Course Description
Course contents
Day 1
- MITRE ATT&CK framework
- Overview on using the in-LAB SIEM
- Offensive OSINT
- IPv6 discovery, enumeration and exploitation
- Pivoting, routing, tunnelling and SOCKS proxies
- Application enumeration and exploitation via pivots
- Linux living off the land and post exploitation
- C2 infrastructure and beacon deployment
- Exploitative phishing against our simulated enterprise users
Day 2
- Living off the land tricks and techniques in Windows
- P@ssw0rd and p@ssphras3 cracking
- Windows exploitation and privilege escalation techniques
- Windows Defender/AMSI and UAC bypasses
- Credential harvesting
- Situational awareness and domain reconnaissance
Day 3:
- Bypassing AWL (AppLocker, PowerShell CLM and Group Policy)
- Extracting LAPS secrets
- Active Directory Certificate Services (AD CS) abuse
- Lateral movement for domain trust exploitation
- WMI Event Subscriptions for persistence
- Out of Band (OOB) data exfiltration
- Domain Fronting
Target audience
This training is suited to a variety of students, including:
- Penetration testers / Red Team operators
- SOC analysts
- Security professionals
- IT Support, administrative and network personnel
why attend
We teach practical hands-on knowledge and skills that can be used in the field, not classroom theory to pass an exam. Our Windows clients are kept up to date (Windows 11) and have up to date malware definitions, so we’ll be covering techniques that work today rather than ones that worked years ago. Our in-lab SIEM also allows students to view the evidence and logs of their self-generated attacks, providing deeper insight into how their movements may be logged.
Requirements
- A firm familiarity of Windows and Linux command line syntax
- Understanding of networking concepts
- Previous pentesting and/or SOC experience is advantageous, but not required
Hardware/Software Requirements
- Students will need to bring a laptop to which they have administrative/root access, running either Windows, Linux or Mac operating systems
- Students will need to have access to VNC, RDP, SSH and OpenVPN clients on their laptop
Trainers Biography
Will Hunt has been in infosec for over 15 years, co-founded In.security in 2018 and as a pentester has helped secure many organisations through technical security services and training. Will’s delivered hacking courses globally at several conferences including Black Hat and has spoken at several conferences and events. Will also assists the UK government in various technical, educational and advisory capacities. Before Will was a security consultant he was an experienced digital forensics consultant and trainer.
Twitter : @Stealthsploit
Owen Shearing is a co-founder of In.security, a specialist cyber security consultancy offering technical and training services based in the UK. He has a strong background in networking and IT infrastructure, with well over a decade of experience in technical security roles. Owen has provided technical training to a variety of audiences at bespoke events as well as Black Hat, Wild West Hackin’Fest, NolaCon, 44CON, TROOPERS, BruCON and Hack in Paris. He keeps projects att https://github.com/rebootuser.
Twitter : @rebootuser