Duration:

5 days

Course Synopsis:

The Certified Penetration Testing Professional (CPENT) program is the world’s most comprehensive guided penetration testing program. It offers a complete hands-on pentesting methodology and AI techniques mapped to all pentesting phases. The (CPENT) V2 program enables you to master pentesting within an enterprise network environment, evaluating intrusion risks and compiling actionable, structured reports.

Course Objectives:

Once you have completed this course, you’ll be able to:

Acquire a comprehensive knowledge of SOC processes, procedures, technologies, and workflows
Learn the fundamentals of penetration testing, including its objectives, methodologies, frameworks, and role in an organization’s security strategy
Understand how to scope penetration testing engagements, define objectives, establish clear communication with stakeholders, and adhere to legal and ethical boundaries
Understand OSINT techniques to gather actionable intelligence and learn to Identify, map, and analyse an organizations attack surface
Learn the art of exploiting human vulnerabilities through social engineering techniques, along with preventive measures to mitigate such risks
Cultivate techniques for testing web applications for vulnerabilities such as SQL injection, XSS, and authentication flaws, and learn methods to exploit and remediate these issues
Understand how to assess API security by testing endpoints, exploiting misconfigurations, and identifying weaknesses in JSON Web Tokens(JWT)
Learn advanced techniques to bypass firewalls, intrusion detection systems(IDS), routers, switches, and other perimeter defenses
Gain methods to exploit vulnerabilities in Windows systems and perform privilege escalation to gain higher-level access
Discover how to test and exploit vulnerabilities in Active Directory environments by identifying misconfigurations and security weaknesses
Acquire techniques for exploiting Linux systems and escalating privileges, as well as understanding common vulnerabilities and configurations
Learn reverse engineering, fuzzing techniques, and binary exploitation to identify and exploit weaknesses in software and applications
Obtain techniques to navigate through internal networks, gain access to additional systems, and pivot to critical assets during penetration testing
Develop techniques to find and exploit vulnerabilities in IoT devices and ecosystems
Learn how to create professional penetration testing reports, communicate findings effectively, and outline actionable post-testing recommendations

Course Prerequisites:

There are no defined pre-requisite for the exam, but it is strongly recommend that candidates to attempt the CEH (Practical) and/ or ECSA (Practical) prior to attempting CPENT.

Who Should Attend:

Ethical Hackers
Penetration Testers
Network Server Administrators
Firewall Administrators
Security Testers
System Administrators and Risk Assessment Professionals
Cybersecurity Forensic Analyst
Cyberthreat Analyst
Cloud Security Analyst
Information Security Analyst
Application Security Analyst
Cybersecurity Assurance Engineer
Security Operations Center (SOC) Analyst
Technical Operations Network Engineer
Information Security Engineer
Network Security Penetration Tester
Network Security Engineer
Information Security Architect

Outline Course Contents:

Module 1: Introduction to Penetration Testing and Methodologies

Principles and Objectives of Penetration Testing
Penetration Testing Methodologies and Frameworks
Best Practices and Guidelines for Penetration Testing
Role of Artificial Intelligence in Penetration Testing
Role of Penetration Testing in Compliance with Laws, Acts and Standards

Module 2: Penetration Testing Scoping and Engagement

Penetration Testing: Pre-engagement Activities
Key Elements Required to Respond to Penetration Testing RFPs
Drafting Effective Rules of Engagement (ROE)
Legal and Regulatory Considerations Critical to Penetration Testing
Resources and Tools for Successful Penetration Testing
Strategies to Effectively Manage Scope Cree

Module 3: Open-Source Intelligence (OSINT)

Collect Open-Source Intelligence (OSINT) on Target’s Domain Name
Collect OSINT about Target Organization on the Web
Perform OSINT on Target’s Employees
OSINT Using Automation Tools
Map the Attack Surface

