Penetration Testing Professional (PTP) comes with lifetime access to course materials and flexible access to the world’s best penetration testing virtual lab.
Highly Practical
Perform penetration tests against real-world networks. PTP includes the most advanced virtual lab for penetration testing.
The Course at a Glance
- Based on the techniques used by professional penetration testers
- Covers everything a modern penetration tester needs to know
- Network penetration testing, web application penetration testing, wireless network penetration testing and a system security section
- Architecture fundamentals, buffer overflows and shellcoding
- Both Windows and Linux exploitation
- Post-exploitation and pillaging methodology
- Includes Ruby and PowerShell sections for penetration testers
- Learn how to build your own Metasploit modules
- Learn how to make use of the PowerShell Empire toolkit
- Includes a professional guide to penetration testing reporting
- Highly practical, with dozens of labs and exercises
Course Material
- Over 17 hours of HQ video training material
- 6500+ slides
- 30 labs in Hera Lab
Course Delivery
- HTML5, PDF, MP4
- Offline access available
- Access from PC, tablet and smartphone
Curriculum
Section: System Security
Module 1: Architecture Fundamentals
In this section you will learn the core concepts that will help you develop skills in areas such as fuzzing, exploit development, buffer overflows, debugging, reverse engineering and malware analysis. Sample C++ and assembly source code is provided so the mechanics can be understood.
Module 2: Assemblers, Debuggers and the Tools Arsenal
The previous module showed you that assembly is a very low-level programming language made up of mnemonic code, also known as opcodes. Although it is a low-level language, it still has to be converted into machine code for the machine to run it. In this module you will see how that happens and which tools are required.
Module 3: Buffer Overflow
Finding and exploiting buffer overflows in real-world applications is what you will learn during this remarkably hands-on module. A difficult subject made easier with step-by-step examples, starting from the fundamentals of stack manipulation. Equipped with assemblers, compilers and debuggers, students will learn how to take control of an application’s execution. At the end of the module, the student is exposed to the most modern techniques used to prevent buffer overflows and the main methods for bypassing them.
Module 4: Shellcoding
The art of shellcoding is made accessible to everyone through easy-to-follow examples and complex real-world scenarios. A brief theoretical overview leads into practical examples in which you will build your own shellcode using compilers and assemblers. Different techniques are demonstrated to let you build your own shellcode. Three source code examples are explained line by line.
Module 5: Cryptography and Password Cracking
Almost every penetration testing engagement requires an understanding of cryptographic topics. This module will keep you up to date with the most common encryption technologies, algorithms and tools. You will also learn how to carry out advanced password cracking using the best tools available. This module includes a thorough examination of the most modern tools used to steal and crack Windows password hashes.
Module 6: Malware
Here a comprehensive and detailed introduction to the classification of malware types is provided, explaining the most advanced and obscure techniques used by modern malware. The module is completed with three explained malware source codes: a keylogger, a trojan and a virus.
Section: Network Security
Module 1: Information Gathering
The information gathering module is the most important phase of a typical engagement. Penetration testers will use the information gathered in this phase to map the attack surface and increase their chances of breaching the target, just as criminals do. normSight recommends a highly comprehensive research methodology that takes the client’s business and infrastructure into account. Students will learn how to access valuable, sensitive and sometimes confidential documents through free services, databases and specialised search engines. Infrastructure information gathering will address the enumeration of DNS, domains, netblocks and other web assets belonging to the organisation.
Module 2: Scanning
One of the most important steps in the penetration testing of a network, this module will first teach you the theory behind port scanning and service discovery. If you are not a networking specialist, the opening sections of the module will introduce you to the fundamentals of TCP and other network protocols. We will then show you how to use the best tools to detect live hosts, open ports and the services running on them. With Nmap and Hping2 you will learn how to find a zombie in order to carry out fully stealthy port scans against a target. Passive and active OS fingerprinting techniques are also addressed in depth.
Module 3: Enumeration
The scope of this module is to provide the techniques professional penetration testers use to enumerate resources on a target. With several different Windows and Unix tools you can discover, enumerate and map the remote network and its available services. NetBIOS is the subject of the first part of this module: real-world examples are explained to demonstrate the most important techniques and tools for enumerating remote Windows shares and printers. You will also learn how to test for NetBIOS null sessions, which still affect older Windows versions. The fundamentals of SNMP are explained, and the student is then introduced to attacks against the protocols using several common tools.
