PENETRATION TESTINGTopics

This topic covers the nature, objectives, and key concepts of penetration testing, as well as its role in assessing the security of information systems. external and internal penetration tests and the black box, white box, and grey box approaches are studied. the stages of planning, reconnaissance, vulnerability discovery, validation of exploitability, analysis of results, and reporting are examined. the differences between penetration testing and vulnerability scanning, along with the core principles of security assessment, are also explained.

This topic covers the principles for conducting penetration tests lawfully, ethically, and safely. students learn about obtaining written authorization, defining scope, and agreeing on the testing period and permitted methods. the rules of engagement are used to examine permitted and prohibited activities, protection of confidential information, service continuity, and procedures for unexpected events. responsible disclosure of discovered vulnerabilities, professional ethics, and compliance with legal requirements are also considered.

This topic covers international methodologies and frameworks used to plan, conduct, and evaluate penetration tests. the main stages, objectives, and areas of application of ptes, osstmm, and NIST SP 800-115 are studied. the OWASP web security testing guide (wstg) is used to examine security testing of web applications, while the MITRE att&ck framework is used to analyze threat actors’ tactics and techniques. students develop skills in comparing methodologies, selecting an approach appropriate to a particular testing objective, and systematically documenting results.

This topic covers the technical knowledge required to conduct penetration tests in a safe, controlled laboratory environment. students learn to create virtual machines, configure virtual networks, save system snapshots, and isolate the laboratory environment. the main capabilities of kali linux, file and directory management, user permissions, processes, network settings, and basic linux command-line commands are examined. practical skills are also developed in installing testing tools, saving results, and restoring laboratory systems to their initial state.

This topic covers methods for gathering information from open sources and building an initial understanding of a target system. students examine domains, subdomains, IP addresses, public DNS records, technologies, certificates, and publicly available organizational information. the principles of using search engines, public registries, WHOIS data, and other OSINT sources are reviewed. verification of collected information, assessment of its reliability, and preparation of an initial attack-surface map are also covered. all activities must remain within the objectives and legal limits of an authorized assessment.

This topic covers active reconnaissance methods on authorized networks, host discovery, and identification of open ports. students learn how nmap works, how to check TCP and UDP ports, how to identify services at a preliminary level, and how to estimate the operating system. the selection of scan parameters, interpretation of results, and identification of network topology are examined. the effects of scanning on network performance, the operation of detection systems, and proper documentation of results are also considered. practical work is limited to authorized laboratory systems or test targets.

This topic covers methods for obtaining more detailed information about services operating on a network. students study the operation of smb, ftp, ssh, snmp, and http; service-version identification; configuration checks; and detection of potential security gaps. risks such as shared resources, anonymous access, insecure configurations, exposed information, and outdated software versions are analyzed. students also develop skills in relating enumeration results to vulnerability assessment and presenting findings in a security report.

This topic covers methods for identifying software, configuration, and architectural vulnerabilities in information systems and assessing their risk levels. students learn to use automated vulnerability scanners, manual verification methods, CVE identifiers, and vulnerability databases. under the common vulnerability scoring system (cvss), they assess exploit complexity, required privileges, user interaction, and potential impact. validation of scan results, identification of false positives, risk prioritization, and planning remediation measures are also examined.

This topic covers key concepts related to vulnerability exploitation and their use in penetration testing. students study concepts such as exploit, payload, module, and exploitation conditions, as well as the architecture and capabilities of the metasploit framework. they examine how to validate whether an identified vulnerability can be exploited in a safe laboratory environment, evaluate the results, and analyze possible effects on a system. the principles of maintaining system stability during testing, documenting exploitation activities, and using findings to develop defensive measures are also covered.

This topic covers the security characteristics of password-based authentication systems, how password hashes work, and the risks posed by weak passwords. the characteristics of md5, the SHA family, bcrypt, scrypt, and argon2 are studied, along with salting and mechanisms for increasing computational cost. differences between online password attacks and offline hash verification, as well as password guessing, brute-force, and dictionary attacks, are examined. defensive measures such as strong password policies, multi-factor authentication, account lockout, and rate limiting are evaluated.

This topic covers the fundamentals of web application security testing, common vulnerabilities, and methods for detecting them. risks covered by the OWASP top 10 include broken access control, insecure configurations, injection vulnerabilities, and other common issues. students learn to analyze http/https requests and responses using burp suite, examine application behavior, and conduct security tests. the causes and potential impact of SQL injection and cross-site scripting (xss), and how to test for them in a safe laboratory environment, are reviewed. defensive methods such as parameterized queries, input validation, contextual encoding, and content security policy are studied.

This topic covers the risks of privilege escalation resulting from improper user-permission management and weaknesses in system configuration. students study file and directory permissions, suid/sgid mechanisms, sudo configuration, services, scheduled tasks, and security issues associated with kernel versions. system configuration checks, vulnerability identification, and assessment of whether user privileges match actual needs are examined. defensive measures include applying the principle of least privilege, secure configuration, software updates, and system-log monitoring.

This topic covers permission management in windows, privilege-escalation risks, and security characteristics of active directory environments. user and group rights, service permissions, system configurations, authentication mechanisms, and the fundamentals of domain administration are studied. the roles of domains, user accounts, groups, group policy, and kerberos authentication in active directory are examined. students develop skills in identifying risks caused by misconfiguration and excessive privileges, limiting permissions, protecting accounts, and monitoring security events.

This topic examines risks that may arise within systems and networks after initial access has been obtained during a penetration test. persistence mechanisms, lateral movement, privilege expansion, and security implications of trust relationships between systems are studied. the possible impact of these techniques, their detectability, and the effectiveness of defensive systems are examined. clearing tracks is discussed in terms of understanding behaviors that make real attacks harder to detect and learning how to identify and prevent them. during practical work, system logs are not deleted and audit trails are preserved; changes are documented and the laboratory environment is safely restored after testing.

This topic covers organizing penetration-test findings, preparing technical and management-level reports, and recommending remediation for identified vulnerabilities. reports include the test scope, methodology, discovered vulnerabilities, risk levels, evidence, and potential impacts. students learn to prioritize vulnerabilities based on CVSS and business risk, define specific remediation actions, and assign responsibilities. practical skills are developed in verifying fixes through retesting, assessing residual risks, and documenting the system’s security posture again.