Training/Certification Rangers IM Pentester - INE
What is the INE - PENTESTER certification?
The CRP (Certified Rangers Pentester) is the entry-level certification for the Rangers-IM offensive technical programme. It is aimed at IT technicians who wish to acquire the fundamentals of penetration testing whilst understanding how these skills fit within the Belgian legal framework and the regulatory requirements (ISO, NIS 2, DORA) that their employers or clients are required to comply with.
Introducing a certification that opens the doors to the CyberWorld’s underground
Certified RANGERS Pentester (INE)
The CRP is not a duplicate of the INE. It is based on the same five-day training course and the same INE labs for the technical foundation, but it certifies four additional skills that the INE does not cover.
- The first is a thorough understanding of the Belgian legal framework specific to ethical hacking, which currently offers greater protection than elsewhere in Europe but is subject to strict conditions.
- The second is the ability to link technical findings to the requirements of ISO 27001, NIS 2 and DORA, enabling the technician to communicate with CISOs, DPOs and auditors using the correct terminology.
- The third is exposure to five complementary attack surfaces not covered by the INE: AI-enhanced OSINT, dark web investigation, Wi-Fi security, mobile security and IoT security.
- The fourth is the practice of reporting to the Rangers standard, which transforms a penetration test report into a risk treatment plan that can be utilised by senior management.
This training course is particularly relevant for:
- An audience consisting mainly of IT technicians (systems administration, network administration, Level 1 to Level 3 support) and our Belgian and European clients.
- The secondary audience includes internal auditors, CSI and CISO professionals who have already been trained in standards by Rangers and wish to acquire the technical knowledge, IT teams from public institutions and large companies, and those undergoing career change who wish to enter the field of hacking through this entry point.
- Recommended group size: 6 to 10 participants to ensure effective support during the labs.
- Please note: This course is exclusively for participants who are nationals of European Union member states.
- To be signed: An Ethical Hacker Charter.
Prerequisites:
Basic knowledge of TCP/IP and networking (OSI model, routing, NAT, ports). Practical experience with Linux command lines (Bash) and Windows command lines (PowerShell). Basic understanding of Active Directory, DNS, HTTP and HTTPS. No prior knowledge of hacking is required.
Technical environment:
- Each participant has a virtualised lab on their workstation (VMware or VirtualBox) running Kali Linux and a set of vulnerable targets (Metasploitable, DVWA, test AD environment). Access to the INE platform for the official eJPT labs.
- For the dark web module: Tor Browser and a dedicated Tails or Whonix virtual machine.
- Each participant brings their own machine and will have a secure, monitored connection to a cloud environment.
Your trainers
- Sherlock Code
- The Grinch
- Pinky "PinkUnicorn"
- Ragnard
Practical details:
Our Cyber Hack certification course combines theory with “lots”... “lots”... “lots” of practical work to enable you to master all aspects of the fundamentals of ethical hacking. We’ll take an interactive and participatory teaching approach, encouraging discussion and the practical application of attacks!
- An exceptional setting: the Actibel Business Village in Namur, situated at the motorway junction on Avenue d’Écolys 2, 5020 Suarlée, in the heart of Wallonia. Enjoy an unrivalled training experience in a professional and inspiring environment.
- Complimentary lunch: Enjoy a delicious meal at Brasserie le Félicien every day of the course to keep your energy levels up and encourage discussion amongst participants.
- Training materials included: Take home comprehensive PDF syllabus-style materials to deepen your knowledge and help you succeed in your certification exams.
- EXCLUSIVE: Taught by hackers with over 10 to 20 years’ experience.
- You’ll also have access to online resources, for your convenience. What’s more, you can sit your exam online whenever you like within the year of your course.
- A 5-day course from 9.00 am to 5.30 pm, with your certification exam included in the price (dates are shown at the time of registration).
- €4,880 excluding VAT, all-inclusive. Subject to a minimum of 5 participants. 10% discount for groups of 10 from the same organisation!
- It’s also possible to stay overnight at the training venue. It’s ideal, with a late-night pizza session planned for those staying on site!
- Hotel accommodation is at your own expense. IBIS in Suarlée.
- Don’t worry – the pizzas are on Captain Cyber :) but not the hotel :)!
Program Overview :
Day 1: Fundamentals, methodology and the Belgian legal framework
- Threat landscape 2026 (ransomware, supply chain, malicious AI). Belgian legal framework: Articles 550bis/550ter, the Ethical Hacking Act (28 November 2022), the role of the CCB, 72-hour reporting requirement, prohibited techniques.
- Belgian NIS 2 Act (26 April 2024) and obligations.
- Methodologies: PTES, OWASP, MITRE ATT&CK, Lockheed Martin kill chain. The lifecycle of a penetration test.
- Link to ISO 27001 (A.8.29) and EBIOS RM. Lab set-up, TCP/IP refresher, Wireshark workshop (attack traffic analysis), detection of scans in firewall/IDS logs.
- Deliverable: Operational lab + personal methodology sheet.
Day 2: Reconnaissance, AI-enhanced OSINT and dark web investigation
- Reconnaissance: Passive reconnaissance tools (Google Dorks, Shodan, Censys, Maltego, data breaches) and active reconnaissance tools (Nmap, TCP/UDP scans, OS fingerprinting, SMB/SNMP/DNS/FTP/SSH/HTTP enumeration). Link to ISO 27001 (A.8.8) and NIS 2 (Art. 21).
