What does a pentester actually do?
A pentester (penetration tester) is hired by an organisation to attack its own systems, with its written consent, in order to find weaknesses before a real attacker exploits them. The scope can be a web application, a mobile app, an internal network, an Active Directory environment, a cloud infrastructure or even staff, in the case of social engineering tests.
An engagement almost always follows the same flow: scoping and authorisation, reconnaissance, vulnerability discovery, exploitation, privilege escalation and lateral movement, then reporting. That last step is often underestimated: a pentest is only as good as the report delivered to the client, with reproducible findings, a well-argued risk rating and actionable recommendations.
What skills do you need to become a pentester?
Penetration testing is not an entry point into IT: it is a specialisation built on solid fundamentals. These are the skills recruiters expect from a junior pentester.
- Networking: the TCP/IP model, routing, common ports and services (DNS, HTTP, SMB, LDAP, SSH), capturing and reading traffic with Wireshark.
- Systems: comfort on the Linux command line, Windows administration, how Active Directory works (Kerberos, groups, delegation, GPOs).
- Web: the HTTP protocol, sessions and cookies, OWASP Top 10 vulnerabilities (injection, broken access control, XSS, SSRF), hands-on use of a proxy such as Burp Suite.
- Scripting: reading, adapting and writing Python, Bash or PowerShell scripts to automate a task or modify a public exploit.
- Tools: Nmap, Metasploit, Active Directory enumeration suites, password cracking tools — understanding what they do, not just running them.
- Soft skills: method, rigorous note-taking, clear writing in French and English, a strong sense of ethics and the ability to explain a technical risk to a decision-maker.
How to practise: labs, CTFs and a home lab
Practice is what separates a candidate who has read about pentesting from one who can actually do it. The good news: everything can be practised legally, on environments built for that purpose.
Aim for consistency rather than intensity: a few machines a week, each with a written walkthrough, beat an intense weekend with no notes. Those write-ups also become a portfolio you can show in interviews.
- Online lab platforms: TryHackMe to start with guided paths, Hack The Box and OffSec Proving Grounds for more realistic machines.
- Web security: PortSwigger's free Web Security Academy and deliberately vulnerable apps such as OWASP Juice Shop or DVWA.
- Home lab: a few virtual machines on your computer (Kali Linux, an evaluation Windows domain controller, vulnerable machines) to reproduce Active Directory attacks.
- CTFs: Capture The Flag competitions, online or run by schools and communities in Morocco, train problem-solving under time pressure and help you meet other enthusiasts.
- Bug bounty: only on public programmes, strictly within their scope and rules; best tackled once the fundamentals are in place.
In what order should you take pentesting certifications?
Certifications structure your learning and reassure employers, provided you take them in a sensible order. The path we recommend goes from general foundations to hands-on proof.
- 1. CompTIA Security+ (SY0-701): the foundation. It checks that you master security fundamentals before you specialise. 5-day training, from 10,900 MAD, voucher included.
- 2. CEH v13 (312-50): the broadest coverage of attack techniques, from reconnaissance to exploitation, with hands-on labs. A 125-question, 4-hour exam, with the optional CEH Practical on top. 5-day training, from 21,900 MAD.
- 3. CompTIA PenTest+ (PT0-003): focused on running a complete engagement, from planning and scoping to reporting, with performance-based questions. 5-day training, from 12,900 MAD.
- 4. OSCP+ (PEN-200): the hands-on benchmark. A proctored 23 h 45 min exam on an Active Directory set and standalone machines, then 24 hours to submit a professional report; you need 70 points out of 100. 10-day training (80 hours), from 29,900 MAD.
Pentesting and Moroccan law: always with written authorisation
The difference between a pentester and a criminal hacker comes down to one word: authorisation. Morocco's Penal Code, in articles 607-3 and following (introduced by Law 07-03 on offences against automated data processing systems), penalises in particular fraudulent access to a system, fraudulently remaining in it and interfering with its operation or data. Good intentions change nothing: testing a website or network without consent is a criminal offence, even if you meant to help.
In practice, no test should start without a document signed by an authorised person at the client organisation: an agreement or engagement letter stating the exact scope (IP addresses, domains, applications), dates, permitted techniques and emergency contacts. Personal data encountered during the engagement also remains protected by Law 09-08, which requires confidentiality and data minimisation.
This is a general overview, not legal advice: if you have any doubt about a scope or contract, have it checked by a lawyer before acting.
Where do pentesters work in Morocco?
Cybersecurity consulting and audit firms, along with IT services companies, are the main employers of pentesters: they run engagements for Moroccan clients and often for European clients from Casablanca, Rabat or Tangier. Banks, insurers and telecom operators also have internal technical audit teams or hire providers they oversee.
In the public sector and among critical infrastructure operators, Law 05-20 on cybersecurity and the DGSSI framework encourage regular security audits, which drives demand for technical auditors. Some experienced professionals work as freelancers or supplement their income with bug bounty. For a first job, a SOC analyst or junior auditor role is often a realistic stepping stone into pentesting.
Training for pentesting with GATech
GATech supports this path in Morocco with Security+, CEH v13, PenTest+ and OSCP+ training, in the classroom or online, official exam voucher included. If you are not sure where to start, our advisers can assess your level and point you to the most suitable certification.
Frequently asked questions
Do you need an engineering degree to become a pentester in Morocco?
A degree in IT or networking helps, especially for a first hire at a consulting firm, but it is not always required. Recruiters mainly look at demonstrable skills: hands-on certifications, lab write-ups, CTF results. A well-documented self-taught profile can be convincing.
Which certification should I start with to become a pentester?
If your security fundamentals are still thin, start with CompTIA Security+. With good networking and systems foundations, you can go straight to CEH v13 or PenTest+, then OSCP+ once you are comfortable with hands-on labs and Active Directory environments.
Is it legal to practise hacking in Morocco?
Yes, as long as you stay on environments you own or that are designed for it: your home lab, lab platforms, CTFs, bug bounty programmes within their scope. Testing a third-party system without authorisation is a criminal offence under articles 607-3 and following of the Penal Code.
Is OSCP+ essential to get hired as a pentester?
No, but it is highly valued because it proves practical ability under demanding exam conditions. Many junior pentesters are hired with CEH or PenTest+ and a solid lab portfolio, then earn OSCP+ in the first years of their career.
How long does it take to become a pentester?
It depends on where you start. An experienced systems or network administrator progresses faster than a complete beginner. Either way, plan several months of regular practice on top of training, and consider that a first role in a SOC or junior audit may be part of the path.
GATech teaching team
Cybersecurity trainers and consultants preparing professionals in Morocco for CEH, OSCP+, CISSP, CompTIA and ISO 27001.
Published
