PENETRATION TESTINGSyllabus

Subject code

MS-1403-EN

Credits

6

Student workload

135

Semester

Autumn semester

Academic year

2

Subject type

Mandatory

Form of education

Full-time

Language of instruction

English

In-class hours

30 hours lecture 15 hour seminar

Out-of-class hours

60 hours individual work

This course provides students with theoretical knowledge and practical skills in penetration testing, vulnerability assessment, and security evaluation of information systems. It covers the fundamental concepts, types, stages, and methodologies of penetration testing, as well as the legal and ethical requirements governing authorized security assessments. Students learn to gather information using open-source intelligence (OSINT) and active reconnaissance techniques, identify hosts and open ports, enumerate network services, and detect and prioritize vulnerabilities using the Common Vulnerability Scoring System (CVSS). The course also examines vulnerability exploitation in controlled laboratory environments, password security and attack techniques, web application security testing, and privilege escalation in Linux and Windows systems, including Active Directory environments. Students are introduced to tools such as Kali Linux, Nmap, Metasploit Framework, and Burp Suite, as well as security testing methodologies and frameworks including PTES, OSSTMM, NIST SP 800-115, OWASP WSTG, and MITRE ATT&CK. Emphasis is placed on safe testing practices, evidence collection, professional report writing, remediation recommendations, and retesting to verify corrective measures. Upon completion, students will be able to conduct authorized penetration tests, analyze security weaknesses, assess risks, and recommend appropriate measures to improve the security of information systems.

• lecture
• seminar
• interactive discussion
• project-based learning
• presentations
• teamwork

1. 1

   CLO 1: Explains the types and stages of penetration testing and its legal and ethical framework.

2. 2

   CLO 2: Collects information about a target system using open sources and active scanning tools.

3. 3

   CLO 3: Analyzes identified vulnerabilities and prioritizes them using cvss.

4. 4

   CLO 4: Exploits vulnerabilities and escalates privileges in a controlled laboratory environment.

5. 5

   CLO 5: Prepares and presents the test results in a professional report.

1. 1.
   Introduction to penetration testing: concepts, types, and stagesLecture

   This topic covers the nature, objectives, and key concepts of penetration testing, as well as its role in assessing the security of information systems. external and internal penetration tests and the black box, white box, and grey box approaches are studied. the stages of planning, reconnaissance, vulnerability discovery, validation of exploitability, analysis of results, and reporting are examined. the differences between penetration testing and vulnerability scanning, along with the core principles of security assessment, are also explained.

2. 2.
   Legal and ethical foundations of penetration testing; rules of engagementLecture

   This topic covers the principles for conducting penetration tests lawfully, ethically, and safely. students learn about obtaining written authorization, defining scope, and agreeing on the testing period and permitted methods. the rules of engagement are used to examine permitted and prohibited activities, protection of confidential information, service continuity, and procedures for unexpected events. responsible disclosure of discovered vulnerabilities, professional ethics, and compliance with legal requirements are also considered.

3. 3.
   . methodologies and standards: ptes, osstmm, NIST SP 800-115, OWASP wstg, and MITRE att&ckLecture

   This topic covers international methodologies and frameworks used to plan, conduct, and evaluate penetration tests. the main stages, objectives, and areas of application of ptes, osstmm, and NIST SP 800-115 are studied. the OWASP web security testing guide (wstg) is used to examine security testing of web applications, while the MITRE att&ck framework is used to analyze threat actors’ tactics and techniques. students develop skills in comparing methodologies, selecting an approach appropriate to a particular testing objective, and systematically documenting results.

4. 4.
   Laboratory environment: virtualization, kali linux, and linux command-line fundamentalsLecture

   This topic covers the technical knowledge required to conduct penetration tests in a safe, controlled laboratory environment. students learn to create virtual machines, configure virtual networks, save system snapshots, and isolate the laboratory environment. the main capabilities of kali linux, file and directory management, user permissions, processes, network settings, and basic linux command-line commands are examined. practical skills are also developed in installing testing tools, saving results, and restoring laboratory systems to their initial state.

5. 5.
   Passive reconnaissance and open-source intelligence (osint)Lecture

   This topic covers methods for gathering information from open sources and building an initial understanding of a target system. students examine domains, subdomains, IP addresses, public DNS records, technologies, certificates, and publicly available organizational information. the principles of using search engines, public registries, WHOIS data, and other OSINT sources are reviewed. verification of collected information, assessment of its reliability, and preparation of an initial attack-surface map are also covered. all activities must remain within the objectives and legal limits of an authorized assessment.

6. 6.
   Active reconnaissance: host discovery and port scanning with nmapLecture

   This topic covers active reconnaissance methods on authorized networks, host discovery, and identification of open ports. students learn how nmap works, how to check TCP and UDP ports, how to identify services at a preliminary level, and how to estimate the operating system. the selection of scan parameters, interpretation of results, and identification of network topology are examined. the effects of scanning on network performance, the operation of detection systems, and proper documentation of results are also considered. practical work is limited to authorized laboratory systems or test targets.

