OVERVIEW
Penetration Testing with Kali Linux (PEN-200) is the foundational course at Offensive Security. Those new to OffSec or penetration testing should start here.
This online ethical hacking course is self-paced. It introduces penetration testing tools and techniques via hands-on experience. PEN-200 trains not only the skills, but also the mindset required to be a successful penetration tester.
Students who complete the course and pass the exam earn the coveted Offensive Security Certified Professional (OSCP) certification.
BENEFITS
- Introduction into the latest hacking tools and techniques
- Training from the experts behind Kali Linux
- Learn the “Try Harder” method and mindset
- Earn the industry-leading OSCP certification
ABOUT THE EXAM
The PEN-200 course and online lab prepares you for
- the OSCP certification
- 24-hour exam
- Proctored
- Learn more about the exam
WHO IS THE COURSE FOR?
- Infosec professionals transitioning into penetration testing
- Pentesters seeking an industry-leading certification
- Security professionals
- Network administrators
- Other technology professionals
COURSE PREREQUISITES
All students are required to have:
- Solid understanding of TCP/IP networking
- Reasonable Windows and Linux administration experience
- Familiarity with basic Bash and/or Python scripting
COURSE SYLLABUS
1Penetration Testing with Kali Linux: General Course Information
1.1About The PWK Course
1.1.1PWK Course Materials
1.1.2Access to the Internal VPN Lab Network
1.1.3The Offensive Security Student Forum
1.1.4Live Support
1.1.5OSCP Exam Attempt
1.2Overall Strategies for Approaching the Course
1.2.1Welcome and Course Information Emails
1.2.2Course Materials
1.2.3Course Exercises
1.2.4PWK Labs
1.3Obtaining Support
1.4About Penetration Testing
1.5Legal
1.6The MegaCorpone.com and Sandbox.local Domains
1.7About the PWK VPN Labs
1.7.1Lab Warning
1.7.2Control Panel
1.7.3Reverts
1.7.4Client Machines
1.7.5Kali Virtual Machine
1.7.6Lab Behavior and Lab Restrictions
1.8Reporting
1.8.1Consider the Objective
1.8.2Consider the Audience
1.8.3Consider What to Include
1.8.4Consider the Presentation
1.8.5The PWK Report
1.8.6Note Taking
1.9About the OSCP Exam
1.9.1Metasploit Usage - Lab vs Exam
1.10Wrapping Up
2Getting Comfortable with Kali Linux
2.1Booting Up Kali Linux
2.2The Kali Menu
2.3Kali Documentation
2.3.1The Kali Linux Official Documentation
2.3.2The Kali Linux Support Forum
2.3.3The Kali Linux Tools Site
2.3.4The Kali Linux Bug Tracker
2.3.5The Kali Training Site
2.3.6Exercises
2.4Finding Your Way Around Kali
2.4.1The Linux Filesystem
2.4.2Basic Linux Commands
2.4.3Finding Files in Kali Linux
2.5Managing Kali Linux Services
2.5.1SSH Service
2.5.2HTTP Service
2.5.3Exercises
2.6Searching, Installing, and Removing Tools
2.6.1apt update
2.6.2apt upgrade
2.6.3apt-cache search and apt show
2.6.4apt install
2.6.5apt remove –purge
2.6.6dpkg
2.7Wrapping Up
3Command Line Fun
3.1The Bash Environment
3.1.1Environment Variables
3.1.2Tab Completion
3.1.3Bash History Tricks
3.2Piping and Redirection
3.2.1Redirecting to a New File
3.2.2Redirecting to an Existing File
3.2.3Redirecting from a File
3.2.4Redirecting STDERR
3.2.5Piping
3.3Text Searching and Manipulation
3.3.1grep
3.3.2sed
3.3.3cut
3.3.4awk
3.3.5Practical Example
3.4Editing Files from the Command Line
3.4.1nano
3.4.2vi
3.5Comparing Files
3.5.1comm
3.5.2diff
3.5.3vimdiff
3.6Managing Processes
3.6.1Backgrounding Processes (bg)
3.6.2Jobs Control: jobs and fg
3.6.3Process Control: ps and kill
3.7File and Command Monitoring
3.7.1tail
3.7.2watch
3.8Downloading Files
3.8.1wget
3.8.2curl
3.8.3axel
3.9Customizing the Bash Environment
