Hands-on Penetration Testing Labs 2.0

Welcome. This lecture consists of an introduction and overview of my Hands-on Penetration Testing Labs 2.0 course. I look forward to working with you!

This lecture will  provide a technical explanation of many but not all of the commands and tools we'll be utilizing within this course. Also, in the resources attached to this lecture, there are multiple URLs that contain additional comprehensive information related to what is covered. If there's anything you're confused about or need further information on that you cannot find out on your own with research, please feel free to contact me via the Q&A system or direct messaging.

This lecture will show you how and where to download and configure the latest version of Kali Linux, 2020, which is tailor made for my Udemy course Hands-on Penetration Testing Labs 4.0. It's also being made available for all other courses, as the newest version has some slight differences which may make an impact.

This video will show you how to download and configure Kali Linux within VirtualBox, using the most recent version as of January 2019. Kali Linux is an industry standard for pentesters, and will be the OS used to exploit numerous intentionally vulnerable VMs during this course.

This lab will show you how to download, configure, and setup a Windows 7 VM and the various tools we’ll be needing to perform analysis on binaries. We’re going to need Immunity Debugger and mona.py for efficient and effective analysis of applications and Windows-based exploit development. All of the things we need are free, and I’ll show you where and how to get them.

Now we're going to download several intentionally vulnerable VMs from my Google drive, which I've set up to allow you to conveniently download from a single location. Alternatively, you can search for them on Google, as they're publicly available on vulnhub. There will be more setups required later on for specific VMs that require manual installation and configuration, but these are what we use to start. If you don't have enough storage for all the VMs, you can delete them as necessary during your progression through this course.

This lab will consist of the enumeration and exploitation of an intentionally vulnerable VM. You should already have this VM downloaded at this point. If not, please refer to the previous lab (lecture 5) for instructions on how to acquire all vulnerable VM's from my Google drive.

This lab will consist of the enumeration and exploitation of an intentionally vulnerable VM. You should already have this VM downloaded at this point. If not, please refer to the previous lab (lecture 5) for instructions on how to acquire all vulnerable VM's from my Google drive.

This lab will consist of the enumeration and exploitation of an intentionally vulnerable VM. You should already have this VM downloaded at this point. If not, please refer to the previous lab (lecture 5) for instructions on how to acquire all vulnerable VM's from my Google drive.

This lab will consist of the enumeration and exploitation of an intentionally vulnerable VM. You should already have this VM downloaded at this point. If not, please refer to the previous lab (lecture 5) for instructions on how to acquire all vulnerable VM's from my Google drive.

This lab will consist of the enumeration and exploitation of an intentionally vulnerable VM. You should already have this VM downloaded at this point. If not, please refer to the previous lab (lecture 5) for instructions on how to acquire all vulnerable VM's from my Google drive.

This lab will provide an overview of Hackthebox, and show you how to get set up and start hacking their VMs. Hackthebox is one of the best platforms for pentesting hands-down, offering free and paid CTF style VMs to hack over their VPN. Obviously, the paid version has more content. However, the catch is, you have to hack your way into their site in order to get an invite code.     

This lab will show you how to enumerate and exploit the retired Hackthebox VM, Active.

This lab will show you how to setup, enumerate, and exploit one of the only available intentionally vulnerable Windows Server 2008 VMs, Metasploitable 3.

In this lab, we'll be setting up a local vulnerable Apache Struts application with docker, utilizing a standalone exploit to show proof of concept.

Apache Struts is an open source web application framework for developing Java EE web applications. There are several critical vulnerabilities which pertain to certain versions of Apache Struts, several of which result in remote code execution. Due to its importance, I wanted to include a hands-on demo of Apache Struts to show its potential.

This lab will provide an overview of Hack.me and show you how to get started with it. Hack.me is an open source collection of vulnerable sites that can be utilized anywhere for free, but requires registration. All you need to register is a valid e-mail address.

Hack.me is supported by the creators of eLearnsecurity, which is one of the best cybersecurity training providers I've ever used. At the time of this recording, I've only completed their Web Application Penetration Testing cert, known as eWPT, but I plan to do their other certs over the next few years to support my continuing education units for my other certs.

This lab will cover two of hack.me's vulnerable Wordpress exercises. Instructions on how to sign up for it are in the previous lab.