7. 7.
   Service enumeration: smb, ftp, ssh, snmp, and HTTPLecture

   This topic covers methods for obtaining more detailed information about services operating on a network. students study the operation of smb, ftp, ssh, snmp, and http; service-version identification; configuration checks; and detection of potential security gaps. risks such as shared resources, anonymous access, insecure configurations, exposed information, and outdated software versions are analyzed. students also develop skills in relating enumeration results to vulnerability assessment and presenting findings in a security report.

8. 8.
   Vulnerability discovery and cvss-based assessmentLecture

   This topic covers methods for identifying software, configuration, and architectural vulnerabilities in information systems and assessing their risk levels. students learn to use automated vulnerability scanners, manual verification methods, CVE identifiers, and vulnerability databases. under the common vulnerability scoring system (cvss), they assess exploit complexity, required privileges, user interaction, and potential impact. validation of scan results, identification of false positives, risk prioritization, and planning remediation measures are also examined.

9. 9.
   Fundamentals of exploitation: metasploit framework, exploit, and payload conceptsLecture

   This topic covers key concepts related to vulnerability exploitation and their use in penetration testing. students study concepts such as exploit, payload, module, and exploitation conditions, as well as the architecture and capabilities of the metasploit framework. they examine how to validate whether an identified vulnerability can be exploited in a safe laboratory environment, evaluate the results, and analyze possible effects on a system. the principles of maintaining system stability during testing, documenting exploitation activities, and using findings to develop defensive measures are also covered.

10. 10.
    Password attacks: hash types, online and offline attacksLecture

    This topic covers the security characteristics of password-based authentication systems, how password hashes work, and the risks posed by weak passwords. the characteristics of md5, the SHA family, bcrypt, scrypt, and argon2 are studied, along with salting and mechanisms for increasing computational cost. differences between online password attacks and offline hash verification, as well as password guessing, brute-force, and dictionary attacks, are examined. defensive measures such as strong password policies, multi-factor authentication, account lockout, and rate limiting are evaluated.

11. 11.
    Introduction to web application testing: OWASP top 10, burp suite, SQL injection, and XSSLecture

    This topic covers the fundamentals of web application security testing, common vulnerabilities, and methods for detecting them. risks covered by the OWASP top 10 include broken access control, insecure configurations, injection vulnerabilities, and other common issues. students learn to analyze http/https requests and responses using burp suite, examine application behavior, and conduct security tests. the causes and potential impact of SQL injection and cross-site scripting (xss), and how to test for them in a safe laboratory environment, are reviewed. defensive methods such as parameterized queries, input validation, contextual encoding, and content security policy are studied.

12. 12.
    Privilege escalation in linux systemsLecture

    This topic covers the risks of privilege escalation resulting from improper user-permission management and weaknesses in system configuration. students study file and directory permissions, suid/sgid mechanisms, sudo configuration, services, scheduled tasks, and security issues associated with kernel versions. system configuration checks, vulnerability identification, and assessment of whether user privileges match actual needs are examined. defensive measures include applying the principle of least privilege, secure configuration, software updates, and system-log monitoring.

13. 13.
    Privilege escalation in windows systems and introduction to active directoryLecture

    This topic covers permission management in windows, privilege-escalation risks, and security characteristics of active directory environments. user and group rights, service permissions, system configurations, authentication mechanisms, and the fundamentals of domain administration are studied. the roles of domains, user accounts, groups, group policy, and kerberos authentication in active directory are examined. students develop skills in identifying risks caused by misconfiguration and excessive privileges, limiting permissions, protecting accounts, and monitoring security events.

14. 14.
    Post-exploitation: persistence, lateral movement, and clearing tracksLecture

    This topic examines risks that may arise within systems and networks after initial access has been obtained during a penetration test. persistence mechanisms, lateral movement, privilege expansion, and security implications of trust relationships between systems are studied. the possible impact of these techniques, their detectability, and the effectiveness of defensive systems are examined. clearing tracks is discussed in terms of understanding behaviors that make real attacks harder to detect and learning how to identify and prevent them. during practical work, system logs are not deleted and audit trails are preserved; changes are documented and the laboratory environment is safely restored after testing.

15. 15.
    Report preparation, remediation recommendations, and retestingLecture

    This topic covers organizing penetration-test findings, preparing technical and management-level reports, and recommending remediation for identified vulnerabilities. reports include the test scope, methodology, discovered vulnerabilities, risk levels, evidence, and potential impacts. students learn to prioritize vulnerabilities based on CVSS and business risk, define specific remediation actions, and assign responsibilities. practical skills are developed in verifying fixes through retesting, assessing residual risks, and documenting the system’s security posture again.

1. Georgia weidman. penetration testing: a hands-on introduction to hacking. no starch press, 2014.
2. Patrick engebretson. the basics of hacking and penetration testing, 2nd edition. syngress, 2013.
3. Peter kim. the hacker playbook 3: practical guide to penetration testing. secure planet, 2018.
4. Daniel g. graham. ethical hacking: a hands-on introduction to breaking in. no starch press, 2021.
5. Gordon fyodor lyon. nmap network scanning. insecure.com llc, 2009.
6. Dafydd stuttard and marcus pinto. the web application hacker’s handbook, 2nd edition. wiley, 2011.