Introduction to Penetration Testing

Lernziele

• Explain what a penetration test is and how it differs from vulnerability scanning, red teaming and bug bounties.
• Describe the main types of test and the black, grey and white box approaches.
• Outline the published methodologies and the phases a test moves through.
• Describe the UK assurance schemes and the standards that require testing.
• Explain why written authorisation matters under the Computer Misuse Act 1990.
• Define a scope and rules of engagement, including systems a client does not own.

In diesem Thema

1. What is penetration testing?
2. Methodologies and standards
3. Scoping, authorisation and rules of engagement

Lernziele

• Distinguish passive from active reconnaissance and explain why passive comes first.
• Build a picture of a target from DNS, WHOIS, certificate transparency and archives.
• Discover live hosts and scan their ports with Nmap, and read the results.
• Explain the difference between a connect scan and a SYN scan, and when each is used.
• Enumerate services to confirm the software and version behind each open port.
• Record enumeration findings in a form the next phase can use.

In diesem Thema

1. Passive reconnaissance
2. Host discovery and port scanning
3. Service enumeration

Lernziele

• Match software versions to known vulnerabilities using CVE and the National Vulnerability Database.
• Explain what a vulnerability scanner does well, and where false positives and negatives arise.
• Confirm a finding by hand before acting on it.
• Explain what exploitation proves and how to choose the safest demonstration.
• Describe the role of exploitation frameworks and the duty of care they demand.
• Find and safely test weak, default and leaked credentials.
• Recognise common web application flaws using the OWASP Top 10.

In diesem Thema

1. From services to vulnerabilities
2. Exploitation in a controlled test
3. Weak and default credentials
4. Web application testing basics

Lernziele

• Explain privilege escalation and the common Linux and Windows misconfigurations that allow it.
• Assess the impact of a foothold while staying in scope.
• Gather evidence safely and clean up so the client is left no worse off.
• Describe the structure of a penetration test report and its audiences.
• Rate the severity of a finding and write a finding an engineer can fix.
• Explain why a retest closes an engagement and why a test is only a snapshot.
• Apply the whole testing process to an authorised staging server in a lab.

In diesem Thema

1. Privilege escalation
2. Post-exploitation and clean-up
3. Reporting and retesting
4. Lab: Testing a staging server
5. Lab walkthrough: Testing a staging server