
In this video course module, Chris Thorsen introduces the fundamentals of penetration testing (pen testing), emphasizing its importance in cybersecurity. He outlines the course structure, which consists of six modules focusing on various aspects of pen testing, including engagement management, reconnaissance, vulnerability discovery, and deliverables. The module highlights the legal and ethical considerations, the significance of pre-engagement activities, and the necessity of clear communication and agreements with clients to ensure a successful pen test.
Introduction to PenTest Plus
Instructor's background and experience
Overview of course modules
Engagement management
Pre-engagement activities
Legal and ethical considerations
Comparison of vulnerability assessments, pen testing, and red teaming
Types of pen testing: white box, black box, gray box
Defining the scope of a pen test
Objectives and deliverables
Importance of agreements and documentation
Shared responsibility model in pen testing
Roles of hosting providers and clients
Legal obligations and reporting requirements
Best practices for pre-engagement activities
In this video module, we will explore the essential aspects of collaboration and communication during a penetration testing engagement. Emphasizing the importance of teamwork, peer reviews, and stakeholder alignment, we will discuss various strategies to ensure effective communication and risk management throughout the pen test process.
Collaboration and communication in pen testing
Peer review and its significance
Stakeholder alignment and engagement
Root cause analysis techniques
Escalation paths for critical findings
Secure distribution of sensitive information
Articulating risk, severity, and impact
Goal reprioritization during testing
Business impact analysis
Client acceptance of findings
In this video module, we will explore the importance of following established methodologies and frameworks in penetration testing (pen testing) and threat modeling. A structured approach not only enhances collaboration and reduces errors but also ensures that critical areas are addressed and results are credible. We will discuss various pen testing frameworks, their applications, and the significance of threat modeling in identifying and mitigating potential vulnerabilities.
Importance of methodology in pen testing
Benefits of using a framework
Collaboration and error reduction in pen testing
Common pen testing frameworks: OSS TMM, CREST, PTES, MITRE ATT&CK, OWASP Top Ten, MASVS, Purdue Model
Overview of threat modeling
Common threat modeling frameworks: STRIDE, DREAD, PASTA, VAST, Octave, OWASP Threat Dragon
In this video module, viewers will explore the MITRE ATT&CK framework, which provides a comprehensive overview of tactics, techniques, and procedures used by advanced persistent threat (APT) groups. The discussion will cover how to navigate the MITRE website, understand various attack techniques, and analyze real-world examples of cyber threats.
Introduction to the MITRE ATT&CK framework
Navigating the MITRE website
Understanding tactics, techniques, and data sources
Exploring reconnaissance and scanning techniques
Analyzing advanced persistent threat (APT) groups
Reviewing software used by APTs
Examining cyber campaigns and their impact
This video module focuses on engagement management in penetration testing, covering the foundational aspects of planning and executing a pen test. It discusses various types of pen tests, the importance of pre-engagement activities, and the necessary documentation and agreements that ensure a successful and ethical testing process.
Introduction to engagement management
Definition of penetration testing
Types of penetration testing: white box, black box, gray box
Targets for penetration testing
Scope document and its importance
Rules of engagement and letter of authorization
Nondisclosure agreements and master service agreements
Statement of work and terms of service
Shared responsibility model in pen testing
Regulatory frameworks: GDPR, HIPAA
Handling sensitive information and illegal activity
Peer review process in pen testing
Defining scope, objectives, and timelines
Reporting and sharing pen test results
Adjusting goals during the engagement
Pen testing frameworks and methodologies
Threat modeling and cyber kill chain
In this video module, viewers will learn about Google hacking techniques, specifically focusing on the use of Google dorks to uncover sensitive information and vulnerabilities. The instructor will explore the Google hacking database, demonstrate how to utilize existing dorks, and discuss the ethical implications of such practices.
Introduction to Google hacking
Using Google dorks
Exploring the Google hacking database
Finding sensitive information
Ethical considerations in hacking
In this video module, we will delve into the concept of active reconnaissance, contrasting it with passive reconnaissance. The focus will be on engaging with targets through various techniques such as network sniffing, port scanning, vulnerability scanning, and service enumeration. We will explore tools and methods for gathering information about networks, systems, and services, as well as the implications of these techniques in cybersecurity.
Active vs. Passive Reconnaissance
Network Sniffing
Port Scanning
Vulnerability Scanning
Service Enumeration
Banner Grabbing
HTML Scraping
Common Targets for Reconnaissance
Traceroute Techniques
Sniffing Tools for IoT and OT
In this video module, we will explore the fundamentals of active reconnaissance using Nmap, a powerful network scanning tool. The session will cover how to set up the environment with Kali Linux and Metasploitable, perform various types of scans, and interpret the results to identify open ports and potential vulnerabilities. By the end of this module, learners will have a solid understanding of how to utilize Nmap for effective penetration testing.
Introduction to active reconnaissance
Setting up Kali Linux and Metasploitable
Using Nmap for network scanning
Understanding open ports and services
Performing ping scans and port scans
Interpreting Nmap scan results
SYN scans and TCP connect scans
Scanning for UDP ports
Operating system detection with Nmap
Advanced Nmap options and output formats
In this video module, we will explore the concept of trace routing in network security. The session will cover how to map out the security perimeters of a target by understanding the path that network packets take to reach their destination. We will demonstrate how to perform a trace route using various operating systems and discuss the significance of the information obtained through this process, including identifying routers, firewalls, and potential security vulnerabilities.
Introduction to trace routing
Importance of trace route in network security
How to perform a trace route
Understanding packet paths and hops
Using command prompts for trace route
Differences between IPv4 and IPv6 in trace routing
Interpreting trace route results
Identifying firewalls and packet filtering
Dynamic nature of internet traffic
In this video module, we will explore the process of intercepting unencrypted network transmissions using Wireshark. The demonstration will focus on capturing login credentials and other sensitive information transmitted in clear text over HTTP, specifically within a Metasploitable environment. By the end of this session, viewers will gain practical skills in using Wireshark to analyze network traffic and identify vulnerabilities in unencrypted protocols.
Introduction to network penetration testing
Understanding unencrypted protocols
Using Wireshark for data interception
Setting up Metasploitable for testing
Capturing HTTP traffic
Filtering captured data in Wireshark
Analyzing HTTP POST requests
Searching for specific strings in packets
Identifying vulnerabilities in network transmissions
In this video module, we will explore the process of web scraping to gather valuable information from a target website. Using the web data extractor tool, we will learn how to extract URLs, meta tags, emails, phone numbers, and other relevant data. This practical exercise will enhance our reconnaissance skills in cybersecurity.
Introduction to web scraping
Setting up the web data extractor tool
Extracting URLs and links
Retrieving meta tags and descriptions
Collecting emails and phone numbers
Understanding multimedia content sources
Analyzing extracted data
Exploring internal links and subdomains
In this video module, we will delve deeper into the concept of enumeration, focusing on various techniques for discovering hidden directories, shares, user accounts, email accounts, permissions, secrets, and how to bypass web application firewalls. The module will cover both automated and manual enumeration methods, tools, and best practices for effective information gathering.
