گواهینامه‌ی دوره

برای دریافت گواهینامه‌ی این دوره، ده روز پس از جلسه‌ی پایانی، آزمونی برگزار خواهد شد که با قبولی در این آزمون، امکان صدور گواهینامه‌ی دوره برای شما را خواهیم داشت. حضور در آزمون پایانی و دریافت گواهینامه‌ی دوره برای شرکت‌کنندگان اختیاری است.
هزینه‌ی چاپ و صدور گواهینامه‌ی دوره: ۵۰ هزارتومان

این دوره به چه افرادی توصیه می‌شود؟

• علاقه‌مندان ورود به زمینه‌ی تست نفوذ و ارزیابی امنیت سایبری
• علاقه‌مندان ورود به زمینه‌ی Bug Bounty

برای حضور در این دوره چه دانش‌هایی باید داشته باشم؟

از آن‌جایی که این دوره در سطح پایه برگزار می‌شود به دانش پیش‌نیاز بالایی نیاز ندارد و تنها کافیست تا با موارد زیر آشنایی داشته باشید:

• آشنایی با مفاهیم و تعاریف فناوری اطلاعات
• آشنایی با مبانی و مفاهیم شبکه و ارتباطات
• آشنایی با پروتکل‌های پرکاربرد

سرفصل‌های دوره

Module 1: Network Attacks

Chapter 1: Reconnaissance

1.1 Reconnaissance Concept

1.2 Whois Lookups

1.3 DNS Nslookup

1.4 Web-Site Searches

1.5 Search Engines as Recon Tools

1.6 Web-Based Recon and Attack Sites

Chapter 2: Scanning

2.1 Scanning Goals and Types

2.2 Network Mapping with Nmap

2.3 Port Scanning with Nmap

2.4 Overall Scanning Tips

2.5 Network Tracing

2.6 OS Fingerprinting

2.7 Version Scanning

2.8 SMB Sessions

2.9 Packet Crafting with Scapy

2.10 Enumerating Users

2.11 Evading IDS/IPS

Chapter 3: Exploiting

3.1 Why Exploitation?

3.2 Exploit Categories

3.3 Metasploit

3.4 Metasploit Database and Toll Integration

3.5 Command Shell Versus Terminal Access

3.6 Netcat

3.7 Passive and Active Sniffing

3.8 Session Hijacking

3.9 DNS Cache Poisoning

3.10 Password Cracking

3.11 Pass the Hash Attacks

3.12 Worm and Bots

Chapter 4: Denial of Service

4.1 Local DoS

4.2 DNS Amplification Attacks

4.3 Distributed DoS

Chapter 5: Post-Exploitation

5.1 Moving Files with Exploits

5.2 Pilfering from Target Machines

5.3 Windows Command Line Kung Fu for Pen Testers

5.4 Making Win Run Commands

5.5 PowerShell Kung Fu for Pen Testers

Chapter 6: Password Attacks / Merciless Pivoting

6.1 Motivation and Definitions

6.2 Password Attack Tips

6.3 Account Lockout

6.4 Password Guessing with THC-Hydra

6.5 Password Representation Formats

6.6 Obtaining Hashes

6.7 More Hash Dumping Options

6.8 John the Ripper

6.9 Cain

6.10 Rainbow Table Attacks

6.11 Pass-the-Hash Attacks

Chapter 7: Keeping Access

7.1 App-Level Trojan Horse Backdoor Suites

7.2 Wrappers and Packers

7.3 Memory Analysis

7.4 User Mode Rootkits

7.5 Kernel Mode Rootkits

Chapter 8: Covering Tracks

8.1 Covering Tracks in linux

8.2 Covering Tracks in windows

8.3 Covering Tracks in network

8.4 Steganography

Chapter 9: Wireless

9.1 Type of Wireless Networks

9.2 Type of Wireless Encryptions

9.3 Aircrack-ng

9.4 WEP/WPA Attacks

9.5 Wireless Hacking Methodology

9.6 Wireless Hacking Tools

9.7 Wireless Hacking Countermeasures

Module 2: Web Attacks

Chapter 10: Web Introduction

10.1 Why the Web

10.2 Understanding the Web

10.3 Web App. Pen Tester’s Toolkit

