Course Details
Course Code: CPT; Duration: 5 days; Instructor-led
- Attendees will learn about different attacks used by hackers to hack into the organisation
- Attendees will learn how to understand the current defense mechanisms in an environment and find gaps and make it secure.
- Attendees will learn various types of Information / Intelligence gathering techniques, tools and its countermeasures
- Attendees will learn various Network scanning techniques, tools and scanning countermeasures
- Attendees will learn various Enumeration techniques, tools and enumeration countermeasures
- Attendees will learn Packet sniffing techniques and learn on how to defend against sniffing and spoofing attacks.
- Attendees will learn Firewall, IDS and honeypot evasion techniques, evasion tools, and countermeasures
- Attendees will learn various Social Engineering techniques, tools and countermeasures
- Attendees will learn different types of Web application vulnerabilities & attacks, web application hacking methodologies, and countermeasures
- Attendees will learn Wireless Encryption, wireless hacking methodology, wireless hacking tools, and Wi-Fi security tools with details on how to safeguard a wireless infrastructure
- Attendees will learn Mobile platform attack vectors, vulnerabilities and countermeasures
- Attendees will learn various types of penetration testing, security audit, vulnerability assessment, and penetration testing roadmap
- Attendees will be able to Perform vulnerability analysis to identify security loopholes in the target organization’s network, communication infrastructure, and end systems.
- Attendees will be able to perform Penetration Test, Security Consultation, Security Architecture Review, Security Architecture design and provide advise to the IT Team.
Audience
This course is also recommended for security professionals who are interested in conducting vulnerability assessment and penetration test for their customers.
Prerequisites
This course will enable the network administrators, network executives and Security professionals to :
- Understand different attacks used by hackers
- Learn how to conduct a vulnerability assessment on the network and systems
- Safely exploit the network and systems with the same tools used by the hackers to identify the vulnerabilities before a hacker would do
- Learn ways to harden the network and systems thus securing the corporate network and systems.
- Prepare and submit Vulnerability Assessment & Pentest Reports
Methodology
This program will be conducted with interactive lectures, PowerPoint presentation, discussion, and practical exercise.
Course Objectives
- Understand different attacks used by hackers
- Learn Various types of foot printing, foot printing tools, and countermeasures
- Learn Network scanning techniques and scanning countermeasures
- Learn Enumeration techniques and enumeration countermeasures
- Learn Packet sniffing techniques and how to defend against sniffing
- Learn Social Engineering techniques, identify theft, and social engineering countermeasures
- Learn Different types of web application attacks, web application hacking methodology, and countermeasures
- Learn Wireless Encryption, wireless hacking methodology, wireless hacking tools, and Wi-Fi security tools
- Learn Mobile platform attack vectors and vulnerabilities
- Learn Firewall, IDS and honeypot evasion techniques, evasion tools, and countermeasures
- Learn Various types of penetration testing, security audit, vulnerability assessment, and penetration testing roadmap
- Perform vulnerability analysis to identify security loopholes in the target organization’s network, communication infrastructure, and end systems.
Outlines
Module 1: Introduction to Vulnerability Assessment & Penetration Testing
- Objective: To understand the basics of attack life cycle, various attack methodologies, vulnerabilities, Vulnerability assessment and Penetration Testing.
- Outcome: Attendees will Learn all the attack, vulnerability and Penetration Testing basics needed to be a Pentester
- Basics: Vulnerability, Exploit, Payload, Listener, Vulnerability Assessment Vs. Penetration Testing, Types of Vulnerabilities, Vulnerability Research Sources for Penetration Testers, Exploits and tools sources for Penetration Testers, Commercial Tools for Penetration Testers, Penetration Testing Methodologies and Penetration Test Report Template
Module 2: Information Intelligence Techniques
- Objective: To understand various types of foot printing, foot printing tools, and countermeasures.
- Outcome: Attendees will learn various types of Information / Intelligence gathering techniques, tools to Map the customer organisation / target and come up with strategy to exploit with its countermeasures
- Passive Information Gathering with tools
- Intelligence gathering and Map the Customer organization from Internet
- Information intelligence and Map the infrastructure/technologies of the Target
Module 3: Scanning & Vulnerability Assessment
- Objective: To understand Network scanning techniques, Enumeration techniques and countermeasures
- Outcome: Attendees will learn various Network scanning techniques, Enumeration techniques, Vulnerability assessments, tools and scanning countermeasures. Attendees will be able to understand the infrastructure of the target and find their vulnerabilities that can be used for exploitation.