Introduction to Enumeration
Directory Enumeration Techniques
Share Enumeration
Local User Enumeration
Email Account Enumeration
Permissions Enumeration
Secrets Enumeration
Cloud Access Keys and Secret Repositories
Web Application Firewalls (WAF)
Web Crawling vs. Web Scraping
Content Management System (CMS) Enumeration
Manual Enumeration Techniques
In this video module, we will explore the process of enumeration in penetration testing, focusing on how to gather information about hidden directories on web servers using tools like Kali Linux and Durbuster. We will cover the importance of identifying the server's IP address, determining open ports, and utilizing directory brute-forcing techniques to uncover potentially hidden resources.
Introduction to enumeration in penetration testing
Using Kali Linux for reconnaissance
Identifying IP addresses and open ports
Understanding standard vs. non-standard ports
Exploring hidden directories on web servers
Using Nmap for port scanning
Introduction to Durbuster for directory enumeration
Configuring Durbuster with target URLs and wordlists
Analyzing results from Durbuster
Planning for web application vulnerability scanning
In this video module, we will explore the process of email enumeration as part of a penetration testing exercise, particularly focusing on how to gather email addresses from an email server. We will practice using various methods and tools, including Telnet and SMTP user enumeration tools, to identify valid email accounts and distribution lists.
Introduction to email enumeration
Setting up the environment with a server and command prompt
Understanding mailboxes and distribution lists
Using Telnet for email server interaction
SMTP methods: verify, expand, recipient
Using SMTP user enumeration tools in Kali Linux
Practical examples of email enumeration
Limitations of Metasploit for email enumeration
This video module focuses on the use of scripts for reconnaissance and enumeration in cybersecurity. It covers various scripting languages, their applications in automating tasks, and considerations for running scripts in different operating systems. The module also includes practical examples of scripts for data manipulation, network scanning, and credential extraction.
Introduction to scripting for reconnaissance and enumeration
Popular scripting languages: Python, Bash, PowerShell
Automation of tasks using scripts
Information gathering techniques
Operating system considerations for running scripts
Dependencies and environment issues
Data manipulation and analysis with scripts
Creating and modifying scripts for specific needs
Examples of scripts for email extraction, data exfiltration, and port scanning
Logic constructs in scripting: conditionals, loops, functions
Using libraries and modules in scripting
In this video module, we will explore how to utilize PowerShell scripts to extract valuable information from a compromised client system without the need for additional software installations. The focus will be on leveraging existing scripts from GitHub to gather data such as user credentials, WLAN keys, and system information, all while adhering to the principle of 'living off the land'.
Introduction to PowerShell scripting
Finding and selecting scripts from GitHub
Downloading PowerShell scripts
Using PowerShell ISE for script execution
Extracting system information using Get-Information script
Retrieving password hashes with Get-PassHashes script
Acquiring WLAN keys using Get-WLANKeys script
Running scripts and analyzing output
In this video module, we will explore various reconnaissance and enumeration tools that are essential for penetration testing and OSINT (Open Source Intelligence). These tools help gather information about targets, analyze data relationships, and uncover historical data, which is crucial for effective security assessments. The discussion will cover tools like the Wayback Machine, Maltego, ReconNG, Shodan, and Nmap, among others, highlighting their functionalities and practical applications in the field of cybersecurity.
Introduction to reconnaissance and enumeration tools
Wayback Machine for historical website data
Maltego for data relationship analysis
ReconNG for automated OSINT
Shodan for discovering internet-connected devices
SpiderFoot for gathering information on domains and IPs
Whois protocol for domain ownership information
DNS lookup tools: nslookup and dig
Censys for monitoring internet-facing assets
Hunter.io for finding and validating email addresses
DNS Dumpster for mapping DNS records
Nmap for network mapping and vulnerability scanning
Wireshark for traffic analysis
Aircrack-ng for assessing Wi-Fi security
In this video module, we will explore the use of ReconNG, a powerful open-source intelligence (OSINT) tool designed for reconnaissance tasks. The session will cover the setup of workspaces, the use of API keys, and various commands to gather information about domains, companies, and contacts. We will also demonstrate how to handle errors and troubleshoot issues that arise during the data collection process.
Introduction to ReconNG
Setting up workspaces
Understanding API keys and their importance
Basic commands in ReconNG
Exploring the schema of ReconNG
Adding domains and companies
Using modules for data collection
Troubleshooting API key issues
Exporting data to CSV
Best practices for OSINT
In this video module, viewers will learn how to obtain and manage an API key for the Bing Search API using ReconNG. The instructor will demonstrate the process of signing up for a trial key, navigating Microsoft's Cognitive Services, and integrating the API key into a Python script for use in ReconNG. Additionally, the video will cover troubleshooting common issues related to API integration.
Introduction to ReconNG and API keys
Obtaining a Bing Search API key
Navigating Microsoft Cognitive Services
Understanding API endpoints
Integrating the API key into ReconNG
Troubleshooting API integration issues
In this video module, we explore the use of Shodan to search for Internet of Things (IoT) devices, focusing on unexpected findings such as Xerox DocuCenters and Samsung smart TVs. The session highlights the potential vulnerabilities associated with these devices and emphasizes the ethical responsibilities of hackers.
Introduction to Shodan
Searching for IoT devices
Exploring Xerox DocuCenters
Understanding device ports and their functions
Identifying vulnerabilities in IoT devices
Ethical hacking practices
In this video, we will explore how to perform a WHOIS lookup using the website whois.domaintools.com. We will use the EC Council's domain as a case study to understand the information that can be retrieved from a WHOIS search, including domain registration details, hosting information, and potential security measures like Cloudflare. Additionally, we will discuss the importance of being cautious when using WHOIS tools and the implications of domain squatting.
Introduction to WHOIS lookups
Navigating whois.domaintools.com
Case study: EC Council domain (ec-council.org)
Understanding WHOIS information: registration details, hosting, and name servers
Cloudflare's role in domain security
Domain squatting and its implications
Cautions when using WHOIS tools
In this video module, we will explore how to manually query DNS servers using two command-line tools: nslookup for Windows and dig for Linux. We will practice retrieving IP addresses, name servers, and CNAME records for a specific domain, demonstrating the differences between the two tools and their outputs.
Introduction to DNS and its purpose
Using nslookup on Windows
Using dig on Linux
Retrieving IP addresses for a domain
Finding name servers for a domain
Querying CNAME records
Changing DNS servers for queries
Comparing outputs of nslookup and dig
In this video module, we will explore the use of Nmap scripts within a Kali Linux environment to scan and gather information about a Metasploitable target. The session will cover how to access and utilize various Nmap scripts, including default scripts and specific categories for vulnerabilities, fuzzing, and malware detection. We will also demonstrate how to interpret the results from these scans.
Introduction to Nmap scripts
Setting up Kali Linux and Metasploitable
Finding the IP address of Metasploitable
Pinging the target machine
Using Nmap help commands
Accessing Nmap script reference portal
Exploring Nmap scripts by categories
Running default Nmap scripts
Analyzing scan results
Using specific script categories (e.g., fuzzing, malware, vulnerabilities)
Running individual scripts for targeted scans
In this video module, viewers will learn how to utilize the Harvester tool for Open Source Intelligence (OSINT) to gather contact and host information from various online sources. The instructor will guide participants through the process of executing commands in Kali Linux, discussing the challenges and limitations associated with different search engines and API keys. The session emphasizes the importance of ethical hacking practices and the need to adapt to the constantly evolving landscape of cybersecurity.
