Fundamentals of penetration testingSyllabus

Subject code

İF-2212y

Credits

8

Student workload

165

Semester

Spring semester

Academic year

3

Subject type

Mandatory

Form of education

Full-time

Language of instruction

Azerbaijani

In-class hours

a) 30 saat - mühazirə b) 15 saat - seminar c) 30 saat - laboratoriya

Out-of-class hours

a) 70 saat - TSİ b) 50 saat - MRTSİ

The subject provides students with the formation of theoretical knowledge and practical skills in planning, preparation and implementation of penetration tests. within the subject, the main concepts, legal and ethical frameworks, methodologies and stages of penetration testing are studied. students are introduced to approaches to actively and passively gather information about information systems and network environments, identify existing vulnerabilities, and assess risks posed by them. implementation of conventional attack scenarios in laboratory conditions, controlled testing of discovered vulnerabilities, enhancement of capabilities and possible impact assessment are considered. it also examines the basic principles of penetration testing in network infrastructure, web applications, iot, and other technical environments. the subject is aimed at developing students' skills to analytically evaluate potential threat and attack scenarios, identify key risk factors, prepare recommendations for appropriate security measures, and report the results of penetration tests in a professional manner.

• lecture
• laboratory work
• problem-based learning
• interactive discussion
• seminar
• presentations
• case study

1. 1

   CLO 1: You will be introduced to the principles and techniques of penetration testing.

2. 2

   CLO 2: You will learn the stages of penetration testing.

3. 3

   CLO 3: You will get acquainted with active and passive data collection methods.

4. 4

   CLO 4: You will learn how to detect, exploit, measure risk, and propose ways to prevent security vulnerabilities for a given target.

5. 5

   CLO 5: You will be introduced to the tools used during penetration testing.

6. 6

   CLO 6: You will gain knowledge about preparing a professional report based on the results of the penetration test.

1. 1.
   Introduction to penetration testingLecture

   Within the scope of the topic, the essence, purpose and role of penetration tests in ensuring information security are studied. the importance of penetration testing in identifying existing vulnerabilities in information systems, verifying the effectiveness of security controls, and assessing the possible impact of potential attacks is considered. key differences and application areas of penetration testing from other security assessment approaches are explained. also, the historical development of the hacker culture, the main stages affecting the formation of this culture and the emergence of the concept of ethical hacking are examined.

2. 2.
   Ethical issues in penetration testingLecture

   Ethical, legal and professional principles to be considered during the implementation of penetration tests are studied within the subject. ethical norms, professional responsibility and the basic requirements of authorized safety tests are reviewed. the concepts of white hat, black hat and gray hat are distinguished in terms of activity purpose, permission and legal responsibility. the relevant provisions of national legislation and the criminal code, as well as the role of international conventions and regulatory documents, are explained regarding cybercrimes and unauthorized access to information systems. it also examines the importance of security policies in determining the scope of penetration testing, permitted activities, and party responsibilities.

3. 3.
   Methodological approaches, standards and frameworks in penetration testingLecture

   The main methodologies, standards and frameworks used for systematic planning and implementation of penetration tests are studied within the subject. the main stages of the penetration testing life cycle and the general approach of the CEH methodology are reviewed. the MITER att&ck framework, ptes, NIST SP 800-115, iso/iec 27001, and OWASP testing guide documents explain the purpose, scope, and application characteristics of penetration testing. the approaches of different methodologies and standards are comparatively analyzed. it also explores the principles of vulnerability identification, classification, and severity assessment through the CVE system and CVSS scoring mechanism.

4. 4.
   Threat modeling in penetration testingLecture

   Within the framework of the topic, the essence, purpose and application principles of threat modeling in penetration tests are studied. issues of systematic identification and assessment of potential threats to information systems, attack surfaces and possible attack scenarios are considered. the main methods used in threat modeling and their applicability to different systems and applications are explained. analysis of threats, attack paths and risks identified as a result of modeling, their prioritization and use in planning penetration tests are also investigated.

5. 5.
   Gathering information about the targetLecture

   Within the scope of the topic, the essence, purpose and main approaches of gathering information about the target in penetration tests are studied. passive and active information gathering methods, their characteristics and differences during application are reviewed. principles of obtaining information about a target organization, system, and infrastructure through open source intelligence (osint) approaches are explained. the collection of domains, IP addresses, DNS records, and other technical data, as well as the role of human factors and open sources in the information collection process, are examined.

6. 6.
   Scanning and analysis phaseLecture

   The purpose and main activities of the scanning and analysis phase of penetration testing are studied within the subject. methods for determining open ports, active services and their versions on target systems are reviewed. approaches to identifying existing vulnerabilities in detected systems and services through automated tools and manual analysis are explained. false positives and false negatives in scan and vulnerability assessment results, their causes and the importance of correct verification of results are also investigated.

