We provide virtual course about Full-Stack Pentesting Laboratory: 100% Hands-On + Lifetime LAB Access in english. Modern IT systems are increasingly complex, making full-stack expertise more essential than ever.
Course description:
That's why diving into full-stack pentesting is crucial - you will gain the skills needed to master modern attack vectors and implement effective defensive countermeasures. For each attack, vulnerability and technique presented in this training, there is a lab exercise to help you develop your skills step by step.
What's more, when the training is over, you can take the complete lab environment home to hack again at your own pace. The instructor has found security bugs in many companies including Google, Yahoo, Mozilla, Twitter and in this training he´ll share his experience with you.
Course outline:
Day 1:
Module 1 - Hacking cloud applications (90 minutes):
• Amazon S3: directory listing via AWS CLI tool
• Amazon S3: bruteforcing buckets
• Amazon S3: bruteforcing objects in a given bucket
• Amazon EC2: reading the SecretAccessKey (3 techniques)
• Bypassing Cloudflare firewall
Module 2 - API hacking tips & tricks (60 minutes):
• API hacking with X-HTTP-Method-Override:
• API hacking with X-Override-URL:
• API hacking with callback
• API hacking with JSON enforcement (in request)
• API hacking with JSON enforcement (in response)
Module 3 - OSINT asset discovery tools (60 minutes):
• Subdomain enumeration with dnscan and amass
• Subdomain enumeration with Certificate Transparency log
• Subdomain enumeration with SubDomainizer
• Domain enumeration with nerdydata.com
• Top-level domain enumeration with dnscan
Module 4 - Hacking with special characters (45 minutes):
• Visual impersonation with ASCII control characters
• Visual impersonation with Unicode control characters
• XSS via response splitting
Module 5 - XML attacks (45 minutes):
• XML External Entity attack (XXE)
• XML XInclude attack
• XSS via XML
Module 6 - Server-side template injection (SSTI) (60 minutes):
• RCE via template injection in PHP Smarty
• RCE via template injection in Python Jinja
• RCE via template injection in Java FreeMarker
Module 7 - Hacking git repos (45 minutes):
• Gitleaks (finding sensitive data based on regular expressions)
• Trufflehog (finding sensitive data based on entropy checking)
• Dumping git repo with git-dumper
• Finding sensitive data in git commit history
Day 2:
Module 8 - Google hacking techniques (45 minutes):
• Finding directory listings and backup files
• Finding SQL syntax errors
• Finding URLs with API keys
• Finding internal server errors
• Finding insecure HTTP web pages
Module 9 - Automated SQL injection detection and exploitation (45 minutes):
• Sqlmap: full test case coverage, dumping database table entries
• Sqlmap: installing a backdoor (from SQL injection to remote code execution)
• Sqlmap: bypassing web application firewalls with tamperscripts
Module 10 - File read attacks (60 minutes):
• Alternate Data Streams notation
• 8dot3 notation
• Windows NTFS (2 techniques)
Module 11 - Data exfiltration tools and techniques (90 minutes):
• DNS exfiltration using dnscat2
• ICMP exfiltration using Data Exfiltration Toolkit
• Text-based steganography using cloakify
• Image-based steganography exfiltration using LSBSteg
• Video-based steganography using CCVS
Module 12 - GitHub hacking techniques (45 minutes):
• Web config files
• Database config files
• Private keys
• IDE config files
• Amazon AWS keys
Module 13 - Non-standard XSS attacks (30 minutes):
• XSS attack with two slashes
• XSS via URL
Module 14 - Smart password cracking with hashcat (45 minutes):
• Cracking NTLM password
• Cracking password-protected PDF document
• Benchmarking
Module 15 - Other tools and techniques (45 minutes):
• Retire.js: finding JavaScript libraries with known vulnerabilities
• Extracting passwords with LaZagne
• NTLM hash hijacking with Responder
Day 3:
Module 16 - File upload attacks (45 minutes):
• Via .htaccess
• Via SVG file
• Via AddHandler
Module 17 - CLI hacking scripts (60 minutes):
• Using waybackurls
• Using photon
• Using nmap + nikto
• Nmap vs. masscan
Module 18 - Hacking with wrappers (60 minutes):
• RCE with data: wrapper
• RCE with php://input wrapper
• RCE with zip: wrapper
Module 19 - NoSQL injection detection and exploitation (45 minutes):
• Elasticsearch
• MongoDB
• CouchDB
Module 20 - Bypassing restrictions (60 minutes):
• With X-Forwarded-For:
• With Forwarded:
• With IP address
• With hex encoding in JavaScript
Module 21 - Modern full-stack web attacks (45 minutes):
• HTTP parameter pollution
• Web cache deception attack
Module 22 - Hacking Electron applications (45 minutes):
• From XSS to RCE
• From insecure framing to RCE
Module 23 - Miscellaneous (45 minutes):
• Finding metadata with exiftool
• Reverse shell connection with ShellPop
• XSS polyglot
Key takeaways:
After completing this training, you will have learned about:
• Hacking cloud applications
• API hacking tips & tricks
• Data exfiltration techniques
• OSINT asset discovery tools
• Tricky user impersonation
• Bypassing protection mechanisms
• CLI hacking scripts
• Interesting XSS attacks
• Server-side template injection
• Hacking with Google & GitHub search engines
• Automated SQL injection detection and exploitation
• File read & file upload attacks
• Password cracking in a smart way
• Hacking Git repos
• XML attacks
• NoSQL injection
• HTTP parameter pollution
• Web cache deception attack
• Hacking with wrappers
• Finding metadata with sensitive information
• Hijacking NTLM hashes
• Automated detection of JavaScript libraries with known vulnerabilities
• Extracting passwords
• Hacking Electron applications
• Establishing reverse shell connections
• RCE attacks
• XSS polyglot
Instructor: Dawid Czagan
Dawid Czagan is an internationally recognized security researcher and trainer. He is listed among top hackers at HackerOne. Dawid Czagan has found security bugs in Apple, Google, Mozilla, Microsoft and many others. Due to the severity of many bugs, he received numerous awards for his findings. Dawid Czagan shares his offensive security experience in his hands-on trainings.
He delivered trainings at key industry conferences such as DEF CON (Las Vegas), OWASP Global AppSec EU (Barcelona), Hack In The Box (Amsterdam), CanSecWest (Vancouver), 44CON (London), Hack In Paris (Paris), NorthSec (Montreal), HITB GSEC (Singapore), BruCON (Ghent) and for many corporate clients. His students include security specialists from Oracle, Adobe, ESET, ING, Red Hat, Trend Micro, Philips and government sector (references are attached to Dawid Czagan's LinkedIn profile
Target audience:
Penetration testers, ethical hackers, red and blue team members, SOC analysts, software developers, software testers, security engineers and security consultants.
Prerequisites:
• To get the most of this training intermediate knowledge of web application security is needed. Students should have experience in using a proxy, such as Burp Suite Proxy or Zed Attack Proxy (ZAP), to analyze or modify the traffic.
Language:
• English course material and english speaking instructor
Course material:
The course fee includes digital course documentation, VMware-image lab environment, access to 6 online courses, assignments.