Introduction to OSINT and the Harvester tool
Setting up the environment in Kali Linux
Understanding the command syntax for the Harvester
Using search engines and social media for data gathering
Challenges with Google and the use of VPNs
Interpreting the results from the Harvester
Ethical considerations in hacking
In this video module, we will explore the concepts of reconnaissance and enumeration, focusing on both passive and active techniques used to gather information about a target network. We will discuss various tools and methods for footprinting, service enumeration, and the importance of understanding network interactions to identify potential vulnerabilities.
Passive reconnaissance (footprinting)
Active reconnaissance techniques
Sources of footprinting information
Certificate transparency logs
Google hacking
Port scanning and TCP SYN scan
Service enumeration and fingerprinting
OS fingerprinting
Network mapping with trace route
Traffic sniffing
Banner grabbing and HTML scraping
Directory and share enumeration
User and email account enumeration
Permissions enumeration
Authentication methods (passwords, secrets, API keys)
Web application firewalls (WAF) and their enumeration
Web crawling vs. web scraping
Content management system vulnerabilities
Scripting for information gathering
OSINT tools and frameworks
Popular reconnaissance tools (Nmap, Wireshark, etc.)
In this video module, we will explore the critical aspects of vulnerability discovery and analysis, focusing on various scanning techniques, tools, and methodologies used in penetration testing. The discussion will cover the importance of identifying vulnerabilities, assessing their exploitability, and prioritizing targets for effective penetration testing. Additionally, we will delve into the significance of physical security and operational technology in vulnerability assessments.
Vulnerability discovery and analysis
Reconnaissance scanning and enumeration
Physical security considerations
Types of vulnerability scans
Automated scanning tools
Validating findings and peer reviews
Identifying final and intermediate targets
Network and host-based scans
Web application scanning
Mobile application security
Infrastructure as code vulnerabilities
Operational technology and industrial control systems
Common vulnerabilities in ICS and SCADA
Container security scanning
In this video module, we will explore the installation and configuration of OpenVAS, a powerful vulnerability scanning tool, as part of a penetration testing engagement. We will automate the scanning process to efficiently identify vulnerabilities across multiple targets, analyze the results, and discuss potential exploits.
Introduction to OpenVAS
Installation of OpenVAS on Kali Linux
Setting up OpenVAS and downloading signatures
Creating and configuring a scan
Analyzing scan results
Identifying vulnerabilities and potential exploits
Using ExploitDB for further research
Understanding severity levels of vulnerabilities
In this video module, we will conduct a static code review of an Android application written in Kotlin. The focus will be on identifying hard-coded sensitive information such as API keys, usernames, and passwords that could expose the application to security vulnerabilities. Participants will learn how to use Notepad++ to analyze the source code effectively, even without prior coding experience.
Introduction to static code reviews
Overview of the Android app source code structure
Identifying hard-coded sensitive information
Using Notepad++ for code analysis
Understanding the implications of exposing API keys
Best practices for securing sensitive information in applications
In this video module, we will delve into the critical process of analyzing and validating the results obtained from vulnerability scans and reconnaissance efforts. Emphasizing the importance of distinguishing between true positives, false positives, and false negatives, we will explore various methods for validating vulnerabilities, including peer reviews, automated tools, and manual exploitation techniques. The module will also cover the selection of appropriate public exploits and the necessary precautions to minimize risks during testing.
Analyzing vulnerability scan results
Validating findings from reconnaissance
Public exploit selection
Manual validation techniques
Peer review and automated validation
True positives, false positives, true negatives, and false negatives
Compensating controls in vulnerability management
Best practices for scanning and troubleshooting
Choosing the right exploits for validation
Minimizing risks during exploitation
In this module, we will explore various techniques related to physical security testing in penetration testing. The focus will be on understanding methods such as tailgating, site surveys, USB drops, badge cloning, and lock picking. These techniques are essential not only for real-world application but also for exam preparation, as they highlight vulnerabilities in physical security that can be exploited by unauthorized individuals.
Tailgating and Piggybacking
Site Surveys
Physical Security Weaknesses
Unauthorized Access Techniques
Malicious USB Drops
Badge Cloning
Lock Picking
Social Engineering in Physical Security
In this video module, we will explore the process of conducting a physical security assessment with a focus on RFID badge cloning using the Proxmark three tool. The session will cover the setup, configuration, and practical demonstration of cloning an RFID badge, highlighting the potential vulnerabilities in physical security systems.
Introduction to physical security assessment
Overview of RFID badge systems
Proxmark three RFID badge cloner
Setting up and configuring the Proxmark three
Demonstration of RFID badge cloning
Testing and verifying cloned badges
Discussion on security implications and best practices
In this video, we explore the Flipper Zero, a versatile gadget that captures and replays various wireless signals. The session includes a demonstration of cloning RFID badges and NFC credit cards, showcasing the device's capabilities and the creativity of its users.
Introduction to Flipper Zero
Wireless signal capture and replay
Open-source features
Developer peripherals
Cloning RFID badges
Cloning NFC credit cards
Practical demonstrations
In this video module, we will explore the essential techniques and methodologies for vulnerability discovery and analysis in penetration testing. The focus will be on identifying exploitable vulnerabilities, understanding different scanning methods, and validating findings to ensure effective security assessments.
Vulnerability discovery and analysis
Types of vulnerabilities: true positives, false positives, false negatives
Automated vs manual vulnerability scanning
Network scans and host-based scans
Web application and mobile application scans
Container and infrastructure as code (IAC) scans
Operational technology (OT) and industrial control systems (ICS)
Validation of vulnerabilities and exploitability
Social engineering techniques: tailgating, USB drops
Physical security assessments
In this module, we will explore the essential steps for prioritizing and preparing for various types of attacks in penetration testing. The focus will be on identifying high-value targets, understanding the client's security priorities, and utilizing automated tools effectively. We will discuss different attack vectors, including network, web application, and social engineering attacks, while emphasizing the importance of aligning testing efforts with business impact and compliance requirements.
Prioritizing and preparing attacks
Target prioritization principles
Network and authentication attacks
Host-based attacks
Web application attacks
Cloud attacks
Wireless attacks
Social engineering
Specialized systems using scripts
Reviewing attack strategies
Identifying high-value assets
Understanding EPSS, CVSS, CWE, and CVE metrics
Balancing risk and exploitability
Documentation and ethical considerations in pen testing
This video module focuses on various types of network attacks and the tools used to execute them. It covers techniques for exploiting vulnerabilities, misconfigurations, and social engineering tactics to gain unauthorized access to networks and systems. The discussion includes specific attack methods, tools like Metasploit and Netcat, and practical examples of how these attacks are carried out.
Types of network attacks
Exploiting default credentials
Misconfigured services
On-path attacks (MITM)
Certificate misconfigurations
VLAN hopping
Multi-homed hosts
Relay attacks
Packet crafting
Network attack tools (Metasploit, Netcat, Nmap)
Impacket and CrackMapExec
Wireshark for network reconnaissance
In this video module, we will explore the implementation of a man-in-the-middle (MITM) attack using ARP poisoning with the Ettercap tool. The demonstration involves three virtual machines: Metasploitable as the server, Kali Linux as the attacker, and Server 2016 as the client. We will walk through the setup process, including logging into the machines, configuring Ettercap, and capturing traffic between the client and server to demonstrate the effectiveness of the attack.
