Penetration Test Training

Attack Types: Active Attack, Passive Attack, Insider Attack, Outsider Attack
Concept of Ethical Hacking and Penetration Testing
Types of Ethical Hacking and Penetration Testing: Network Security Testing, Web Application Testing,
Client-side Testing, Wireless Security Testing
Limitations of Ethical Hacking and Penetration Testing Approaches
Alternative Approaches to Identifying Security Vulnerabilities
Overview of Testing Methodologies: OSSTMM, NIST 800-42, OWASP, Penetration Testing Framework
Ethical Hacking Tools and Exploit Resources
Test Environments and Important Considerations During Testing
Overview of Ethical Hacking and Penetration Testing Steps
Scope and “Rules of Engagement” in Ethical Hacking and Penetration Tests
Test Phases to Be Applied During Ethical Hacking and Penetration Tests
Reporting Process: Mandatory Information and Critical Points in the Final Report
Legal Considerations to Keep in Mind During Testing
First Step in Ethical Hacking and Penetration Testing: Information Gathering
Asset Enumeration Within Scope
Gathering Information via Search Engines and the Web
Using Whois
IP Block Allocations and Regional Internet Registries (ARIN, RIPE, etc.)
DNS Information Gathering (nslookup, Recurse/No-recurse Queries, Dig, Zone Transfer)
Information Gathering with Maltego
Google Hacking and GHDB (Google Hacking Database)

Tips for the Scanning Stage
Use of Sniffers During Scanning, Advantages, and tcpdump
Network Scanning Tools (Angry IP and ICMPQuery)
Network Scanning with Hping
Network Trace and Usage of Traceroute
Port Scanning
Basic Features of TCP and UDP and Their Impact on Port Scanning
Introduction to Advanced Port Scanning Techniques with Nmap (Packet Trace, Timing, Ping, Traceroute Features)
TCP Port Scanning Methods with Nmap (Connect Scan, SYN Scan, ACK Scan, FTP Bounce Scan)
UDP Port Scanning with Nmap
Operating System Detection
Active and Passive Methods for OS Detection
Version Scanning
Version Detection with Amap
Vulnerability Scanning
Approaches to Vulnerability Scanning
Overview of Nmap Scripting Engine (NSE)
NSE Script Categories
Using NSE
Vulnerability Scanning with Nessus
Nexpose Installation and Configuration
Vulnerability Scanning with Nexpose
Overview of Other Vulnerability Scanning Tools
User Account Enumeration (via Windows Null Session, Finger, LDAP)
Using Netcat and Advanced Netcat Usage Scenarios

• What is an Exploit?

• Exploit Categories

  • Server-side Exploits

  • Client-side Exploits

  • Local Privilege Escalation

• Introduction to Metasploit

• Metasploit Modules

  • Exploits

  • Payloads

  • Stagers

  • Stages

• Details of Meterpreter

• Non-Metasploit Exploits

• Shell and Terminal Access Dilemma: Issues and Solutions

• Relay Scenarios with Netcat

• Post-Exploitation Activities

  • File Transfer

  • Gathering Additional Data from the Compromised System

• Remote Command Execution Methods on Windows Systems

  • Using psexec, at, schtasks, sc, wmic

• Advanced Windows Command-Line Techniques for Ethical Hacking and Penetration Testing

• Client-Side Exploits: Techniques and Practical Examples for Gaining Access

Introduction to Password Cracking and Guessing Techniques

• Tips for Effective Password Attacks

• Account Lockout Scenarios in Windows and Linux (Account Policy and PAM)

• Password Guessing with THC-Hydra

• Using Pw-inspector

• Password Hash Formats

  • Password Formats in Windows SAM Database

  • Password Formats in Active Directory

  • LANMAN Hash Algorithm

  • NT Hash Algorithm

• Challenge/Response Mechanisms in Windows Networks

  • LANMAN Challenge/Response

  • NTLMv1 Challenge/Response

  • NTLMv2 Challenge/Response

  • Microsoft Kerberos Authentication

• Password Formats in Linux and Unix Systems

• Extracting Password Hashes

  • Using Pwdump6, Fgdump, and Metasploit Priv Modules

• John the Ripper

  • Configuration File and Cracking Modes

  • john.pot and john.rec Files

  • Patches, Speed Optimizations, and Distributed Cracking with John

• Cain as a Password Cracking Tool

  • Cain’s Sniffer Capabilities

  • ARP-Poisoned Routing with Cain

  • Cain’s Auxiliary Tools

• Rainbow Tables: Concepts and Usage

  • Rainbow Table Cracking with Ophcrack

• Pass-the-Hash Technique

  • Using pshtoolkit, SAMBA, and Metasploit for Pass-the-Hash

Wireless Network Vulnerabilities

• Hardware Selection for Wireless Security Testing (Wi-Fi Cards, Antennas, GPS)

• Wireless Network Fundamentals (802.11 b/g Channels, SSID, 802.11 Handshake Steps)

• Wireless Network Detection Methods (Managed/Monitor Interface Modes)

• Sniffer Usage in Wireless Networks

• Wireless Sniffing with Kismet

• Wireless Discovery with NetStumbler and Cain

• SSID Cloaking Techniques

• Cryptographic Attacks on Wireless Networks

• Wired Equivalent Privacy (WEP): Basics, Operation, and Weaknesses

• Wi-Fi Protected Access (WPA)

• Attack Tools for WPA1 and WPA2

• Aircrack-ng Suite

• Dictionary Attacks with CoWPAtty

• Wireless Client Attacks (Airpwn, AirJack, Karma, Karmasploit)

Web Applications

• Introduction to Web Applications

• Web Server Vulnerabilities and Nikto Scanning Tool

• Manual Confirmation Examples of Nikto Findings

• Paros Proxy and Its Features (HTTP Request/Response Capture, Vulnerability Scanning, Request Editor, Hash Calculator)

• Injection Attacks

  • Cross Site Request Forgery (XSRF)

  • Cross-Site Scripting Attacks (Reflected and Stored XSS)

  • Command Injection (Non-Blind and Blind)

  • SQL Injection (Command Execution via SQL Injection, Blind SQL Injection)