Module 4: Social Engineering Penetration Testing

Social Engineering Penetration Testing Concepts
Off-Site Social Engineering Penetration Testing
On-Site Social Engineering Penetration Testing
Document Findings with Countermeasure Recommendations

Module 5: Web Application Penetration Testing

Web Application Footprinting and Enumeration Techniques
Techniques for Web Vulnerability Scanning
Test for Vulnerabilities in Application Deployment and Configuration
Techniques to Assess Identity Management, Authentication, and Authorization Mechanisms
Evaluate Session Management Security
Evaluate Input Validation Mechanisms
Detect and Exploit SQL Injection Vulnerabilities
Techniques for Identifying and Testing Injection Vulnerabilities
Exploit Improper Error Handling Vulnerabilities
Identify Weak Cyptography Vulnerabilities
Test for Business Logic Flaws in Web Applications
Evaluate Applications for Client-Side Vulnerabilities

Module 6: API and Java Web Token Penetration Testing

Techniques and Tools to Perform API Reconnaissance
Test APIs for Authentication and Authorization Vulnerabilities
Evaluate the Security of JSON Web Tokens (JWT)
Test APIs for Input Validation and Injection Vulnerabilities
Test APIs for Security Misconfiguration Vulnerabilities
Test APIs for Rate Limiting and Denial of Service(DoS) Attacks
Test APIs for Security of GraphQL Implementations
Test APIs for Business Logic Flaws and Session Management

Module 7: Perimeter Defense Evasion Techniques

Techniques to Evaluate Firewall Security Implementations
Techniques to Evaluate IDS Security Implementations
Techniques to Evaluate the Security of Routers
Techniques to Evaluate the Security of Switches

Module 8: Windows Exploitation and Privilege Escalation

Windows Pen Testing Methodology
Techniques to Perform Reconnaissance on a Windows Target
Techniques to Perform Vulnerability Assessment and Exploit Verification
Methods to Gain Initial Access to Windows Systems
Techniques to Perform Privilege Escalation
Post-Exploitation Activities

Module 9: Active Directory Penetration Testing

Architecture and Components of Active Directory
Active Directory Reconnaissance
Active Directory Enumeration
Exploit Identified Active Directory Vulnerabilities
Role of Artificial Intelligence in AD Penetration Testing Strategies

Module 10: Linux Exploitation and Privilege Escalation

Linux Exploitation and Penetration Testing Methodologies
Linux Reconnaissance and Vulnerability Scanning
Techniques to Gain Initial Access to Linux Systems
Linux Privilege Escalation Techniques

Module 11: Reverse Engineering, Fuzzing, and Binary Exploitation

Concepts and Methodology for Analyzing Linux Binaries
Methodologies for Examining Windows Binaries
Buffer Overflow Attacks and Exploitation Methods
Concepts, Methodologies, and Tools for Application Fuzzing

Module 12: Lateral Movement and Pivoting

Advanced Lateral Movement Techniques
Advanced Pivoting and Tunneling Techniques to Maintain Access

Module 13: IoT Penetration Testing

Fundamental Concepts of IoT Pentesting
Information Gathering and Attack Surface Mapping
Analyze IoT Device Firmware
In-depth Analysis of IoT Software
Assess the Security of IoT Networks and Protocols
Post-Explotation Strategies and Persistence Techniques
Comprehensive Pentesting Reports

Module 14: Report Writing and Post-Testing Actions

Purpose and Structure of a Penetration Testing Report
Essential Components of a Penetration Testing Report
Phases of a Pen Test Report Writing
Skills to Deliver a Penetration Testing Report Effectively
Post-Testing Actions for Organizations

Length of exam

24 hours

Number of questions

Performance-based

Question format

Performance-based and hands-on

Passing grade

70%

Exam availability

English

Testing center

Remotely Proctored Practical Exam

Examination Information:

Programme scope, delivery arrangements and suitability are confirmed during enquiry.

CPENT-Course Outline-SE