7. 7.
   Controlled exploitation scenarios and access mechanismsLecture

   Within the framework of the topic, the main principles of the stage of controlled checking of vulnerabilities found in penetration tests and gaining access to the system are studied. the concept of an exploit, its main types and the difference between a vulnerability and an exploit are reviewed. approaches to gain access using various vulnerabilities are explained, as well as the concept of payload and its main types. it also explores the principles of controlled exploitation in ethical penetration testing, implementation of exploitation activities within the framework of pre-defined scope and permissions, limitation of possible impact on the system.

8. 8.
   Post-entry stageLecture

   Within the framework of the topic, the purpose and basic principles of the activities carried out after obtaining the initial access in penetration tests are studied. an assessment of the level of access achieved, the powers available and the possibilities for action within the system is considered. basic approaches related to privilege escalation, lateral movement to other resources within the system and network, and access credentials are explained. it also examines the issues of determining the broader business impact from the technical results of the access gained, assessing the possible impact on critical assets and the organization's operations.

9. 9.
   System trace analysis and recovery after a penetration test activityLecture

   Within the framework of the subject, the principles of analysis of traces of activity created in systems during penetration tests and returning the environment to its initial state after the test is completed are studied. the concept of logging, the main types of logs, and the digital footprints created on systems as a result of penetration activity are reviewed. the concepts of covering tracks and cleanup are distinguished in terms of purpose, permission and application context. the importance of system traces in terms of digital forensics and security auditing is explained. it also examines the issues of removing accounts, files, configuration changes and other test artifacts created during the test, restoring changed system parameters, and returning the system to its previous state after the pentest.

10. 10.
    Preparation of reports on penetration testsLecture

    The principles of documenting the results of penetration tests in a systematic and professional form are studied within the subject. the basic structure of the pentest report, the purpose and content of the executive summary and technical sections intended for the management level are reviewed. approaches for classifying identified vulnerabilities and risks, determining severity and prioritization are explained. also, the principles of preparing practical and prioritized remediation recommendations for eliminating the identified problems, retesting for the purpose of checking the effectiveness of the corrections are investigated.

11. 11.
    Penetration testing in network environmentsLecture

    Within the subject, the principles of conducting penetration tests in network environments are studied. the main components of the network architecture, network segments and their role in terms of security are considered. the purpose, scope and key differences between internal and external penetration testing are explained. the role of firewall, ids, and IPS systems in network protection and the evaluation of these security controls during penetration testing are explored. also reviewed are misconfigurations, weak access controls, and other key security risks that may exist in active directory environments.

12. 12.
    Penetration testing of web applications and apisLecture

    The basic principles of penetration testing in web applications and apis are studied within the subject. web application architecture, attack surface, and security evaluation approaches are reviewed. the OWASP top 10 describes common web application vulnerabilities as well as security issues in authentication and authorization mechanisms. it also examines key risks associated with session management, session identifiers, and token-based authentication mechanisms and their assessment during penetration testing.

13. 13.
    Iot infrastructure and penetration testing in specific environmentsLecture

    Within the framework of the topic, the basic principles of penetration testing in iot infrastructures and special technological environments are studied. the concept of iot, the general architecture and main components of these systems are reviewed. typical security vulnerabilities found in iot devices, communication interfaces, network services, and application components are explained. the main features of embedded systems and their security evaluation approaches are examined. it also reviews the risks posed by default user data, unmodified default settings, and other unsafe default configurations and how to identify them during penetration testing.

14. 14.
    Typical mistakes and limitations encountered during penetration testingLecture

    Within the framework of the topic, typical errors and main limitations encountered during the planning, execution and evaluation of results of penetration tests are studied. typical errors such as improper scoping, incomplete information collection, overreliance on the results of automated tools, failure to check for false positives and false negatives, failure to document test activities, and failure to consider possible impact on systems are reviewed. the impact of time, resource, scope, technical capabilities, and legal constraints on the results of penetration testing is explained. the principles of proper management of these limitations and objective evaluation of test results are also explored.

1. Ec-council. (2022). certified ethical hacker (ceh) v13: official study guide. wiley.
2. Allen, j. (2021). the hacker playbook 3: practical guide to penetration testing. secure planet.
3. Enisa. (2021). guidelines for penetration testing and vulnerability assessment. european union agency for cybersecurity.
4. Iso/iec. (2018). iso/iec 27001: information security management systems — requirements. international organization for standardization.
5. Kennedy, d., o’gorman, j., kearns, d., & aharoni, m. (2011). metasploit: the penetration tester's guide. no starch press.
6. Miter. (2023). att&ck framework.
7. Nist. (2008). special publication 800-115: technical guide to information security testing and assessment. national institute of standards and technology.
8. Stuttard, d., & pinto, m. (2011). the web application hacker's handbook: finding and exploiting security flaws. wiley.
9. Weidman, g. (2014). penetration testing: a hands-on introduction to hacking. no starch press.
10. Ptes. (n.d.). penetration testing execution standard.