1971 Nov
The first Unix manual documents sh
The first Unix Programmer's Manual recorded sh as the command interpreter. Early shell execution already connected command files, process creation, redirection, and pipes.
← Penetration Tester career guide
Security
Penetration Tester timeline
How the field of a Penetration Tester got here: the sourced milestones from every published course of this career, on one axis.
1971 to 2025
82 milestones across 9 courses
- Core
- Supporting
- Specialization
The axis stretches toward recent years, where most milestones fall. Bars count milestones per year; dots are single milestones.
Before 1990
4 milestones
1978 Nov
Bourne describes the Unix shell as a command programming language
Stephen Bourne documented control flow, variables, parameter passing, return codes, redirection, pipelines, and commands read from files. Those concepts established the core shape of later Bourne-family scripting.
1983
KornShell extends the Bourne-family scripting model
David Korn's first ksh version added a richer command and scripting language at Bell Labs. Its 1988 language later served as source material for the POSIX shell standard.
1989 Jun
Bash reaches its first public beta
Bash appeared as a free Bourne-family shell for the GNU system. It combined scripting compatibility goals with features influenced by KornShell and the C shell.
1990s
9 milestones
1992 Sep
POSIX standardizes the shell and utilities
IEEE 1003.2 established a portable shell-language and utility baseline. Script authors could target a published contract instead of one vendor's interpreter behavior.
1995
SATAN makes automated security scanning public
Dan Farmer and Wietse Venema release SATAN, an early tool that scans networks for known weaknesses, making automated security testing available to a wide audience.
1997
Kerberos becomes Windows' default domain authentication protocol
Windows 2000 development adopted Kerberos version 5 as the default authentication protocol for domains. The design that enables later ticket abuses, including the KDC's trust in its own krbtgt key, dates from this decision.
1997 Sep 1
Nmap is first released
Nmap's publication consolidated multiple port-scanning techniques behind one tool and interface. Network discovery became a repeatable starting point for security assessment.
1998
SQL injection becomes a named attack class
Early public writing by researcher Jeff Forristal marks the start of SQL injection as a recognized web attack class, giving testers a label for a class of input-handling flaws.
1998 Apr 4
Nessus is publicly released
The first Nessus release paired a scanner engine with vulnerability checks. It strengthened the automated hypothesis stage that penetration testers still distinguish from manual validation.
1998 Dec 12
Nmap 2.00 adds remote operating-system detection
Packet-response fingerprints extended network assessment from port reachability toward host-platform inference. Testers could use one discovery tool to form more specific service and exploit hypotheses.
1999
Microsoft engineers name cross-site scripting
Microsoft security engineers coin the term cross-site scripting for the client-side attack class where a site renders untrusted input, giving the emerging web security field a shared term.
1999 Jun
HTTP/1.1 is standardized
RFC 2616 standardized HTTP/1.1. Its method, header, and response model became a common transport surface for web APIs and their security controls.
2000s
24 milestones
2000 Dec 7
Nmap receives an official Windows port
Nmap 2.54BETA16 expanded the same network-discovery workflow beyond Unix-like tester hosts. Cross-platform availability made the tool easier to place inside varied assessment environments.
2001
WebGoat gives testers a legal training target
OWASP releases WebGoat, a deliberately vulnerable web application, so testers and developers can practice finding and exploiting weaknesses without authorization concerns.
2001 Aug
Passive WEP key recovery demonstrated
Researchers implement the FMS attack against WEP with administrator permission. The result exposes a failure in WEP key handling.
2001 Sep 9
OWASP is founded
Mark Curphey starts the Open Web Application Security Project (OWASP), giving web application security a permanent community home for standards, tools, and training.
2003
First OWASP Top Ten is published
OWASP publishes the first OWASP Top Ten, a consensus list of the most critical web application security risks. It becomes the shared vocabulary for describing and prioritizing web risk.
2003
Original OWASP Top 10 published
OWASP published the first Top 10 list, establishing a shared awareness document for web application security risks.
