SEC560: Enterprise Penetration Testing

Overview

Section 1 establishes the foundation for effective enterprise penetration testing by demonstrating the complete attack lifecycle through a miniature engagement before diving deep into reconnaissance and scanning techniques.

Students begin by witnessing a full credential stuffing attack that achieves initial access, immediately experiencing the penetration testing mindset and understanding how individual techniques combine into successful compromises. The section then methodically builds essential skills in infrastructure setup, Linux command-line proficiency, and professional pre-engagement practices before exploring the critical reconnaissance phase. By learning to gather organizational intelligence, identify infrastructure, harvest breached credentials, and enumerate employees through OSINT, students understand how real attackers prepare for targeted attacks.

The section concludes with comprehensive scanning instruction covering both Masscan for rapid large-scale port discovery and Nmap for detailed service enumeration, providing the technical foundation necessary for identifying attack surfaces and potential entry points into target environments.

Full Lab Details

• Lab 1.1: Credential Stuffing to a Breach
• Lab 1.2: Reconnaissance and OSINT
• Lab 1.3: Masscan
• Lab 1.4: Nmap

Full Topic Details

• Getting Started: This module establishes the foundational framework for enterprise penetration testing, introducing students to the essential mindset, concepts, and methodologies needed throughout the course.
• Miniature Engagement: This module provides a concentrated yet comprehensive introduction to the entire penetration testing workflow through a practical, hands-on demonstration of a complete attack.
• Building an Infrastructure: This module addresses the fundamental requirement for professional penetration testing by establishing robust, secure, and efficient testing environments for both operations and practice.
• Linux for Penetration Testers: This module provides essential Linux command-line skills and security concepts necessary for effective penetration testing, focusing on privilege structures, file permissions, and system reconnaissance.
• Pre-engagement: This module establishes the critical foundation for successful penetration testing through comprehensive planning, scoping, authorization procedures, and Rules of Engagement that ensure legal compliance and operational safety.
• Reconnaissance Overview: This module establishes the critical foundation for effective penetration testing through systematic intelligence gathering and analysis using both passive and active reconnaissance techniques.
• Scanning Goals, Types, and Tips: This module establishes the strategic framework for active network reconnaissance, transforming passive intelligence gathering into direct target interaction through carefully orchestrated scan types.
• Port Scanning: This module provides deep technical understanding of how penetration testers systematically discover open services on target systems through protocol manipulation and response analysis of TCP and UDP communications.
• Masscan: This module introduces a revolutionary approach to high-speed port scanning using stateless architecture that enables orders-of-magnitude performance improvements over traditional tools for large-scale network reconnaissance.
• Nmap: This module explores the capabilities of the world's most widely used network reconnaissance tool, demonstrating how it has evolved from a simple port scanner into a comprehensive vulnerability assessment platform.

Overview

Section 2 transitions from reconnaissance and basic scanning to gaining initial access through multiple attack vectors that mirror real-world penetration tests.

The section begins by advancing Nmap skills through version detection, operating system fingerprinting, and the powerful Nmap Scripting Engine that automates vulnerability detection and detailed service enumeration. Students learn to leverage these scanning capabilities to identify exploitable services and misconfigurations. The section then systematically addresses initial access techniques, starting with password-based attacks including password spraying and targeted password guessing against SMB and SSH services. Cloud environments receive comprehensive coverage through Azure and Entra ID reconnaissance, username enumeration, and password spraying attacks that exploit single-factor authentication in Microsoft cloud services. Network-based attacks using Responder demonstrate how attackers capture and relay NTLM authentication to gain unauthorized access without valid credentials.

Finally, the Metasploit Framework provides hands-on experience with exploit modules, payload generation, and Meterpreter sessions that establish persistent command and control. By combining these techniques, students understand the multiple paths attackers use to breach perimeter defenses and establish initial footholds in target environments.

Full Lab Details

• Lab 2.1: Version Scanning, OS Detection, NSE, and GoWitness
• Lab 2.2: Password Guessing
• Lab 2.3: Azure Recon and Password Spraying
• Lab 2.4: Responder
• Lab 2.5: Metasploit and Meterpreter

Full Topic Details

• Nmap OS & Version Scanning
• Netcat
• GoWitness and EyeWitness
• Vulnerability Scanning
• Nmap Scripting Engine
• Initial Access
• Password Guessing
• Azure Intro
• Entra ID
• Azure Recon
• Azure Password Attacks
• Sniffing and Relaying
• Responder
• Exploitation
• Exploit Categories
• Metasploit and Meterpreter

Overview

Section 3 focuses on the critical post-exploitation phase where penetration testers must quickly establish situational awareness, harvest credentials, escalate privileges, and maintain access before defensive measures detect and respond to the intrusion.

