Facebook-f Twitter Youtube Linkedin
Cart

Penetration Testing as a Day Job

$3,299.00

REGISTER

Duration

3 days

Delivery Method

in-person

Level

beginner / intermediate

Seats Available

20

Duration

3 days

Delivery Method

in-person

Level

beginner / intermediate

REGISTRATION CLOSED

DATE: 21-23 August 2023

TIME: 09:00 to 17:00 ICT/GMT+7

Date Day Time Duration
21 Aug Monday 0900-17:00 ICT/GMT+7 8 Hours
22 Aug Tuesday 0900-17:00 ICT/GMT+7 8 Hours
23 Aug Wednesday 0900-17:00 ICT/GMT+7 8 Hours

Exclusive for HITB, this class will include :-

– Multiple HITB exclusive hands-on labs
– HITB exclusive CTF at the end of the course
– 30 days of on-demand lab access.

Many introductory hacking courses show attendees tools & exploit scenarios, yet don’t prepare attendees to work towards a pentesting career, with a methodical approach to beginning, “middling”, ending, or reporting on an actual real pentest.
We take attendees on a light-hearted and hopefully humorous journey from start to finish through a very real (totally simulated) pen test engagement. Pwning our way through our real (fictional) organisation’s apps and infra, including webapps through internal infra and even some physical device silliness (think lights / sounds / maybe even some foam darts), before telling our “client” our findings in a professional (mostly) pentest report.

Hugely lab driven, with a “narrative over the top” almost continuously hands-on approach.

If you didn’t have fun then honestly we totally screwed this up, yet we will ensure that you come away feeling confident and ready to practise your skills flying solo, with plenty of advice included on next steps.

Key Learning Objectives
  • Learn a huge number of skills, tools, concepts and techniques used by real pentesters on real engagements
  • Learn how to apply those skills in an actual pentest-like scenario
  • Learn to proactively prepare for and produce a meaningful report at the end of the engagement
  • Have fun along the way!

(Course is also fully aligned to the published syllabus to prepare for CREST CPSA and CRT examinations)

Student will be provided with
  • Full slide deck.
  • Handouts with lab walkthroughs
  • 30 days worth of on-demand lab access (HITB exclusive)

 

Topics covered

1. Introduction, Soft Skills & Assessment Management

  • How to approach a pentest
  • Engagement Lifecycle
  • Law & Compliance
  • Methodology
  • Scoping
  • Understanding, Explaining, and Managing Risk
  • Good report writing skills: before, during, and after the assessment

 

2. Background Information Gathering and Open Source (OSINT)

  • Records: Registration / DNS / CT Logs
  • Customer Web Site Analysis
  • Google Hacking and Web Enumeration
  • NNTP Newsgroups and Mailing Lists
  • Information Leakage from Mail & News Headers
  • Social Engineering and Physical Security

 

3. Security Fundamentals

  • Cryptography
  • Applications of Cryptography
  • Encoding / Encryption / Hashing
  • Hash cracking
  • File System Permissions
  • Audit Techniques
  • Source Code Review

4. Web Technologies

  • Web Servers
  • Web Enterprise Architectures
  • Web Protocols
  • Web Mark-up Languages
  • Web Programming Languages
  • Web Application Servers
  • Web APIs
  • Web SubComponents

5. Web Application Security Assessment

  • Web Application Reconnaissance
  • Identifying vulnerabilities
  • Web Site Structure Discovery
  • Information Gathering from Web Mark-up
  • Information Disclosure in Error Messages
  • Enumerating CMSs
  • Threat Modelling and Attack Vectors
  • Authentication Mechanisms
  • Authentication bypasses / flow abuses
  • Authorization Mechanisms
  • Session Handling: Predictability / Termination / Hijacking / Fixation
  • Access control bypasses
  • Object referencing issues
  • Input Validation
  • Cross-Site Scripting Attacks (XSS)
  • SQL Injection
  • Parameter Manipulation
  • Web form input abuse
  • CSRF
  • Open redirects
  • Command injection
  • XXE
  • Feature abuses
  • Generating payloads

