SEC560: Enterprise Penetration Testing

Overview

In this course section, you'll develop the skills needed to conduct a best-of-breed, high-value penetration test. We'll go in-depth on how to build a penetration testing infrastructure that includes all the hardware, software, network infrastructure, and tools you will need to conduct great penetration tests, with specific low-cost recommendations for your arsenal. We'll then cover formulating a pen test scope and rules of engagement that will set you up for success, including a role-play exercise. We'll also dig deep into the reconnaissance portion of a penetration test, covering the latest tools and techniques. The course section features hands-on lab exercises to learn about a target environment, including a lab using Spiderfoot to automate the discovery of information about the target organization, network, infrastructure, and users.

Exercises

• Linux for Pen Testers
• Formulating an Effective Scope and Rules of Engagement
• Organizational Recon
• Infrastructure Recon
• User/Employee Recon
• Automated Recon with Spiderfoot

Topics

• The Mindset of the Professional Pen Tester

• Building a World-Class Pen Test Infrastructure
• Creating Effective Pen Test Scopes and Rules of Engagement
• Detailed Recon Using the Latest Tools
• Mining Search Engine Results
• Reconnaissance of the Target Organization, Infrastructure, and Users
• Automating Reconnaissance with Spiderfoot

Overview

This course section focuses on the vital task of mapping the target environment's attack surface by creating a comprehensive inventory of machines, accounts, and potential vulnerabilities. We look at some of the most useful scanning tools freely available today and run them in numerous hands-on labs to help hammer home the most effective way to use each tool. We'll cover vital techniques for false-positive reduction so that you can focus your findings on meaningful results and avoid the sting of a false positive. And we'll examine the best ways to conduct your scans safely and efficiently. The section includes password guessing attacks, which are a common way for penetration testers and malicious attackers to gain initial access and pivot through the network. This action-packed section concludes with another common way to gain initial access: exploitation. We'll discuss many ways that exploits are used to gain access or escalate privileges, then examine how these exploits are packaged in frameworks like Metasploit and its mighty Meterpreter. You'll learn in-depth how to leverage Metasploit and Meterpreter to compromise target environments.

Exercises

• Getting the Most Out of Nmap
• Faster Scanning with Masscan
• OS Fingerprinting, Version Scanning In-Depth, Netcat for Penetration Testers, and EyeWitness
• The Nmap Scripting Engine
• Initial Access with Password Guessing with Hydra
• Comprehensive Metasploit Coverage with Exploits, Stagers, and Stages
• Strategies and Tactics for Anti-Virus Evasion and Application Control Bypass
• Exploitation with Metasploit and the Meterpreter Shell
• In-Depth Meterpreter Analysis, Hands-On

Topics

• Tips for Awesome Scanning
• Nmap In-Depth: The Nmap Scripting Engine
• Version Scanning with Nmap
• False-Positive Reduction
• Netcat for the Pen Tester
• Gaining Initial Access
• Password Guessing, Spraying, and Credential Stuffing
• Exploitation and Exploit Categories
• Exploiting Network Services and Leveraging Meterpreter

Overview

Once you've successfully exploited a target environment, penetration testing gets extra exciting as you perform post-exploitation, gathering information from compromised machines and pivoting to other systems in your scope. In this section we'll discuss a common modern penetration test style, the Assumed Breach, where initial access is ceded to the testers for speed and efficiency. Whether the testers gain access themselves or access is provided, the testers now identify risks that are not visible on the surface. You'll learn tools and techniques to perform privilege escalation attacks to gain elevated access on compromised hosts. Part of post-exploitation includes password dumping, and we'll perform cleartext password extraction with Mimikatz, and password cracking. You'll learn modern tools and techniques to perform better cracking attacks that will extend or upgrade your access in the target environment.