2003 Jul 21
Nmap service and version detection enters testing
Protocol-aware probes connected open ports to likely applications and versions. The change strengthened enumeration while preserving the need to validate fingerprints before claiming exploitability.
2003 Oct 6
Metasploit 1.0 is released
Metasploit packaged reusable exploit modules in a shared framework. Testers gained a common platform for moving from a suspected weakness to controlled exploit validation.
2004
First Top 10 update
OWASP updated the original list, beginning a recurring cycle of revisiting the web application risks practitioners use for awareness.
2004
IEEE 802.11i security amendment
The amendment extends 802.11 MAC security. It provides a standards foundation for robust security networks.
2004
OWASP Testing Guide v1.0 is released
OWASP publishes the Web Application Penetration Checklist and then Testing Guide v1.0 in December, the first version of the structured methodology that becomes the Web Security Testing Guide.
2004 Aug 14
OWASP publishes its Web Application Penetration Checklist
OWASP WSTG version 1.1 organized web application checks into a public reference. Application testing gained a target-specific structure beyond general network assessment.
2004 Aug 30
Whoppix packages a portable security-testing environment
The live distribution bundled assessment tools for work on a restricted, air-gapped engagement. It began the project lineage that later produced BackTrack and Kali Linux.
2006
sqlmap project starts
The sqlmap project is registered on SourceForge and its early versions test MySQL injection. It grows into the standard automated tool for detecting and exploiting SQL injection.
2006 May
BackTrack combines two security distributions
The WHAX and Auditor projects merged into a shared live testing environment. A portable tool platform reduced setup work across constrained engagements.
2006 May 26
BackTrack 1 combines earlier testing distributions
WHAX and Auditor efforts converged into a shared live environment for security assessment. A maintained toolkit distribution reduced setup work between engagements.
2006 Jun
Ubuntu plans dash as its sh implementation
Ubuntu's specification moved the system sh link from Bash to dash while retaining Bash as the user shell. The change made undeclared Bash syntax in system scripts an operational portability defect.
2007
Third Top 10 edition
The 2007 update continued the list as a maintained reference rather than a one-time catalog of vulnerabilities.
2007 Jan
Apple introduces iPhone
Apple introduced iPhone as a software-rich handheld platform. Mobile assessment increasingly had to consider device-side applications, platform controls, and remote services together.
2007 Feb 10
OWASP Testing Guide v2.0 expands the methodology
Testing Guide v2.0 broadens the web testing methodology across more application security categories, cementing the guide as the reference for structured web penetration testing.
2008 Jul
Apple opens the App Store
Apple opened the App Store in July 2008. Third-party distributed apps became a mainstream security assessment target.
2008 Sep
Android 1.0 releases publicly
Android 1.0 released publicly in September 2008. Testing practice expanded across a second major mobile platform with its own application and permission model.
2008 Sep
NIST assessment guide published
SP 800-115 includes passive and active wireless scanning within a planned assessment. Wireless testing is tied to scope and evidence handling.
2008 Sep
NIST publishes SP 800-115
The guide formalized planning, discovery, attack, reporting, rules of engagement, and operational risk for technical security assessments. It placed penetration testing inside a broader assessment program rather than treating exploitation as the whole activity.
2010s
27 milestones
2010
OWASP Top 10:2010 released
The 2010 edition refreshed the risk categories for the changing web application landscape.
2010 Apr
OAuth 1.0 is published as an RFC
RFC 5849 published OAuth 1.0. It documented a signed-request approach to delegated access before OAuth 2.0 replaced it.
2010 Sep 6
ZAP 1.0.0 is released
ZAP 1.0.0 is released as an open-source intercepting proxy and scanner. It becomes an OWASP project and the most-used free tool for manual web application testing.
2011 Sep
OWASP Mobile Top 10 appears at AppSec USA
OWASP AppSec USA material documented the Mobile Security Project and Mobile Top 10 risks. It gave practitioners a shared vocabulary for recurring mobile weaknesses.
2011 Dec
WPS PIN weakness disclosed
Research identifies a weakness in PIN enrollment. Wireless assessment must examine enrollment separately from WPA passphrase strength.
