Pentest report

N Topic Status
1 Module 1. Introduction to the penetration testing

·         What is hacking and ethical hacking?

·         Types of cyberattacks;

·         Penetration testing methodology: OSTMM, ISSAF, etc;

·         Penetration testing project management;

·         Hacking tools overview;

·         Know the applicable laws;

·         Dealing with third parties;

·         Social engineering issues;

·         Logging;

·         Reporting;

·         Scope. Links to other courses;

Labs:

·         Lab 1.1 Basic configuration of ethical hacker workplace: Kali Linux

·         Lab 1.2 Basic configuration of machine for hacking: Metasploitable 2

 

 Teacher’s book – 100%

Student’s book – 100%

PPT – 100%

Virtual machine (ISO image) – 100%
2 Module 2. Intelligence Gathering

·         Open Source Intelligence methods;

·         Structured analytic techniques overview;

·         Types of collected information:

o   Business information (financial, clients, suppliers, partners);

o   Information about IT-infrastructure;

o   Employee;

·         Discovering sources of the information;

·         Google for penetration testers;

·         Other search instruments;

·         Tools overview;

Labs:

·         Lab 2.1 Using of Google for OSINT;

·         Lab 2.2 Using Maltego;

·         Lab 2.3 Whois Reconnaissance, DNS Reconnaissance, SNMP reconnaissance, SMTP reconnaissance, Microsoft Netbios Information Gathering

·         Lab 2.4 Network discovery with NMAP scanner.

·         Lab 2.5 Using sniffers

 

 Teacher’s book – 100%

Student’s book – 100%

PPT – 100%

Virtual machine (ISO image) – 100%
3 Module 3. Vulnerability Analysis

·         Types of vulnerabilities;

·         Manual search for vulnerabilities;

·         Automated search for vulnerabilities;

·         Vulnerability Analysis tools.

Labs:

·         Lab 3.1 Basic Netcat usage;

·         Lab 3.2 Manual search for vulnerability in Apache Web-server using Telnet\Netcat;

·         Lab 3.3 Using vulnerability scanners (Nessus, Nexpose, OpenVAS) for vulnerability discovery;

·         Lab 3.4 Using miscellaneous assessment tools.

 

 Teacher’s book – 100%

Student’s book – 100%

PPT – 100%

Virtual machine (ISO image) – 100%
4 Module 4. Vulnerability Analysis for Web-applications

·         OWASP projects

·         Types of vulnerabilities in Web-applications. OWASP Top 10 vulnerabilities

·         OWASP testing guide overview;

·         Google Hacking. Google Hacking Database (GHDB)

·         Web security testing tools:

–          Web-scanners,

–          Local Proxies

–          Fuzzers

–          Specialized browsers and browser plugins

Labs:

·         Lab 4.1 Google Hacking using Google Hacking Database (GHDB);

·         Lab 4.2 Vulnerabilities discovery with web-scanners Nikto, Arachni..;

·         Labs 4.3 – 4.12 on OWASP Top 10 vulnerabilities

 

 Teacher’s book – 0%

Student’s book – 0%

PPT – 0%

Virtual machine (ISO image) – 100%
5 Module 5. Exploitation

·         What is an exploit? (Dorofeev)

·         The Exploit Database

·         Google for penetration testers: www.exploit-db.com

·         Local exploitation

·         Metasploit Framework overview;

·         Types of payloads;

·         Meterpreter usage;

·         Man-in-the-middle attacks;

·         Password attacks: online and offline;

·         Art of manual password guessing;

·         Pass the hash attack.

Labs:

·         Lab 5.1 Exploitation of Metasploitable 2 with Metasploit (…);Dorofeev )

·         Lab 5.2 spoofing tools : basic Ettercap, arpspoof usage (Cain & Abel? – Dorofeev)

·         Lab 5.3 Perform A Man In The Middle Attack With Kali Linux & Ettercap (among others SSLStrip);

·         Lab 5.4 Online password attack with THC-Hydra; (Dorofeev)

·         Lab 5.5 Offline password attacks with John-the-Ripper (Dorofeev)

·         Lab 5.6 Modern 2014 attacks – heartbleed, shellshock, etc

 

 Teacher’s book – 50%

Student’s book –50%

PPT – 0%

Virtual machine (ISO image) – 100%
6 Module 6. Social engineering

·         Social engineering (Dorofeev)

·         The Social engineering Toolkit project overview; (Andrian)

Labs:

·         Lab 6.1 SET usage;

 

 Teacher’s book – 0%

Student’s book – 0%

PPT – 0%

Virtual machine (ISO image) – 100%
7 Module 7. Exploitation using client-side attacks

·         Client side exploits

·         The browser exploitation framework project overview;

Labs:

·         Lab 7.1 Client side exploits;

·         Lab 7.2 BeEF usage;

 

 Teacher’s book – 0%

Student’s book – 0%

PPT – 0%

Virtual machine (ISO image) – 100%
8 Module 8. Maintaining Access

·         Maintaining Access utilities

Labs:

·         8.1 Remote rootkit installation and usage;

 

 Teacher’s book – 0%

Student’s book – 0%

PPT – 0%

Virtual machine (ISO image) – 100%