PENETRATION TESTING

Fənnin təsviri

This course provides students with theoretical knowledge and practical skills in penetration testing, vulnerability assessment, and security evaluation of information systems. It covers the fundamental concepts, types, stages, and methodologies of penetration testing, as well as the legal and ethical requirements governing authorized security assessments. Students learn to gather information using open-source intelligence (OSINT) and active reconnaissance techniques, identify hosts and open ports, enumerate network services, and detect and prioritize vulnerabilities using the Common Vulnerability Scoring System (CVSS). The course also examines vulnerability exploitation in controlled laboratory environments, password security and attack techniques, web application security testing, and privilege escalation in Linux and Windows systems, including Active Directory environments. Students are introduced to tools such as Kali Linux, Nmap, Metasploit Framework, and Burp Suite, as well as security testing methodologies and frameworks including PTES, OSSTMM, NIST SP 800-115, OWASP WSTG, and MITRE ATT&CK. Emphasis is placed on safe testing practices, evidence collection, professional report writing, remediation recommendations, and retesting to verify corrective measures. Upon completion, students will be able to conduct authorized penetration tests, analyze security weaknesses, assess risks, and recommend appropriate measures to improve the security of information systems.

Fənn təlim nəticələri

1. 1

   CLO 1: Explains the types and stages of penetration testing and its legal and ethical framework.

2. 2

   CLO 2: Collects information about a target system using open sources and active scanning tools.

3. 3

   CLO 3: Analyzes identified vulnerabilities and prioritizes them using CVSS.

4. 4

   CLO 4: Exploits vulnerabilities and escalates privileges in a controlled laboratory environment.

5. 5

   CLO 5: Prepares and presents the test results in a professional report.