Windows & AD Pentesting - Hands-on Lab Scenarios
What you'll learn
- Full Windows Pentesting Lifecycle from Recon to Post-Exploitation
- Red Teaming with Common Windows Services - WinRM - SMB - WMI
- AD Domain Enumeration - BloodHound - PowerView - ldapsearch
- Initial Access Exploitation - AS-REP Roasting - SharePoint - Password Spraying
- Privilege Escalation - WinPEAS - 3rd-party Passwords - AlwaysInstallElevated
- Post-Exploitation - Golden Ticket Attacks - Pass-the-Ticket - Overpass-the-Hash - Dumping & Cracking Hashs
- Basic knowledge of Windows and AD terminology and functionality
- Beginner to Intermediate knowledge and experience in Pentesting
- Experience with Linux and Windows command line
- A Kali Linux VM and high-speed internet connection to follow along in the labs
This 2023 course is targeted for Beginner to Intermediate security professionals and enthusiasts who want to learn more about Windows and Active Directory security. Topics covered are 100% Windows related and dive into the full pentesting lifecycle of Windows and Active Directory.
The course guides the student through red team and ethical hacking TTP's while showcasing real-world scenarios on a Windows cyber-range which mimics a corporate network. The cyber-range, Kinetic is hosted by SlayerLabs and contains 25 Windows VM's with 5 Domains and 6 subnets all engineered to exploit!
The mission of this course and cyber-range is to provide the user with a technical high-level overview of Windows and Active Directory security, along with realistic scenarios and learning opportunities to become proficient in Windows AD Pentesting. The goal is to provide real-world scenarios so the student can get hands-on keyboard and start running through the entire process from Reconnaissance to Post-Exploitation.
The course has been designed to trim the fat and only covers Windows related topics. With that, the student is expected to know basic TTP's in relation to offensive security, ethical hacking and pentesting. For example - covering how to setup a VM in VirtualBox, explaining the basics of networking or installing additional tools on Kali will not be covered.
Each topic dives into the technical side, providing command-line examples and explanations along the way. Topics covered (but are not limited to):
Domain Enumeration with BloodHound, PowerView, ldapsearch and Dsquery.
Initial Exploitation of AS-REP Roasting, Kerberoasting, Follina, Sharpoint Exploits, and Password Spraying.
PrivEsc with WinPEAS, Saved 3rd party creds, and AlwaysInstallElevated.
Post-Exploitation using Golden Ticket attacks, Pass-the-Ticket, Overpass-the-Hash, Pass-the-Hash, Dumping & Cracking NTLM & MsCache hashes and DPAPI.
Course content uses Kali the majority of the time, but also uses Slayer Labs Kinetic range Windows targets as jump boxes, utilizing built-in services such as WinRM and SMB. Students should be comfortable using Kali Linux along with Linux and Windows command-line. Majority of the commands used throughout this course are provided as a downloadable resource once purchased. Common tools used on Kali are Impacket Suite, CrackMapExec, Evil-Winrm and Metasploit.
Who this course is for:
- Students interested in learning about Windows and Active Directory Pentesting
- Students who want to learn and get hands on experience running through entire Windows Pentesting lifecycle
Slayer Labs is passionate about offensive cybersecurity and committed to engineering and developing course content and cyber-ranges to reflect real world scenarios.
In regards to pentesting and offensive cybersecurity, we believe getting hands on keyboard, running through actual pentesting scenarios provides much more value than simply covering theory. The mission for creating course content is to bridge the gap between theory and practice...with a heavy focus on practice.