3.9.1Bash History Customization
3.9.2Alias
3.9.3Persistent Bash Customization
3.10Wrapping Up
4Practical Tools
4.1Netcat
4.1.1Connecting to a TCP/UDP Port
4.1.2Listening on a TCP/UDP Port
4.1.3Transferring Files with Netcat
4.1.4Remote Administration with Netcat
4.2Socat
4.2.1Netcat vs Socat
4.2.2Socat File Transfers
4.2.3Socat Reverse Shells
4.2.4Socat Encrypted Bind Shells
4.3PowerShell and Powercat
4.3.1PowerShell File Transfers
4.3.2PowerShell Reverse Shells
4.3.3PowerShell Bind Shells
4.3.4Powercat
4.3.5Powercat File Transfers
4.3.6Powercat Reverse Shells
4.3.7Powercat Bind Shells
4.3.8Powercat Stand-Alone Payloads
4.4Wireshark
4.4.1Wireshark Basics
4.4.2Launching Wireshark
4.4.3Capture Filters
4.4.4Display Filters
4.4.5Following TCP Streams
4.5Tcpdump
4.5.2Filtering Traffic
4.5.3Advanced Header Filtering
4.6Wrapping Up
5Bash Scripting
5.1Intro to Bash Scripting
5.2Variables
5.2.1Arguments
5.2.2Reading User Input
5.3If, Else, Elif Statements
5.4Boolean Logical Operations
5.5Loops
5.5.1For Loops
5.5.2While Loops
5.6Functions
5.7Practical Examples
5.7.1Practical Bash Usage – Example 1
5.7.2Practical Bash Usage – Example 2
5.7.3Practical Bash Usage – Example 3
5.8Wrapping Up
6Passive Information Gathering
6.1Taking Notes
6.2Website Recon
6.3Whois Enumeration
6.4Google Hacking
6.5Netcraft
6.6Recon-ng
6.7Open-Source Code
6.8Shodan
6.9Security Headers Scanner
6.10SSL Server Test
6.11Pastebin
6.12User Information Gathering
6.12.1Email Harvesting
6.12.2Password Dumps
6.13Social Media Tools
6.13.2Site-Specific Tools
6.14Stack Overflow
6.15Information Gathering Frameworks
6.15.1OSINT Framework
6.15.2Maltego
6.16Wrapping Up
7Active Information Gathering
7.1DNS Enumeration
7.1.1Interacting with a DNS Server
7.1.2Automating Lookups
7.1.3Forward Lookup Brute Force
7.1.4Reverse Lookup Brute Force
7.1.5DNS Zone Transfers
7.1.6Relevant Tools in Kali Linux
7.2Port Scanning
7.2.1TCP / UDP Scanning
7.2.2Port Scanning with Nmap
7.2.3Masscan
7.3SMB Enumeration
7.3.1Scanning for the NetBIOS Service
7.3.2Nmap SMB NSE Scripts
7.4NFS Enumeration
7.4.1Scanning for NFS Shares
7.4.2Nmap NFS NSE Scripts
7.5SMTP Enumeration
7.6SNMP Enumeration
7.6.1The SNMP MIB Tree
7.6.2Scanning for SNMP
7.6.3Windows SNMP Enumeration Example
7.7Wrapping Up
8Vulnerability Scanning
8.1Vulnerability Scanning Overview and Considerations
8.1.1How Vulnerability Scanners Work
8.1.2Manual vs. Automated Scanning
8.1.3Internet Scanning vs Internal Scanning
8.1.4Authenticated vs Unauthenticated Scanning
8.2Vulnerability Scanning with Nessus
8.2.1Installing Nessus
8.2.2Defining Targets
8.2.3Configuring Scan Definitions
8.2.4Unauthenticated Scanning With Nessus
8.2.5Authenticated Scanning With Nessus
8.2.6Scanning with Individual Nessus Plugins
8.3Vulnerability Scanning with Nmap
8.4Wrapping Up
9Web Application Attacks
9.1Web Application Assessment Methodology
9.2Web Application Enumeration
9.2.1Inspecting URLs
9.2.2Inspecting Page Content
9.2.3Viewing Response Headers
9.2.4Inspecting Sitemaps
9.2.5Locating Administration Consoles
9.3Web Application Assessment Tools
9.3.2DIRB
9.3.3Burp Suite
9.3.4Nikto
9.4Exploiting Web-based Vulnerabilities
9.4.1Exploiting Admin Consoles
9.4.2Cross-Site Scripting (XSS)
9.4.3Directory Traversal Vulnerabilities
9.4.4File Inclusion Vulnerabilities
9.4.5SQL Injection
9.5Extra Miles
9.5.1Exercises
9.6Wrapping Up
10Introduction to Buffer Overflows
10.1Introduction to the x Architecture
10.1.1Program Memory
10.1.2CPU Registers
10.2Buffer Overflow Walkthrough
10.2.1Sample Vulnerable Code
10.2.2Introducing the Immunity Debugger
10.2.3Navigating Code
10.2.4Overflowing the Buffer
