Pentest Discovery Junior - 5 days
Description
Performing intrusion tests allows a realistic simulation of defense mechanisms and therefore represents a key step in securing information systems. This introductory pentest training aims to provide an in-depth understanding of security auditing by addressing the different stages of an intrusion.
During these five days of training, participants will be exposed to four course modules covering reconnaissance, web applications, Linux and Windows systems, and post-exploitation techniques. Each module will be illustrated by guided practical work to apply the theoretical notions taught. Finally, the training will conclude with a realistic scenario on a corporate network.
-
5 days ( 35 hours )
-
4 course modules covering the main steps of a penetration test
-
Reconnaissance, web applications, Linux, Windows, post-exploitation
-
20 exercises
-
1 guided intrusion on a complete corporate environment ( 10 machines )
Public and prerequisites
This training has been designed for people with no prior experience in penetration testing. It is mainly aimed at beginner pentesters, system administrators, security architects and developers, but also at any technical profile wishing to enrich their professional career with a security component.
-
Beginner pentesters
-
System administrators
-
Security architects
-
Developers
Basic knowledge of the Unix environment and web languages is recommended.
Content
Day 1
Introduction to discovery methods: DNS and HTTP enumeration, service scans. Overview of the main intrusion tools: Metasploit, Burp Suite. Web application vulnerabilities: SQL injections, XSS ( Cross-Site Scripting ), XXE ( XML eXternal Entities ), SSRF ( Service-Side Request Forgery ), file upload, deserialization, with various practice exercises.
Day 2
Practice on complex web applications: reconnaissance, exploitation and elevations of privileges until obtaining access to servers. Privilege escalation on Linux systems: fundamentals ( identity and access management ), reconnaissance and exploitation ( permissions, sudo configurations, scheduled tasks, systemd units, kernel ), and containerization technologies ( Docker, LXC/LXD ).
Day 3
Privilege elevation on Windows systems: fundamentals ( identity and access management, secrets management ), reconnaissance and exploitation ( permissions, service configurations, scheduled tasks, public vulnerabilities ). Hands-on practice on servers from non-privileged access.
Days 4 and 5
Post-exploitation steps: extracting secrets ( disk, memory ), installing backdoors and lateral moves ( network bounce, SOCKS proxy, port forward ). Hands-on intrusion of a corporate network.