SEC504: Hacker Tools, Techniques, and Incident Handling

Experience SANS training through course previews.
Learn MoreLet us help.
Contact usBecome a member for instant access to our free resources.
Sign UpWe're here to help.
Contact UsAs cyberthreats grow more sophisticated, it is critical to proactively identify and address vulnerabilities before adversaries exploit them. SANS Offensive Operations delivers expert-led training across the entire attack surface, covering everything from penetration testing and red teaming to exploit development and hardware hacking. Through hands-on labs and industry-recognized certifications, we equip professionals to master real-world offensive techniques and adversarial tactics.
Use real-world tactics, tools and methodologies to identify, exploit, and remediate security vulnerabilities.
Learn adversary emulation, stealth, and evasion techniques to test and improve an organization's security posture against persistent threats.
Bridge the gap between offense and defense, to foster collaboration between red and blue teams and strengthen detection, response, and overall security resilience.
In one week, my instructor built a bridge from typical vulnerability scanning to the true art of penetration testing. Thank you, SANS, for making myself and my company much more capable in information security.
NVISO co-founder and SANS Senior Instructor, leading cybersecurity education in advanced adversary tactics. Experienced in offensive security with extensive background in penetration testing and ethical hacking across Europe.
Learn moreChristopher is a senior security analyst for Counter Hack and Operations Officer (S-3) for the Army National Guard's 91st Cyber Brigade. Through his work, he shares his unique insights into cyber security threats to prepare and inspire students.
Learn moreMoses has built an impressive career as a Network Architect, DevOps Engineer, and Information Security professional. Today, he works in the Offensive Operations space as a Red Team Operator and serves as the course author for SEC588.
Learn moreEuropean director of advanced assessment at Neuvik, specializing in penetration testing, red teaming, and adversary emulation. Passionate open-source contributor with extensive experience in offensive security technologies.
Learn moreJeff McJunkin, Rogue Valley InfoSec founder, has led Fortune 100 pen tests and shaped Core NetWars. His key role in SANS Holiday Hack Challenge and hands-on security innovations continue to elevate the industry, advancing defenses worldwide.
Learn moreLarry has revolutionized embedded device security with decades of hands-on offensive research, co-authoring SANS's flagship wireless and IoT penetration testing courses, and pioneering SBOM exploitation techniques for supply chain defense strategies.
Learn moreIn this role you will be challenged to look at problems and situations from the perspective of an adversary. The focus is on making the Blue Team better by testing and measuring the organization’s detection and response policies, procedures, and technologies. This role includes performing adversary emulation, a type of Red Team exercise where the Red Team emulates how an adversary operates, following the same tactics, techniques, and procedures (TTPs), with a specific objective similar to those of realistic threats or adversaries. It can also include creating custom implants and C2 frameworks to evade detection.
Explore learning pathIn this fairly recent job position, you have a keen understanding of both how cybersecurity defenses (“Blue Team”) work and how adversaries operate (“Red Team”). During your day-today activities, you will organize and automate emulation of adversary techniques, highlight possible new log sources and use cases that help increase the detection coverage of the SOC, and propose security controls to improve resilience against the techniques. You will also work to help coordinate effective communication between traditional defensive and offensive roles.
Explore learning pathApplication penetration testers probe the security integrity of a company’s applications and defenses by evaluating the attack surface of all in-scope vulnerable web-based services, clientside applications, servers-side processes, and more. Mimicking a malicious attacker, app pen testers work to bypass security barriers in order to gain access to sensitive information or enter a company’s internal systems through techniques such as pivoting or lateral movement.
Explore learning pathIn this role, you will work to find 0-days (unknown vulnerabilities) in a wide range of applications and devices used by organizations and consumers. Find vulnerabilities before the adversaries!
Explore learning pathEsta charla describe las tendencias en dichas disciplinas para poder responder de manera eficiente y eficaz antes los cibercriminales.
Discover how to install and run attacker tools to hunt vulnerabilities in your environment before the pentesters (or attackers!) do.
Moving red and blue teams out of their silos means building a continuous feedback loop that translates adversarial knowledge into actionable defensive countermeasures and real fixes. At the Solutions Summit for Hack & Defend 2025, we’ll present state of the art solutions that can help you to achieve this. Furthermore, with AI and automation everywhere, it’s easy to get buried in data. In this forum, we will show you solutions that can. help you speed up triage and investigations, while keeping human judgment in the loop.Key Points for 2025:Fast Turnaround: Move test findings into rules and controls without delayPurple-Team Drills: Run joint red/blue exercises to spot and close gapsAutomated Validation: Replay attacks and check defenses at scaleRisk-First Focus: Use simple threat models to target your highest-impact pathsAI with Purpose: Enrich alerts automatically, but keep analysts in controlJoin me, Ismael Valenzuela, author of SEC530, Defensible Security Architecture and Engineering and co-author of SEC568: Product Security Penetration Testing, and SANS senior instructor, as we turn offensive insights into stronger defenses at Hack & Defend 2025.
With the proliferation of multi-factor authentication, penetration testers need to apply existing tooling to manipulate even internal applications.