PenTest+ exam prep: attacks and exploits
You carry out network, web, password, social engineering and wireless attacks on your own lab targets and build the chain from first access to privilege escalation.
Level 301 · 18 lessons · 15 practice labs
Lessons
Network and service attacks
- On-path attack: an ARP poisoning lab
- Exploiting a vulnerable service
- Password attacks: online guessing and offline cracking
- Exploitation and session handling with Metasploit
- Short task: gain first access to the target server
Web attacks
- SQL injection: manual and automated
- XSS and CSRF
- File inclusion and directory traversal
- Authentication and session weaknesses
- Command injection and file upload
- Short task: reach the database from the web application
Social engineering and wireless
- Planning and measuring an authorised phishing campaign
- Physical tests: getting through the door, cloning badges
- Wireless attacks: capturing and cracking the handshake
- Short task: write a scenario and metrics for a social engineering test
Privilege escalation
- Privilege escalation on Linux
- Privilege escalation paths on Windows
- Capstone: an attack chain from first access to root
Practice labs
- See the trace of an on-path test in the ARP table: You compare the victim machine's ARP table before and after an authorised lab test and document the changed entry.
- Prove the risk of a cleartext protocol with a capture: You show with a capture file that a cleartext session on the lab network is readable and write a recommendation to move to an encrypted protocol.
- Turn on the defence and repeat the test: After static ARP and port protection are enabled on the lab network you repeat the same test and report with evidence that it now fails.
- Assess password hash formats against policy: In an account export from the lab server you identify which accounts use an outdated hash format and recommend an upgrade.
- Audit lab accounts against a banned-password list: You audit Erguvan Eczanesi's lab account export against a banned-password list and report how many accounts break policy and the fix.
- Test that the account lockout control works: You measure whether the failed-attempt limit is enforced on the lab login service, configure lockout if missing and retest.
- Find the page that reflects input unchanged: You find the field in the lab web app that writes user input back unencoded and write how output encoding fixes it.
- Find and fix a parameter that breaks the query: You identify the parameter in the lab app that returns a database error on unexpected input, convert the code to a parameterised query and retest.
- Harden a file upload check: You show the gap in a lab app's extension-only upload check, add content-type and storage-location checks and verify them.
- Prepare a brief for an authorised phishing drill: You fill in a brief for an awareness drill covering approver, target group, dates and data that will not be collected.
- Produce a metrics report from drill results: From drill records generated in the lab you calculate open, click and report rates and report them by department.
- Write a checklist for a physical security test: You prepare a physical test checklist for an office covering the authorisation letter, escort, off-limits areas and what to do if stopped by security.
- List over-broad sudo rules: You review sudo rules on the lab server and list passwordless and wildcard rules with a risk note.
- Close a scheduled script anyone can write: You find a scheduled script that runs as root and is world-writable, fix its ownership and permissions and verify the risk is gone.
- Find privilege paths and write a plan to close them: You audit setuid files, capabilities and service configuration on the lab server and report the three paths you find with evidence and lasting fixes.
About this course
You carry out network, web, password, social engineering and wireless attacks on your own lab targets and build the chain from first access to privilege escalation.
What you will learn
- Network and service attacks
- Web attacks
- Social engineering and wireless
- Privilege escalation
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.