Introduction to man-in-the-middle attacks
Understanding ARP poisoning
Setting up the virtual machines
Logging into Metasploitable, Kali Linux, and Server 2016
Using Ettercap for network sniffing
Scanning for hosts on the network
Configuring targets for ARP poisoning
Capturing web session credentials
Performing FTP and SMB connections
Analyzing captured traffic and credentials
In this video module, we will explore the Metasploit framework to execute a classic network attack leveraging one of the most infamous buffer overflow vulnerabilities in cyber history, specifically the Microsoft MS08-067 exploit. The session will guide viewers through the setup and execution of the exploit, demonstrating how to gain administrative privileges on a vulnerable Windows XP machine.
Introduction to Metasploit framework
Overview of the MS08-067 vulnerability
Setting up the virtual machines (Kali and Windows XP)
Launching Metasploit and selecting the exploit
Configuring the payload for exploitation
Executing the exploit and establishing a Meterpreter session
Using Meterpreter commands to interact with the target system
Creating a backdoor user account on the compromised machine
In this video module, we will explore the process of exploiting a target using Meterpreter, focusing on the techniques of code injection and process migration. We will demonstrate how to compromise a Windows Server 2016 system using the EternalBlue exploit, and discuss the implications of process stability when injecting malicious code. Additionally, we will cover the importance of migrating the Meterpreter session to a more stable process to maintain control over the target system.
Introduction to Meterpreter and code injection
Understanding buffer overflow vulnerabilities
Compromising Windows Server 2016 with EternalBlue
Setting up the exploit and configuring parameters
Process ID and process migration in Meterpreter
Using the migrate command to change the process
Keylogging capabilities and limitations
Best practices for maintaining a Meterpreter session
In this video module, we will explore the process of creating a malicious payload using MSFvenom, a tool from the Metasploit framework. The focus will be on how to craft a lightweight malware dropper, deploy it on a USB stick, and set up a listener to capture connections from compromised machines. This practical demonstration will provide insights into penetration testing techniques and the use of Meterpreter for exploiting vulnerabilities in target systems.
Introduction to penetration testing
Creating malware with MSFvenom
Deploying malware on USB sticks
Setting up a listener with Metasploit
Using Meterpreter for exploitation
Simulating user interaction with malware
In this video module, we will explore the powerful tool Netcat, often referred to as the Swiss army knife of hacking. Participants will learn how to set up and utilize Netcat for various tasks, including establishing basic connections, transferring files, and creating reverse shells between two virtual machines running Kali Linux and Windows Server 2016. The module will provide hands-on demonstrations to ensure a comprehensive understanding of Netcat's capabilities and practical applications in penetration testing.
Introduction to Netcat
Setting up virtual machines
Basic Netcat connection
Creating a simple chat server
File transfer from server to client
File upload from client to server
Using NCAT as an alternative to Netcat
Establishing a reverse shell
Creating a backdoor user account
Transferring files back to the client
In this video module, we will learn how to use Wireshark to capture network traffic between virtual machines, specifically focusing on file transfers using the SMB protocol. The session will guide you through setting up the environment with Server 2016, Metasploitable, and Kali Linux, capturing the file transfer process, and extracting the transferred file from the network traffic.
Setting up the virtual machine environment
Starting Wireshark for network traffic capture
Understanding VM connectivity as a hub
Using SMB for file sharing
Uploading files from Server 2016 to Metasploitable
Capturing file transfer traffic with Wireshark
Filtering and analyzing SMB traffic in Wireshark
Exporting captured objects from Wireshark
In this video module, we will explore authentication attacks, focusing on various types and tools used to exploit weaknesses in authentication systems. We will discuss how passwords are stored, the importance of strong passwords, and the methods attackers use to crack them. Additionally, we will cover advanced techniques such as pass-the-hash, password spraying, and credential stuffing, as well as tools like Mimikatz, John the Ripper, and Hashcat.
Overview of authentication attacks
Password storage mechanisms
Importance of strong passwords
Password hashing and cracking methods
Types of authentication attacks
Tools for password cracking
Active Directory authentication
Kerberos and ticket-based authentication
Credential dumping and cached credentials
Password cracking techniques: dictionary attacks, brute force, mask attacks
Advanced attack methods: pass-the-hash, password spraying, credential stuffing
Social engineering and non-electronic attacks
Tools for authentication attacks: Mimikatz, Hashcat, John the Ripper, Burp Suite
Network service attacks and exploitation
In this video module, we will explore how to use Medusa, a powerful online password attack tool, to perform brute force attacks on network services. We will demonstrate the process of configuring Medusa, selecting a dictionary file for password attempts, and executing the attack against a target system. The session will provide practical insights into identifying user accounts and testing password strength using common password lists.
Introduction to Medusa and its capabilities
Setting up the environment with Kali and Windows XP
Checking IP addresses and user accounts
Selecting and using a password dictionary
Executing a brute force attack with Medusa
Understanding Medusa command syntax and options
Analyzing attack results and user account access
In this video module, viewers will learn about the concept of 'Pass the Hash' attacks, a technique used to exploit vulnerabilities in Windows Server 2016. The instructor will guide participants through the process of setting up the necessary tools, creating user accounts, and executing commands to dump password hashes. The module will also cover how to use Metasploit to compromise the server and the importance of understanding network configurations and user permissions.
Introduction to Pass the Hash attacks
Setting up the environment with Windows Server 2016 and Kali Linux
Creating user accounts on Windows Server
Using Metasploit for exploitation
Compromising Windows Server 2016 with EternalBlue
Dumping password hashes
Using John the Ripper for password cracking
Understanding the implications of cached passwords
Executing commands with Meterpreter sessions
In this video module, we will explore the technique of password spraying using Kali Linux. The instructor will demonstrate how to create user accounts on a Windows Server 2016 environment and then utilize the Hydra tool to test a common password against multiple users. This method is effective for identifying weak passwords across a range of accounts.
Introduction to password spraying
Setting up user accounts on Windows Server 2016
Using the net user command
Creating a list of users for testing
Understanding password requirements for Server 2016
Introduction to Hydra tool
Executing password spraying with Hydra
Identifying successful logins
In this video module, we will explore the technique of stealing a token from an authenticated user, specifically an administrator, to impersonate them and perform unauthorized actions. This method allows penetration testers to bypass the need for password cracking by leveraging existing session tokens.
Introduction to token stealing
Setting up Metasploit for exploitation
Using Windows SMB PS exec
Capturing and using tokens
Impersonating an administrator
Creating a new user with administrative privileges
Examining the event logs for audit trails
Framing the administrator for unauthorized actions
In this video module, we will explore the use of Responder on Kali Linux for penetration testing, specifically focusing on how to capture authentication credentials from clients using various network protocols. The session will cover the setup of the environment, the functionality of Responder, and practical demonstrations of credential capture techniques.
Understanding private networks and authentication methods
Introduction to Responder and its purpose
Setting up Kali Linux and Server 2016 for testing
Running Responder with appropriate switches
Capturing credentials using NTLM and basic authentication
Analyzing captured data and logs
Demonstrating credential capture through SMB and HTTP
In this video module, we will explore the process of cracking NTLM passwords using Hashcat on Kali Linux. We will cover the necessary system requirements, how to prepare the environment, and the steps to execute a dictionary attack using the popular 'rockyou' wordlist. By the end of the video, viewers will understand how to efficiently recover passwords from NTLM hashes.