Module 4: Sniffing and MITM (Man in the Middle)
Understanding ARP, how it works and how it can be manipulated to carry out sophisticated attacks has been made remarkably straightforward. Sniffing is a technique whose most practical aspects you will fully grasp. Before addressing available attack scenarios using the best tools available, we will make sure you have a sufficient grounding in network theory. LLMNR and NBT-NS spoofing/poisoning is also covered, including advanced scenarios using the Responder toolkit. Man-in-the-middle attacks are among the most widely used penetration testing techniques today; you will be able to carry out man-in-the-middle attacks on local networks and over the internet.
Module 5: Vulnerability Assessment and Exploitation
This module will teach the student how to master Nessus in order to run detailed and targeted vulnerability scans. Weaknesses in Windows authentication protocols and the related attacks are examined with Metasploit demonstrations. The student is then immersed in the common exploitation techniques used by today’s penetration testers to exploit client-side and remote vulnerabilities on workstations and servers. The latest Windows remote code execution vulnerabilities are covered and combined with many other attack techniques. Finally, building custom word lists is another skill the student will gain from studying this module. Note that this module is intensive in both video and lab work.
Module 6: Post-Exploitation
normSight’s experienced instructors have developed a proven methodology for comprehensively exploiting remote internal networks through advanced post-exploitation techniques. Once you are comfortable with the latest exploitation techniques, you will be exposed to the cyclical steps of a successful post-exploitation phase. This is the phase in which criminals establish stable, high-privilege access to the remote network in order to steal and exfiltrate documents and credentials from the organisation. Penetration testers must have the same skill set and tools in order to test not only perimeter security but every kind of internal weakness affecting organisational security. Privilege escalation through insecurely configured services, DLL hijacking and DNS tunnelling are only a small fraction of what students will learn in this module.
Module 7: Anonymity
Penetration testers rarely need to cover their tracks. However, there are times when doing so falls within the scope of the engagement, such as when testing the effectiveness of the target organisation’s incident response team. This module will teach you techniques for carrying out your tests while covering your tracks.
Module 8: Social Engineering
The social engineering module will guide you through the most modern social engineering attack techniques. Real-world attacks will be explained, drawing on the potential of social networks such as Facebook, Spokeo and Twitter. Nearly an hour of video lessons will teach you everything you need to know in order to master the most important tool in this field: the Social Engineering Toolkit.
Section: PowerShell for Penetration Testers
Module 1: Introduction
The PowerShell for Penetration Testers introduction module sets out why PowerShell matters. Some of the advantages of using PowerShell for penetration testing engagements and PowerShell’s high-level features are introduced.
Module 2: PowerShell Fundamentals
PowerShell fundamentals range from using the command line interface to the various useful commands and components relevant to PowerShell and its use in penetration testing. The student will gain a good understanding of module usage, cmdlets, objects, scripts and looping statements, and will understand some common PowerShell frameworks and other techniques for use in penetration testing.
Module 3: Offensive PowerShell
With the offensive PowerShell module, students will dive deeper into specific PowerShell tools, techniques and frameworks. They learn everything from downloading and executing payloads and scripts to obfuscation, information gathering and post-exploitation. This module will also give the student a better understanding of the “living off the land” concept and introduce various PowerShell penetration testing frameworks and tools such as Nishang, PowerSploit and Empire.
Section: Linux Exploitation
Module 1: Introduction
The Linux exploitation introduction module presents Linux as the platform of choice for most of today’s internet-connected devices, covering some of its history and various common distributions.
Module 2: Information Gathering
This module takes the student through the methods and tools used in the information gathering process for Linux-based systems, from remote information gathering to gathering information locally on compromised systems. It includes enumerating services such as SMTP, SMB, NFS and more, using both automated tools and manual bash script-based methods.
Module 3: Exploitation Over the Network
The exploitation over the network section is a deep dive into some of the most common and less common vulnerabilities found to affect Linux-based systems. The student will learn the concept of password spraying attacks from a remote perspective in order to exploit Java, Samba, Shellshock and many other vulnerabilities. This module will enable the student to identify exploitable vulnerabilities and misconfigurations commonly found on Linux systems.
