PenTest+ exam prep: post-exploitation and reporting
You practise persistence, lateral movement, pivoting and domain attacks in the lab, then clean up your traces and present the findings to the client in a clear report.
Level 401 · 15 lessons · 12 practice labs
Lessons
Persistence, spread and the domain
- Persistence methods and the traces they leave
- Lateral movement: moving to another host with captured credentials
- Pivoting: SSH tunnels and a SOCKS proxy
- Domain enumeration
- Domain attacks: Kerberoasting and password spraying
- Short task: reach the server in the second subnet by pivoting
Evidence and clean-up
- Proving data exfiltration safely
- A tester’s artefacts: what to record and what to undo
- Post-test clean-up: accounts, files, persistence
- Short task: list every trace you left and undo it
Reporting and communication
- Report structure: executive summary, method, findings
- Writing a finding: evidence, impact, remediation
- Root-cause recommendations: technical, process, people
- The debrief meeting and retesting
- Capstone: take over the domain and write the full report
Practice labs
- List the traces a test left behind: From a finished lab test's notes you extract created accounts, files and scheduled jobs and write the list of things to undo.
- Find persistence traces through a defender's eyes: On a lab server after a test you find leftover service, key and scheduled-job traces and match which log record reveals each.
- Clean up, verify and get client sign-off: In the CORP.LAB test environment you undo every account, file and setting you left and prepare cleanup verification output and a sign-off record.
- Reach an internal service through a jump host: Through the authorised jump host you open the web interface in the second subnet with SSH local port forwarding and document the access.
- Inventory the second subnet through a tunnel: With SSH dynamic forwarding you write the hosts and open services of a lab subnet not directly reachable into an inventory file.
- Close the segmentation gap that allowed the hop: You find the rule that made the hop between two lab subnets possible, propose and apply the firewall rule and show the tunnel no longer works.
- List the privileged groups in the domain: In the CORP.LAB domain you list admin group members including nested memberships and mark the unexpected account.
- Audit risky account settings: In the lab domain you query accounts with non-expiring passwords, pre-authentication disabled or a password in the description and produce a fix list.
- Harden service accounts and re-audit: You audit password length and rights of CORP.LAB service accounts, fix the weak ones and repeat the audit to report the result.
- Write up one finding with its evidence: From given screen output you prepare a finding card with title, affected asset, evidence, impact and remediation sections.
- Write the executive summary without jargon: You translate a ten-finding test result into business risk and write a half-page executive summary free of technical terms.
- Record a retest result in the report: You retest three findings the client says are fixed in the lab and update each as closed, partly closed or open with evidence.
About this course
You practise persistence, lateral movement, pivoting and domain attacks in the lab, then clean up your traces and present the findings to the client in a clear report.
What you will learn
- Persistence, spread and the domain
- Evidence and clean-up
- Reporting and communication
Prerequisites
You should have practised the topics of the same path up to level 301.
Lab environment
Lessons run in a Kali Linux terminal in the browser and in a practice domain (CORP.LAB) set up separately for every lab. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 401; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.