Prerequisites

A basic understanding of TCP/IP networking, e.g.

• Can you describe at a high-level how a request reaches a web server through Ethernet, IP and TCP?
• What function does ARP perform?
• How does a system know whether or not a gateway is required?
• What is a TCP port?

Familiarity with the Windows or Linux command line, e.g.

• What’s the difference between a command and its switches?
• Can you navigate the file system using commands?
• Display network configuration information, etc?

Networking Refresher

• Sniffing Traffic – Wireshark, Ettercap




Information Discovery

• Information Gathering – wget, metadata, pdfinfo and extract
• DNS – dig, zone transfers, DNSenum and Fierce



Target Scanning

• Host Discovery – Nmap and Netdiscover
• Port Scanning with Nmap – Connect, SYN and UDP scans, OS detection
• Banner Grabbing – Amap, Netcat, Nmap, Nmap scripts (NSE)




Vulnerability Assessment

• Nikto
• Nessus




Attacking Windows

• Windows Enumeration – net commands, Active Directory searches
• Enum4linux
• RID Cycling – Enum4linux, Cain
• Metasploit
• Client-side Exploits – Internet Explorer, Metasploit Auxiliary modules




Privilege Escalation – Windows

• Information Gathering with Meterpreter – Stuxnet exploit, Meterpreter scripts
• Privilege Escalation – Keylogging
• Privilege Escalation exploit – Meterpreter’s hashdump, privileged keylogging
• Password Cracking with John The Ripper
• Password Cracking with Cain – fgdump, tailoring dictionaries
• Brute-Force Password Attacks
• Password Cracking with Rainbow Tables – Ophcrack Live CD, Ophcrack application
• Attacks on Cached Domain Credentials
• Token Stealing – PsExec, Incognito, local admin to domain admin
• Pass the Hash


Attacking Linux

• Exploiting Linux
• Pivoting the Attack
• Online Password Cracking – Medusa
• ARP Poisoning Man in the Middle – clear-text protocols, secured protocols




Privilege Escalation – Linux

• Privilege Escalation – standalone exploit
• Cracking UNIX Passwords – John The Ripper
• Exploiting sudo through File Permissions
• Exploiting SUID and Flawed Scripts – logic errors
• Further Shell Script Flaws – command injection, path exploits




Retaining Access

• Netcat as a Backdoor (via a Java Exploit)
• Bandook RAT (via a PDF Exploit) – Metasploit Handlers, a full end-to-end attack




Covering Tracks

• Simple Obfuscation
• HXD Rootkit
• Log Manipulation – wevtutil, Meterpreter scripts, audit policy