PenTest+ exam prep: vulnerability discovery and analysis
You tune vulnerability scans, validate findings by hand, find web, code, configuration and crypto weaknesses and turn them into a prioritised attack plan.
Level 301 · 14 lessons · 12 practice labs
Lessons
Scanning and validation
- Vulnerability scanning and sorting the results
- Tuning the scan: credentials, speed, out-of-scope
- Validating a finding by hand
- Exploit research: searchsploit and vulnerability databases
- Short task: validate three findings from the scan by hand
Applications and configuration
- Finding web vulnerabilities: inspecting requests through a proxy
- Looking for vulnerabilities in source code
- Weak configurations: default passwords, open shares
- Weak TLS and cipher suites
- Short task: list an application’s vulnerabilities with evidence
Prioritisation
- Planning the attack path: chaining findings
- Exploit priority: impact, ease, business risk
- Specialised systems: IoT, industrial control, mobile
- Capstone: draw up a prioritised attack plan for the target network
Practice labs
- Organise scan output by asset: You group a vulnerability scan output by server and severity and list each server's most critical finding.
- Explain the gap between credentialed and uncredentialed scans: You scan the same lab server with and without a read-only account and report the findings seen only with credentials, with reasons.
- Tune a scan for a fragile target: For a lab device that stops answering under heavy scanning you set rate, concurrency and exclusions and finish the scan with the device still up.
- Compare a version banner with the installed package: You verify from package information whether a service the scan reported as outdated is actually patched.
- Tie a finding to the right advisory: For three findings you search the offline vulnerability database and match the affected version range and the fixed version.
- Validate and evidence three findings by hand: You validate three scan findings by hand on the lab target without causing harm and write evidence output and a false-positive verdict for each.
- List the TLS versions a server supports: You list the protocol versions and cipher suites the lab web server accepts and mark the outdated ones.
- Audit default accounts: You check with the approved list whether vendor default accounts are enabled on lab management interfaces and tabulate the results.
- Fix a weak TLS setting and retest: You disable old protocols and weak cipher suites on the lab server, retest and add the before-and-after output to the report.
- Rank findings by score and context: You weigh eight findings by CVSS score, reachability and asset value and rank the top three with reasons.
- Draw how small findings chain together: You show in a diagram file how three findings that look low on their own combine into a larger risk.
- Write a prioritised remediation plan for the client: You split the findings on Lalezar Tekstil's lab network into three waves by business risk and prepare a plan proposing an owner and deadline for each.
About this course
You tune vulnerability scans, validate findings by hand, find web, code, configuration and crypto weaknesses and turn them into a prioritised attack plan.
What you will learn
- Scanning and validation
- Applications and configuration
- Prioritisation
Prerequisites
You should be comfortable with the level 101 and 201 topics of the same path.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 301; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.