2012
ShellCheck brings static analysis to shell scripts
The ShellCheck project began cataloging defects in quoting, tests, commands, and portability. Script review gained an automated layer that reasons from the declared shell language.
2012 Feb
NIST WLAN lifecycle guidance
SP 800-153 addresses security across WLAN design, deployment, maintenance and monitoring. AP and client controls belong to the same lifecycle.
2012 Oct
OAuth 2.0 authorization framework is published
RFC 6749 standardized OAuth 2.0 authorization grants and access tokens. API security practice gained a common framework for delegated authorization.
2013
OWASP Top 10:2013 released
The 2013 edition revised the list and broadened some category scopes, affecting how teams mapped findings to risk categories.
2013 Mar 13
Kali Linux 1.0 succeeds BackTrack
The Debian-based distribution replaced BackTrack with a rebuilt development and packaging model. Penetration testers gained a maintained platform for assembling the discovery, validation, evidence, and reporting toolchain.
2014
Kerberoasting is presented publicly
Tim Medin demonstrated requesting service tickets for SPN accounts and cracking them offline, converting an ordinary ticket request into a password recovery attack. The technique remains one of the most common path steps because it needs no privilege at all.
2014 Sep
Shellshock changes Bash environment handling
The Shellshock disclosures showed that crafted environment values could trigger unintended command execution in vulnerable Bash versions. Fixes changed how exported functions were represented and imported.
2014 Sep 17
OWASP releases WSTG version 4.0
The fourth major guide release refreshed the public framework for web application testing. Versioned scenarios gave reports a stable way to name application coverage.
2014 Sep 17
Web Security Testing Guide v4.0 is released
The renamed Web Security Testing Guide v4.0 organizes tests into categories with stable WSTG identifiers, so testers can cite a specific check across tools and reports.
2014 Nov
MS14-068 escalates any domain user to domain admin
Microsoft's security bulletin documented a Kerberos KDC signature validation flaw allowing forged tickets claiming privileged group membership. The patch closed the flaw for updated systems, but unpatched estates still carry the edge.
2015 May
JSON Web Token is standardized
RFC 7519 defined JSON Web Token claims and compact serialization. Token validation became an explicit API implementation concern.
2015 Sep
PKCE extends OAuth authorization code flow
RFC 7636 specified proof key for code exchange. Public clients gained a standardized mitigation for authorization-code interception.
2016
BloodHound is released at BSides
BloodHound introduced attack path analysis as shortest-path queries over collected Active Directory relationship data. The demonstration showed hidden paths to Domain Admins that no checklist inspection surfaced, and the tool quickly became standard for both attackers and defenders.
2016
OWASP publishes the 2016 Mobile Top 10 final list
OWASP recorded a final 2016 Mobile Top 10 list. Mobile assessment could compare recurring risk categories across apps while retaining app-specific evidence.
2017
KRACK disclosed
Key reinstallation research exposes nonce-reuse risks in WPA2 exchanges. Password replacement alone does not repair the affected mechanism.
2017
OWASP Top 10:2017 released
The 2017 edition documented categories including injection, broken authentication, and sensitive data exposure.
2017 Mar
OWE specified in RFC 8110
The RFC specifies encryption without peer authentication. Passive confidentiality and network identity become explicit separate properties.
2018
PetitPotam-era coercion research reaches MS-EFSR
Coercion primitives in remote procedure interfaces, studied through 2018 and after, showed that ordinary protocol methods could force machines to authenticate to attacker-chosen hosts. These primitives became the standard way to feed relay and unconstrained delegation capture chains.
2018 Jun
WPA3 certification introduced
Wi-Fi Alliance introduces SAE-based personal authentication and required PMF for WPA3 connections. Transitional operation retains WPA2 compatibility.
2019
Dragonblood findings disclosed
Research examines SAE and EAP-pwd downgrade and side-channel weaknesses. Implementation updates and transition choices remain part of assessment.
2019
OWASP publishes its first API Security Top 10
OWASP released its first API-specific Top 10. It established a shared vocabulary for broken object authorization and resource limits.