10.4 Interception Proxies

10.5 The HTTP Protocol

10.6 HTTP Methods

10.7 HTTP Status Codes

10.8 HTTPS

10.9 Testing for Weak Ciphers

10.10 Heartbleed

Chapter 11: Configuration, Identity, and Authentication Testing

11.1 Testing Software Configuration

11.2 Shellshock

11.3 Spidering Web Applications

11.4 Analyzing Spidering Results

11.5 Fuzzing

11.6 Information Leakage

11.7 Authentication

11.8 Username Harvesting

Chapter 12: Injection

12.1 Session Tracking

12.2 Session Fixation

12.3 Bypass Flaws

12.4 Vulnerable Web Apps

12.5 Command Injection

12.6 File Inclusion-Directory Traversal

12.7 SQL Injection Primer

12.8 Discovering SQLi

12.9 Exploiting SQLi

12.10 SQL Tools

Chapter 13: XXE and XSS

13.1 Javascript Concept

13.2 Cross Site Scripting

13.3 XSS Tools

13.4 XSS Fuzzing

13.5 XSS Exploitation

13.6 BeEF

13.7 Ajax

13.8 Data Attacks

13.9 XXE

Chapter 14: CSRF, Logic Flaws and Advanced Tools

14.1 Cross Site Request Forgery

14.2 Logic Attacks

14.3 WPScan

14.4 w3af

Module 3: Threat and Vulnerabilty Assessment

Chapter 15: Vulnerability Management and Assessment

15.1 Introduction to using PowerShell

15.2 Vulnerability Management

15.3 Managing Vulnerability Data

15.4 Vulnerability Assessment Methodology

15.5 VA Planning

15.6 Team-Based Operations

15.7 Cyber Threat Intelligence

15.8 Threat Modeling

Chapter 16: Network and Cloud Asset Discovery & Classification

16.1 Discovery

16.2 Passive Discovery

16.3 Open-Source Intelligence Gathering

16.4 Web Application Discovery

16.5 Reconnaissance Framework

16.6 Active Scanning

16.7 Network Scanners

16.8 Cloud Technologies and Scanning

Chapter 17: Enterprise and Cloud Vulnerability Scanning

17.1 Vulnerability Discovery

17.2 Open-Source Vulnerability Identification

17.3 Risk Rating, Scales and Metrics

17.4 General-Purpose Scanning

17.5 Application-Specific Vulnerability Scanning

17.6 Scanning Enterprise Systems

17.7 Enterprise Cloud Vulnerability Discovery

Chapter 18: Validation, Triage and Mass Data Management

18.1 Vulnerability Validation

18.2 Manual Validation

18.3 Authenticated Scanning

18.4 Credentialed Access

18.5 Overcoming Data Management Pitfalls

18.6 Configuration Auditing

18.7 Data Management and Collaboration

18.8 Collaboration and Purple Teaming

18.9 Triage

Chapter 19: Collaboration, Remediation and Report

19.1 The Primacy of Passwords

19.2 Auditing Domain Password

19.3 The Windows Domain

19.4 Group Policy

19.5 Password Attacks

19.6 Kerberos and Domain Authentication

19.7 Domain Trusts

19.8 Remediation

19.9 Compensating Controls

19.10 Reporting

Module 4: Pen Testing Methods and Reporting

Chapter 20: Pen Testing Methods and Effective Reporting

20.1 Defining Terms

20.2 Motivation

20.3 Types of Pen Tests

20.4 Free Testing Methodologies

20.5 Overall Process

20.6 Rules of Engagement

20.7 Scoping

20.8 Tips for Effective Reporting

20.9 Repository Tools and Collaboration