Module 4: Post-Exploitation
The post-exploitation module for Linux exploitation will guide the student through the various stages of post-exploitation: privilege escalation, lateral movement, data exfiltration and maintaining access. The student will learn how to exploit misconfigurations, SUID executables, password cracking and the fundamentals of kernel exploits, as well as lesser-known techniques for obtaining root access such as SSH hijacking and shared object library loading, and known techniques that can be used to maintain persistence through dedicated services and utilities built into the operating system.
Section: Web Application Security
Module 1: Introduction
This module will introduce you to the field of web application security and its core terminology. If you are new to this field, you will gather all the skills you need to move on to the more advanced modules. If you are already an advanced web application security tester, you will become familiar with the methods and tools followed throughout the course.
Module 2: Information Gathering
Web application information gathering is a long and complex process. It requires insight and persistence. You will learn the best methods for gathering and storing information about your target web assets. This information will be used in the later steps of the exploitation process. By the end of this module you will have so much information about your target that exploiting it will be easy and enjoyable.
Module 3: Cross-Site Scripting (XSS)
The most common web application vulnerability will be examined in detail. You will first be given a theoretical explanation. This understanding will help you during the exploitation and remediation process. You will then master all the techniques for finding XSS vulnerabilities through black-box testing and within PHP code. Real-world exploitation examples will conclude the module; you will finally steal session cookies, modify a website’s DOM and carry out advanced phishing attacks. This is a hands-on intensive module.
Module 4: SQL Injection
This module contains the most advanced techniques for finding and exploiting SQL injections, from an explanation of the most basic SQL injection through to the most advanced. Advanced methods will be taught with real-world examples, and the best tools will be demonstrated against real targets. With advanced SQL injection techniques you will be able to gain root on the remote machine. Tools will be addressed in depth, and a classification will help the student choose the right tool according to the environment and scenario they encounter in real engagements. This is a video and hands-on intensive module.
Module 5: Other Common Web Attacks
Complex attacks against web applications are the subject of this module. Session fixation and CSRF are often overlooked. In this module they will be addressed in depth. A step-by-step working exploit will be built to demonstrate a CSRF vulnerability found in a well-known CMS.
Section: WiFi Security
Module 1: Prerequisites
In the first module of the Wi-Fi section we will see what the hardware and software prerequisites for the course are.
Module 2: Environment Setup
In this module the student will learn how to configure the test environment in order to get the best results from the modules that follow.
Module 3: Wireless Standards and Networks
In this module the student will learn the core concepts underlying Wi-Fi infrastructures. We will see which types of Wi-Fi configuration exist, how they work, and what security features and mechanisms they have. We will also provide an overview of the most important flaws affecting different types of wireless infrastructure and protocol.
Module 4: Discovering Wi-Fi Networks
The first step when carrying out a penetration test against Wi-Fi networks is to discover and identify our target. In this module we will see how to do this with a range of tools available for different platforms.
Module 5: Traffic Analysis
Once the target network has been identified, the next step is to configure our tools to sniff and intercept traffic. This is a crucial step for all the attacks that follow.
Module 6: Attacking Wi-Fi Networks
This module focuses on the attacks that can be carried out against Wi-Fi networks. The student will learn how to attack and gain access to remote Wi-Fi networks, obtain keys, passwords and much more, according to their configuration and security mechanisms. We will begin by exploring attacks against WEP and then focus our testing on more secure networks: WPA, WPA2 and WPS.
Module 7: Wi-Fi as an Attack Vector
In the final module of the Wi-Fi section, the student will learn how to use Wi-Fi as an attack vector. This means we will not be attacking Wi-Fi networks; instead we will use Wi-Fi to create rogue networks, obtain credentials, carry out MitM attacks and much more. The effective evil twin attack will be demonstrated in detail, alongside an explanation of how WPA2-Enterprise can be attacked.