Introduction to password cracking
System requirements for Kali Linux
Preparing the hash and dictionary files
Using Hashcat for password recovery
Executing a dictionary attack
Analyzing the results of password cracking
In this video module, we will explore host-based attacks, focusing on various attack types, methods of privilege escalation, and the tools used to execute these attacks. We will discuss how attackers exploit system weaknesses and misconfigurations to gain unauthorized access and escalate privileges on both Windows and Linux systems. Key techniques such as DLL injection, credential dumping, and the use of living-off-the-land binaries will also be covered.
Introduction to host-based attacks
Privilege escalation techniques
Windows escalation methods
Linux escalation methods
Exploiting unpatched vulnerabilities
Using tools like Mimikatz and Metasploit
Scheduled tasks and cron jobs
Credential dumping techniques
Circumventing security tools
Payload obfuscation
Access control exploitation
Kiosk escape techniques
Library injection methods
Using living-off-the-land binaries
Real-world examples of host-based attacks
In this video module, we will explore the process of privilege escalation in penetration testing using the EternalBlue exploit within the Metasploit framework. The session will cover the initial foothold gained through a low-level user account and demonstrate how to escalate privileges to gain higher access levels, including system-level control.
Introduction to privilege escalation
Using low-level user accounts for initial access
Overview of Metasploit and its tools
Understanding the EternalBlue exploit
Setting up the environment with Windows Server 2016 and Kali Linux
Social engineering for user credentials
Executing the EternalBlue exploit via Metasploit
Using Meterpreter for post-exploitation tasks
Creating a backdoor for persistent access
Review of different variants of the EternalBlue exploit
In this video module, we will explore techniques for clearing event logs using Meterpreter in a Windows Server 2016 environment. The focus will be on utilizing Metasploit to erase traces of activities and understand the implications of such actions.
Introduction to Meterpreter and Metasploit
Establishing a Meterpreter session on Windows Server 2016
Using SMB PS exec for exploitation
Setting up reverse TCP payloads
Clearing event logs with Meterpreter
Understanding the limitations of log clearing
Implications of clearing logs and framing evidence
In this video module, we will demonstrate how to successfully exploit a Linux box using Kali Linux and Metasploitable. The process involves scanning for vulnerabilities, utilizing Metasploit to gain access, and managing user credentials. By the end of this session, viewers will understand the steps to pwn a Linux system from start to finish.
Introduction to pwn (punk and own)
Setting up Kali and Metasploitable
Finding the IP address of Metasploitable
Using Nmap for vulnerability scanning
Understanding Nmap scan types and options
Identifying open ports and services
Using Metasploit for exploitation
Setting up and running exploits
Managing user credentials and passwords
Extracting user and password data
In this video module, we will explore the most common type of hacking attack: web application attacks. We will cover various attack vectors including brute force, collision attacks, directory traversal, server-side request forgery (SSRF), cross-site request forgery (CSRF), deserialization attacks, injection attacks, and more. The session will also highlight the importance of input validation, access controls, and secure coding practices to mitigate these vulnerabilities.
Introduction to web application attacks
Brute force attacks
Collision attacks
Directory traversal
Server-side request forgery (SSRF)
Cross-site request forgery (CSRF)
Deserialization attacks
Injection attacks (SQL injection, command injection)
Cross-site scripting (XSS)
Server-side template injection (SSTI)
Insecure direct object references (IDOR)
Session hijacking
Arbitrary code execution
File inclusion attacks
API abuse
JSON Web Token (JWT) manipulation
Web application attack tools
In this video module, we will explore directory traversal techniques using the DVWA (Damn Vulnerable Web Application) hosted on Metasploitable. We will navigate through the web application's directory structure, exploit vulnerabilities to access sensitive files, and analyze web logs to identify evidence of our actions. This practical demonstration will provide insights into the security implications of improper input validation and file inclusion vulnerabilities.
Introduction to directory traversal
Setting up Metasploitable and DVWA
Navigating the web application structure
Understanding file inclusion vulnerabilities
Executing directory traversal attacks
Accessing sensitive files (e.g., passwd file)
Analyzing web logs for evidence of attacks
Using PuTTY for log analysis
In this video module, we will explore SQL injection, one of the most common web application vulnerabilities. The session will guide you through the process of exploiting SQL injection to extract sensitive information, such as user credentials, from a vulnerable web application hosted on Metasploitable. You will learn how to set up your environment, perform SQL injection attacks, and analyze the underlying SQL queries to retrieve valuable data.
Introduction to SQL Injection
Setting up Metasploitable for Pen Testing
Understanding the DVWA Application
Performing Basic SQL Injection
Analyzing SQL Queries
Extracting User Information
Using Union Statements in SQL Injection
Identifying Database Users and Tables
Retrieving Password Hashes
In this video module, we will explore SQL injection techniques using a live website set up for educational purposes. The focus will be on identifying vulnerabilities in the website's SQL queries and manipulating URL parameters to test for SQL injection possibilities. We will also discuss error messages and how they can indicate potential vulnerabilities.
Introduction to SQL Injection
Overview of the test PHP Vulnerable Web Application
Navigating the website and understanding its structure
Identifying potential SQL injection points
Testing for SQL injection vulnerabilities
Understanding error messages and their implications
Determining the number of columns in SQL queries
Using UNION statements in SQL injection
Analyzing query results and identifying vulnerable columns
In this video module, we will continue our exploration of SQL injection techniques, specifically targeting a vulnerable PHP web application. We will identify and exploit various SQL injection points to extract sensitive information from the database, including user credentials and other critical data. The session will provide practical demonstrations of how to utilize MySQL global variables and functions to manipulate SQL queries effectively.
Overview of SQL injection
Identifying vulnerable columns in a web application
Using MySQL global variables and functions
Testing SQL injection with mathematical functions
Enumerating tables and columns in a database
Extracting sensitive user information
Using group_concat for data retrieval
Demonstrating potential impacts of SQL injection
In this video module, we will explore the concept of command injection in web applications, specifically focusing on exploiting a vulnerable web app that allows the execution of operating system commands without proper input validation. We will demonstrate how to leverage this vulnerability to execute commands, read system files, and perform network scans.
Introduction to command injection
Setting up Metasploitable
Using Nmap for network scanning
Executing commands through a vulnerable web app
Reading system files using command injection
Navigating directories on the server
Dumping sensitive files
Scanning the subnet using Nmap
Understanding the implications of command injection
In this video module, we will explore the concept of cross-site scripting (XSS) and demonstrate how to inject a malicious iframe into a vulnerable web application using Metasploitable. The session will cover the necessary setup, the mechanics of XSS attacks, and the implications of using iframes for malicious purposes.
Introduction to Cross-Site Scripting (XSS)
Setting up Metasploitable
Understanding iframes and their functionality
Logging into DVWA (Damn Vulnerable Web Application)
Adjusting security settings in DVWA
Executing a basic XSS attack
Injecting a malicious iframe
Social engineering implications of XSS
In this video module, we will explore the Document Object Model (DOM) and its implications for web security. We will demonstrate how to create a malicious web page that exploits the DOM to bypass web application firewalls (WAF) using obfuscation techniques and social engineering tactics. The session will involve setting up a controlled environment with virtual machines and utilizing JavaScript for dynamic manipulation of web content.
