Real world Hacking & Penetration testing: Version-1

Set up the OWASP broken web apps project in a local virtual machine using VM player, download the components, and configure access via the IP address for vulnerability testing.

Set up metasploitable in a virtual lab using VM player or VirtualBox, log in as msfadmin, find the VM IP with ifconfig, and explore vulnerable apps for real-world hacking practice.

Explore penetration testing methodologies and the essential compliance guidelines that govern security testing. Learn to follow security controls, rules, and testing guides across the security software development lifecycle.

Learn open source intelligence gathering basics by collecting publicly available data from social media, websites, and Netcraft to profile organizations and employees, using passive discovery techniques.

Master open source intelligence gathering with spiderfoot, an OSINT tool for collecting internet-derived data about a target. Install, configure scans, and analyze results like emails and hacked accounts.

Discover how to quickly scan an entire network in minutes using a powerful toolkit, defining target ranges, performing port scans, and saving outputs for repeat analyses.

Learn how to perform a vulnerability assessment with Nessus, including installing the scanner and running discovery scans on the local host. Build policies, select plugins, and export results.

Explore how to configure and use the Metasploit framework (msfconsole) to search for exploits, select payloads, set targets and options, and run exploits.

Explore cross-site scripting attacks (XSS), including stored, reflected, and DOM-based variants, how JavaScript injects code to steal cookies and manipulate profiles.

Learn how cross-site request forgery exploits authenticated users to perform actions, such as unauthorized transfers, and how token-based defenses mitigate this vulnerability.

Leverage automated fuzzing of input fields and parameters with tools like Burp Suite to rapidly detect vulnerabilities, configure payloads and proxies, and test multiple inputs in parallel.

Master web app testing methodologies for bug hunting by defining scope, using proxy and decoder, crafting payloads, and validating vulnerabilities such as cross site scripting and sql injection.

Explore how Windows caches user passwords and the risk of dumping cached credentials, including last ten passwords, especially on domain and offline machines, and the implications for security.