Advanced Penetration Testing, Exploit Writing, and Ethical Hacking Training

Advanced Penetration Testing, Exploit Writing, and Ethical Hacking Training

Introduction:

Advanced Penetration Testing, Exploit Writing, and Ethical Hacking Training Course Hands-on

Advanced Penetration Testing, Exploit Writing, and Ethical Hacking Training is designed as a logical progression point for those who have completed Network Penetration Testing and Ethical Hacking Training Hacking, or for those with existing penetration testing experience. Students with the prerequisite knowledge to take this Advanced Penetration Testing, Exploit Writing, and Ethical Hacking Training course will walk through dozens of real-world attacks used by the most seasoned penetration testers. The methodology of a given attack is discussed, followed by exercises in a hands-on lab to consolidate advanced concepts and facilitate the immediate application of techniques in the workplace. Each day of the Advanced Penetration Testing, Exploit Writing, and Ethical Hacking Training course includes a two-hour evening boot camp to drive home additional mastery of the techniques discussed. A sample of topics covered includes weaponizing Python for penetration testers, attacks against network access control (NAC) and virtual local area network (VLAN) manipulation, network device exploitation, breaking out of Linux and Windows restricted environments, IPv6, Linux privilege escalation and exploit-writing, testing cryptographic implementations, fuzzing, defeating modern OS controls such as address space layout randomization (ASLR) and data execution prevention (DEP), return-oriented programming (ROP), Windows exploit-writing, and much more!

Attackers are becoming more clever and their attacks more complex. To keep up with the latest attack methods, you need a strong desire to learn, the support of others, and the opportunity to practice and build experience. This Advanced Penetration Testing, Exploit Writing, and Ethical Hacking Training course provides attendees with in-depth knowledge of the most prominent and powerful attack vectors and furnishes an environment to perform these attacks in numerous hands-on scenarios. The Advanced Penetration Testing, Exploit Writing, and Ethical Hacking Training course goes far beyond simple scanning for low-hanging fruit and shows penetration testers how to model the abilities of an advanced attacker to find significant flaws in a target environment and demonstrate the business risk associated with these flaws.

Advanced Penetration Testing, Exploit Writing, and Ethical Hacking TrainingRelated Courses:

Duration:5 days

Skills Gained:

• Create 0day (private unreleased exploits) attacks as part of the “Advanced Persistent Threat”
• Run sophisticated attacks against client side applications
• Use fuzzers and dynamic analysis to discover vulnerabilities
• Reverse engineer binaries to find new vulnerabilities never discovered before
• Exploit secured web applications
• Run chained exploits to pivot from multiple exploitable systems
• Attack and defeat VPNs, IDS/IPS and other security technologies

Customize It:

With onsite Training, courses can be scheduled on a date that is convenient for you, and because they can be scheduled at your location, you don’t incur travel costs and students won’t be away from home. Onsite classes can also be tailored to meet your needs. You might shorten a 5-day class into a 3-day class, or combine portions of several related courses into a single course, or have the instructor vary the emphasis of topics depending on your staff’s and site’s requirements.

Course Content:

Network Attacks for Penetration Testers

Bypassing network access/admission control (NAC)
Impersonating devices with admission control policy exceptions
Exploiting EAP-MD5 authentication
Custom network protocol manipulation with Ettercap and custom filters
Multiple techniques for gaining man-in-the-middle network access
IPv6 for penetration testers
Exploiting OSPF authentication to inject malicious routing updates
Using Evilgrade to attack software updates
Overcoming SSL transport encryption security with Sslstrip
Remote Cisco router configuration file retrieval

Crypto, Network Booting Attacks, and Escaping Restricted Environments

Pen testing cryptographic implementations
Exploiting CBC bit flipping vulnerabilities
Exploiting hash length extension vulnerabilities
Delivering malicious operating systems to devices using network booting and PXE
PowerShell Essentials
Enterprise PowerShell
Post Exploitation with PowerShell and Metasploit
Escaping Software Restrictions
Two-hour evening Capture the Flag exercise using PXE, network attacks, and local privilege escalation

Python, Scapy, and Fuzzing

Becoming familiar with Python types
Leveraging Python modules for real-world pen tester tasks
Manipulating stateful protocols with Scapy
Using Scapy to create a custom wireless data leakage tool
Product security testing
Using Taof for quick protocol mutation fuzzing
Optimizing your fuzzing time with smart target selection
Automating target monitoring while fuzzing with Sulley
Leveraging Microsoft Word macros for fuzzing .docx files
Block-based code coverage techniques using Paimei

Exploiting Linux for Penetration Testers

Stack and dynamic memory management and allocation on the Linux OS
Disassembling a binary and analyzing x86 assembly code
Performing symbol resolution on the Linux OS
Identifying vulnerable programs
Code execution redirection and memory leaks
Identifying and analyzing stack-based overflows on the Linux OS
Performing return-to-libc (ret2libc) attacks on the stack
Return-oriented programming
Defeating stack protection on the Linux OS
Defeating ASLR on the Linux OS

Exploiting Windows for Penetration Testers

The state of Windows OS protections on Windows 7, 8, 10, Server 2008 and 2012
Understanding common Windows constructs
Stack exploitation on Windows
Defeating OS protections added to Windows
Creating a Metasploit module
Advanced stack-smashing on Windows
Using ROP
Building ROP chains to defeat DEP and bypass ASLR
Windows 7 and Windows 8 exploitation
Porting Metasploit modules
Client-side exploitation
Windows Shellcode

Capture the Flag Challenge

This day will serve as a real-world challenge for students by requiring them to utilize skills they have learned throughout the course, think outside the box, and solve a range of problems from simple to complex. A web server scoring system and Capture the Flag engine will be provided to score students as they capture flags. More difficult challenges will be worth more points. In this offensive exercise, challenges range from local privilege escalation to remote exploitation on both Linux and Windows systems, as well as networking attacks and other challenges related to the course material.

Whether you are looking for general information or have a specific question, we want to help

Request More Information

Time Frame: 0-3 Months4-12 Months

No Comments Yet.

Leave a comment