- AI-enhanced OSINT: Use of LLMs to automate searches, reverse image search, pretext generation (strict Belgian legal framework). Detection of AI-generated content and profile reconstruction in 15 minutes. Focus on digital hygiene and OPSEC.
- Dark Web investigation: Tor architecture, distinction between the dark, deep and surface web, and a secure environment (dedicated VM, OPSEC). Supervised demonstration (Tor directories, marketplaces, leak forums). Belgian legal framework (Tor is legal, but access to certain content is prohibited; CCB position, GDPR). Defence perspective: monitoring, crisis management, GDPR reporting.
- Deliverable: Report incorporating traditional reconnaissance, AI-powered OSINT and Dark Web monitoring.
Day 3: Vulnerabilities, exploitation and Wi-Fi security
- Vulnerability assessment: Nessus, OpenVAS and Nuclei tools for scanning and prioritising CVEs (CVSS, EPSS) via NVD, Exploit-DB and GitHub. Metasploit Framework: modules, payloads, the ‘search-use-set-exploit’ workflow, Meterpreter and post-exploitation.
- Manual exploitation: Attacks on common services, authentication (Hydra, Medusa, password spraying), hash cracking (John the Ripper, Hashcat: NTLM, bcrypt).
- Defence perspective: patch management, EPSS prioritisation, CIS Benchmarks (Windows/Linux), MFA, LAPS, brute-force detection (Event ID 4625, fail2ban). Link to DORA (Articles 26–27) for Threat-Led Penetration Testing (financial sector).
- Wi-Fi security: WPA2/WPA3 vulnerabilities, handshake capture, PMKID attacks, Aircrack-ng. Rogue APs, Evil Twin, Karma. Defence: SSID segmentation, certificates, WIDS, WPS deactivation.
- Deliverable: Remediation plan for a critical CVE + mini Wi-Fi audit.
Day 4: Web application penetration testing and mobile security
- Web security: HTTP/HTTPS protocols, cookie management, sessions, JWT. Burp Suite (proxy, repeater, intruder, decoder).
- OWASP Top 10 2021 and trends for 2026: SQL injections (union-based, blind, time-based, SQLMap), XSS (reflected, stored, DOM-based), CSRF, SSRF, IDOR, upload vulnerabilities, LFI/RFI, path traversal, authentication bypass, broken access control. INE lab on DVWA/Juice Shop.
- Defence perspective: secure coding, prepared queries, CSP, WAF (ModSecurity, Cloudflare), SAST/DAST in CI/CD. Links to OWASP ASVS and ISO 27034, and DORA for the financial sector.
- Mobile security: OWASP Mobile Top 10, Android/iOS architectures, sandboxing. Static analysis with MobSF, basic reverse engineering (jadx). Defence: MDM/MAM, app shielding, certificate pinning.
- Deliverable: Web vulnerability report + mini APK audit.
Day 5: IoT, post-exploitation, Active Directory and final CTF
- IoT security: Attack surface (firmware, MQTT, CoAP, Zigbee and BLE protocols), exposure via Shodan (example: Belgium). Risks: default passwords, lack of updates, supply chain.
- Real-world cases: Mirai, IP cameras, OT/SCADA. Defence: network segmentation, dedicated VLANs, asset inventory, hardening. Link to NIS 2 for critical sectors.
- Privilege escalation: Linux (SUID, sudo, cron, kernel exploits, LinPEAS) and Windows (services, registry, tokens, WinPEAS). Active Directory: enumeration (BloodHound, ADRecon), Kerberoasting, AS-REP roasting, pass-the-hash/ticket, Mimikatz. Pivoting with proxychains, SSH tunnelling.
- Reporting and CTF: Professional report (structure, findings, severity, remediation plan) aligned with ISO 27005/EBIOS RM. Final team-based CTF: compromising an entire network.
- Defence perspective: AD tiering, Red Forest/ESAE, EDR/XDR, MDR, behavioural detection (Sysmon, Sigma, SIEM), ‘Assume Breach’ strategy. Synergy between Rangers’ offensive capabilities and governance.
- Presentation of the CRPs and overview of INE pathways (eJPT, eCPPT, eCPTX) and upcoming specialisations.
- PWPGL: Pizza & Wine Party & Gaming – LAN party for the bravest in the evening! :) Featuring a surprise guest from the cyber security world.
On the way to the cyber world
Holders of a CRP are well-placed to go on to the specialist Rangers training courses (due in 2026 and 2027), then aim for the CEH or eCPPT at INE, followed by the OSCP or GIAC certifications. Rangers trains you, coaches you, explains things to you and prepares you so that you’re fully equipped for success!
The supplementary Rangers modules are designed as an introduction. Participants do not emerge as mobile or wireless penetration testers, or dark web investigators, after just a few hours. The aim is to lay the foundations and inspire you to go further through the specialist training courses that follow on the Rangers pathway.
Sign up now for our certification course, run in partnership with INE International.
Secure your professional future and that of your organisation by mastering offensive techniques to check whether your organisation is secure. Don’t let threats compromise your data – sign up now and become a cybersecurity expert, safeguarding your organisation’s critical information!