission to audit TechNova and we end with the scope of a bug bounty program. That is the one border you must never cross. You have the method, you have the tools, and you have the map to keep growing. Now build your lab, solve your first machine, and keep practicing: always hack with permission, never stop learning, and use what you know to make systems more secure. The course ends here; your career in offensive security begins.