Introduction to the Document Object Model (DOM)
Dynamic behavior modification using JavaScript
Creating a malicious web page
Encoding and obfuscating JavaScript to bypass WAF
Setting up a virtual machine environment
Utilizing social engineering for cross-site scripting
Testing and deploying the malicious page
Understanding web application firewalls (WAF)
In this video module, we will explore how to exploit insecure direct object references (IDOR) using Burp Suite. The session will guide you through a practical lab scenario where we will identify and retrieve sensitive information by manipulating URLs and analyzing chat logs.
Introduction to Insecure Direct Object References (IDOR)
Using Burp Suite for web application security testing
Navigating PortSwigger's academy labs
Accessing user chat logs through static URLs
Identifying and exploiting predictable URL patterns
Using Burp Suite's proxy and repeater tools
Retrieving sensitive information from chat transcripts
Logging in with discovered credentials
In this video module, we will explore the concept of cross-site scripting (XSS) through a practical demonstration involving two users: a hacker named Moo and an unsuspecting user named Susie. The session will illustrate how Moo can exploit vulnerabilities in a web application to steal Susie's session cookie, allowing him to impersonate her without needing her credentials. The video will cover the setup required for the demonstration, including clearing cookies, registering users, and executing a simple XSS attack to capture session data.
Introduction to Cross-Site Scripting (XSS)
Setting up the environment with Metasploitable
Clearing cookies in web browsers
User registration and login process
Executing a basic XSS attack
Capturing session cookies
Session hijacking demonstration
Implications of XSS attacks
In this video module, we will explore parameter tampering using Burp Suite, a powerful tool for web security testing. The tutorial will guide you through the setup process on Kali Linux, demonstrate how to intercept web traffic, and show you how to manipulate parameters to achieve desired outcomes, such as altering prices in a shopping cart.
Introduction to Burp Suite
Setting up Burp Suite on Kali Linux
Creating a key for the keyring
Navigating the Burp Suite dashboard
Using the Burp browser for testing
Accessing the Web Security Academy labs
Understanding excessive trust in client-side controls
Logging into a test shopping site
Parameter tampering demonstration
Editing request parameters
Submitting altered requests
In this video module, we will explore various types of cloud-based attacks, the tools used by attackers, and real-world examples of these attacks. We will discuss how attackers exploit cloud infrastructure, including misconfigurations and vulnerabilities, to gain unauthorized access and control over systems. The module will also cover specific attack techniques, such as phishing, credential theft, and supply chain attacks, along with the tools available for penetration testing and security assessment in cloud environments.
Types of cloud-based attacks
Real-world examples of cloud attacks
Cloud infrastructure exploitation
Phishing campaigns
Credential theft and exfiltration
Misconfigurations in identity and access management
Third-party integrations and vulnerabilities
Supply chain attacks
Tools for penetration testing and security assessment
In this video module, we will explore the concept of Amazon S3 buckets, their common uses, and how to identify and access publicly available content within these buckets. We will discuss various tools and techniques for searching and scanning S3 buckets, including the use of platforms like Shodan and GitHub, as well as the Grayhat Warfare website for more efficient searches.
Introduction to Amazon S3 buckets
Setting up an AWS account
Common uses of S3 buckets
Permission issues with S3 buckets
Searching for S3 buckets using Shodan
Using GitHub for S3 bucket tools
Grayhat Warfare for bucket searches
Examples of content in S3 buckets
Narrowing searches by file type and keywords
In this video module, we will explore various types of wireless attacks and the tools used to execute them. The inherent vulnerabilities of wireless networks, particularly due to their reliance on radio waves, will be discussed. We will cover techniques such as wardriving, evil twin attacks, deauthentication attacks, and more, along with practical examples and tools that can be utilized for these types of attacks.
Overview of wireless attack types
Vulnerabilities of wireless networks
Long-range Wi-Fi antennas and their applications
Wardriving and tools for network mapping
Evil twin attacks and social engineering
Signal jamming and denial of service
Deauthentication attacks
Protocol fuzzing and its implications
Exploiting captive portals
WPS PIN attacks and vulnerabilities
Wireless attack tools overview
In this video module, we will explore the setup and execution of a Wi-Fi evil twin attack using Wi-Fi Pumpkin and Bettercap. We will discuss the necessary infrastructure, installation processes, and the logical flow of data between the attacker and the victim. The session will cover how to capture credentials through a man-in-the-middle attack, emphasizing the importance of understanding SSL stripping and the implications of HSTS.
Introduction to Wi-Fi evil twin attacks
Setting up Wi-Fi Pumpkin
Using Bettercap for enhanced functionality
Understanding the network infrastructure
The role of SSL stripping in man-in-the-middle attacks
Installation of necessary tools
Configuration of Wi-Fi Pumpkin and Bettercap
Capturing credentials from victims
Limitations of HSTS in capturing data
In this video module, we will explore the process of conducting a wireless network attack by capturing and cracking a WPA2 handshake. The demonstration will utilize the Aircrack NG suite to illustrate how to set up the necessary tools and execute the attack effectively. Key steps include war driving, setting up a rogue access point, and using a dictionary attack to retrieve the Wi-Fi password.
Surveying the client's perimeter
War driving and war walking techniques
Setting up a rogue access point
Using Aircrack NG suite
Capturing WPA2 handshake
Using a dictionary for password cracking
Monitor mode and packet sniffing
Executing a de-authentication attack
Analyzing capture files
Cracking WPA2 passwords
In this module, we explore the fascinating and critical topic of social engineering, which involves manipulating individuals to gain unauthorized access to confidential information. We will discuss various types of social engineering attacks, the psychological tactics behind them, and the tools used by attackers. Understanding these concepts is essential for recognizing vulnerabilities and enhancing security measures against such attacks.
Definition of social engineering
Types of social engineering attacks
Psychological manipulation techniques
Phases of social engineering attacks
Common social engineering attack types (phishing, vishing, smishing, etc.)
Advanced social engineering techniques (deep fakes, impersonation, pretexting)
Social engineering attack tools (Social Engineering Toolkit, Gophish, Evilginx, etc.)
Human motivations behind falling victim to social engineering
Real-world examples of social engineering attacks
Preventive measures against social engineering
In this video module, we will explore two social engineering techniques: spear phishing and credential harvesting. We will manually create a spear phishing email that directs users to a fake login page hosted on Kali Linux. This bogus website will capture user credentials while seamlessly redirecting them to the actual site, demonstrating the effectiveness of these techniques in social engineering attacks.
Introduction to social engineering techniques
Creating a spear phishing email
Setting up a fake website on Kali Linux
Using the Social Engineering Toolkit
Configuring a burner Gmail account
Crafting a convincing phishing email
Embedding malicious links in emails
Capturing credentials through fake login pages
Redirecting users to legitimate websites
In this module, we will explore the concept of social engineering through the use of a specialized malicious Apple lightning cable known as the OMG cable. This cable contains a hidden programmable chip with a Wi-Fi transceiver, allowing attackers to execute commands on a victim's device once the cable is plugged in. We will discuss the setup process, including firmware updates, pre-programming malicious commands, and executing a PowerShell script to extract sensitive information from the target device.
