Infrastructure Pentesting Bootcamp (IPB)

DAY 1: Mastering Reconnaissance and Enumeration

Module 1. Reconnaissance Techniques

• Review of goals for testing
• Mastering scanning tools
• Attacking password authentication
• Executing initial access techniques
• Network traffic sniffing and analysis
• Covert channel delivery and exfiltration\nModule 2: Operating system oriented environment enumeration
  • Understanding Windows & Linux network architecture
  • Enumerating Windows domains and workstations
  • Identifying high value targets (users, admins, devices etc.)
  • Identifying roles of different machines (Domain Controllers, File Servers, etc.)
  • Utilizing Nmap for operating system-specific scans
  • Accessing sensitive data\nDaily Summary: Discussing possible points of entry and mitigation strategies.
  DAY 2: Mastering Hunting for Vulnerabilities

Module 3: Hunting for Vulnerabilities

• Discovering live systems
• Getting information from open ports
• Misusing typical services NetBIOS, SMB, and other
• Metasploit and other tools
• Automation techniques
• Mastering Powershell / Powersploit
• Manipulating SMB, RDP, and other protocols for control and data exfiltration\nDaily Summary: Discussing vulnerability management and possible mitigations.

DAY 3: Mastering identity attacks and protocol flows

Module 4: Attacks on NTLM: Execution and Mitigations

Understanding and exploiting NTLM

Pass-The-Hash

Over-Pass-The-Hash

NTLM relay

NTLM attacks detections

Hardening NTLM authentication\nModule 5: Attacks on Kerberos authentication: Execution and Mitigations

• Understanding and exploiting Kerberos
• Core concepts (tickets, keys, SPN)
• Authentication flow
• PKIinit
• Refreshing PAC
• Authentication Monitoring\nModule 6: Attacks against Kerberos tickets: Execution and Mitigations
  • Pass-The-Ticket
  • Silver ticket
  • Golden ticket
  • Keberoasting\nDaily Summary: Discussing identity protection techniques.
  DAY 4: Advanced attacks on Active Directory and Entra ID

Module 7: Advanced AD Attacks: Execution and Mitigations

• DCSync
• DCShadow
• NGC/shadow credentials
• Advanced persistence techniques
• Skeleton Key
• Windows Hello for Business Security,
• AdminSDholder
• Offline access attacks
• Decrypting secrets with DPAPI and DPAPI-NG
• Attacks against smart card authentication\nModule 8: Azure and Entra ID pivoting
  • Cloud enumeration
  • On-prem to cloud pivoting
  • Cloud to on-prem pivoting
  • Entra ID security review
  • Stealing Entra ID tokens
  • Entra ID MFA and FIDO2 auditing
  • Entra ID application security
  • Catching signs of attack on-prem and in the Cloud\nDaily Summary: Discussing security features and misconfigurations that help or lead to attacks.
  DAY 5: Mastering Enterprise Exploitation, Post-Exploitation and Pivoting

Module 9: Mastering Exploitation of Enterprise Services

Exploiting PKI services

Exploiting MSSQL Severs

Exploiting IIS

Exploiting ADFS

Bypassing application whitelisting\nModule 10: Mastering Persistence and Lateral Movement

• Techniques for lateral movement recap
• BITS Jobs
• Boot or Login Autostart Execution
• Boot or Login Initialization Scripts
• Browser Extensions
• Compromising Software Binary
• Event-Triggered Execution
• External Remote Services
• Hijack Execution Flow
• Office Application Startup
• Scheduled Task/Job
• Server Software Component
• Traffic Signaling
• Persistence through Registry keys
• Malicious services
• Fileless malware\nDaily Summary: Discussing mitigations and monitoring capabilities.

- Penetration Tester: Experienced in performing authorized simulated attacks to identify vulnerabilities and seeking to deepen your skills in advanced network and system exploitation.\n- Security Analyst: Responsible for monitoring, analyzing, and defending against security threats and looking to enhance your ability to identify and mitigate complex vulnerabilities.\n- IT Professional: Managing and securing IT infrastructure, eager to learn cutting-edge techniques to protect your organization™s assets from sophisticated cyber attacks.\n- Cybersecurity Professional: Focused on safeguarding organizational data and systems, aiming to stay ahead of the latest threats and improve your defensive strategies.\n- Geeks with an IT Background: Excited to start an adventure in the cybersecurity pentesting field, ready to dive deep into hands-on learning and practical application of advanced pentesting techniques.