SEC560: Network Penetration Testing and Ethical Hacking

Overview

In this course section, you'll develop the skills needed to conduct a best-of-breed, high-value penetration test. We'll go in-depth on how to build a penetration testing infrastructure that includes all the hardware, software, network infrastructure, and tools you will need to conduct great penetration tests, with specific low-cost recommendations for your arsenal. We'll then cover formulating a pen test scope and rules of engagement that will set you up for success, including a role-play exercise. We'll also dig deep into the reconnaissance portion of a penetration test, covering the latest tools and techniques, including hands-on lab exercises to learn about a target environment, as well as a lab using Spiderfoot to automate the discovery of information about the target organization, network, infrastructure, and users.

Exercises

• Linux for Pen Testers
• Formulating an Effective Scope and Rules of Engagement
• Organizational Recon
• Infrastructure Recon
• User/Employee Recon
• Automated Recon with Spiderfoot

Topics

• The Mindset of the Professional Pen Tester

• Building a World-Class Pen Test Infrastructure
• Creating Effective Pen Test Scopes and Rules of Engagement
• Detailed Recon Using the Latest Tools
• Mining Search Engine Results
• Reconnaissance of the Target Organization, Infrastructure, and Users
• Automating Reconnaissance with Spiderfoot

Overview

This course section focuses on the vital task of mapping the target environment's attack surface by creating a comprehensive inventory of machines, accounts, and potential vulnerabilities. We look at some of the most useful scanning tools freely available today and run them in numerous hands-on labs to help hammer home the most effective way to use each tool. We finish the module covering vital techniques for false-positive reduction so that you can focus your findings on meaningful results and avoid the sting of a false positive. And we examine the best ways to conduct your scans safely and efficiently. The section wraps up with password guessing attacks, which is a common way for penetration testers and malicious attackers to gain initial access as well as pivot through the network.

Exercises

• Getting the Most Out of Nmap
• Faster Scanning with Masscan
• OS Fingerprinting and Version Scanning In-Depth and EyeWitness
• The Nmap Scripting Engine
• GhostPack Seatbelt
• Netcat for the Pen Tester
• Initial Access with Password Guessing with Hydra

Topics

• Tips for Awesome Scanning
• Tcpdump for the Pen Tester
• Nmap In-Depth: The Nmap Scripting Engine
• Version Scanning with Nmap
• Identifying insecurities in Windows with GhostPack Seatbelt
• False-Positive Reduction
• Netcat for the Pen Tester
• Initial Access
• Password Guessing, Spraying, and Credential Stuffing

Overview

In this course section we look at the many kinds of exploits that penetration testers use to compromise target machines, including client-side exploits, service-side exploits, and local privilege escalation. We'll see how these exploits are packaged in frameworks like Metasploit and its mighty Meterpreter. You'll learn in-depth how to leverage Metasploit and the Meterpreter to compromise target environments. You'll also examine application control bypasses to circumvent the target organization's security measures, as well as methods to pivot through target environments - all with a focus on determining the true business risk of the target organization.

Exercises

• Client-Side Attacks with Metasploit
• Exploiting Network Services and Leveraging the Meterpreter
• Port Pivoting Relays
• Leveraging PowerShell Empire for Post-Exploitation
• Bypassing Application Control Technology Using Built-in Windows Features
• Pivoting by Creating Malicious Services and Leveraging the Wonderful WMIC Toolset

Topics

• Comprehensive Metasploit Coverage with Exploits, Stagers, and Stages
• Strategies and Tactics for Anti-Virus Evasion and Application Control Bypass
• In-Depth Meterpreter Analysis, Hands-On
• Implementing Port Forwarding Relays for Merciless Pivots
• How to Leverage PowerShell Empire to Plunder a Target Environment
• Lateral Movement with WMI and SC

Overview

Once you've successfully exploited a target environment, penetration testing gets extra exciting as you perform post-exploitation, gathering information from compromised machines and pivoting to other systems in your scope. This course section zooms in on pillaging target environments and building formidable hands-on command line skills. We'll then turn our attention to password cracking attacks, as well as numerous options for plundering password hashes from target machines, including the great Mimikatz Kiwi tool. We'll cover password cracking techniques and strategies using both John the Ripper and Hashcat. In addition, we'll look at pivoting techniques using SSH and the routing features in Metasploit. We'll cover Windows command line skills in-depth, including PowerShell's awesome abilities for post-exploitation. The course section wraps up with a discussion on effective reporting and communication with the business.

Exercises

• Metasploit Psexec, Hash Dumping, and Mimikatz Kiwi Credential Harvesting
• Pivoting with Metasploit and SSH
• Password Cracking with John the Ripper and Hashcat
• Sniffing and Cracking Windows Authentication Exchanges
• Metasploit Pivoting and Mimikatz Kiwi for Credential Harvesting
• PowerShell for Pen Testers

Topics

• Password Attack Tips
• Retrieving and Manipulating Hashes from Windows, Linux, and Other Systems
• Pivoting through Target Environments
• Extracting Hashes and Passwords from Memory with Mimikatz Kiwi
• PowerShell's Amazing Post-Exploitation Capabilities
• Tips for Effective Reporting

Overview

In this course section, we'll zoom in on typical Active Directory lateral movement strategies. You'll get an in-depth understanding of how Kerberos works and what the possible attack vectors are. We'll look at typical local privilege escalation techniques and User Account Control bypasses. We'll also map the internal domain structure using BloodHound to identify feasible attack paths. We'll use Mimikatz to perform domain dominance attacks, where domain replication is used to fully compromise the domain. With full privileges over the on-premise domain, we'll then turn our attention to the cloud and have a look at Azure principles and attack strategies. The integration of Azure AD with the on-premise domain provides interesting attack options, which will be linked to the domain dominance attacks we saw earlier during the course section.

Exercises

• Kerberos Attacks
• Domain Dominance through Different Paths
• Silver Tickets for Persistence
• Attacking Nearby Clients with Responder
• Domain Mapping and Exploitation with Bloodhound
• Effective Domain Privilege Escalation

Topics

• Kerberos Authentication Protocol
• Poisoning Multicast Name Resolution with Responder
• Domain Mapping and Exploitation with Bloodhound
• Effective Domain Privilege Escalation
• Persistent Administrative Domain Access
• Azure Authentication Principles and Attacks
• Azure AD Integration with On-Premise Domain
• Azure Applications and Attack Strategies

Overview

This lively session represents the culmination of the network penetration testing and ethical hacking course. You'll apply all of the skills mastered in the course in a comprehensive, hands-on workshop during which you'll conduct an actual penetration test of a sample target environment. We'll provide the scope and rules of engagement, and you'll work to achieve your goal to determine whether the target organization's Personally Identifiable Information is at risk. As a final step in preparing you for conducting penetration tests, you'll make recommendations about remediating the risks you identify.

Exercises

• A Comprehensive Lab Applying What You Have Learned Throughout the Course
• Modeling a Penetration Test Against a Target Environment

Topics

• Applying Penetration Testing and Ethical Hacking Practices End-to-End
• Detailed Scanning to Find Vulnerabilities and Avenues to Entry
• Exploitation to Gain Control of Target Systems
• Post-Exploitation to Determine Business Risk
• Merciless Pivoting
• Analyzing Results to Understand Business Risk and Devise Corrective Actions