Adversarial Web Attacks & Tactics for Red Teams

امیرحسین حقیقی

• پیشرفته
• مسیر قرمز
• ۸ درس

دربارۀ این دوره

مخاطبان

• علاقه‌مندان ورود به تیم قرمز
• کارشناسان ارزیابی امنیت و تست نفوذ
• شکارچیان باگ
• متخصصان امنیت سایبری

پیش‌نیازها

• آشنایی با مفاهیم امنیت وب
• آشنایی با فریمورک ®MITRE ATT&CK

• Introduction to Web Application Offense for Red Teams
• Dos and Don’ts of Large-Scale Reconnaissance
  • Introduction to Red Team Reconnaissance
  • Wide Reconnaissance
  • Deep Recon
  • Automation and Recon Orchestration
  • Non-Attributable Recon Methods
• Development of web Resources infrastructure
  • Understanding the Role of Web Infrastructure in Adversary Campaigns
  • Setup Web servers, serverless services, services and etc …
  • Automation of Infra Deployment
• legitimize a phishing campaign with web application vulnerabilities
• deep dive into the role of web application vulnerabilities in Exploits
• post exploitation of web resources
  • Web-Based Persistence Techniques
  • Escalating Privileges Through Web Interfaces and APIs
  • Web-Focused Data Exfiltration
  • Web Tunneling & Pivoting
• make the most of internal web assets
  • internal web assets analysis
  • SAML
  • misconfigured APIs
• deep dive on HTTP-based C2
  • Analyzing Mythic C2: Architecture and Operational Use
  • Living Off Trusted Sites (LOTS) (Third-Party Services,..., ...)
  • • Setting Up and evasions through Redirector Chains (reverse proxies, CDNs , cloud services )
  • evasions methods

گواهینامه‌ی دوره