Hands-on Penetration Testing Labs 3.0
- 4 hours on-demand video
- 14 downloadable resources
- Full lifetime access
- Access on mobile and TV
- Certificate of Completion
Get your team access to 4,000+ top Udemy courses anytime, anywhere.
Try Udemy for Business- Enumeration
- Remote and Local Exploitation
- Vulnerability Scanning
- SQL Injection
- Cross-site Scripting (XSS)
- Reverse shells
- Nmap
- Metasploit
- Nikto
- Dirb
- Remote and local buffer overflows
- Burp Suite
- Kali Linux
- Privilege escalation
- Custom exploit development
- Windows host (preferred, course tested with Windows 10, although other OS's should work)
- VirtualBox
- 8 GB RAM (more is better, less may cause performance issues)
- Several free and open source VMs
NOTE: This is independent from Hands-on Penetration Testing Labs 1.0 and 2.0. All three are standalone courses and can be taken in any order, or on their own.
Hello students, and welcome to my Hands-on Penetration Testing Labs 3.0 course. If you're familiar with my previous courses, this is part three of the series.
We're going to be diving straight into hands-on technical labs with little focus on theory, as in my opinion this is the best way to prepare for the actual job and for hands-on practical certifications such as OSCP. There's no better way as a penetration tester to gain the raw skills that are needed on the job than to actually use and master the necessary technology and skills.
I should mention right now that this course requires a reliable Internet connection, and a decent laptop or PC which can support at least two virtual machines. I suggest that you have at least 8 GB of RAM, but the more the better, especially if you want to make an advanced virtual lab in which to practice and hone your pentesting skills. Ideally, you should have 16 GB or 32 GB of RAM and a decent processor, but you can get away with less.
During our course work we'll be using Virtual Box as a software hypervisor in order to spin up Kali Linux, which is an industry standard penetration testing operating system. We'll also be setting up several intentionally vulnerable VMs to demonstrate vulnerabilities within a variety of network services and web applications, walking through various tactics, techniques, and procedures to simulate adversarial activity. I'll be providing all of the necessary software, which is completely free and open source.
We'll be covering enumeration, vulnerability scanning, and automated and manual exploitation. More specifically, we'll be going over key essential pentesting skills such as port scanning and service enumeration, local file inclusion, web directory brute forcing, buffer overflows exploit development, SQL injection, Cross-Site Scripting, various types of reverse shells, a variety of local privilege escalation, and much more.
All of the technology which is utilized within these recordings is current as of June 2019. Technology is constantly changing, so some of the software seen in these videos may be different when you take the course. However, it should be similar enough for you to figure out with quick Google searches, or with my assistance if needed. You can always reach out to me via the messaging or Q&A system, although I highly encourage you to perform troubleshooting on your own, as the ability to research and troubleshoot is one of the single most important skill sets as a penetration tester and IT professional in general.
I'm looking forward to working with all of you, and hope you enjoy my course. Please leave a review if you enjoy my course, as it allows me to reach more and more dedicated students and existing or aspiring cyber security professionals.
- Penetration Testers
- Cyber Security Students
- Cyber Security Analysts
- Aspiring Penetration Testers
- Aspiring Cyber Security Analysts
- OSCP Candidates
- CEH Candidates
- Pentest+ Candidates
Due to popular demand in my previous pentesting courses, I'm going to provide a technical explanation of many but not all of the commands and tools we'll be utilizing within this course. Also, in the resources attached to this lecture, I have a bunch of URLs that contain additional comprehensive information related to what we're about to cover. If there's anything you're confused about or need further information on that you cannot find out on your own with research, please feel free to contact me via the Q&A system or direct messaging.
If you're already well versed in basic to intermediate Linux commands, you should be okay with skipping this lecture. Otherwise, stay tuned for the new information or refresher depending on your skill level.
This lecture will show you how and where to download and configure the latest version of Kali Linux, 2020, which is tailor made for my Udemy course Hands-on Penetration Testing Labs 4.0. It's also being made available for all other courses, as the newest version has some slight differences which may make an impact.
This video will show you how to download and configure Kali Linux for VirtualBox. Kali Linux is the primary operating system that we'll be using for penetration testing during the remainder of our course. Kali Linux is an industry standard for penetration testing, and has numerous conveniently built in tools for enumeration and exploitation. We're going to be downloading the most recent version as of June 2019 at the time of this recording, so the version you download may be different. However, in most cases, it should be the same or just slightly different in terms of commands and usability. If big changes occur that severely impact its usage, I will make updates to the course as needed.
In this quick lecture, I'm going to explain where you can find the vulnerable VMs that are going to be utilized within the remainder of the course. As you can see on screen, I'm providing a Google drive location where you can conveniently download all of the vulnerable VMs. Alternatively, you could grab them from VulnHub, with the exception of the Windows box which is only available here.
Stapler is an intentionally vulnerable Linux VM authored by g0tmi1k, who consistently creates stellar pentesting content. This VM is interesting because there are two different ways to get shells with limited privileges, and three different ways to get root access. We're only going to cover one way to enumerate and exploit this VM, but I highly encourage you to find out the other ways on your own.
Here is a custom made intentionally vulnerable 32-bit Windows 7 box that was built from scratch using the free Windows 7 developer VirtualBox VM. It's really hard to find pre-made vulnerable Windows machines to practice on, so that's why there's only one of them in this course. The only other one I know if is Metasploitable 3, and that's already covered within one of my other courses. For additional practice on Windows enumeration and exploitation, I highly suggest that you start using hackthebox.eu. It has a plethora of Windows machines to hit. I also suggest offensive security's PWK course which is a prep for the coveted OSCP certification.
This lab will focus on the enumeration and exploitation of the intentionally vulnerable VM IMF, which is another Linux box you can find on VulnHub or my Google drive.
The public firing range is a spectacular resource for practicing several exploitation techniques, but mainly cross-site scripting or XSS. We're going to go over several XSS exploitation techniques in detail, showing where the vulnerability exists, how to exploit it, and why the exploit works. While we're only going to cover a certain portion of this site, I suggest that you thoroughly exploit every one of these vulnerabilities manually and do your best to understand everything there is to know about these vulnerabilities. It's one thing to automatically scan vulnerable web applications, it's another to completely understand how the web application works and how to exploit it without the use of automated tools. This is how to bring your penetration testing skills to a new level.