SEC560: Enterprise Penetration Testing

This first course section covers building a penetration testing infrastructure, defining scope, and performing reconnaissance. Through hands-on labs, you'll map attack surfaces, identify vulnerabilities, and refine scanning techniques for accurate and efficient assessments.

This section covers password guessing, exploitation, and post-exploitation, focusing on Metasploit and Meterpreter. You'll explore gaining access, escalating privileges, and pivoting. The "Assumed Breach" methodology and the use of C2 frameworks like Sliver and Empire are discussed, as well as situational awareness on Windows and Linux systems.

Here we dive into the world of privilege escalation, where gaining elevated access on compromised hosts unlocks new opportunities for deeper exploitation. Learn how to use tools like Mimikatz for password dumping, cracking, and maintaining persistence. Map attack paths with BloodHound to target high-value assets, and utilize Responder for relaying attacks.

Explore lateral movement techniques used by attackers and pen testers to navigate networks. Learn manual methods and automate with Impacket to exploit network protocols. Perform pass-the-hash attacks, bypass application controls, and pivot through networks using C2 frameworks. Finish with strategies for effectively reporting and communicating findings.

Delve into Active Directory lateral movement, focusing on Kerberos attacks like Kerberoasting, Golden Tickets, and Silver Tickets. Learn how to extract domain hashes from a compromised Domain Controller and escalate privileges using AD Certificate Services (AD CS). Explore cloud-based attacks, focusing on Azure and Entra ID integration with on-prem domains.

The final hands-on exercise applies penetration testing skills in a simulated environment. Testers work within the defined scope and rules of engagement to assess security risks. The goal is to identify vulnerabilities, exploit them, and provide recommendations to mitigate the risks discovered, using real-world penetration testing practices.