Offensive Ethical Hacking For Beginners Course

Perform reconnaissance and footprinting to gather target information through passive and active methods, including employee details, login pages, emails, and social media posts.

Master google hacking and dorking for passive reconnaissance using site, file type, in title, in URL, and info operators; explore google hacking databases and pastebin for exposed data.

Shodan OSINT teaches how to discover publicly exposed internet of things devices using port and vulnerability filters, banner grabbing, and organization or country searches to assess threats and exposure.

Explore whois lookups to gather domain and registrant details, registrar information, registration dates, and name servers, while recognizing privacy redaction and the use of tunneling services to protect real IPs.

Explore dns footprinting, a passive reconnaissance technique that maps domains to IP addresses and reveals subdomains, mail servers, and service records using dns recon and dns dumpster.

Explore passive email reconnaissance to collect corporate emails for social engineering and initial access, using the harvester on Kali Linux with various search sources to assess phishing susceptibility.

Conclude passive reconnaissance by exploring email addresses, Shodan, domains, DNS subdomains, and Google dorking; prepare for active reconnaissance that scans networks and identifies apps for deeper footholds.

Introduce active reconnaissance for beginners, guiding network scanning with nmap, firewall bypass techniques, and discovery of os, open ports, and services to prepare for exploitation.

Explore active reconnaissance to identify live hosts, open ports, and running services, reveal misconfigurations and unpatched vulnerabilities, and map networks with OS fingerprints and awareness of legacy systems.

Discover host discovery with nmap, using ping, ICMP, ARP, UDP, and TCP SYN and ACK scans on a 192.168.31.0/24 subnet to identify live hosts.

Explore how the nmap scripting engine automates service discovery, host probing, and vulnerability checks with scripts. Update scripts, run scans, and consider intrusion detection system and authorization.

Explore the enumeration phase to gather actionable information about services and shares. Learn NetBIOS, SMB, SSH, SNMP, LDAP, SMTP enumeration on ports 137–139, 161–162, 389, and 25 to prepare exploitation.

Learn how to enumerate ssh services using banner grabbing, netcat, and nmap scripts to identify versions, operating system, and authentication methods, then assess access requirements.

Master NetBIOS enumeration to reveal hostnames, domains, users, and shares using nmap, NTLM lookup, and enum4linux across Windows and Linux hosts.

Learn SNMP enumeration fundamentals using nmap scripts, SNMP walk, and SNMP check to reveal remote device configurations and network details on the 161 port, with practical lab methods.

Enumerate smtp services with nmap scripts and the smtp enum module, focusing on ports 25, 587, and legacy 465. Enumeration reveals backup and MySQL accounts and a data directory.

Learn the LDAP primer, a lightweight directory access protocol for authentication and authorization in Active Directory environments, including ports 389 and 636. Move into Metasploit basics and post-exploitation techniques.

Explore Metasploit framework basics, navigate its directories and word lists, and use the MSF console to manage modules, payloads, encoders, and auxiliary tools for pentest.

Generate payloads with msf venom for Windows, Linux, Mac, Android, and iOS using encoder to create reverse or bind shells, and set up exploit multi handler to receive session.

Learn to use Metasploit to exploit the vsftpd backdoor on a Metasploitable host, configure host and port, and obtain a shell session.

Learn initial access vectors in offensive ethical hacking, focusing on social engineering to gain footholds. Identify payload delivery methods to obtain a shell for exploitation.

Generate malicious pdf files with the social engineering toolkit and metasploit to deliver a meterpreter reverse shell via spear phishing, including payload selection and listener setup.

Embed a malicious VBA macro into a Word document using msf venom to generate a payload, triggering a reverse meterpreter shell for initial access.

Explore service exploitation starting with Windows Metasploitable and Linux targets, using Metasploit, MSF venom, and Hydra to exploit SSH, SMB, and other services, including Eternalblue.

Learn ssh exploitation by enumerating open ssh services, assessing for inherited vulnerability in the ssh service, and performing brute-force login with Metasploit word lists to get a foothold.

Explore SMB exploitation by brute-forcing SMB login with Metasploit on port 445, discover credentials for vagrant and administrator, and gain a remote shell via SMB Psexec on Windows target.

Explore the EternalBlue SMB exploit (MS17-010) and how Metasploit scans for and exploits vulnerable Windows systems to gain a meterpreter shell.

Investigate remote desktop protocol exploitation by using the Metasploit RDP scanner to detect port 3389, brute force credentials with Hydra, and attempt RDP access with Kali Linux clients.

Explore Windows Remote Management, and learn to brute-force credentials with crack map exec and net exact to gain PowerShell access.

Exploit the manageengine desktop central service on the Windows metasploitable machine using nmap scans, exploit searches, and metasploit to obtain a remote shell. Prepare for Linux exploitation next.

Explore linux exploitation by targeting the Metasploitable 3 Linux machine, learning ftp, telnet, vnc, postgresql, and Apache Tomcat vulnerabilities, including the Vsftpd 2.3.4 backdoor, with Metasploit guidance.

Discover ftp service exploitation using the vsftpd backdoor to gain root on a Metasploitable Linux machine, with nmap, Metasploit, and bind or reverse shells.

Explore the telnet service, a legacy insecure protocol on port 23, which sends credentials in plain text. Use netcat to connect to the Metasploitable 2 Linux machine and observe login.

Learn to identify and exploit a vulnerable PostgreSQL service on a Kali Linux / Metasploitable setup with Metasploit, gain a meterpreter shell, and perform post-exploitation tasks such as downloading files.

Explore Apache Tomcat on a Metasploitable Linux machine, testing remote code execution with Metasploit and manager upload. Assess default credentials and initial access for post-exploitation.

Explore post-exploitation after gaining initial access: establish persistence, escalate privileges to system level, harvest credentials, collect and exfiltrate data, and cover tracks to maintain access.

Explore privilege escalation in post-exploitation using the Metasploit getsystem module and Windows privilege escalation tools to elevate to admin, enabling token duplication, credential dumping, and persistence.

Master Windows privilege escalation and post-exploitation with Metasploit, exploring getsystem, EternalBlue exploitation, and local exploit suggestions to elevate access on vulnerable systems.

Demonstrates using WinPEAS for automated Windows privilege escalation, performing rapid enumeration of services, registry files, and credentials to reveal misconfigurations that enable privilege elevation from a standard user.