Penetration Testing Zero to Hero

احسان نیک‌آور

• پیشرفته
• مسیر قرمز
• ۲۴ درس

دربارۀ این دوره

مخاطبان

• علاقه‌مندان ورود به زمینۀ تست نفوذ و ارزیابی امنیت سایبری
• علاقه‌مندان ورود به زمینۀ Bug Bounty

پیش‌نیازها

• آشنایی با مفاهیم و تعاریف فناوری اطلاعات
• آشنایی با مبانی و مفاهیم شبکه و ارتباطات
• آشنایی با پروتکل‌های پرکاربرد

• Module 1: Network Attacks
• Reconnaissance
  • Reconnaissance Concept
  • Whois Lookups
  • DNS Nslookup
  • Web-Site Searches
  • Search Engines as Recon Tools
  • Web-Based Recon and Attack Sites
• Scanning
  • Scanning Goals and Types
  • Network Mapping with Nmap
  • Port Scanning with Nmap
  • Overall Scanning Tips
  • Network Tracing
  • OS Fingerprinting
  • Version Scanning
  • SMB Sessions
  • Packet Crafting with Scapy
  • Enumerating Users
  • Evading IDS/IPS
• Exploiting
  • Why Exploitation?
  • Exploit Categories
  • Metasploit
  • Metasploit Database and Toll Integration
  • Command Shell Versus Terminal Access
  • Netcat
  • Passive and Active Sniffing
  • Session Hijacking
  • DNS Cache Poisoning
  • Password Cracking
  • Pass the Hash Attacks
  • Worm and Bots
• Denial of Service
  • Local DoS
  • DNS Amplification Attacks
  • Distributed DoS
• Post-Exploitation
  • Moving Files with Exploits
  • Pilfering from Target Machines
  • Windows Command Line Kung Fu for Pen Testers
  • Making Win Run Commands
  • PowerShell Kung Fu for Pen Testers
• Password Attacks / Merciless Pivoting
  • Motivation and Definitions
  • Password Attack Tips
  • Account Lockout
  • Password Guessing with THC-Hydra
  • Password Representation Formats
  • Obtaining Hashes
  • More Hash Dumping Options
  • John the Ripper
  • Cain
  • Rainbow Table Attacks
  • Pass-the-Hash Attacks
• Keeping Access
  • App-Level Trojan Horse Backdoor Suites
  • Wrappers and Packers
  • Memory Analysis
  • User Mode Rootkits
  • Kernel Mode Rootkits
• Covering Tracks
  • Covering Tracks in linux
  • Covering Tracks in windows
  • Covering Tracks in network
  • Steganography
• Wireless
  • Type of Wireless Networks
  • Type of Wireless Encryptions
  • Aircrack-ng
  • WEP/WPA Attacks
  • Wireless Hacking Methodology
  • Wireless Hacking Tools
  • Wireless Hacking Countermeasures
• Module 2: Web Attacks
• Web Introduction
  • Why the Web
  • Understanding the Web
  • Web App. Pen Tester’s Toolkit
  • Interception Proxies
  • The HTTP Protocol
  • HTTP Methods
  • HTTP Status Codes
  • HTTPS
  • Testing for Weak Ciphers
  • Heartbleed
• Configuration, Identity and Authentication Testing
  • Testing Software Configuration
  • Shellshock
  • Spidering Web Applications
  • Analyzing Spidering Results
  • Fuzzing
  • Information Leakage
  • Authentication
  • Username Harvesting
• Injection
  • Session Tracking
  • Session Fixation
  • Bypass Flaws
  • Vulnerable Web Apps
  • Command Injection
  • File Inclusion-Directory Traversal
  • SQL Injection Primer
  • Discovering SQLi
  • Exploiting SQLi
  • SQL Tools
• XXE and XSS
  • Javascript Concept
  • Cross Site Scripting
  • XSS Tools
  • XSS Fuzzing
  • XSS Exploitation
  • BeEF
  • Ajax
  • Data Attacks
  • XXE
• CSRF, Logic Flaws and Advanced Tools
  • Cross Site Request Forgery
  • Logic Attacks
  • WPScan
  • w3af
• Module 3: Threat and Vulnerabilty Assessment
• Vulnerability Management and Assessment
  • Introduction to using PowerShell
  • Vulnerability Management
  • Managing Vulnerability Data
  • Vulnerability Assessment Methodology
  • VA Planning
  • Team-Based Operations
  • Cyber Threat Intelligence
  • Threat Modeling
• Network and Cloud Asset Discovery & Classification
  • Discovery
  • Passive Discovery
  • Open-Source Intelligence Gathering
  • Web Application Discovery
  • Reconnaissance Framework
  • Active Scanning
  • Network Scanners
  • Cloud Technologies and Scanning
• Enterprise and Cloud Vulnerability Scanning
  • Vulnerability Discovery
  • Open-Source Vulnerability Identification
  • Risk Rating, Scales and Metrics
  • General-Purpose Scanning
  • Application-Specific Vulnerability Scanning
  • Scanning Enterprise Systems
  • Enterprise Cloud Vulnerability Discovery
• Validation, Triage and Mass Data Management
  • Vulnerability Validation
  • Manual Validation
  • Authenticated Scanning
  • Credentialed Access
  • Overcoming Data Management Pitfalls
  • Configuration Auditing
  • Data Management and Collaboration
  • Collaboration and Purple Teaming
  • Triage
• Collaboration, Remediation and Report
  • The Primacy of Passwords
  • Auditing Domain Password
  • The Windows Domain
  • Group Policy
  • Password Attacks
  • Kerberos and Domain Authentication
  • Domain Trusts
  • Remediation
  • Compensating Controls
  • Reporting
• Module 4: Pen Testing Methods and Reporting
• Pen Testing Methods and Effective Reporting
  • Defining Terms
  • Motivation
  • Types of Pen Tests
  • Free Testing Methodologies
  • Overall Process
  • Rules of Engagement
  • Scoping
  • Tips for Effective Reporting
  • Repository Tools and Collaboration

گواهینامه‌ی دوره