6. Databases

  • MySQL
  • PostgreSQL
  • Microsoft SQL Server
  • Oracle RDBMS
  • Web / App / Database Connectivity

7. Networking

  • IP Protocols
  • Network Architectures
  • Networking Protocols
  • Network Mapping & Target Identification
  • Interpreting Tool Output
  • Filtering Avoidance Techniques
  • OS Fingerprinting
  • Windows vs Linux enumeration
  • Application Fingerprinting and Evaluating Unknown Services
  • Network Access Control Analysis
  • Management Protocols
  • Network Traffic Analysis
  • IPSec
  • VoIP
  • Wireless
  • Configuration Analysis

8. Windows Security Assessment

  • Domain Reconnaissance
  • User Enumeration
  • Active Directory
  • Windows Passwords
  • Windows Vulnerabilities
  • Windows Patch Management Strategies
  • Desktop Lockdown
  • Exchange
  • Common Windows Applications

9. Unix/Linux Security Assessment

  • User Enumeration
  • Unix vulnerabilities
  • FTP (Unix)
  • Sendmail / SMTP (Unix)
  • Network File System (NFS) (Unix)
  • R* services (Unix)
  • X11 (Unix)
  • RPC services (Unix)
  • SSH (Unix)

10. Finishing Up

  • Good report writing skills: after the assessment

Why You Should Take This Course

If you’re serious about becoming a capable and productive penetration tester, then this course will equip you with the skills, techniques and confidence that you will need to make that jump, whilst rarely feeling all that serious at all!

Who Should Attend

Pen Testing Noobs (no total tech noobs please!), and those who already took other hacking courses but came away thinking “I really don’t feel like that taught me how to actually conduct a pentest” (or at least words to that effect)

Key Learning Objectives

  • Learn a huge number of skills, tools, concepts and techniques used by real pentesters on real engagements

  • Learn how to apply those skills in an actual pentest-like scenario

  • Learn to proactively prepare for and produce a meaningful report at the end of the engagement

  • Have fun along the way!

    • Prerequisite Knowledge

    The only requirement is that you are keen and willing to learn, and to step outside of your comfort zone! You may not enjoy this course as a literal tech noob, all other experience levels welcome.

    Hardware / Software Requirements

    • A laptop (Chromebook will be sufficient) with a browser (all our labs are hosted in a virtual environment).
    • In case of a virtual delivery, unrestricted Internet access might be necessary (corporate VPNs can cause problems)

    Your Instructor

    Anthony Webb

    Ant has always, always, felt a need to understand what makes things tick.

    Whether it was pulling apart his toys as a child, first learning to code at around six years old on a BBC Micro in the early 90s, building custom PCs for pocket money as a pre-teen, making websites, or transplanting car engines – he just had to know the “how”, the “why”, and the “could it be made to work differently”.

    Sometimes things still work when he’s done with them.

    Whilst he may have always been one at heart, Ant finally felt he became a Proper HackerTM relatively late in life, working as a Security Consultant / Penetration Tester after achieving a BSc (First Class Hons) in Mathematics and Computing as a mature student in 2015. Over the years since, he has held numerous certifications, such as OSCP, CREST CRT, QSTM / CHECK CTM, AWS-SAA/DVA/SCS, and others.

    In 2018 Ant was recruited to teach Advanced & Specialist Hacking courses in addition to Penetration Testing and Red Team exercises. He has since built and delivered hands-on training to crowds from just a few to over a hundred people at dozens of leading international conferences, including Black Hat USA/Europe/Asia/SecTor, BruCON, OWASP, NullCon, NorthSec, CPX360 and many others, numerous in-house private deliveries, and countless live online virtual events. He specialises in Enterprise Traditional-, Cloud-, Multi Tenant-, and Cloud Hybrid- Infrastructure Security, Containerization and Container Orchestration.

    HACK IN THE BOX LIMITED

    Masdar City, United Arab Emirates