OSCP+ | Penetration Testing with Kali Linux (PEN-200) Live Online in Taipei

The opening module covers the core concepts, technologies and good practice of cyber security that the later modules build on.

• How offensive and defensive security relate to each other
• Threats and threat actors, and the difference between risks, threats, vulnerabilities and exploits
• The CIA triad: confidentiality, integrity and availability
• Security principles, controls and strategies, such as layered defence and restricted privileges
• Laws, regulations, standards and frameworks, and career opportunities in the field

You learn to write clear reports that set out each vulnerability, its likely impact and the steps to fix it.

• Taking notes during an engagement and choosing a note-taking tool
• Capturing screenshots as evidence
• Writing an executive summary and a technical summary
• Describing technical findings and recommendations
• When to use appendices, resources and references

This module is about mapping a target before you attack it, with tools such as Nmap and Shodan.

• The stages of a penetration test and where information gathering fits in each
• Passive information gathering and OSINT, including web server and DNS sources
• Port scanning with Netcat and Nmap
• DNS, SMB, SMTP and SNMP enumeration
• Living-off-the-land techniques

Scanners such as Nessus and OpenVAS find known vulnerabilities in networks, applications and systems, which shortens the early part of a test.

• How vulnerability scanning works, the types of scan and what to consider before running one
• Installing Nessus, configuring a scan and working with the results
• Authenticated scans and Nessus plugins
• Lightweight scanning with the Nmap Scripting Engine (NSE), including custom NSE scripts

How web applications work, the technologies underneath them and the design weaknesses that give attackers a way in.

• Web application assessment methodology and the OWASP Top 10
• Enumeration tools and the Burp Suite proxy
• Inspecting headers, cookies and source code, and testing APIs
• Cross-site scripting (XSS): the types, basic exploitation and privilege escalation through XSS

The techniques behind common web attacks, mainly injection flaws, and the ways to stop them.

• Directory traversal with absolute and relative paths and encoded characters
• Local and remote file inclusion (LFI and RFI), and PHP wrappers
• Finding and exploiting file upload vulnerabilities
• OS command injection used to gain system access

Manipulating databases through SQL injection to extract sensitive data, compromise back-end systems and escalate privileges.

• SQL theory, database types and differences in SQL syntax
• Identifying SQL injection by hand
• UNION-based, error-based and blind SQLi payloads
• Code execution through MSSQL xp_cmdshell
• Automating injection with sqlmap

Attacks on the software that users run themselves, used to compromise their systems and gain access.

• Target reconnaissance and client fingerprinting
• Microsoft Office attacks built on Word macros
• Abusing Windows library files and shortcuts to get code execution

Finding reliable public exploits, judging what they do and using them responsibly in a test.

• The risk of running untrusted exploit code, and why you read it before you run it
• Online exploit resources and Google search operators
• Offline resources: exploit frameworks, SearchSploit and Nmap NSE scripts
• Enumerating a target, choosing a suitable exploit and using it to get a shell

Adapting and customising existing exploits so that they work against the system in front of you.

• Buffer overflow theory at a high level
• Cross-compiling binaries
• Modifying and updating memory corruption exploits
• Fixing web application exploits and troubleshooting common problems with them

How antivirus software detects payloads, and how testers disguise exploits and payloads to behave as a real attacker would.

• Known and unknown threats
• The key components of antivirus software and its detection engines
• Good practice for testing evasion
• Evading antivirus by hand and with automated tools

Finding weak authentication by attacking network logins and cracking captured hashes.

• Attacking SSH and RDP logins and HTTP POST login forms
• Password cracking fundamentals and mutating wordlists
• Attacking password manager key files and SSH private key passphrases
• Obtaining, cracking and passing NTLM hashes
• Cracking and relaying Net-NTLMv2 hashes

Finding and exploiting misconfigurations and vulnerabilities in Windows to gain administrator-level access.

• Windows privileges and access control mechanisms
• Situational awareness and searching a system for sensitive information, including what PowerShell leaves behind
• Automated enumeration tools
• Hijacking service binaries and DLLs, and abusing unquoted service paths
• Scheduled tasks, and abusing privileges to run code as a privileged account

Escalating privileges on Linux systems until you have root access.

• Files and user privileges on Linux, with manual and automated enumeration
• Harvesting credentials from user history files and system trails
• Abusing insecure cron jobs and file permissions
• SUID programs, capabilities and sudo permissions
• Checking the kernel for known vulnerabilities

Tunneling protocols and techniques for pivoting through a network and getting traffic past inspection.

• Tunneling through deep packet inspection
• HTTP tunneling with Chisel
• DNS tunneling with dnscat

Using Metasploit for exploitation, payload generation and post-exploitation work.

• Setting up and navigating Metasploit, with its auxiliary and exploit modules
• Staged and non-staged payloads, Meterpreter and executable payloads
• Post-exploitation with Meterpreter and the post-exploitation modules
• Pivoting with Metasploit
• Automating tasks with resource scripts

The structure of Active Directory, and how to enumerate users, groups, trusts and sensitive configuration to find attack paths with tools such as BloodHound and PowerView.

• Manual enumeration with legacy Windows tools, PowerShell and .NET
• Operating systems, permissions and logged-on users
• Service Principal Names, object permissions and domain shares
• Collecting domain data with SharpHound and analysing it in BloodHound

Exploiting weaknesses in Active Directory authentication (Kerberos and NTLM) to compromise credentials and gain access.

• How NTLM and Kerberos authentication work, and cached AD credentials
• Password attacks that yield valid user credentials
• Abusing user account options and the Kerberos SPN mechanism
• Forging service tickets
• Impersonating a domain controller to retrieve domain user credentials

Moving from host to host inside a domain and extending your control after the first compromise.

• WMI, WinRS and WinRM techniques
• Lateral movement with PsExec
• Pass the Hash and Overpass the Hash
• Abusing DCOM
• Persistence with golden tickets and shadow copies