Description

Before the penetration testing team could start to analyze and conduct a series of tests and attacks, the team needs to gather data to construct a better plan of action. In this module, the participant will go through the basics of information gathering and reconnaissance.

Technical content

• Passive Information Gathering
  o The OSINT Framework
  o Monitoring Personal and Corporate Blogs
  ▪ Collecting Employee Personal Information
  ▪ Harvesting Organization Emails
  o Google-Dorks
• Finding Web directories and files
  o Using Brute-Forcing Techniques
  o Brute-Forcing Tools
  ▪ Dirbuster
  ▪ Dirb
  o Identifying Admin Pages
  o XSS and SQL Injections
  o Dictionary Attacks
  o Hybrid Attacks

Description

After gaining the basic information about the network and employees, testers can move on to scanning and gathering further intelligence on their target machines and systems. In this module, the participants will learn the process of identifying possible exploits and making up an assessment of potential risks.

Technical content

• Active Information Gathering
  o NMAP Ports Scanning
  Port Identification
  Scanning for OS Version
  Uncovering Services Versions
  Aggressive Scanning
  o DNS Enumeration
  Dig and Host for Basic Queries
  DNSrecon
  DNS Zone Transfer
  • Identifying vulnerability and exploits
  o NSE Scripting
  o Banner-Grabbing Methods
  o Vulnerabilities Detection Methods
  o Shodan Search Engine
  o Finding Exploits
  Common Vulnerabilities and Exposures (CVE)
  MITRE Database
  Searchsploit
  Exploit-Suggested
  o Github Tools
  o Automating the Scanning

Description

In this module, the participants will learn to use the knowledge they gained in the first two phases to gain access, either using an existing exploit or by brute-forcing the way into the network. After gaining control of the target, the participants will learn to abuse existing services to elevate their permissions.

Technical content

• Finding a way in
  o Introduction to Metasploit Framework
  ▪ Auxiliaries and Scanners
  ▪ Exploit and Post-Exploitation
  ▪ Privesc and Shell-Escapes
  o Social Engineering
  ▪ Social Fish
  ▪ SET Toolkit
  o Brute-forcing services
  ▪ CUP and Crunch
  ▪ Hydra Attacks
  ▪ Crowbar
• Gaining access through Wi-Fi
  o Wi-Fi Basics
  ▪ Four-Way Handshakes
  ▪ Initializing Devices
  o Management and Monitor Modes
  o Gaining Access to the Network
  ▪ Deauthing Targets
  ▪ Capturing the Handshake
  ▪ Handshake Brute-Force Techniques
  o Karma Attack (Evil-Twin)
• Post Exploitation and Evidence gathering
  o Basic Privilege Escalation
  o Using the Meterpreter Modules
  ▪ Extracting User Credentials
  ▪ Enumerating the Machine
  o Windows and Linux Privesc Basics
  ▪ Enumeration of Services and Process
  ▪ Understanding Permissions
  ▪ Common Techniques
  o Network Pivoting

Description

While gaining access to a system could be quite easy, maintaining control on the target without being noticed by the System Administrators would be hard. In this module, the participants will learn how to use existing components on the network to maintain their control of the network. Also, the participants will learn the basics of removing all semblance of detection.

Technical content

• Maintaining-Access
  o Backdooring
  ▪ Bind-Shell vs. Reverse-Shell
  ▪ Backdoor-Factory
  ▪ Metasploit Built-in Persistence and Metsvc
  o Advanced Netcat Usage
  ▪ File Transferring
  ▪ Spawning a Shell
  o Abusing Crontab and Bashrc
• Covering Tracks
  o Camouflaging the Backdoors
  o Detecting Log Collectors
  ▪ Log Tampering
  ▪ AuditPol
  ▪ Elsave
  ▪ Tracks Eraser Pro
  o Restoring the System to Order
• Researching Security Solutions
  o Creating Research Labs
  ▪ Constructing the Environment
  ▪ Crafting Trojans
  ▪ Understanding AV Mechanism
  ▪ AV Evasion Technics
  ▪ Bypassing Security

Description

At last, the participants will learn to conduct their reports based on their team findings; the participants will present the evidence they have gathered through the previous stages; furthermore, this module will also teach possible fixes to some of the security flaws.

Technical content

• Writing Penetration Reports
  o Describing the Information Gathering Process
  o Being Technical and Contextualized
  o Potential Impacts of Existing Vulnerabilities
  o Breaking Down the Risk
  o An Assessment of Potential Data Loss
  o Possible Remediation Options