Pentesting Fundamentals for Beginners

Pentesting Fundamentals for Beginners

by Cliff Krahenbill
Released June 2022
Publisher(s): Packt Publishing
ISBN: 9781804615553

Watch it now on the O’Reilly learning platform with a 10-day free trial.

O’Reilly members get unlimited access to books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.

Start your free trial

Video description

Ethical hacking fundamentals do not change from one exam to the next. One can expect to see questions about Nmap, what commands were used to generate a specific output, and which tool would you use, regardless of the exam vendor. An individual is expected to know what pentesting framework would be used to meet a specific condition and what information should be delivered in an executive summary. You should know how to scope an assessment and identify what document is used for what purpose and the OWASP Top 10 and identify the hacking methodology used to exploit each one. These are just a few fundamentals that remain constant from one ethical hacking exam.

This course provides you with the fundamental knowledge every ethical hacker is expected to know. Throughout this course, you will learn about cybersecurity tools, reverse shells, scripting basics, identifying output, and what commands were used to generate the output.

This course will help you identify security tools and ethical hacking techniques, exploit web application vulnerabilities, appropriate documentation for starting and finalizing a pentest, correct reporting procedures, and appropriately exploit for a given vulnerability.

By the end of this course, you will have learned the fundamentals of pentesting, and renewed your confidence, and recharged your cyber security career with ease.

What You Will Learn

  • Identify security tools and ethical hacking techniques
  • Identify and exploit web application vulnerabilities
  • Identify the appropriate documentation for starting and finalizing a pentest
  • Understand the correct reporting procedures
  • Analyze threats and vulnerabilities within the context of ethical hacking
  • Identify the appropriate exploit for a given vulnerability

Audience

This course is for the individuals wanting to begin work as an ethical hacker or pentester, and who want to become a Pentest+, Cybersecurity Analyst (CySA+), OSCP, or CeH certified. Anyone who requires a refresher on ethical hacking fundamentals, preparing for entry-level to mid-level cybersecurity exams, and is interested in learning the fundamentals of cybersecurity will gain a lot from this course.

You will need a PC or laptop, a stable internet connection, hardware capable of virtualization, and a strong willingness to learn!

About The Author

Cliff Krahenbill: Cliff Krahenbill, known as Professor K, is a technology professional and online instructor. He received his Master of Science degree in Cybersecurity from UMUC in 2015 and a Master of Science degree in Information Technology from Capella University in 2007. Professor K has been working in the field of technology since 1998 as a Microsoft support technician, Microsoft certified trainer, technology support specialist, senior network technology consultant, IT auditor, and most recently, as the owner and operator of his own technology firm, CLK Technology Solutions, located in Tucson, Arizona.

Professor K’s expertise in technology lies in designing, building, and supporting network infrastructures and network security. He has been teaching online courses since 2008 and conducts online classes for universities and colleges. He holds numerous technology certifications, which include the following:

MCTS: Windows Server 2008 Active Directory, Configuration

MCTS: Windows Server 2008 Applications Infrastructure, Configuration

MCTS: Windows Server 2008 Network Infrastructure, Configuration

A+, Net+, Security+

He spends his spare time working in his woodshop and providing free technical support to the local retirement community in Tucson, Arizona.

Table of contents

  1. Chapter 1 : Introduction to the Course
    1. Course Overview
  2. Chapter 2 : Virtual Lab Build
    1. Create a Virtual Install of Kali Linux
    2. Create a Virtual Install of Windows 10
    3. Create a Virtual Install of Metasploitable2 Using VirtualBox
    4. Create a Virtual Install of Metasploitable3 Using VirtualBox
    5. Create a Virtual Install of OWASP
    6. Taking a Snapshot of Your Current Configuration
  3. Chapter 3 : Documentation
    1. Scoping the Engagement
    2. Statement of Work (SOW) Document
    3. Rules of Engagement (ROE) Document
    4. Master Service Agreement (MSA), NDA
    5. Pentesting Final Report
  4. Chapter 4 : Penetration Testing Frameworks
    1. Overview of MITRE ATT Framework
    2. Overview of the NIST Pentesting Framework
    3. Overview of the Penetration Testing Execution Standard (PTES)
  5. Chapter 5 : Nmap - Network Discovery
    1. Introduction to Nmap
    2. Nmap Service and Open Port Scan
    3. Nmap OS Detection
    4. Nmap Service and Version Detection
    5. Nmap Host Discovery
    6. Nmap Scripting Engine (NSE)
    7. Analyzing Nmap Results
  6. Chapter 6 : OpenVAS - Vulnerability Scanning
    1. Perform a Vulnerability Scan Using OpenVAS
  7. Chapter 7 : Information Gathering
    1. Using Banner Grabbing to Aid in Reconnaissance
    2. Enumerating Windows 10 Using WinPEAS
  8. Chapter 8 : Reverse Shells and Persistent Connections
    1. Creating a Persistent Backdoor Using Service Persistence
    2. Create a Windows Reverse Shell Using PowerShell
    3. Launch a Graphic Console Window Using SSH and XTERM.mp4
  9. Chapter 9 : Privilege Escalation
    1. Window 7/10 Privilege Escalation Using UAC Bypass
    2. Verify Windows Privilege Escalation: Unquoted Service Path
    3. Windows Privilege Escalation Unquoted Service Path
  10. Chapter 10 : OWASP Top 10 Mitigations
    1. Overview of OWASP Top 10
    2. Assemble Fake TCPIP Packets Using Hping3
    3. Identify Active Network Hosts and Services Using Nmap
    4. Perform a Vulnerability Scan Using OWASP Zed Attack Proxy
  11. Chapter 11 : Web Applications Testing
    1. Configuring BurpSuite as a Proxy.pdf
    2. Web Application Firewall Detection Using WAFW00F
    3. Perform a SQL Injection Attack Using SQLmap
    4. Exploit Vulnerable Web Applications Using Command Injection
    5. Exploiting HTTP PUT Method
    6. Brute Forcing WordPress Password
  12. Chapter 12 : Compiling Exploit Code
    1. Compiling Exploit Code for Linux Using GCC
    2. Prepare a Windows OVA file for your Virtual Lab Environment
    3. Cross Compiling Windows Exploits Using Mingw-w64
  13. Chapter 13 : Scripting
    1. Local File Inclusion Using Kali Web Shells PHP Scripts
    2. File Transfer Using HTTP and PowerShell's WebClient Object
    3. Python3 SimpleHTTPServer
    4. String Slicing Using Python
    5. Disable Windows 10 UAC Using PowerShell

Product information

  • Title: Pentesting Fundamentals for Beginners
  • Author(s): Cliff Krahenbill
  • Release date: June 2022
  • Publisher(s): Packt Publishing
  • ISBN: 9781804615553