New
Ethical Hacker (Red Team)
Course Design
This course is designed to optimize knowledge acquisition and skills development related to the learning objectives and related job ...
Show more
Instructor
Acquire NEXUS Academy
5
Students
enrolled
- Description
- Curriculum
About This Course
The PenTest+ Certification is designed for professionals with 10+ years of general hands-on IT experience, with at least five of those years being broad hands-on IT security experience, and 3 – 4 years in a penetration tester job role.
Upon course completion, you will be able to:
- Plan, scope, and perform information gathering as part of a penetration test.
- Perform attacks that are aligned to and fulfill legal and compliance requirements.
- Perform each phase of a penetration test using and modifying appropriate tools and use the appropriate tactics, techniques, and procedures.
- Analyze the results of each phase of a penetration test to develop a written report, effectively communicate findings to stakeholders and provide practical recommendations.
Ethical Hacker
Module 1 Penetration Testing: Before You Begin
-
2
1.0 Introduction -
3
1.1 Professional Conduct and Penetration Testing
-
4
1.1.1 What Is Penetration Testing?
-
5
1.1.2 Ethics, Legal, and Compliance Considerations of Penetration Testing
-
6
1.1.3 Importance and Examples of Documentation
-
7
1.1.4 Scoping and Authorization
-
8
1.1.5 Overview of the PenTest Report
-
9
1.1.6 Live Lab: Exploring the Lab Environment
-
10
1.1.7 Lesson Review -
11
1.2 Collaboration and Communication
-
12
1.2.1 Collaboration and Communication Overview
-
13
1.2.2 PenTest Team Roles and Responsibilities
-
14
1.2.3 Communicating with Clients and Team Members
-
15
1.2.4 Peer Review
-
16
1.2.5 Stakeholder Alignment
-
17
1.2.6 Root Cause Analysis
-
18
1.2.7 Escalation Path
-
19
1.2.8 Secure Distribution
-
20
1.2.9 Articulation of Risk, Severity, and Impact
-
21
1.2.10 Goal Reprioritization
-
22
1.2.11 Business Impact Analysis
-
23
1.2.12 Client Acceptance
-
24
1.2.13 Lesson Review
-
25
1.3 Testing Frameworks and Methodologies
-
26
1.3.1 Testing Frameworks and Methodologies Overview
-
27
1.3.2 Open Source Security Testing Methodology Manual (OSSTMM)
-
28
1.3.3 Council of Registered Ethical Security Testers (CREST)
-
29
1.3.4 Penetration Testing Execution Standard (PTES)
-
30
1.3.5 MITRE ATT&CK
-
31
1.3.6 Open Web Application Security Project (OWASP) Top 10
-
32
1.3.7 OWASP Mobile Application Security Verification Standard (MASVS)
-
33
1.3.8 Purdue Model
-
34
1.3.9 Threat Modeling Frameworks
-
35
1.3.10 Lesson Review
-
36
1.4 Introduction to Scripting for Penetration Testing
-
37
1.4.1 Scripting Languages
-
38
1.4.2 Bash Shell and Bash Script
-
39
1.4.3 Python
-
40
1.4.4 PowerShell
-
41
1.4.5 Use of Libraries, Functions, and Classes
-
42
1.4.6 Logic Constructs
-
43
1.4.7 Create Logic Constructs
-
44
1.4.8 Lesson Review
-
45
1.5 Module Quiz
Module 2 Applying Pre-Engagement Activities
-
46
2.0 Introduction
-
47
2.1 Define the Scope
-
48
2.1.1 Regulations, Frameworks, and Standards
-
49
2.1.2 Rules of Engagement
-
50
2.1.3 Agreement Types
-
51
2.1.4 Target Selection
-
52
2.1.5 Lesson Review
-
53
2.2 Compare Types of Assessments
-
54
2.2.1 Types of Assessments Overview
-
55
2.2.2 Web and Application Assessments
-
56
2.2.3 Network Assessments
-
57
2.2.4 Activity: Assess Environmental Considerations
-
58
2.2.5 Mobile Assessments
-
59
2.2.6 Cloud Assessments
-
60