Introduction to social engineering
Overview of the OMG cable
Technical specifications of the OMG cable
Setting up the OMG cable
Updating firmware from GitHub
Pre-programming malicious commands
Establishing a Wi-Fi connection
Executing scripts on the target device
Extracting password hashes using PowerShell
Uploading data to an FTP server
This video module covers specialized system attacks, focusing on various types of attacks targeting mobile devices, RFID systems, AI, and operational technology. It discusses the mechanisms of these attacks, tools used, and the implications of security vulnerabilities in these specialized systems.
RFID attacks
Mobile attacks
AI attacks
Operational technology attacks
Bluetooth attacks
Prompt injection in AI
Model manipulation
PLC and CAN bus vulnerabilities
Modbus protocol exploitation
Specialized attack tools
In this video module, we will demonstrate how to pawn an Android device using a virtual machine setup with BlueStacks. The tutorial will cover the creation of a malicious APK using MSFvenom, setting up a handler in Metasploit, and utilizing a Python HTTP server to deliver the APK to the target device. We will also explore the capabilities of Meterpreter once the payload is executed on the Android device.
Introduction to BlueStacks and Android VM
Setting up the environment
Creating a malicious APK with MSFvenom
Using Metasploit for payload handling
Setting up a Python HTTP server
Delivering the APK to the target device
Using Meterpreter for post-exploitation
Uninstalling the malicious app
In this video module, we will explore the automation of attacks using various scripting languages and tools, focusing on PowerShell, bash, Python, and breach and attack simulation tools. We will discuss how these scripts can be utilized for fileless attacks, lateral movement within networks, and post-exploitation tasks, while also examining specific tools like PowerSploit, PowerUp SQL, and others.
Introduction to automating attacks with scripts
PowerShell for fileless attacks
PowerShell remoting and lateral movement
Creating and executing PowerShell payloads
PowerSploit for automating attacks
Using bash for automation on Linux/Unix systems
Python tools for network protocol manipulation
Breach and attack simulation tools
In this video module, we will explore various attacks and exploits relevant to cybersecurity, focusing on how to prioritize targets for testing and identifying vulnerabilities. We will discuss the importance of understanding high-value assets, compliance requirements, and the tools and techniques used in penetration testing. Additionally, we will cover different types of attacks, including social engineering, web application vulnerabilities, and network exploits, while emphasizing the need for effective security practices.
Prioritizing targets for vulnerability testing
Identifying high-value assets
Compliance-driven asset testing
Common attack vectors and exploits
Automated vulnerability scanning tools
Exploit prediction scoring system (EPSS)
Common vulnerability scoring system (CVSS)
Penetration testing tools and methodologies
Social engineering tactics
Web application vulnerabilities
Network and wireless security exploits
Password cracking techniques
Active Directory attacks
Cloud security vulnerabilities
Physical security and insider threats
In this video module, we will explore the critical aspects of post-exploitation techniques, focusing on establishing and maintaining persistence within compromised systems. The discussion will cover various methods and tools used for lateral movement, staging and exfiltration, cleanup and restoration, and a review of the key concepts.
Post-exploitation overview
Establishing and maintaining persistence
Scheduled tasks and cron jobs
Registry keys for persistence
Creating unauthorized accounts
Using services for persistence
Botnets and C2 frameworks
Backdoors and shells
Remote Access Trojans (RATs)
Rootkits
Browser extensions
Tampering with security controls
In this video module, we will learn how to create a persistent backdoor on a Windows machine using Netcat and Metasploit. The process involves exploiting the target system, uploading Netcat, and configuring it to ensure it runs on every reboot, allowing continued access to the system.
Introduction to persistent backdoors
Using Netcat for backdoor creation
Exploiting a Windows target with Metasploit
Uploading and configuring Netcat
Editing Windows registry for persistence
Testing the backdoor connection
In this video module, we will learn how to use Netcat for scheduled tasks to exfiltrate data from a Windows server. The tutorial covers setting up a Netcat listener, creating a batch file for data transfer, and configuring Windows Task Scheduler to automate the process of sending files at regular intervals.
Introduction to Netcat
Setting up a Netcat listener
Creating a batch file for data exfiltration
Using Windows Task Scheduler for automation
Verifying data transfer with Wireshark
In this module, we will explore the techniques and tools used for lateral movement within a compromised internal network. The focus will be on how to pivot from one system to another, discover high-value targets, and utilize various tools for enumeration and service discovery. We will also discuss methods for establishing persistence and exfiltrating data, as well as the importance of reconnaissance in planning further attacks.
Lateral Movement Overview
Pivoting Techniques
Compromised Jump Host
SSH Dynamic Port Forwarding
Credential Capture and Enumeration
Establishing Persistence
Exfiltration of Data
Tools for Lateral Movement
Living off the Land Techniques
Network and System Enumeration
High-Value Target Identification
Remote Command Execution
Using Metasploit for Lateral Movement
Netcat as a Relay Tool
Using PowerShell for Attacks
Active Directory Enumeration
In this video module, we will explore the techniques of social engineering and network penetration testing. The focus will be on how to compromise a target's machine through social manipulation and then utilize that access to pivot into a private network for further attacks. We will set up a virtual environment to demonstrate these concepts, including the configuration of virtual machines and the execution of a reverse TCP connection to establish a foothold within the target network.
Social engineering techniques
Network penetration testing
Setting up a virtual environment
Configuring virtual machines
Reverse TCP connections
Establishing a Meterpreter session
Lateral movement within a network
Using a trojanized game for exploitation
In this video module, we will conduct a practical attack using Metasploit to demonstrate how to pivot through a compromised host and gain access to an internal network. The session will cover the setup of a reverse TCP handler, the execution of a payload, and the subsequent lateral movement through the network to gather information and escalate privileges.
Setting up the virtual machines for the pivoting lab
Logging into KALI and setting up a Metasploit handler
Configuring the payload for Meterpreter
Establishing a connection with the victim machine
Using Meterpreter for privilege escalation
Finding internal IP addresses behind a firewall
Setting up a pivot using Meterpreter
Conducting a ping sweep of the internal network
Performing a port scan on discovered hosts
Identifying operating systems and services running on hosts
Executing the EternalBlue exploit against a Windows Server
Creating a backdoor for persistent access
Dumping user hashes from the compromised server
In this module, we will explore advanced techniques for data exfiltration, focusing on file encryption, compression, covert channels, and staging methods. The aim is to understand how to discreetly transfer sensitive data from a compromised environment without attracting attention. We will discuss various tools and methods for encrypting, compressing, and hiding data, as well as the protocols used for exfiltration.
File encryption and compression
Covert channels
Staging and exfiltration
Using tools like GPG, 7-Zip, and gzip
Steganography techniques
Alternate data streams (ADS)
Abusing protocols for data exfiltration
Using DNS, ICMP, HTTP, and email for exfiltration
Cloud storage for staging and exfiltration
In this video module, we will explore the concept of steganography, specifically focusing on how to hide messages within images using the least significant bit (LSB) technique. We will guide you through the process of creating custom colors in a paint application, manipulating image data, and utilizing online tools to encode and analyze hidden messages.
Introduction to steganography
Understanding least significant bit (LSB) technique
Using Microsoft Paint for image manipulation
Creating custom colors for steganography
Encoding messages in images
Using online tools for binary to ASCII conversion
Analyzing encoded images for hidden messages
In this video module, we will explore the process of credential exfiltration using social engineering techniques and specific scripts. We will demonstrate how to set up a Kali Linux environment to act as a DNS and web server listener, and utilize PowerShell and Python scripts to capture user credentials from a compromised machine.
