Advanced Infrastructure Hacking
You will be able to:
- Enumerate, investigate, target and exploit weaknesses in an organisation’s network devices, online presence, and people.
- Understand complex vulnerabilities and chained exploitation processes in order to gain access and perform restriction bypasses, privilege escalation, data exfiltration and gain long term persistence in: Web facing services, databases, Windows, Active Directory, *nix, container-based, VPN, VLAN, VoIP and Cloud environments.
- Use compromised devices to pivot onto other private networks and/or access services protected by whitelisting or only accessible via the loopback interface.
You will receive:
Access to our Hack-Lab is not just for your work during the course, you will have access for 30 days after the course too. This gives you plenty of time to practice the concepts taught during the course. The Hack-Lab contains a wide variety of challenges from local privilege escalation to VLAN hopping etc. Numerous scripts and tools will also be provided during the course, along with Delegate handouts.
What you can take away from the course:
If you are looking to develop your hacking skills further, either for working as a pen tester, or you need to understand how hackers work so that you are better able to defend against it, then this course is for you. In addition to increasing your knowledge and confidence, it provides excellent preparation for the advanced hacking examinations. By utilizing the Hack-Lab following the Advanced Infrastructure Hacking course you are provided with time to test and hone your skills and your understanding of the tools and applications used throughout the course. You can take these away for working with on a day to day basis. There are guides, walkthroughs and examples for you to use as follow-up so that you can translate these modules into practical values within your business.
Who Should Take This Class?
System Administrators, SOC Analysts, Penetration Testers, Network Engineers, security enthusiasts and if you want to take your skills to next level.
While prior pen testing experience is not a strict requirement, familiarity with both Linux and Windows command line syntax will be greatly beneficial and a reasonable technical understanding of computers and networking in general is assumed. Some hands-on experience with tools commonly used by hackers, such as Nmap, NetCat, or Metasploit, will also be beneficial, although if you are a less advanced user, you can work your way up during the 30 days of complimentary lab access provided as part of the course.
The course is ideal if you are preparing for CREST CCT (ICE), CHECK (CTL), TIGER SST or other similar industry certifications, as well as if you perform Penetration Testing on infrastructure as a day job and wish to add to your existing skill set.
Details of the course content:
IPV4/IPV6 SCANNING, OSINT
- Advanced topics in network scanning
- Understanding & exploiting IPv6 Targets
- Advanced OSINT Data gathering
WEB TECHNOLOGIES
- Exploiting DVCS (git)
- Owning Continuous Integration (CI) servers
- Deserialization Attacks (Java, Python, Node, PHP)
HACKING DATABASE SERVERS
- Mysql
- Postgres
- Oracle
- MongoDB
WINDOWS EXPLOITATION
- Windows Enumeration and Configuration Issues
- Windows Desktop ‘Breakout’ and AppLocker Bypass Techniques (Win 10)
- Local Privilege Escalation
- A/V & AMSI Bypass techniques
- Offensive PowerShell Tools and Techniques
- Post Exploitation Tips, Tools and Methodology
AD EXPLOITATION
- Active Directory Delegation Reviews and Pwnage (Win 2016 server)
- Pass the Hash/Ticket Pivoting and WinRM Certificates
- Cross Domain and Forest attacks
- Pivoting, Port Forwarding and Lateral Movement Techniques
- Persistence and backdooring techniques (Golden Ticket, DCSync, LOLBAS)
- Command and Control (C2) Frameworks
LINUX EXPLOITATION
- Linux Vulnerabilities and Configuration Issues
- Treasure hunting via enumeration
- File Share/SSH Hacks
- X11 Vulnerabilities
- Restricted Shells Breakouts
- Breaking Hardened Web Servers
- Local Privilege Escalation
- MongoDB exploitation
- TTY hacks, Pivoting
- Gaining root via misconfigurations
- Kernel Exploitation
- Post Exploitation and credentials harvesting
CONTAINER BREAKOUT
- Breaking and Abusing Docker
- Exploiting Kubernetes Vulnerabilities
- Breaking out of kubernetes containers
CLOUD HACKING
- AWS/Azure/GCP specific attacks
- Storage Misconfigurations
- Credentials, API’s and token Abuse
- IaaS, PaaS, SaaS, CaaS and Serverless exploitation
- Azure AD attacks
VPN EXPLOITATION
- Exploiting Insecure VPN Configuration
VLAN ATTACKS
- VLAN Concepts
- VLAN Hopping Attacks
Sorry! It looks like we haven’t updated our dates for the class you selected yet. There’s a quick way to find out. Contact us at 502.265.3057 or email info@training4it.com
Request a Date