2.2.7 Wireless Assessments
-
61
2.2.8 IoT Devices and Penetration Testing
-
62
2.2.9 Information Technology Versus Operational Technology
-
63
2.2.10 Lesson Review
-
64
2.3 Utilize the Shared Responsibility Model
-
65
2.3.1 The Shared Responsibility Model Overview
-
66
2.3.2 Hosting Provider Responsibilities
-
67
2.3.3 Customer Responsibilities
-
68
2.3.4 Penetration Tester Responsibilities
-
69
2.3.5 Third-Party Responsibilities
-
70
2.3.6 Lesson Review
-
71
2.4 Identify Legal and Ethical Considerations
-
72
2.4.1 Authorization Letters
-
73
2.4.2 Mandatory Reporting Requirements
-
74
2.4.3 Risk to the Penetration Tester
-
75
2.4.4 Documenting Pre-Engagement Activities
-
76
2.4.5 Lesson Review
-
77
2.5 Module Quiz
Module 3 Enumeration and Reconnaissance
-
78
3.0 Introduction
-
79
3.1 Information Gathering Techniques
-
80
3.1.1 Active and Passive Reconnaissance
-
81
3.1.2 Tools for Reconnaissance
-
82
3.1.3 Open-Source Intelligence (OSINT)
-
83
3.1.4 Using Shodan
-
84
3.1.5 Previously Breached Password Lists
-
85
3.1.6 Network Reconnaissance
-
86
3.1.7 Basics of Scanning
-
87
3.1.8 Perform Recon with Nmap
-
88
3.1.9 Certificate Transparency Logs
-
89
3.1.10 Information Disclosure
-
90
3.1.11 Search Engine Analysis/Enumeration
-
91
3.1.12 Network Sniffing
-
92
3.1.13 Data Manipulation
-
93
3.1.14 Lesson Review
-
94
3.2 Host and Service Discovery Techniques
-
95
3.2.1 What Is Enumeration?
-
96
3.2.2 Host Discovery
-
97
3.2.3 Scripting with Nmap
-
98
3.2.4 Activity: Scripting with Nmap
-
99
3.2.5 Banner Grabbing
-
100
3.2.6 Protocol Enumeration
-
101
3.2.7 Service Discovery
-
102
3.2.8 DNS Enumeration
-
103
3.2.9 Operating System (OS) Fingerprinting
-
104
3.2.10 Perform Enumeration with Nmap
-
105
3.2.11 Live Lab: DNS Enumeration and Reconnaissance
-
106
3.2.12 Lesson Review
-
107
3.3 Enumeration for Attack Planning
-
108
3.3.1 Attack Path Mapping
-
109
3.3.2 Manual Enumeration
-
110
3.3.3 Simple Network Management Protocol
-
111
3.3.4 Documenting Enumeration Activities
-
112
3.3.5 Activity: Document Enumeration Activities
-
113
3.3.6 Lesson Review
-
114
3.4 Enumeration for Specific Assets
-
115
3.4.1 Directory Enumeration
-
116
3.4.2 User Enumeration
-
117
3.4.3 Wireless Enumeration
-
118
3.4.4 Permission Enumeration
-
119
3.4.5 Secrets Enumeration
-
120
3.4.6 Share Enumeration
-
121
3.4.7 Web Application Firewall (WAF) Enumeration
-
122
3.4.8 Perform a Decoy Scan
-
123
3.4.9 Industrial Control Systems (ICS) Vulnerability Assessment
-
124
3.4.10 Web Crawling/HTML Scraping
-
125
3.4.11 Lesson Review
-
126
3.5 Module Quiz
Module 4 Scanning and Identifying Vulnerabilities
-
127
4.0 Introduction
-
128
4.1 Vulnerability Discovery Techniques
-
129
4.1.1 Tools for Vulnerability Discovery
-
130
4.1.2 Types of Scans
-
131
4.1.3 Container Scans
-
132
4.1.4 Application Scans
-
133
4.1.5 Scan for Cleartext Vulnerabilities
-
134
4.1.6 Network Scans
-
135
4.1.7 Activity: Scan Identified Targets
-
136
4.1.8 Host-Based Scans
-
137
4.1.9 Live Lab: Using Metasploit
-
138
4.1.10 Secrets Scanning
-
139
4.1.11 Wireless Scans
-
140
4.1.12 Use aircrack-ng to Discover Hidden Networks
-
141
4.1.13 Locate a Rogue Wireless Access Point
-
142
4.1.14 Validate Scan, Reconnaissance, and Enumeration Results
-
143
4.1.15 Applied Live Lab: Network Reconnaissance
-
144
4.1.16 Scan for Linux Vulnerabilities
-
145
4.1.17 Lesson Review
-
146
4.2 Analyzing Reconnaissance Scanning and Enumeration
-
147
4.2.1 Public Exploit Selection
-
