Fundamentals of Penetration TestingSillabus

Fənn kodu

IF-2212y-EN

Kredit

8

Tələbənin iş yükü

1655

Semestr

Yaz semestri

Akademik il

3

Fənnin tipi

Məcburi

Təhsil forması

Əyani

Tədris dili

İngilis

Auditoriyadaxili saatlar

a) 30 hours – Lectures; b) 15 hours – Seminars; c) 30 hours – Laboratory sessions

Auditoriyadan kənar saatlar

a) 70 hours – Student Independent Work; b) 50 hours – Guided Independent Work

The course is designed to develop students’ theoretical knowledge and practical skills in planning, preparing, and conducting penetration tests. It covers the fundamental concepts, legal and ethical frameworks, methodologies, and stages of penetration testing. Students are introduced to approaches for gathering information about information systems and network environments using active and passive techniques, identifying existing vulnerabilities, and assessing the risks associated with them. In laboratory environments, controlled attack scenarios, validation of identified vulnerabilities, privilege escalation, and assessment of potential impact are examined. The course also covers the fundamental principles of penetration testing in network infrastructures, web applications, IoT environments, and other technical environments. Particular emphasis is placed on developing students’ ability to analytically assess potential threats and attack scenarios, identify key risk factors, formulate appropriate security recommendations, and professionally document and report penetration testing results.

• mühazirə
• seminar
• laboratoriya işi
• interaktiv müzakirə
• problem-based learning
• case study
• komanda işi
• təqdimatlar

1. 1

   CLO 1: Explain the fundamental principles, concepts, and techniques of penetration testing.

2. 2

   CLO 2: Describe and apply the main stages of the penetration testing process.

3. 3

   CLO 3: Apply active and passive information-gathering methods during authorized penetration testing activities.

4. 4

   CLO 4: Identify security vulnerabilities in a given target, validate and assess their potential impact and associated risks, and propose appropriate mitigation measures.

5. 5

   CLO 5: Identify and appropriately use common tools and technologies employed in penetration testing.

6. 6

   CLO 6: Analyze penetration testing results and prepare professional and structured penetration testing reports.

1. 1.
   Introduction to Penetration TestingMühazirə

   This topic covers the nature, purpose, and role of penetration testing in ensuring information security. The importance of penetration testing in identifying vulnerabilities in information systems, evaluating the effectiveness of security controls, and assessing the potential impact of attacks is examined. The main differences between penetration testing and other security assessment approaches, as well as their areas of application, are explained. The historical development of hacker culture, the major stages that influenced its formation, and the emergence of the concept of ethical hacking are also explored.

2. 2.
   Ethical Issues in Penetration TestingMühazirə

   This topic examines the ethical, legal, and professional principles that must be considered when conducting penetration tests. Ethical standards, professional responsibility, and the key requirements for authorized security testing are discussed. The concepts of White Hat, Black Hat, and Grey Hat hackers are distinguished in terms of their objectives, authorization, and legal responsibility. National legislation and relevant provisions of criminal law concerning cybercrime and unauthorized access to information systems, as well as the role of international conventions and regulatory documents, are explained. The importance of security policies in defining the scope of penetration tests, permitted activities, and the responsibilities of the involved parties is also examined.

3. 3.
   Methodological Approaches, Standards, and Frameworks in Penetration TestingMühazirə

   This topic covers the main methodologies, standards, and frameworks used for systematically planning and conducting penetration tests. The main stages of the penetration testing lifecycle and the general approach of the CEH methodology are examined. The purpose, scope, and application of the MITRE ATT&CK framework, PTES, NIST SP 800-115, ISO/IEC 27001, and OWASP Testing Guide in penetration testing are explained. The approaches of different methodologies and standards are analyzed comparatively. The principles of identifying, classifying, and assessing the severity of vulnerabilities using the CVE system and CVSS scoring mechanism are also examined.

4. 4.
   Threat Modeling in Penetration TestingMühazirə

   This topic covers the concept, purpose, and application principles of threat modeling in penetration testing. The systematic identification and assessment of potential threats, attack surfaces, and possible attack scenarios against information systems are examined. The main methods used in threat modeling and their applicability to different systems and applications are explained. The analysis and prioritization of threats, attack paths, and risks identified through threat modeling, as well as their use in planning penetration tests, are also explored.

5. 5.
   Target Information GatheringMühazirə

   This topic covers the concept, purpose, and main approaches to gathering information about a target during penetration testing. Passive and active information-gathering techniques, their characteristics, and differences in their application are examined. The principles of obtaining information about target organizations, systems, and infrastructure through Open-Source Intelligence (OSINT) approaches are explained. The collection of domains, IP addresses, DNS records, and other technical information, as well as the role of human factors and open sources in the information-gathering process, are also examined.

6. 6.
   Scanning and Analysis PhaseMühazirə

   This topic covers the purpose and main activities of the scanning and analysis phase of penetration testing. Methods for identifying open ports, active services, and their versions on target systems are examined. Approaches to identifying vulnerabilities in discovered systems and services through automated tools and manual analysis are explained. False-positive and false-negative results that may occur during scanning and vulnerability assessment, their causes, and the importance of properly validating assessment results are also examined.