The race between attacker progression and defender response begins immediately after initial access, making efficient post-exploitation techniques essential for successful penetration tests. Students learn to extract password hashes from compromised Windows systems using both Metasploit's built-in capabilities and the powerful Mimikatz tool that harvests plaintext passwords, Kerberos tickets, and NTLM hashes from memory. These credentials enable lateral movement and privilege escalation across the target environment. Offline password cracking with Hashcat transforms captured hashes into plaintext passwords through dictionary attacks, rule-based mutations, and brute force techniques, revealing password patterns that inform security recommendations.

Modern command and control requires understanding frameworks beyond Metasploit, so the Sliver C2 framework provides hands-on experience with contemporary red team tooling including implant generation, multiplayer capabilities, and advanced payload execution through techniques like execute-assembly. Payload generation and delivery receive comprehensive coverage, addressing how to create and deliver malicious payloads while evading antivirus and endpoint detection systems. Situational awareness forms the foundation for all subsequent actions, teaching students to enumerate system information, running processes, network connections, and security controls on both Windows and Linux systems, with the Seatbelt tool automating comprehensive Windows enumeration.

Finally, Windows privilege escalation techniques teach students to identify and exploit common misconfigurations including unquoted service paths, weak file permissions, vulnerable services, and insecure registry settings that enable standard users to execute code as SYSTEM, demonstrating why proper system hardening remains essential for enterprise security.

Full Lab Details

• Lab 3.1: MSF psexec, hashdump, and Mimikatz
• Lab 3.2: Hashcat
• Lab 3.3: Sliver
• Lab 3.4: Payloads
• Lab 3.5: Seatbelt
• Lab 3.6: Windows Privilege Escalation

Full Topic Details

• Passwords and Credential Access
• Password Representations
• Obtaining Password Hashes
• Hashcat
• Assumed Breach
• Command and Control (C2)
• Sliver
• Payloads
• Post-Exploitation
• Situational Awareness
• Linux Situational Awareness
• Windows Situational Awareness
• Seatbelt
• Privilege Escalation
• Windows Privilege Escalation

Overview

Section 4 focuses on Active Directory-specific attacks that enable domain privilege escalation and lateral movement across enterprise networks. Understanding Kerberos authentication forms the foundation for these attacks, as Active Directory relies entirely on Kerberos for authentication in modern Windows environments. Students learn how Kerberos tickets work, how service principal names identify services, and critically, how the Kerberoasting attack exploits the protocol by requesting service tickets encrypted with service account passwords that can be cracked offline without alerting defenders.

BloodHound revolutionizes Active Directory attack planning by representing the directory as a graph database, revealing complex attack paths from compromised accounts to domain administrators that would be nearly impossible to identify manually. The tool analyzes permissions, group memberships, local administrator rights, and session information to map routes for privilege escalation and lateral movement. Active Directory Certificate Services introduces additional attack vectors through template misconfigurations, with detailed coverage of ESC1 (allowing certificate requests for arbitrary users), ESC4 (vulnerable certificate template permissions), and ESC8 (NTLM relay to web enrollment).

These attacks frequently provide paths to domain dominance even when other privilege escalation routes have been hardened. Lateral movement techniques receive comprehensive treatment for both Windows and Linux attack platforms, covering native Windows remote administration tools, SSH tunneling with local and dynamic port forwarding for accessing systems across network boundaries, and the powerful Impacket toolkit that implements Windows protocols in Python for remote command execution, file manipulation, and credential dumping without uploading traditional tools. Pass-the-Hash attacks enable credential reuse without cracking passwords, using captured NTLM hashes directly for authentication to access additional systems.

Finally, pivoting techniques using both Metasploit and modern C2 frameworks teach students to use compromised systems as stepping stones to reach otherwise inaccessible network segments, essential for demonstrating the full scope of potential compromise in network-segmented environments.

Full Lab Details

• Lab 4.1: Kerberoasting
• Lab 4.2: BloodHound
• Lab 4.3: Active Directory Certificate Services
• Lab 4.4: Lateral Movement from Windows
• Lab 4.5: Lateral Movement from Linux
• Lab 4.6: Impacket
• Lab 4.7: C2 Pivoting and Pass-the-Hash

Full Topic Details

• Kerberos
• Kerberoasting
• BloodHound
• Active Directory Certificate Services (AD CS) and Attacks
• Lateral Movement from Windows
• Lateral Movement from Linux
• Impacket
• Pass-the-Hash
• Pivoting
• C2 Pivoting and Pass-the-Hash

Overview

Section 5 addresses the advanced topics of maintaining persistence, evading detection, achieving domain dominance, and exploiting cloud infrastructure that distinguish sophisticated penetration tests from basic vulnerability assessments.