Section: Ruby for Penetration Testers and Metasploit
Module 1: Installation and Fundamentals
In the first module of the Ruby section you will see how to install and configure the Ruby environment. Once the environment is configured, you will learn Ruby’s core concepts for running and writing scripts, using the interpreter, installing gems and much more. You will also learn fundamental Ruby concepts for data types, variable declarations and more.
Module 2: Control Structures
One of the most important program structures a programmer must master is the flow control structure. In this module the student will learn how to write and define different Ruby control structures. This will allow the student to build scripts and programs that are not limited to a linear sequence of statements.
Module 3: Methods, Variables and Scope
Every program should be clean and have reusable structures. In this module the student will learn to define and use Ruby methods, blocks, aliases and more. This is useful for building very powerful tools and scripts. With the introduction of methods and blocks, a crucial topic must be addressed: scope.
Module 4: Classes, Modules and Exceptions
Ruby is an object-oriented programming language. Accordingly, an OO program contains classes and objects. In this module we will begin to address more advanced topics and see how to define and use classes, functions, modules, namespaces and much more. Alongside these topics we will also see how to handle exceptions; exceptions are a very useful subject that must be mastered in order to take control of program behaviour.
Module 5: Penetration Tester Prerequisites
Ruby is a very powerful programming language and, thanks to its many features, it can be used for many different purposes. From this module onwards we will focus on how to use Ruby for penetration testing purposes. One of the first topics we will address is regular expressions. Regex is widely used in the security field; it is used to find and locate important information stored in files, on web pages, in network communications and so on. A good knowledge of how to use and define regular expressions is indispensable for a penetration tester. During the study of this module, the student will also learn to use the date and time classes and to manage and interact with files and directories: reading, deleting, creating and so on.
Module 6: Input/Output
In this module the student will learn to use different input and output mechanisms and techniques to find (read) or store (write) information to and from files. We will see several examples and scripts that can be used together with other tools (such as Nmap) to collect, filter and store important information.
Module 7: Network and Operating System Interaction
Another important subject a penetration tester must be expert in is network communication. In this module the student will learn how to use Ruby’s power to build and capture network communications. Thanks to many useful examples and scripts, the student will learn how to create raw sockets, generate packets, build TCP/UDP scanners and much more. We will also see how to interact with local and remote operating systems. This, combined with network communication skills, can be useful for building powerful tools such as backdoors that can retrieve information from remote systems and send and execute specific commands.
Module 8: Web
In the previous module the student examined network communications and local interactions with the operating system. Now it is time to focus on web applications. We will see how to build and intercept HTTP and HTTPS requests and responses, how to send and read GET and POST methods, and much more. Alongside these topics, the student will be presented with some useful scripts and use cases for carrying out attacks against web applications or identifying vulnerabilities such as XSS.
Module 9: Exploitation with Ruby
Over the course of the previous modules, the student should have acquired many Ruby programming skills. It is time to make use of those skills and use Ruby to write and exploit vulnerable services and software. In this module we will present a vulnerable application that the student can use to learn how to write a complete working exploit.
Module 10: Metasploit
Now that the student has mastered Ruby and its features, it is time to start working with one of the most powerful Ruby tools: Metasploit. In this module the student will examine the Metasploit architecture and framework and learn how to build, add or edit custom Metasploit modules. Thanks to our virtual labs, the student will also have the chance to practise against real vulnerable machines.
Prerequisites
- Basic knowledge of network communication: TCP/IP, routing, forwarding
- Reading and understanding C, ASM, Python and PHP code is not required but will help
- Development skills are not required
- Basic knowledge of the HTTP protocol, cookies and sessions
- An understanding of IT security topics and the fundamentals of penetration testing
- An injection-capable wireless NIC (the Alfa AWUS036h is recommended)
- A spare Wi-Fi access point
- All the skills recommended above are taught in the PTS (Penetration Testing Student) course
Who Can Attend
- Penetration testers
- IT security specialists
- Network security engineers
- IT staff
- Developers
- Incident response teams
Labs
Penetration Testing Professional (PTP) is the most practical training course on penetration testing. Integrated with Hera Lab, the most advanced virtual lab in IT security, this product offers an unmatched practical learning experience. Hera is the only virtual lab that provides each student with fully isolated access to every real-world network scenario on the platform. Students can access Hera Lab from anywhere over VPN.