Exercises

• Identifying Insecurities in Windows with GhostPack Seatbelt
• Privilege Escalation on Windows
• Domain Mapping and Exploitation with Bloodhound
• Metasploit Psexec, Hash Dumping, and Mimikatz Kiwi Credential Harvesting
• Password Cracking with John the Ripper and Hashcat
• Attacking Nearby Clients with Responder

Topics

• Assumed Breach Testing
• Post-Exploitation
• Situational Awareness on Linux and Windows
• GhostPack's Seatbelt
• Password Attack Tips
• Retrieving and Manipulating Hashes from Windows, Linux, and Other Systems
• Extracting Hashes and Passwords from Memory with Mimikatz Kiwi
• Effective Password Cracking with John the Ripper and Hashcat
• Poisoning Multicast Name Resolution with Responder

Overview

This course sections zooms in on moving through the target environment. When attackers gain access to a network, they move, so you'll learn the same techniques used by modern attackers and penetration testers. You'll start by manually executing the techniques used for lateral movement, then move on to automation using a powerful toolset, Impacket, to exploit and abuse network protocols. We'll examine Windows network authentication, and you'll perform a pass-the-hash attack to move through the network without knowing the compromised accout'ss password. We'll examine C2 frameworks and use two widely known ones, [PowerShell] Empire and Sliver; discuss methods of evasion and application control bypasses; and use our access on one system as a pivot to access another system that is not directly from our attacker system.

Exercises

• Lateral Movement and Running Commands Remotely with WMIC and by Creating Malicious Services
• The Impacket Framework
• Pass-the-Hash
• Command and Control Sliver and Teammates
• Leveraging [PowerShell] Empire for Post-Exploitation
• Bypassing Application Control Technology Using Built-in Windows Features
• Pivoting through SSH and an Existing Meterpreter Session

Topics

• Lateral Movement
• Running Commands Remotely
• Attacking and Abusing Network Protocols with Impacket
• Command and Control (C2) Frameworks and Selecting the One for You
• Using the Adversary Emulation and Red Team Framework, Sliver
• Post-Exploitation with [PowerShell] Empire
• Anti-Virus and Evasion of Defensive Tools
• Application Control Bypasses Using Built-In Windows Features
• Implementing Port Forwarding Relays via SSH for Merciless Pivots
• Pivoting through Target Environments with C2

Overview

This course section will zoom in on typical Active Directory (AD) lateral movement strategies. You'll gain an in-depth understanding of how Kerberos works and what the possible attack vectors are, including Kerberoasting, Golden Ticket, and Silver Ticket attacks. You'll use credentials found during the penetration test of the target environment to extract all the hashes from a compromised Domain Controller. With full privileges over the on-premise domain, we'll then turn our attention to the cloud and have a look at Azure principles and attack strategies. The integration of Azure AD with the on-premise domain provides interesting attack options, which will be linked to the domain dominance attacks we saw earlier during the course section. We'll wrap up with a discussion on effective reporting and communication with the business.

Exercises

• Kerberoast Attack for Domain Privilege Escalation
• Domain Dominance and Password Hash Extraction from a Compromised Domain Controller
• Silver Tickets for Persistence and Evasion
• Golden Ticket attacks for Persistence
• Azure Reconnaissance and Password Spraying
• Running Commands in Azure Using Compromised Credentials

Topics

• Kerberos Authentication Protocol
• Kerberoasting for Domain Privilege Escalation and Credential Compromise
• Persistent Administrative Domain Access
• Obtaining NTDS.dit and Extracting Domain Hashes
• Golden and Silver Ticket Attacks for Persistence
• Additional Kerberos Attacks including Skeleton Key, Over-Pass-the-Hash, and Pass-the-Ticket
• Effective Domain Privilege Escalation
• Azure and Azure AD Reconnaissance
• Azure Password Attacks and Spraying
• Understanding Azure Permissions
• Running Commands on Azure Hosts
• Tunneling with Ngrok
• Lateral Movement in Azure
• Effective Reporting and Business Communication

Overview

This lively session represents the culmination of the network penetration testing and ethical hacking course. You'll apply all of the skills mastered in the course in a comprehensive, hands-on exercise during which you'll conduct an actual penetration test of a sample target environment. We'll provide the scope and rules of engagement, and you'll work to achieve your goal to determine whether the target organization's Personally Identifiable Information is at risk. As a final step in preparing you for conducting penetration tests, you'll make recommendations about remediating the risks you identify.

Exercises

• A Comprehensive Lab Applying What You Have Learned Throughout the Course
• Modeling a Penetration Test Against a Target Environment

Topics

• Applying Penetration Testing and Ethical Hacking Practices End-to-End
• Detailed Scanning to Find Vulnerabilities and Avenues to Entry
• Exploitation to Gain Control of Target Systems
• Post-Exploitation to Determine Business Risk
• Merciless Pivoting
• Analyzing Results to Understand Business Risk and Devise Corrective Actions