10.2.5Exercises
10.3Wrapping Up
11Windows Buffer Overflows
11.1Discovering the Vulnerability
11.1.1Fuzzing the HTTP Protocol
11.2Win Buffer Overflow Exploitation
11.2.1A Word About DEP, ASLR, and CFG
11.2.2Replicating the Crash
11.2.3Controlling EIP
11.2.4Locating Space for Our Shellcode
11.2.5Checking for Bad Characters
11.2.6Redirecting the Execution Flow
11.2.7Finding a Return Address
11.2.8Generating Shellcode with Metasploit
11.2.9Getting a Shell
11.2.10Improving the Exploit
11.3Wrapping Up
12Linux Buffer Overflows
12.1About DEP, ASLR, and Canaries
12.2Replicating the Crash
12.3Controlling EIP
12.4Locating Space for Our Shellcode
12.5Checking for Bad Characters
12.6Finding a Return Address
12.7Getting a Shell
12.8Wrapping Up
13Client-Side Attacks
13.1Know Your Target
13.1.1Passive Client Information Gathering
13.1.2Active Client Information Gathering
13.2Leveraging HTML Applications
13.2.1Exploring HTML Applications
13.2.2HTA Attack in Action
13.3Exploiting Microsoft Office
13.3.1Installing Microsoft Office
13.3.2Microsoft Word Macro
13.3.3Object Linking and Embedding
13.3.4Evading Protected View
13.4Wrapping Up
14Locating Public Exploits
14.1A Word of Caution
14.2Searching for Exploits
14.2.1Online Exploit Resources
14.2.2Offline Exploit Resources
14.3Putting It All Together
14.4Wrapping Up
15Fixing Exploits
15.1Fixing Memory Corruption Exploits
15.1.1Overview and Considerations
15.1.2Importing and Examining the Exploit
15.1.3Cross-Compiling Exploit Code
15.1.4Changing the Socket Information
15.1.5Changing the Return Address
15.1.6Changing the Payload
15.1.7Changing the Overflow Buffer
15.2Fixing Web Exploits
15.2.1Considerations and Overview
15.2.2Selecting the Vulnerability
15.2.3Changing Connectivity Information
15.2.4Troubleshooting the “index out of range” Error
15.3Wrapping Up
16File Transfers
16.1Considerations and Preparations
16.1.1Dangers of Transferring Attack Tools
16.1.2Installing Pure-FTPd
16.1.3The Non-Interactive Shell
16.2Transferring Files with Windows Hosts
16.2.1Non-Interactive FTP Download
16.2.2Windows Downloads Using Scripting Languages
16.2.3Windows Downloads with exe2hex and PowerShell
16.2.4Windows Uploads Using Windows Scripting Languages
16.2.5Uploading Files with TFTP
16.3Wrapping Up
17Antivirus Evasion
17.1What is Antivirus Software
17.2Methods of Detecting Malicious Code
17.2.1Signature-Based Detection
17.2.2Heuristic and Behavioral-Based Detection
17.3Bypassing Antivirus Detection
17.3.1On-Disk Evasion
17.3.2In-Memory Evasion
17.3.3AV Evasion: Practical Example
17.4Wrapping Up
18Privilege Escalation
18.1Information Gathering
18.1.1Manual Enumeration
18.1.2Automated Enumeration
18.2Windows Privilege Escalation Examples
18.2.1Understanding Windows Privileges and Integrity Levels
18.2.2Introduction to User Account Control (UAC)
18.2.3User Account Control (UAC) Bypass: fodhelper.exe Case Study
18.2.4Insecure File Permissions: Serviio Case Study
18.2.5Leveraging Unquoted Service Paths
18.2.6Windows Kernel Vulnerabilities: USBPcap Case Study
18.3Linux Privilege Escalation Examples
18.3.1Understanding Linux Privileges
18.3.2Insecure File Permissions: Cron Case Study
18.3.3Insecure File Permissions: /etc/passwd Case Study
18.3.4Kernel Vulnerabilities: CVE-7-2 Case Study
18.4Wrapping Up
19Password Attacks
19.1Wordlists
19.1.1Standard Wordlists
19.2Brute Force Wordlists
19.3Common Network Service Attack Methods
19.3.1HTTP htaccess Attack with Medusa
19.3.2Remote Desktop Protocol Attack with Crowbar
19.3.3SSH Attack with THC-Hydra
19.3.4HTTP POST Attack with THC-Hydra
19.4Leveraging Password Hashes
19.4.1Retrieving Password Hashes