Persistence mechanisms receive comprehensive coverage, teaching students multiple techniques for surviving system reboots including registry run keys, scheduled tasks, Windows services, WMI event consumers, and startup folder manipulation. Understanding persistence helps both offensive teams maintain access during long-term engagements and defensive teams identify indicators of compromise during incident response.

Modern defensive technologies pose significant challenges for penetration testers, so this section addresses evasion techniques including bypassing the Antimalware Scan Interface (AMSI) that integrates with PowerShell, disabling Windows Defender through policy modifications, evading behavioral detection in endpoint detection and response products, and circumventing application control solutions like AppLocker by abusing trusted Windows binaries such as MSBuild to execute malicious code.

Professional reporting forms a critical component of penetration testing value delivery, so students learn effective reporting practices including executive summaries, technical finding documentation, risk assessment and prioritization, reproduction steps with evidence, and actionable remediation recommendations that enable organizations to improve their security posture based on test results.

Advanced Active Directory attacks enable domain dominance through techniques that extend beyond standard privilege escalation, including Pass-the-Ticket attacks that reuse stolen Kerberos tickets, Overpass-the-Hash (also called Pass-the-Key) that requests Kerberos tickets using NTLM hashes, DCSync attacks that impersonate domain controllers to replicate password hashes for all domain accounts, skeleton key attacks that patch domain controller authentication to allow a master password, and NTDS.dit extraction that steals the entire Active Directory database containing all domain credentials. Golden ticket attacks create forged Kerberos ticket-granting tickets with arbitrary privileges and extended lifetimes, granting long-term unrestricted domain access that survives password changes. Silver tickets create forged service tickets for specific resources, providing stealthy access to individual services without contacting the domain controller. OpenID Connect vulnerabilities in web applications demonstrate how authentication protocol implementations can be exploited.

Finally, the section transitions to Azure security by covering Azure infrastructure including virtual machines, storage accounts, and networking, running commands on Azure VMs through various methods, understanding Azure role-based access control (RBAC) that governs permissions in cloud environments, and exploiting managed identities that allow Azure resources to authenticate to other services without stored credentials, demonstrating that comprehensive penetration tests must address both on-premises and cloud infrastructure in modern hybrid environments.

Full Lab Details

• Lab 5.1: Persistence
• Lab 5.2: MSBuild and Application Control Bypass
• Lab 5.3: Domain Dominance
• Lab 5.4: Golden Ticket
• Lab 5.5: Silver Ticket
• Bonus Lab: Running Commands via Azure

Full Topic Details

• Persistence
• Living Off Trusted Sites with Ngrok
• AV/EDR Evasion
• Application Control Bypass
• Reporting
• More Kerberos Attacks
• Domain Dominance
• Golden Ticket
• Silver Ticket
• OpenID
• Azure Infrastructure
• Running Commands in Azure
• Permissions in Azure

Overview

Section 6 provides the culminating experience of the course through a comprehensive Capture the Flag competition that requires applying all techniques learned throughout the six-day training.

Unlike individual labs that focus on specific skills, the CTF presents multiple interconnected target networks with realistic security controls, misconfigurations, and vulnerabilities that mirror actual enterprise environments. Students work in teams to conduct complete penetration tests from reconnaissance through privilege escalation, lateral movement, and objective completion, earning points for flags discovered along the way. The competition format encourages collaboration, creative problem-solving, and the ability to chain multiple techniques into successful attack paths. Success requires not just technical skills but also the penetration testing mindset developed throughout the course—knowing when to pivot strategies, how to prioritize targets, and understanding which techniques apply to specific situations. The competitive element adds urgency that simulates the time-sensitive nature of real penetration tests where defenders may detect and respond to activities.

After the CTF concludes, the section transitions to professional development guidance that helps students continue their penetration testing journey beyond the course. Cloud penetration testing resources address the growing importance of cloud security assessments, providing starting points for learning Azure, AWS, and GCP-specific attack techniques. GIAC GPEN certification preparation receives detailed attention, covering exam format, study strategies, indexing recommendations, and practice test approaches that maximize certification success.

Building effective home labs enables ongoing practice and skill development, with guidance on virtualization platforms, vulnerable machine resources, and network configuration for safe, legal practice environments. Advanced training environments like Game of Active Directory (GOAD) provide documented vulnerable Active Directory forests where students can practice complex attack chains in realistic but intentionally vulnerable environments. Additional resources point students toward bug bounty programs, vulnerable-by-design applications, and the broader information security community.

By combining the practical CTF experience with clear guidance for continuing education and skill development, Section 6 ensures students leave the course not just with current knowledge but with the resources and direction necessary for long-term success in penetration testing careers.

Full Lab Details

• CTF: Multi-Network Penetration Testing Competition applying all course techniques

Full Topic Details

• CTF Prep
• Next Steps