- Scanning Types & Scan Options
- NMap Scanning
- Ninja & Non-Ninja Scan types
- Multiple IP Addresses scanning
- Host Discovery
- Ping & Port Scanning
- OS Fingerprinting & Service Enumerations
- NMap Scripts
- Host Scanning: Bypassing Firewalls
- Decoys
- ZenMap
- Netcat Fingerprinting
- NeXpose: Vulnerability Scanning & Reporting
- OpenVAS
Module 4: Cracking & Social Engineering
- Objective: Understand Packet sniffing techniques, tools and Countermeasures. Understand Social Engineering techniques, tool, identify theft, and countermeasures. Understand Password Cracking techniques, tools and countermeasures.
- Outcome: Attendees will learn how to run Sniffing attacks, password Cracking with its countermeasures. Attendees will also be able to run various Social Engineering attacks and campaigns and learn how to defend from these attacks.
- MiTM Concepts & Attacks
- Password Cracking
- Brute Force Tools: Hydra, Medusa
- Crunch Password generator
- FTP Credential cracking
- Telnet Brute Force
- SSH Login Brute Force Attack
- Password cracking with John the Ripper
- Social Engineering Attacks: Java Applet Attack Vectors, Infectious Media Generator, Credential Harvester Attack Method, Spear-Phishing Attack Method and many more
Module 5: Exploitation & Pentest
- Objective: Understand different pentest techniques, tools. Understand how to safely exploit the vulnerabilities found in the infrastructure as proof of concept.
- Outcome: Attendees will learn how to exploit the vulnerabilities identified, document and prepare Report that can be presented to the Customer/ organisation.
- Metasploit Framework Concepts
- Metasploit Community & Armitage
- Metasploit Exploitations: Dump Password Hash, Capture Screenshots, Capture Keystrokes, Privilege Escalation, Pivoting, ARP Scan, Stdapi and Priv, Persistence and Backdoors (Maintaining Access), Cover Tracks, Post Exploitations.
- Anti-Virus Evasion Framework
- Netcat Exploitations
- Backdoor using msfvenom & Netcat
- Advanced Exploitations using PowerShell
- Pentest Reporting
Module 6: PowerShell Exploitation
- Objective: Understand PowerShell basics and how PowerShell can be used to evade defenses
- Outcome: Attendees will learn how to user PowerShell during a pentest and evade antivirus and other end point defenses.
- PowerShell Basics
- PowerShell Log Analysis
- PowerShell Malwares Evading Antivirus and End Point Defenses
Module 7: Web Pentest
- Objective: Understand different types of web application attacks, web application hacking methodologies, and countermeasures. Understand how to use the vulnerabilities and exploit them.
- Outcome: Attendees will learn different types of Web application vulnerabilities & attacks, web application hacking methodologies, and countermeasures. Attendees will be able to perform vulnerability assessment and penetration testing on web applications.
- Web Application Basics,
- Web Application Fingerprinting,
- Payment Gateway & Order Tampering,
- Labs on OWASP TOP 10 Vulnerabilities and its sub categories using Mutillidae, DVWA [SQL Injection, Cross Site Scripting, Cross Site Request Forgery, LDAP Injection, Command Injection, Parameter/Form Tampering, Payment Gateway hacking, Improper Error Handling, Directory Traversal, Insecure storage, Information Leakage, Broken Account Management, Denial of Service, Buffer Overflow, Broken Session Management, Session Fixation, Security Misconfiguration, File Upload and Download and many more ]
- Pentest Reporting
- Tools Covered: Acunetix, Qualys, Burp Suite
Module 8: Wireless Pentest
- Objective: Understand Wireless Encryption, wireless hacking methodology, wireless hacking tools, and Wi-Fi security tools.
- Outcome: Attendees will learn how to conduct vulnerability assessment and Penetration testing on WIFI networks.
- Introduction on WEP, WPA, WPA2
- Wireless cracking with Reaver
- Uncovering hidden SSIDs
- WiFi Twining Attacks