19.4.2Passing the Hash in Windows
19.4.3Password Cracking
19.5Wrapping Up
20Port Redirection and Tunneling
20.1Port Forwarding
20.1.1RINETD
20.2SSH Tunneling
20.2.1SSH Local Port Forwarding
20.2.2SSH Remote Port Forwarding
20.2.3SSH Dynamic Port Forwarding
20.3PLINK.exe
20.4NETSH
20.5HTTPTunnel-ing Through Deep Packet Inspection
20.6Wrapping Up
21Active Directory Attacks
21.1Active Directory Theory
21.2Active Directory Enumeration
21.2.1Traditional Approach
21.2.2A Modern Approach
21.2.3Resolving Nested Groups
21.2.4Currently Logged on Users
21.2.5Enumeration Through Service Principal Names
21.3Active Directory Authentication
21.3.1NTLM Authentication
21.3.2Kerberos Authentication
21.3.3Cached Credential Storage and Retrieval
21.3.4Service Account Attacks
21.3.5Low and Slow Password Guessing
21.4Active Directory Lateral Movement
21.4.1Pass the Hash
21.4.2Overpass the Hash
21.4.3Pass the Ticket
21.4.4Distributed Component Object Model
21.5Active Directory Persistence
21.5.1Golden Tickets
21.5.2Domain Controller Synchronization
21.6Wrapping Up
22The Metasploit Framework
22.1Metasploit User Interfaces and Setup
22.1.1Getting Familiar with MSF Syntax
22.1.2Metasploit Database Access
22.1.3Auxiliary Modules
22.2Exploit Modules
22.2.1SyncBreeze Enterprise
22.3Metasploit Payloads
22.3.1Staged vs Non-Staged Payloads
22.3.2Meterpreter Payloads
22.3.3Experimenting with Meterpreter
22.3.4Executable Payloads
22.3.5Metasploit Exploit Multi Handler
22.3.6Client-Side Attacks
22.3.7Advanced Features and Transports
22.4Building Our Own MSF Module
22.5Post-Exploitation with Metasploit
22.5.1Core Post-Exploitation Features
22.5.2Migrating Processes
22.5.3Post-Exploitation Modules
22.5.4Pivoting with the Metasploit Framework
22.6Metasploit Automation
22.7Wrapping Up
23PowerShell Empire
23.1Installation, Setup, and Usage
23.1.1PowerShell Empire Syntax
23.1.2Listeners and Stagers
23.1.3The Empire Agent
23.2PowerShell Modules
23.2.1Situational Awareness
23.2.2Credentials and Privilege Escalation
23.2.3Lateral Movement
23.3Switching Between Empire and Metasploit
23.4Wrapping Up
24Assembling the Pieces: Penetration Test Breakdown
24.1Public Network Enumeration
24.2Targeting the Web Application
24.2.1Web Application Enumeration
24.2.2SQL Injection Exploitation
24.2.3Cracking the Password
24.2.4Enumerating the Admin Interface
24.2.5Obtaining a Shell
24.2.6Post-Exploitation Enumeration
24.2.7Creating a Stable Pivot Point
24.3Targeting the Database
24.3.1Enumeration
24.3.2Attempting to Exploit the Database
24.4Deeper Enumeration of the Web Application Server
24.4.1More Thorough Post Exploitation
24.4.2Privilege Escalation
24.4.3Searching for DB Credentials
24.5Targeting the Database Again
24.5.1Exploitation
24.5.2Post-Exploitation Enumeration
24.5.3Creating a Stable Reverse Tunnel
24.6Targeting Poultry
24.6.2Enumeration
24.6.3Exploitation (Or Just Logging In)
24.6.4Post-Exploitation Enumeration
24.6.5Unquoted Search Path Exploitation
24.6.6Post-Exploitation Enumeration
24.7Internal Network Enumeration
24.7.1Reviewing the Results
24.8Targeting the Jenkins Server
24.8.1Application Enumeration
24.8.2Exploiting Jenkins
24.8.3Post Exploitation Enumeration
24.8.4Privilege Escalation
24.8.5Post Exploitation Enumeration
24.9Targeting the Domain Controller
24.9.1Exploiting the Domain Controller
24.10Wrapping Up
25Trying Harder: The Labs
25.1Real Life Simulations
25.2Machine Dependencies
25.3Cloned Lab Machines
25.4Unlocking Networks
25.5Routing
25.6Machine Ordering & Attack Vectors
25.7Firewall / Routers / NAT
25.8Passwords
Programme scope, delivery arrangements and suitability are confirmed during enquiry.