SEC560: Enterprise Penetration Testing

Section 1 begins with a credential stuffing attack to introduce the penetration testing mindset then guides students through infrastructure setup, Linux fundamentals, and pre-engagement planning. It dives into reconnaissance using OSINT to gather organizational intelligence, concluding with scanning via Masscan and Nmap to identify active hosts and services.

Section 2 expands on Nmap’s advanced scanning with version and OS detection plus scripting for vulnerabilities. Students then explore initial access through password attacks, Azure and Entra ID spraying, and network exploits using Responder, Metasploit, and Meterpreter to gain and control compromised systems.

Section 3 focuses on post-exploitation, teaching credential access with Mimikatz, Metasploit, and Hashcat. Students build C2 skills with Sliver, craft evasive payloads, and use tools like Seatbelt for situational awareness on Linux and Windows. The section ends with Windows privilege escalation techniques to gain admin access.

Section 4 explores Kerberos and Kerberoasting to crack service accounts, plus BloodHound for attack path mapping and ADCS exploitation for privilege escalation. Students practice lateral movement using SSH, Impacket, and native tools, then perform Pass-the-Hash and pivoting with Metasploit and C2 frameworks.

Section 5 teaches persistence via registry edits, tasks, and WMI while evading AMSI and EDR defenses. Students learn professional reporting, advanced AD attacks like Pass-the-Ticket, DCSync, and Golden/Silver tickets, then shift to cloud exploits targeting Azure authentication, RBAC abuse, and managed identities.

Section 6 culminates in a team-based Capture the Flag event applying all learned skills across target networks. Afterward, students explore next steps with cloud pentesting resources, GIAC GPEN prep, home lab guidance, and advanced training like Game of Active Directory to refine attack mastery.