Penetration Testing: What You Should Know

• This module introduces you to the course and sets expectations.

• About The PWK Course.

• Overall Strategies for Approaching the Course.

• Obtaining Support.

• About Penetration Testing.

• Legal considerations.

• The MegaCorpone.com and Sandbox.local Domains.

• About the PWK VPN Labs.

• Reporting.

• About the OSCP Exam.

Getting Comfortable with Kali Linux

• Booting Up Kali Linux.

• The Kali Menu.

• Kali Documentation.

• Finding Your Way Around Kali.

• Managing Kali Linux Services.

• Searching, Installing, and Removing Tools.

Command Line Fun

• The Bash Environment.

• Piping and Redirection.

• Text Searching and Manipulation.

• Editing Files from the Command Line.

• Comparing Files.

• Managing Processes.

• File and Command Monitoring.

• Downloading Files.

• Customizing the Bash Environment.

Practical Tools

• Netcat.

• Socat.

• PowerShell and Powercat.

• Wireshark.

• Tcpdump.

Bash Scripting – NEW in 2020

• Intro to Bash Scripting.

• Variables.

• If, Else, Elif Statements.

• Boolean Logical Operations.

• Loops.

• Functions.

• Practical Examples.

Passive Information Gathering

• Using OSINT to gather information, including the use of shodan and pastebin.

• Taking Notes.

• Website Recon.

• Whois Enumeration.

• Google Hacking.

• Netcraft.

• Recon-ng.

• Open-Source Code.

• Shodan.

• Security Headers Scanner.

• SSL Server Test.

• Pastebin.

• User Information Gathering.

• Social Media Tools.

• Stack Overflow.

• Information Gathering Frameworks.

Active Information Gathering

• DNS Enumeration.

• Port Scanning.

• SMB Enumeration.

• NFS Enumeration.

• SMTP Enumeration.

• SNMP Enumeration.

Vulnerability Scanning

• Vulnerability Scanning Overview and Considerations.

• Vulnerability Scanning with Nessus.

• Vulnerability Scanning with Nmap.

Web Application Attacks

• Burp Suite, PHP Wrappers.

• Web Application Assessment Methodology.

• Web Application Enumeration.

• Web Application Assessment Tools.

• Exploiting Admin Consoles.

• Cross-Site Scripting (XSS).

• Directory Traversal Vulnerabilities.

• File Inclusion Vulnerabilities.

• SQL Injection.

Buffer Overflow Intro

• Introduction to the x86 Architecture.

• Buffer Overflow Walkthrough.

Windows Buffer Overflows

• Discovering the Vulnerability.

• Win32 Buffer Overflow Exploitation.

Linux Buffer Overflow

• About DEP, ASLR, and Canaries.

• Replicating the Crash.

• Controlling EIP.

• Locating Space for Your Shellcode.

• Checking for Bad Characters.

• Finding a Return Address.

• Getting a Shell.

Client-Side Attacks

• HTA Attacks, Microsoft Word Macros, Object Linking and Embedding (DDE).

• Know Your Target.

• Leveraging HTML Applications.

• Exploiting Microsoft Office.

Using Public Exploits

• A Word of Caution.

• Searching for Exploits.

• Putting It All Together.

Fixing Exploits

• Fixing Memory Corruption Exploits.

• Fixing Web Exploits.

File Transfers

• Considerations and Preparations.

• Transferring Files with Windows Hosts.

Bypassing Antivirus Software

• What is Antivirus Software.

• Methods of Detecting Malicious Code.

• Bypassing Antivirus Detection.

• Wrapping Up.

Privilege Escalation

• Information Gathering.

• Windows Privilege Escalation Examples.

• Linux Privilege Escalation Examples.

• Enumerating Firewall and Status Rules, Bypassing UAC.

• Wrapping Up.

Password Attacks

• Mimikatz.

• Wordlists.

• Brute Force Wordlists.

• Common Network Service Attack Methods.

• Leveraging Password Hashes.

• Wrapping Up.

Port Redirection and Tunneling

• HTTP tunneling.

• Port Forwarding.

• SSH Tunneling.

• PLINK.exe.

• NETSH.

• HTTPTunnel-ing Through Deep Packet Inspection.

• Wrapping Up.

Metasploit

• Advanced options with multi/handler, transport modules, Meterpreter.

• Section: Metasploit User Interfaces and Setup.

• Exploit Modules.

• Metasploit Payloads.

• Building Our Own MSF Module.

• Post-Exploitation with Metasploit.

• Metasploit Automation.

• Wrapping Up.

Active Directory Attacks (Domains)

• Active Directory Theory.

• Active Directory Enumeration.

• Active Directory Authentication.

• Active Directory Lateral Movement.

• Active Directory Persistence.

• Includes Kerberos attacks, password spraying AD.

• Wrapping Up.

PowerShell Empire

• Introduction to PowerShell Empire and the use of Power-Up.

• Installation, Setup, and Usage.

• PowerShell Modules.

• Switching Between Empire and Metasploit.

• Wrapping Up.

Assembling the Pieces: Penetration Test Breakdown

• Sandbox.local hands-on walkthrough.

• Public Network Enumeration.

• Targeting the Web Application.

• Targeting the Database.

• Deeper Enumeration of the Web Application Server.

• Targeting the Database Again.

• Targeting Poultry.

• Internal Network Enumeration.

• Targeting the Jenkins Server.

• Targeting the Domain Controller.