2019 Jan
Wagging the Dog publishes RBCD abuse
Elad Shamir's research showed that S4U2Proxy accepts non-forwardable tickets under resource-based constrained delegation, reducing host takeover to one writable attribute plus any SPN-bearing account. Combined with relayed machine authentications into LDAP, this became the default modern takeover chain.
2020s
18 milestones
2020 Aug
Zerologon (CVE-2020-1472) resets domain controller trust
The Netlogon remote protocol's use of AES-CFB8 with a zero initialization vector allowed an attacker to reset a domain controller's machine account password. Where reachable, the flaw compressed domain takeover to minutes and forced urgent patching campaigns.
2020 Dec
Bronze bit (CVE-2020-17049) extends delegation bypasses
A Kerberos S4U flaw allowed the forwardable flag to be forged in constrained delegation requests, bypassing delegation restrictions. Microsoft's December 2020 patches closed it, adding another historic edge that patch state decides.
2020 Dec 3
OWASP releases WSTG version 4.2
Version 4.2 added testing scenarios and revised chapters and layout. The guide continued separating target-specific web tests from a generic penetration-testing checklist.
2020 Dec 3
WSTG v4.2 updates the test suite
WSTG v4.2 refreshes existing test scenarios and adds new ones while keeping the stable identifier format, remaining the current reference version for web application testing.
2021
OWASP Top 10:2021 released
OWASP introduced new categories and naming changes that emphasized root causes over symptoms, using a formalized data-collection process.
2021 May
JWT best current practices are published
RFC 8725 documented JSON Web Token best current practices. It emphasized explicit algorithm, issuer, audience, and token-kind checks.
2021 May 11
FragAttacks disclosed
Research finds fragmentation and aggregation design flaws plus implementation defects. Assessment needs patch evidence across Wi-Fi security modes.
2021 Jul
OWASP releases MSTG version 1.2
OWASP released MSTG v1.2 with updated test material, tools, and platform guidance. The guide continued to connect verification work with changing Android and iOS practice.
2021 Sep 24
OWASP Top Ten 2021 ranks broken access control first
The 2021 Top Ten puts Broken Access Control at the top position, reflecting how frequently missing authorization checks lead to data exposure, and adds categories for insecure design and integrity failures.
2022
RBCD and Kerberoasting chains appear across ransomware intrusions
Adversary reporting through 2022, including SVR and ransomware crew tradecraft, recorded BloodHound collection, Kerberoasting, DCSync, and golden ticket use as routine steps. The techniques stopped being specialist knowledge and became the expected path model defenders must assume.
2023
OWASP releases MASVS 2.0
MASVS 2.0 simplified and clarified the standard while relying more on related industry standards. Testing details remained in MASTG during the transition.
2023
OWASP updates the API Security Top 10
The 2023 edition includes business-flow abuse, server-side request forgery, improper inventory management, and unsafe API consumption.
2023 Feb
CISA red team report publishes a complete attack path narrative
AA23-059A documented a three-month assessment that went from spearphishing through unconstrained delegation, DCSync of krbtgt, and golden tickets to deep persistence, undetected. The advisory's findings list read as a validation of the graph model, since no single step was exotic and the chain went uncaught.
2023 Aug
OWASP releases the current Mobile Top 10
OWASP recorded the initial release of the current Mobile Top 10 in August 2023. The list reflects a refreshed taxonomy for communicating mobile application risks.
2024 Jan
OWASP releases MASVS 2.1
MASVS 2.1 added the MASVS-PRIVACY category. Privacy became an explicit control area in the standard used to organize mobile assessment objectives.
2024 Jun
POSIX.1-2024 publishes Issue 8
IEEE and The Open Group published a new base specification including the shell and utilities volume. The portable contract remained an active standard rather than a frozen description of one historic shell.
2025
OWASP Top 10:2025 released
The 2025 edition updated the ten-category map, including software supply chain failures and mishandling of exceptional conditions.
2025 Jun
NIST publishes API protection guidance
NIST SP 800-228 organized controls across pre-runtime and runtime lifecycle stages for cloud-native systems.