148
4.2.2 Use Scripting to Validate Results
-
149
4.2.3 Lesson Review
-
150
4.3 Physical Security Concepts
-
151
4.3.1 Tailgating
-
152
4.3.2 Site Surveys
-
153
4.3.4 Badge Cloning
-
154
4.3.5 Lock Picking
-
155
4.3.6 Documenting Scanning and Identifying Vulnerabilities Activities
-
156
4.3.7 Activity: Identify Physical Security Concepts
-
157
4.3.8 Lesson Review
-
158
4.4 Module Quiz
-
159
4.5 Checkpoint Review
Module 5 Conducting Pentest Attacks
-
160
5.0 Introduction
-
161
5.1 Prepare and Prioritize Attacks
-
162
5.1.1 Target Prioritization
-
163
5.1.2 High-Value Asset Identification
-
164
5.1.3 Descriptors and Metrics
-
165
5.1.4 End-of-Life Software and Systems
-
166
5.1.5 Default Configurations
-
167
5.1.6 Running Services
-
168
5.1.7 Vulnerable Encryption Methods
-
169
5.1.8 Defensive Capabilities
-
170
5.1.9 Capability Selection
-
171
5.1.10 Exploit Selection and Customization
-
172
5.1.11 Documentation Procedures for Attacks
-
173
5.1.12 Dependencies
-
174
5.1.13 Consideration of Scope Limitations
-
175
5.1.14 Activity: Customize Exploits
-
176
5.1.15 Live Lab: Evaluate EOL Software & Systems
-
177
5.1.16 Applied Live Lab: Exploiting Default Configurations with Responder
-
178
5.1.17 Lesson Review
-
179
5.2 Scripting Automation
-
180
5.2.1 Types of Scripting Automation
-
181
5.2.2 PowerShell
-
182
5.2.3 Bash
-
183
5.2.4 Python
-
184
5.2.5 Breach and Attack Simulation (BAS)
-
185
5.2.6 Live Lab: Executing Scripts to Automate Tasks
-
186
5.2.7 Lesson Review
-
187
5.3 Module Quiz
Module 6 Web-based Attacks
-
188
6.0 Introduction
-
189
6.1 Web-based Attacks
-
190
6.1.1 Web Application Attacks Overview
-
191
6.1.2 Types of Web Application Attacks
-
192
6.1.3 Tools for Performing Web Application Attacks
-
193
6.1.4 Brute-Force Attack
-
194
6.1.5 Collision Attack
-
195
6.1.6 Directory Traversal
-
196
6.1.7 Request Forgery Attacks
-
197
6.1.8 Deserialization Attack
-
198
6.1.9 Injection Attacks
-
199
6.1.10 Activity: Injection Attacks
-
200
6.1.11 Insecure Direct Object Reference
-
201
6.1.12 Session Hijacking
-
202
6.1.13 Arbitrary Code Execution
-
203
6.1.14 File Inclusions
-
204
6.1.15 API Abuse
-
205
6.1.16 JSON Web Token (JWT) Manipulation
-
206
6.1.17 Live Lab: Evaluating a Database Using SQLMap
-
207
6.1.18 Live Lab: Exploiting Directory Traversal
-
208
6.1.19 Live Lab: Performing XSS
-
209
6.1.20 Live Lab: Abusing Insecure Direct Object References
-
210
6.1.21 Live Lab: Performing Lateral Movement
-
211
6.1.22 Live Lab: Performing RFI and LFI Exploitation
-
212
6.1.23 Lesson Review
-
213
6.2 Cloud-based Attacks
-
214
6.2.1 Cloud-based Attacks Overview
-
215
6.2.2 Types of Cloud-based Attacks
-
216
6.2.3 Tools for Performing Cloud-based Attacks
-
217
6.2.4 Metadata Service Attacks
-
218
6.2.5 Access Management Misconfigurations
-
219
6.2.6 Third-party Integrations
-
220
6.2.7 Resource Misconfiguration
-
221
6.2.8 Activity: Conduct Resource Misconfiguration Attacks
-
222
6.2.9 Logging Information Exposure
-
223
6.2.10 Image and Artifact Tampering
-
224
6.2.11 Supply Chain Attacks
-
225
6.2.12 Workload Runtime Attacks
-
226
6.2.13 Container Escape
-
227
6.2.14 Trust Relationship Abuse
-
228
6.2.15 Perform and Analyze a SYN Flood Attack
-
229
6.2.16 Lesson Review
-
230
6.3 Module Quiz
Module 7 Enterprise Attacks
-
231
7.0 Introduction
-
232
7.1 Perform Network Attacks
-
233
7.1.1 Network Attack Types
-
234
7.1.2 Tools for Performing Network Attacks
-
235
7.1.3 Default Credentials
