The Pentester Guide is a hand-rolled Jekyll knowledge base of links

A static site with no theme and no build-time JavaScript

The project is described as a comprehensive, SEO-first penetration-testing knowledge base of tools, methodologies, cheatsheets, certifications and career resources, built as a hand-rolled Jekyll static site on GitHub Pages with no off-the-shelf theme. The engineering section spells out the choices: a custom dark-indigo design system consistent with the ZishanHack brand, an SEO pipeline with per-page meta and canonical tags, a robots.txt and a single-author sitemap with no junk URLs, a fully responsive layout, and static output for fast load. The stack is Jekyll and Liquid with no CSS framework and no build-time JavaScript, and the skills it is said to demonstrate are static site architecture, Liquid and Jekyll templating, accessible and responsive HTML and CSS, technical writing at scale, SEO, and Git and GitHub collaboration. The scope is seven deep dive modules, seven cheatsheet suites, more than ten curated resource directories and hundreds of hand-picked tools, commands and links. That last number is the reason the site exists and also the reason it is a link farm with a narrative on top.

The notes are the core, and the roadmap tells you the order

The important notes are listed at the top of the readme because they are what a returning visitor wants first. There is an Active Directory note, an All about Pentesting note covering methodology, a Bug Bounty Hunting Methodology note, a Bug Bounty Collections note, a CTF Box Manual, a Cyber Security Roadmap and a Tools index. The roadmap is the piece that gives the rest its shape, since it is the note that says what to learn and in what order, and the CTF Box Manual is the practice counterpart to it. Alongside those there is a separate wordlist and tool installer script, the Hackify project, linked from the important notes list, and a companion blog with write-ups at zishanhack.com. The repository root backs this up, with a notes/ directory, a CHEATSHEET/ directory, a BOOKMARK.md, a JOB.md for career material and a LESSONS.md, plus a shell/ directory and a scripts/ directory. The primary language on the repository is recorded as PHP, which reflects the mixed tooling rather than the site itself.

Practice platforms, deliberately vulnerable apps, and free labs

Three separate lists cover where to actually practise, and the split matters. The pentesting practice platforms section is twelve entries with a free or paid label on each, including VulnHub, VulnMachines, the PortSwigger Web Security Academy, TryHackMe, pwnable.kr, pwnable.tw, HackTheBox, root-me, Pentester Academy, Pentester Lab, the standoff365 hackbase and LabEx, with the readme noting that VulnHub, VulnMachines, the Web Security Academy, pwnable.kr, pwnable.tw and root-me are free. The FOSS Labs list is different in kind, since these are intentionally vulnerable applications you run yourself: Vulhub, the Metasploitable3 box, OWASP Juice Shop, DVWA, WebGoat, Kubernetes GOAT, Wrong Secrets, SQLi Lab, the HackerOne CTF and a link to a wider awesome vulnerable app list. The bug bounty hunting platforms section then names the programs themselves, HackerOne, Bugcrowd, Intigriti, YesWeHack, Standoff365, RedStorm, Zerocopter, OpenBugBounty, Immunify Web3 and HackenProof, with a separate short list of independent pentesting platforms, Yogosha and Synack, and a zero day market section for CrowdFense, Zerodium and ZeroZenx.

The certification table includes prices, and they move

The certifications section is a numbered list of fourteen certifications with a price attached to each, and the prices are the most useful and the most fragile part of it. INE eJPT and AlteredSecurity CRTP are both $249, TCM Security PNPT is $499, INE eCPPT is $599, Offensive Security PEN-200 for OSCP is $1749, the HackTheBox CPTS with an annual Silver plan is $490, PEN-300 for OSEP is $1649, the Microsoft Certified Azure Security Engineer Associate is $146, a CompTIA Security+ exam voucher is $500, CREST CRT is $500, ISC2 CISSP is $750, ISC2 CCSP is $599, and two SANS courses, SEC560 for GPEN and SEC660 for GXPN, are $2,499 each. The readme adds a note that price may vary, which is a polite way of saying these figures were true when the page was written. For anyone budgeting a certification path, the sensible move is to use the list for ordering and shortlisting and then check the current price with the provider, since the table mixes vendor training bundles, exam vouchers and membership subscriptions and those move on different schedules.

The remaining sections are link collections and one page about the author

The contents list also includes a section on the best operating system for hacking, which names Kali Linux from OffSec, ParrotSec Security Edition and BlackArch, and an Awesome Links section that opens with The Book of Secret Knowledge. There is a Hackers Manuals section and an About Me section. The readme ends with the sections you would expect in a personal knowledge base: a CNAME file for the custom domain, a _config.yml for the Jekyll configuration, a _layouts/ directory for the hand-rolled templates, a robots.txt for the crawler policy, the notes/ directory for the long form material, the CHEATSHEET/ directory, a scripts/ directory and a shell/ directory. The git history and the last push date are the only signal about upkeep, and with the last push on 2026-10-16 and no tagged releases, this is a project that moves when the author has something to add.

Where this is the wrong place to learn

Three limits are worth naming. The first is that it is a link farm, so the value depends on the links staying alive, and link rot in a list this long is a matter of time. The second is depth. The notes are summaries that point onward, and for a technique you do not yet understand, a summary of a summary is not a substitute for the primary source, whether that is the original paper, the vendor documentation or the tool's own manual. The third is that the site is a personal project with a single author and no release process, so there is no version, no changelog and no guarantee that a page you bookmarked today says the same thing next year, and the price list proves the point. None of that makes it a poor starting point, because the alternative for most people is a search engine with a dozen half-relevant results, and a hand-curated map with a roadmap is a better first move than a random query. The mistake to avoid is treating the summary as the end of the learning.

Editorial conclusion

The Pentester Guide suits a learner who wants one page to start from rather than a dozen tabs, and it suits someone who wants to see a knowledge base built without a theme, a CSS framework or build-time JavaScript. It is the wrong tool for a deep reference on a single technique, since the entries are summaries and link lists rather than full writeups, and it is the wrong place to look for a tool that stays current, because the links and prices go stale and the site has no release cadence. Before relying on it, follow the links rather than the summaries, and read the notes in the order the roadmap suggests if you are starting from nothing. The last push was on 2026-10-16 and the repository publishes no releases.

Frequently asked questions

Official sources

1. Issues
2. License: GPL-3.0
3. Project website
4. README
5. ZishanAdThandar/pentest on GitHub