Certified Penetration Testing Consultant

Course Outline

Module 1 – Pentesting Team Formation

• Section 1 – Project Management
• Section 2 – Pentesting Metrics
• Section 3 – Team Roles, Responsibilities and Benefits
• Lab Exercise – Skills Assessment 

Module 2 – NMAP Automation

• Section 1– NMAP Basics
• Section 2 – NMAP Automation
• Section 3 – NMAP Report Documentation
• Lab Exercise – Automation Breakdown

Module 3 – Exploitation Process  

• Section 1 – Purpose
• Section 2 – Countermeasures
• Section 3 – Evasion
• Section 4 – Precision Strike
• Section 5 – Customized Exploitation
• Section 6 – Tailored Exploits
• Section 7 – Zero Day Angle
• Section 8 – Example Avenues of Attack
• Section 9 – Overall Objective of Exploitation 

Module 4 – Fuzzing with Spike

• Section 1 – Vulnserver
• Section 2 – Spike Fuzzing Setup
• Section 3 – Fuzzing a TCP Application
• Section 4 – Custom Fuzzing Script
• Lab Exercise – Fuzzing with Spike 

Module 5 – Simple Buffer Overflow

• Section 1 – Exploit-DB
• Section 2 – Immunity Debugger
• Section 3 – Python
• Section 4 - Shellcode
• Lab Exercise – Let’s Crash and Callback

Module 6 – Stack Based Windows Buffer Overflow

• Section 1 – Debugger
• Section 2 – Vulnerability Research
• Section 3 – Control EIP, Control the Crash
• Section 4 – JMP ESP Instruction
• Section 5 –  Finding the Offset
• Section 6 – Code Execution and Shellcode
• Section 7 – Does the Exploit Work?
• Lab Exercise – MiniShare for the Win 

Module 7 – Web Application Security and Exploitation  

• Section 1 – Web Applications
• Section 2 – OWASP Top 10 - 2017
• Section 3 – Zap
• Section 4 – Scapy

Module 8 – Linux Stack Smashing

• Section 1 – Exploiting the Stack on Linux
• Lab Exercise – Stack Overflow. Did we get root?

Module 9 – Linux Address Space Layout Randomization  

• Section 1 –   Stack Smashing to the Extreme
• Lab Exercise – Defeat Me and Lookout ASLR 

Module 10 – Windows Exploit Protection  

• Section 1 – Introduction to Windows Exploit Protection
• Section 2 -  Structured Exception Handling
• Section 3 – Data Execution Prevention (DEP)
• Section 4 – SafeSEH/SEHOP 

Module 11 – Getting Around SEH and ASLR (Windows)

• Section 1 – Vulnerable Server Setup
• Section 2 –  Time to Test it Out
• Section 3 - “Vulnserver” meets Immunity
• Section 4 – VulnServer Demo
• Lab Exercise – Time to overwrite SEH and ASLR 

Module 12 – Penetration Testing Report Writing

• Section 1 –  Reporting

LABORATORY EXERCISES

Lab 1: Skills Assessment

Lab 2: Automation Breakdown

Lab 3: Fuzzing with Spike

Lab 4: Let’s Crash and Callback

Lab 5: MiniShare for the Win

Lab 6: Stack Overflow. Did we get root?

Lab 7: Defeat Me and Lookout ASLR

Lab 8: Time to overwrite SEH and ASLR