Penetration Testing as a Day Job

3-day hands-on technical training in Phuket

Penetration Testing as a Day Job

If you're serious about becoming a capable and productive penetration tester, then this course will equip you with the skills, techniques and confidence that you will need to make that jump, whilst rarely feeling all that serious at all!

Categories 3-Day Training, HITB2023HKT, In-person

Attend Virtually$3,299.00

Duration

3-day

Delivery Method

In-Person

Level

beginner / intermediate

Seats Available

20

REGISTRATION CLOSED

DATE: 21-23 August 2023

TIME: 09:00 to 17:00 ICT/GMT+7

Date	Day	Time	Duration
21 Aug	Monday	0900-17:00 ICT/GMT+7	8 Hours
22 Aug	Tuesday	0900-17:00 ICT/GMT+7	8 Hours
23 Aug	Wednesday	0900-17:00 ICT/GMT+7	8 Hours

Exclusive for HITB, this class will include :-

– Multiple HITB exclusive hands-on labs
– HITB exclusive CTF at the end of the course
– 30 days of on-demand lab access.

Many introductory hacking courses show attendees tools & exploit scenarios, yet don’t prepare attendees to work towards a pentesting career, with a methodical approach to beginning, “middling”, ending, or reporting on an actual real pentest.

We take attendees on a light-hearted and hopefully humorous journey from start to finish through a very real (totally simulated) pen test engagement. Pwning our way through our real (fictional) organisation’s apps and infra, including webapps through internal infra and even some physical device silliness (think lights / sounds / maybe even some foam darts), before telling our “client” our findings in a professional (mostly) pentest report.

Hugely lab driven, with a “narrative over the top” almost continuously hands-on approach.

If you didn’t have fun then honestly we totally screwed this up, yet we will ensure that you come away feeling confident and ready to practise your skills flying solo, with plenty of advice included on next steps.

Key Learning Objectives

Learn a huge number of skills, tools, concepts and techniques used by real pentesters on real engagements
Learn how to apply those skills in an actual pentest-like scenario
Learn to proactively prepare for and produce a meaningful report at the end of the engagement
Have fun along the way!

(Course is also fully aligned to the published syllabus to prepare for CREST CPSA and CRT examinations)

Student will be provided with

Full slide deck.
Handouts with lab walkthroughs
30 days worth of on-demand lab access (HITB exclusive)

Topics covered

1. Introduction, Soft Skills & Assessment Management

How to approach a pentest
Engagement Lifecycle
Law & Compliance
Methodology
Scoping
Understanding, Explaining, and Managing Risk
Good report writing skills: before, during, and after the assessment

2. Background Information Gathering and Open Source (OSINT)

Records: Registration / DNS / CT Logs
Customer Web Site Analysis
Google Hacking and Web Enumeration
NNTP Newsgroups and Mailing Lists
Information Leakage from Mail & News Headers
Social Engineering and Physical Security

3. Security Fundamentals

Cryptography
Applications of Cryptography
Encoding / Encryption / Hashing
Hash cracking
File System Permissions
Audit Techniques
Source Code Review

4. Web Technologies

Web Servers
Web Enterprise Architectures
Web Protocols
Web Mark-up Languages
Web Programming Languages
Web Application Servers
Web APIs
Web SubComponents

5. Web Application Security Assessment

Web Application Reconnaissance
Identifying vulnerabilities
Web Site Structure Discovery
Information Gathering from Web Mark-up
Information Disclosure in Error Messages
Enumerating CMSs
Threat Modelling and Attack Vectors
Authentication Mechanisms
Authentication bypasses / flow abuses
Authorization Mechanisms
Session Handling: Predictability / Termination / Hijacking / Fixation
Access control bypasses
Object referencing issues
Input Validation
Cross-Site Scripting Attacks (XSS)
SQL Injection
Parameter Manipulation
Web form input abuse
CSRF
Open redirects
Command injection
XXE
Feature abuses
Generating payloads

6. Databases

MySQL
PostgreSQL
Microsoft SQL Server
Oracle RDBMS
Web / App / Database Connectivity

7. Networking

IP Protocols
Network Architectures
Networking Protocols
Network Mapping & Target Identification
Interpreting Tool Output
Filtering Avoidance Techniques
OS Fingerprinting
Windows vs Linux enumeration
Application Fingerprinting and Evaluating Unknown Services
Network Access Control Analysis
Management Protocols
Network Traffic Analysis
IPSec
VoIP
Wireless
Configuration Analysis

8. Windows Security Assessment

Domain Reconnaissance
User Enumeration
Active Directory
Windows Passwords
Windows Vulnerabilities
Windows Patch Management Strategies
Desktop Lockdown
Exchange
Common Windows Applications

9. Unix/Linux Security Assessment

User Enumeration
Unix vulnerabilities
FTP (Unix)
Sendmail / SMTP (Unix)
Network File System (NFS) (Unix)
R* services (Unix)
X11 (Unix)
RPC services (Unix)
SSH (Unix)

10. Finishing Up

Good report writing skills: after the assessment

Why You Should Take This Course

If you’re serious about becoming a capable and productive penetration tester, then this course will equip you with the skills, techniques and confidence that you will need to make that jump, whilst rarely feeling all that serious at all!

Who Should Attend

Pen Testing Noobs (no total tech noobs please!), and those who already took other hacking courses but came away thinking “I really don’t feel like that taught me how to actually conduct a pentest” (or at least words to that effect)

Prerequisite Knowledge

The only requirement is that you are keen and willing to learn, and to step outside of your comfort zone! You may not enjoy this course as a literal tech noob, all other experience levels welcome.

Hardware / Software Requirements

A laptop (Chromebook will be sufficient) with a browser (all our labs are hosted in a virtual environment).
In case of a virtual delivery, unrestricted Internet access might be necessary (corporate VPNs can cause problems)

TRAINER

Anthony Webb

Co-Founder

4amLabs

Ant has always, always, felt a need to understand what makes things tick. Whether it was pulling apart his toys as a child, first learning to code at around six years old on a BBC Micro in the early 90s, building custom PCs for pocket money as a pre-teen, making websites, or transplanting car engines – he just had to know the “how”,
the “why”, and the “could it be made to work differently”. Sometimes things still work when he’s done with them.

Whilst he may have always been one at heart, Ant finally felt he became a Proper HackerTM relatively late in life, working as a Security Consultant / Penetration Tester after achieving a BSc (First Class Hons) in Mathematics and Computing as a mature student in 2015. He has since found himself earning (and in many cases lapsing) numerous certifications, such as OSCP, CREST CRT, QSTM / CHECK CTM, AWS-SAA/DVA/SCS, and others.

In 2018 Ant was recruited to teach Advanced & Specialist Hacking courses in addition to Penetration Testing and Red Team exercises. He has since built and delivered hands on training to crowds from just a few to over a hundred people at dozens of leading international conferences, including Black Hat USA/Europe/Asia/SecTor, BruCON, OWASP, NullCon, NorthSec, CPX360 and many others, numerous in-house private deliveries, and countless live online virtual events. He specialises in Enterprise Traditi