-
236
7.1.4 On-Path Attack
-
237
7.1.5 Certificate Services
-
238
7.1.6 Misconfigured Services Exploitation
-
239
7.1.7 Virtual Local Area Network (VLAN) Hopping
-
240
7.1.8 Multihomed Hosts
-
241
7.1.9 Relay Attack
-
242
7.1.10 IDS Evasion
-
243
7.1.11 Live Lab: Sniffing Network Traffic
-
244
7.1.12 Applied Live Lab: Exploring the Power of Nmap NSE
-
245
7.1.13 Live Lab: Discovering Vulnerabilities with Netcat
-
246
7.1.14 Applied Live Lab: Performing a Relay Attack
-
247
7.1.15 Lesson Review
-
248
7.2 Perform Authentication Attacks
-
249
7.2.1 Authentication Attack Types
-
250
7.2.2 Tools for Performing Authentication Attacks
-
251
7.2.3 Multifactor Authentication (MFA) Fatigue
-
252
7.2.4 Pass-the-Hash Attacks
-
253
7.2.5 Pass-the-Ticket Attacks
-
254
7.2.6 Pass-the-Token Attacks
-
255
7.2.7 Kerberos Attacks
-
256
7.2.8 Lightweight Directory Access Protocol (LDAP) Injection
-
257
7.2.9 Dictionary Attacks
-
258
7.2.10 Crack a Password with John the Ripper
-
259
7.2.11 Brute-Force Attacks
-
260
7.2.12 Mask Attacks
-
261
7.2.13 Password Spraying
-
262
7.2.14 Credential Stuffing
-
263
7.2.15 OpenID Connect (OIDC) Attacks
-
264
7.2.16 Security Assertion Markup Language (Saml) Attacks
-
265
7.2.17 Live Lab: Cracking Passwords
-
266
7.2.18 Lesson Review
-
267
7.3 Perform Host-Based Attacks
-
268
7.3.1 Types of Host-Based Attacks
-
269
7.3.2 Tools for Performing Host-Based Attacks
-
270
7.3.3 Privilege Escalation
-
271
7.3.4 Credential Dumping
-
272
7.3.5 Circumventing Security Tools
-
273
7.3.6 Clear Audit Policies
-
274
7.3.7 Misconfigured Endpoints
-
275
7.3.8 Payload Obfuscation
-
276
7.3.9 User-Controlled Access Bypass
-
277
7.3.10 Shell Escape
-
278
7.3.11 Kiosk Escape
-
279
7.3.12 Library Injection
-
280
7.3.13 Process Hollowing and Injection
-
281
7.3.14 Log Tampering
-
282
7.3.15 Unquoted Service Path Injection
-
283
7.3.16 Documenting Enterprise Attacks
-
284
7.3.17 Applied Live Lab: Performing an On-Path (AiTM) Attack
-
285
7.3.18 Live Lab: Performing Privilege Escalation
-
286
7.3.19 Live Lab: Implementing Payload Obfuscation
-
287
7.3.20 Live Lab: Performing SQL Injection
-
288
7.3.21 Live Lab: Investigating with Evil-WinRM
-
289
7.3.22 Live Lab: Exploiting LOLBins
-
290
7.3.23 Live Lab: Implementing Credential Dumping
-
291
7.3.24 Lesson Review
-
292
7.4 Module Quiz
-
293
7.5 Checkpoint Review
Module 8 Specialized Attacks
-
294
8.0 Introduction
-
295
8.1 Wireless Attacks
-
296
8.1.2 Tools for Performing Wireless Attacks
-
297
8.1.3 Activity: Explore Wireless Tools
-
298
8.1.4 Wardriving
-
299
8.1.5 Bluetooth
-
300
8.1.6 Evil Twin Attack
-
301
8.1.7 Signal Jamming
-
302
8.1.8 Protocol Fuzzing
-
303
8.1.9 Packet Crafting
-
304
8.1.10 Deauthentication
-
305
8.1.11 Captive Portal
-
306
8.1.12 Wi-Fi Protected Setup (WPS) and Personal Identification (PIN) Attack
-
307
8.1.13 Lesson Review
-
308
8.2 Social Engineering Attacks
-
309
8.2.1 Types of Social Engineering Attacks
-
310
8.2.2 Tools for Performing Social Engineering Attacks
-
311
8.2.3 Phishing, Whaling, Spear phishing, and Smishing
-
312
8.2.4 Social Engineering Techniques for Gathering Information
-
313
8.2.5 Watering Hole
-
314
8.2.6 Credential Harvesting
-
315
8.2.7 Live Lab: Performing Social Engineering using SET
-
316
8.2.8 Lesson Review
-
317
8.3.9 Lesson Review
-
318
8.4 Module Quiz
Module 9 Performing Penetration Testing Tasks
-
319
9.0 Introduction
-
320
9.1 Establish and Maintain Persistence
-
321