Compromising a user's machine
Social engineering techniques
Setting up Kali Linux as a DNS and web server listener
Using PowerShell and Python scripts for credential capture
Editing and executing the Credfish scripts
Exfiltrating credentials via DNS and HTTP requests
Analyzing captured credentials
In this video module, we will cover the essential steps for cleanup and restoration after conducting a penetration test. The focus will be on ensuring that the client's environment is returned to its original state, thereby maintaining system integrity and preventing vulnerabilities. We will discuss the importance of professionalism in the cleanup process, proper documentation, and the methods for securely deleting artifacts and credentials to protect the client.
Importance of cleanup and restoration
Removing persistence mechanisms
Restoring configuration changes
Deleting tester-created credentials and tools
Spinning down infrastructure
Preserving artifacts
Securing data destruction
Documentation and reporting
Post-test monitoring
Minimizing operational risk and costs
In this video module, we will explore the critical concepts of post-exploitation techniques and lateral movement within a compromised network. The focus will be on maintaining control over compromised systems, utilizing persistence methods, and leveraging various tools and techniques to navigate and expand access within the internal network. Key strategies for credential harvesting, unauthorized account creation, and the use of compromised hosts will also be discussed.
Post-exploitation overview
Lateral movement techniques
Persistence methods
Scheduled tasks for malware execution
Registry keys for persistence
Creating unauthorized accounts
Credential extraction and reuse
Pass-the-hash attacks
Botnets and command and control (C2) servers
Bind shells vs. reverse shells
Web shells and remote access trojans (RATs)
Rootkits and their detection challenges
Tampering with security controls
Pivoting techniques
SSH dynamic port forwarding
Using Metasploit for lateral movement
Network enumeration and discovery
Lateral movement tools and frameworks
Living off the land binaries (LOL bins)
In this video module, we will cover the essential components of a penetration test report, focusing on how to present findings and recommendations in a clear, professional, and actionable manner. We will discuss the importance of report formatting, risk scoring, limitations, assumptions, and ethical considerations, as well as the role of artificial intelligence in the pen testing process.
Components of a pen test report
Report formatting and alignment
Document specifications
Risk scoring and prioritization
Test limitations and assumptions
Executive summary and key findings
Methodology and assessment techniques
Legal and ethical considerations
Quality control in reporting
Use of AI in vulnerability detection and reporting
In this video module, we will explore the essential findings and recommendations that should be included in a penetration test report. Emphasis will be placed on presenting findings clearly and effectively, ensuring they are actionable and aligned with recognized security frameworks. We will cover best practices for articulating findings, providing recommendations, and addressing various types of controls including technical, administrative, operational, and physical.
Presenting findings in a structured manner
Best practices for articulating findings
Aligning findings with CVE IDs, CVSS scores, and MITRE tactics
Providing actionable recommendations
Technical controls: system hardening, encryption, patch management
Administrative controls: role-based access, security policies
Operational controls: job rotation, user training
Physical controls: biometric security, surveillance
In this video module, we will explore the process of preparing a penetration test report for clients. We will review various examples of pen test reports, highlighting their structure, content, and areas for improvement. Key elements such as executive summaries, findings, recommendations, and client acceptance will be discussed to ensure a comprehensive and effective deliverable.
Overview of completed penetration test
Gathering and validating findings
Deliverables for clients
Reviewing examples of pen test reports
Key components of a pen test report
Executive summary and findings overview
Risk ratings and classifications
Recommendations and conclusions
Importance of client acceptance
Appendices and glossary inclusion
In this video module, we will explore the essential components of deliverables in a penetration testing report. The focus will be on creating a polished, professional report that aligns with industry standards and effectively communicates findings to clients. Key elements such as report format, risk scoring, assumptions, and ethical considerations will be discussed to ensure clarity and accuracy in documentation.
Overview of deliverables in penetration testing
Report format alignment and goals
Definitions and glossary in reports
Risk scoring and prioritization of vulnerabilities
Test limitations and their implications
Assumptions in testing and their impact on results
Common components of a pen test report
Ethical and legal considerations in reporting
Quality control in findings
Use of AI in report writing and testing
Presenting findings and recommendations
Technical, administrative, operational, and physical control recommendations
In this concluding module of the course, the instructor encourages students to take their time in understanding the concepts covered. Emphasis is placed on the importance of practice and outside research to enhance learning and prepare for the exam. The instructor expresses confidence in the students' abilities to succeed.
Course conclusion
Understanding concepts
Importance of practice
Outside research
Exam preparation
Encouragement and motivation
Step confidently into the world of penetration testing with our CompTIA PenTest+ PT0-003 training course. Designed to align with the latest exam version, this course gives you the hands-on skills and in-depth knowledge needed to pass the certification and excel as a penetration tester or ethical hacker.
The CompTIA PenTest+ certification is a globally recognized credential that validates your ability to plan, conduct, and report penetration tests against networks, web applications, cloud environments, and more. With cyberattacks on the rise, organizations rely on skilled professionals who can identify vulnerabilities, exploit weaknesses ethically, and recommend remediation strategies to strengthen defenses.
This comprehensive PenTest+ course covers all exam domains and goes beyond theory with real-world labs, demonstrations, and practice tests. Whether you’re aiming to advance your career, transition into cybersecurity, or add practical offensive security skills to your toolkit, this training is your step-by-step guide to success.
What You’ll Learn
Understand scoping and rules of engagement for penetration testing projects
Master reconnaissance and enumeration using industry-standard OSINT tools
Perform vulnerability scanning and analysis with tools like Nmap, Nessus, and Burp Suite
Execute network, wireless, and web application attacks including SQL injection, XSS, and password exploitation
Gain skills in cloud and IoT penetration testing scenarios
Apply post-exploitation techniques such as privilege escalation, persistence, and lateral movement
Develop report writing and remediation recommendation skills to present findings effectively
Build scripting and code analysis knowledge in Python, Bash, and PowerShell
Prepare for performance-based questions (PBQs) with realistic hands-on labs
Access PenTest+ practice exams and quizzes aligned to PT0-003 objectives
Why Take This Course
Updated for CompTIA PenTest+ PT0-003 (the newest exam release)
A complete blend of video lectures, demonstrations, labs, and practice questions
Learn directly from instructors experienced in ethical hacking and penetration testing
Gain confidence for both the exam and real-world pentesting engagements
Perfect for those pursuing careers as penetration testers, vulnerability analysts, security consultants, or red team specialists
Complements other certifications in the CompTIA cybersecurity pathway such as Security+ and CySA+
Who This Course Is For
IT professionals and security specialists preparing for the CompTIA PenTest+ certification exam
Ethical hackers and penetration testers who want structured, exam-focused training
Cybersecurity students seeking to build hands-on offensive security skills
Professionals comparing PenTest+ vs CEH or OSCP as a certification choice
Anyone looking to gain practical knowledge in penetration testing methodology, exploitation techniques, and security reporting
Course Benefits
Lifetime access to course content and updates
Practice quizzes and mock exams to reinforce knowledge
Learn anywhere, anytime with Udemy’s on-demand platform
Build a strong foundation in penetration testing for 2025 and beyond