7. 7.
   Controlled Exploitation Scenarios and Access MechanismsMühazirə

   This topic covers the fundamental principles of controlled validation of identified vulnerabilities and the process of obtaining access to systems during penetration testing. The concept of an exploit, its main types, and the distinction between a vulnerability and an exploit are examined. Approaches to obtaining access by exploiting different vulnerabilities, as well as the concept of payloads and their main types, are explained. The topic also examines the importance of conducting exploitation activities within a predefined scope and authorization framework, limiting potential impact on systems, and applying controlled exploitation principles in ethical penetration testing.

8. 8.
   Post-Exploitation PhaseMühazirə

   This topic covers the purpose and main principles of activities performed after initial access has been obtained during penetration testing. The assessment of the obtained access level, available privileges, and possible activities within the compromised system is examined. Key approaches related to privilege escalation, lateral movement within systems and networks, and credential acquisition are explained. The topic also examines the identification of broader business impacts resulting from technical access, as well as the potential impact on critical assets and organizational operations.

9. 9.
   Analysis of System Traces and Restoration of the Initial State After Penetration TestingMühazirə

   This topic covers the principles of analyzing activity traces generated in systems during penetration testing and restoring the environment to its original state after testing has been completed. The concept of logs, major log types, and digital traces generated in systems as a result of penetration testing activities are examined. The concepts of covering tracks and cleanup are distinguished in terms of their purpose, authorization, and application context. The importance of system traces from the perspectives of digital forensics and security auditing is explained. The removal of test accounts, files, configuration changes, and other test artifacts created during testing, as well as the restoration of modified system parameters and the overall environment to its pre-test state, are also examined.

10. 10.
    Penetration Testing ReportingMühazirə

    This topic covers the principles of systematically and professionally documenting the results of penetration tests. The main structure of a penetration testing report, as well as the purpose and content of the Executive Summary intended for management and the technical sections of the report, are examined. Approaches to classifying identified vulnerabilities and risks, determining their severity, and prioritizing remediation activities are explained. The preparation of practical and prioritized remediation recommendations and the principles of conducting retesting to verify the effectiveness of implemented corrective measures are also examined.

11. 11.
    Penetration Testing in Network EnvironmentsMühazirə

    This topic covers the principles of conducting penetration tests in network environments. The main components of network architecture, network segments, and their role from a security perspective are examined. The purpose, scope, and main differences between internal and external penetration testing are explained. The role of firewalls, Intrusion Detection Systems (IDS), and Intrusion Prevention Systems (IPS) in network protection and the evaluation of these security controls during penetration testing are examined. Common security risks in Active Directory environments, including misconfigurations and weak access controls, are also discussed.

12. 12.
    Penetration Testing of Web Applications and APIsMühazirə

    This topic covers the fundamental principles of conducting penetration tests on web applications and APIs. Web application architecture, attack surfaces, and approaches to security assessment are examined. Common web application vulnerabilities within the OWASP Top 10 framework, as well as security issues related to authentication and authorization mechanisms, are explained. Key risks associated with session management, session identifiers, and token-based authentication mechanisms, as well as their assessment during penetration testing, are also examined.

13. 13.
    Penetration Testing of IoT Infrastructure and Specialized EnvironmentsMühazirə

    This topic covers the fundamental principles of penetration testing in IoT infrastructures and specialized technological environments. The concept of the Internet of Things (IoT), the general architecture of IoT systems, and their main components are examined. Typical security vulnerabilities found in IoT devices, communication interfaces, network services, and application components are explained. The main characteristics of embedded systems and approaches to their security assessment are also examined. In addition, risks arising from default credentials, unchanged initial settings, and other insecure default configurations, as well as methods for identifying such risks during penetration testing, are discussed.

14. 14.
    Common Errors and Limitations in Penetration TestingMühazirə

    This topic covers common errors and major limitations encountered during the planning, execution, and evaluation of penetration tests. Typical issues such as improperly defined scope, incomplete information gathering, excessive reliance on automated tools, failure to validate false-positive and false-negative results, inadequate documentation of testing activities, and insufficient consideration of potential system impact are examined. The effects of time, resource, scope, technical capability, and legal constraints on penetration testing outcomes are explained. The principles of properly managing these limitations and objectively evaluating penetration testing results are also examined.

1. EC-Council. (2022). Certified Ethical Hacker (CEH) v13: Official Study Guide. Wiley.
2. Allen, J. (2021). The Hacker Playbook 3: Practical Guide to Penetration Testing. Secure Planet.
3. ENISA. (2021). Guidelines for Penetration Testing and Vulnerability Assessment. European Union Agency for Cybersecurity.
4. ISO/IEC. (2018). ISO/IEC 27001: Information Security Management Systems — Requirements. International Organization for Standardization.
5. Kennedy, D., O’Gorman, J., Kearns, D., & Aharoni, M. (2011). Metasploit: The Penetration Tester’s Guide. No Starch Press.
6. MITRE. (2023). ATT&CK Framework.
7. NIST. (2008). Special Publication 800-115: Technical Guide to Information Security Testing and Assessment. National Institute of Standards and Technology.
8. Stuttard, D., & Pinto, M. (2011). The Web Application Hacker’s Handbook: Finding and Exploiting Security Flaws. Wiley.
9. Weidman, G. (2014). Penetration Testing: A Hands-On Introduction to Hacking. No Starch Press.
10. PTES. (n.d.). Penetration Testing Execution Standard.