9.1.1 Principals of Establishing and Maintaining Persistence
-
322
9.1.2 Scheduled Tasks/cron Jobs
-
323
9.1.3 Service Creation
-
324
9.1.4 Reverse and Bind Shells
-
325
9.1.5 Add New Accounts
-
326
9.1.6 Obtain Valid Account Credentials
-
327
9.1.7 Registry Keys
-
328
9.1.8 Command and Control (C2) Frameworks
-
329
9.1.9 Backdoor
-
330
9.1.10 Activity: Maintain Persistence
-
331
9.1.11 Create a Backdoor with Metasploit
-
332
9.1.12 Rootkit
-
333
9.1.13 Browser Extensions
-
334
9.1.14 Tampering Security Controls
-
335
9.1.15 Live Lab: Configuring Reverse and Bind Shells
-
336
9.1.16 Live Lab: Establishing Persistence and Other Post-Exploitation Activities
-
337
9.1.17 Lesson Review
-
338
9.2 Move Laterally through Environments
-
339
9.2.1 Lateral and Horizontal Movement
-
340
9.2.2 Scan for Open Ports from a Remote Computer
-
341
9.2.3 Techniques for Moving Laterally through Environments
-
342
9.2.4 Tools for Moving Laterally through Environments
-
343
9.2.5 Pivoting
-
344
9.2.6 Relay Creation
-
345
9.2.7 Enumeration
-
346
9.2.8 Perform Enumeration of MSSQL with Metasploit
-
347
9.2.9 Service Discovery
-
348
9.2.10 Perform a Scan Using Zenmap
-
349
9.2.11 Bypass Windows Firewall
-
350
9.2.12 Window Management Instrumentation (WMI)
-
351
9.2.13 Window Remote Management (WinRM)
-
352
9.2.14 Lesson Review
-
353
9.3 Staging and Exfiltration
-
354
9.3.1 Fundamentals of Staging and Exfiltration
-
355
9.3.2 Getting Data from a Target
-
356
9.3.3 Hide Files with OpenStego
-
357
9.3.4 Alternate Data Streams
-
358
9.3.5 Applied Live Lab: Staging and Exfiltration Using ADS
-
359
9.3.6 Lesson Review
-
360
9.4 Cleanup and Restoration
-
361
9.4.1 Cleanup and Restoration Procedures
-
362
9.4.2 Activity: Implement Cleanup and Restoration Activities
-
363
9.4.3 Documenting Penetration Testing Tasks
-
364
9.4.4 Lesson Review
-
365
9.5 Module Quiz
Module 10 Reporting and Recommendations
-
366
10.0 Introduction
-
367
10.1 Penetration Test Report Components
-
368
10.1.1 Creating the Penetration Test Report
-
369
10.1.2 Reporting Considerations
-
370
10.1.3 Report Components and Definitions
-
371
10.1.4 Documentation Specifications and Format Alignment
-
372
10.1.5 Risk Scoring
-
373
10.1.6 Test Limitations and Assumptions
-
374
10.1.7 Lesson Review
-
375
10.2 Analyze Findings and Remediation Recommendations
-
376
10.2.1 Analyzing Findings and Developing Recommendations Overview
-
377
10.2.2 Technical Controls
-
378
10.2.3 Administrative Controls
-
379
10.2.4 Operational Controls
-
380
10.2.5 Physical Controls
-
381
10.2.6 Activity: Administrative and Operational Controls
-
382
10.2.7 Lesson Review
-
383
10.3 Module Quiz
Module A PenTest+ PT0-003 Practice Exams
-
384
A.0 I Introduction
-
385
A.1 Prepare for CompTIA PenTest+ Certification
-
386
A.1.1 Why Should I Take a Certification Exam?
-
387
A.1.2 Exam Details for PenTest+ (PT0-003)
-
388
A.1.3 How to Take the Certification Exam
-
389
A.1.4 Tips for Taking the Exam
-
390
A.2 Practice Exams
-
391
A.2.1 Exam Practice 1: Engagement Management
-
392
A.2.2 Exam Practice 2: Reconnaissance and Enumeration
-
393
A.2.3 Exam Practice 3: Vulnerability Discovery, and Analysis
-
394
A.2.4 Exam Practice 4: Attacks and Exploits
-
395
A.2.5 Exam Practice 5: Post-exploitation and Lateral Movement
-
396
A.2.6 PenTest+ PT0-003 Exam Practice
Glossary
Course details
Duration
4 weeks
Lectures
348
Quizzes
49
Level
Advanced
obtained after course assessment
1 year
any
Popular courses
