Real world Hacking & Penetration testing: Version-1

Set up the OWASP broken web apps project in a local virtual machine using VM player, download the components, and configure access via the IP address for vulnerability testing.

Set up metasploitable in a virtual lab using VM player or VirtualBox, log in as msfadmin, find the VM IP with ifconfig, and explore vulnerable apps for real-world hacking practice.

Install and configure a Windows virtual machine to build a lab for real world hacking. Deploy Windows XP with a product key and mirror localhost settings.

Explore penetration testing methodologies and the essential compliance guidelines that govern security testing. Learn to follow security controls, rules, and testing guides across the security software development lifecycle.

Learn open source intelligence gathering basics by collecting publicly available data from social media, websites, and Netcraft to profile organizations and employees, using passive discovery techniques.

Explore open source intelligence gathering using DiscoverScript and tools like the harvester to collect domain, email, and DNS data from the Internet for reconnaissance.

Master open source intelligence gathering with spiderfoot, an OSINT tool for collecting internet-derived data about a target. Install, configure scans, and analyze results like emails and hacked accounts.

Learn to use Recon-ng for gathering open-source intelligence, loading domains, running discovery models, using API keys, collecting hosts and IPs, geolocating data, and exporting a structured report.

Discover recon-ng, an open-source reconnaissance tool with a command line interface and web interfaces, learn its workspace and modules workflow, marketplace modules, and how to gather data from public sources.

Discover how to quickly scan an entire network in minutes using a powerful toolkit, defining target ranges, performing port scans, and saving outputs for repeat analyses.

Explore the discovery phase by collecting data from target websites and front-end assets, using automated screenshot tools to snapshot sites and capture headers for fingerprinting.

Learn how to perform a vulnerability assessment with Nessus, including installing the scanner and running discovery scans on the local host. Build policies, select plugins, and export results.

Master vulnerability assessment with open-source vulnerability scanning tools, authenticated scans, distributed scanning, and detailed reports. Configure, run scans against targets, and interpret reports to identify high-risk vulnerabilities.

Perform quick scans of web applications to identify vulnerabilities and surface quick findings with references and attack details for rapid assessment and practice.

Analyze zap scan results to identify and verify sql injection vulnerabilities, review evidence from inputs and errors, and export a comprehensive risk mitigation report.

Explore web application scanning with AppSpider_pro, configuring scans, analyzing vulnerabilities, generating reports, and assessing compliance to mitigate risks.

Explore how to configure and use the Metasploit framework (msfconsole) to search for exploits, select payloads, set targets and options, and run exploits.

Explore Metasploit's MS08-067 exploitation against Windows XP and 2000/2003 SMB servers, leveraging remote shells, Meterpreter payloads, and post-exploitation techniques like keylogging, password dumping, and process migration.

Demonstrates a buffer overflow attack on a vulnerable C program to gain shell access, using memory concepts and little-endian payloads in an over the wire lab.

Explore exploiting sql injection with sqlmap to identify vulnerabilities, enumerate databases, tables, and columns, and extract usernames and passwords through dictionary-based cracking.

Explore cross-site scripting attacks (XSS), including stored, reflected, and DOM-based variants, how JavaScript injects code to steal cookies and manipulate profiles.

Learn how cross-site request forgery exploits authenticated users to perform actions, such as unauthorized transfers, and how token-based defenses mitigate this vulnerability.

Leverage automated fuzzing of input fields and parameters with tools like Burp Suite to rapidly detect vulnerabilities, configure payloads and proxies, and test multiple inputs in parallel.

Master web app testing methodologies for bug hunting by defining scope, using proxy and decoder, crafting payloads, and validating vulnerabilities such as cross site scripting and sql injection.

This lecture demonstrates adding a user account to a Windows target, explores domain membership options, and discusses potential privilege escalation via command-line tools in a penetration testing context.

Learn to generate and deploy payloads with msfvenom and msfpc using rc scripts, create resource files, and run metasploit handlers to deliver Windows XP targets.

Explore how Windows caches user passwords and the risk of dumping cached credentials, including last ten passwords, especially on domain and offline machines, and the implications for security.