Beyond the Syllabus: Pen Testing, Incident Response and Stapler on VulnHub | GCF Parul University…

This is Part 2 of my Parul University GCF cybersecurity training. Part 1 covered network and endpoint security, and how breaking a login page in the PortSwigger SQL injection labs finally made data sanitization click for me. You can read it here: Part-1

This part covers the second half of the syllabus, plus the lab that was both my favourite and the most frustrating of the week.

4. Vulnerability assessment and risk management

Threat intelligence._ The syllabus covers vulnerability databases like CVEs, security reports and news, subscription services, and automated vs. ad hoc threat intel. It's also upfront about the limits. A CVE tells you something exists, not whether it matters in your environment. And documentation and communication have to stay current before, during and after an incident._

Risk management._ Vulnerability vs. risk sounds obvious until you have to explain it. A vulnerability is a weakness. Risk is that weakness plus how likely it is to be exploited and how bad the impact would be. This section also covers mitigation strategies, severity levels and data classification._

Penetration testing._ This is the part I cared about most, since offensive security is where I'm heading. The process runs through vulnerability identification, active and passive reconnaissance, port scanning and automation, then reporting to stakeholders with recommendations. DAST and SAST for testing applications are covered too._

The report is the part people skip. Finding the bug is half the job. Explaining it clearly enough that someone can fix it is the other half.

5. Incident handling

This domain has a lot of moving parts:

• Monitoring:_ SIEM and SOAR, and telling true positives from false positives, and true negatives from false negatives_
• Forensics and frameworks:_ evidence handling, chain of custody, the Cyber Kill Chain, MITRE ATT&CK, the Diamond Model and the Pyramid of Pain_
• Incident response:_ the NIST SP 800–61 lifecycle, and how GDPR, HIPAA and PCI-DSS change notification requirements_
• DR and BCP:_ backups, hot, warm and cold standby, RPO and RTO_
• Restoring data:_ restore points and recovery from cloud storage_

MITRE ATT&CK was the one that stood out. Even at this level, thinking in tactics, techniques and procedures changes how you read an attack. You stop seeing a pile of events and start seeing a pattern.

The lab: Stapler on VulnHub

Beyond the syllabus, I solved Stapler from VulnHub. It was challenging.

Stapler pulls together everything in the pen testing section: recon, enumeration, choosing a path, and getting stuck. It's nothing like a guided lab with one intended answer. More than once I'd run everything I knew and nothing worked. That's frustrating, but it's also close to how real assessments feel.

I'm writing a full writeup, so I won't spoil the approach here. For now, if you're starting boot2root machines: don't skip enumeration, and take notes as you go. You'll need them later.

What I took away

Revision isn't wasted time. Covering familiar topics in a structured way exposed gaps I would have missed.

Labs beat reading. The SQL injection labs and Stapler taught me more than any slide did.

Entry-level doesn't mean easy. The syllabus is broad, and the real skill is connecting the domains.

And documentation is part of security. It showed up in threat intel, pen testing and incident response alike.

If you're a student thinking about cybersecurity, grab the syllabus, do the labs, and write about what you learn. Writing it down is the fastest way to find out what you don't understand.

The Stapler writeup is coming soon. Follow me here so you don't miss it. And if you've got a boot2root machine that gave you a hard time, tell me which one. I'm looking for my next.