# Practical Ethical Hacking

## Networking Refresher

I used my own notes on these subjects, added some of Heaths notes.

[Networking](https://cybersec.th4ntis.com/networking) - [TCP, UDP, 3-Way Handshake](https://cybersec.th4ntis.com/networking/3-way-handshake) - [OSI Model](https://cybersec.th4ntis.com/networking/osi-model) - [Common Ports](https://cybersec.th4ntis.com/networking/common-ports-and-protocols) - [Subnetting](https://cybersec.th4ntis.com/networking/subnetting)

## Intro to Linux

### Lab Setup

The previous section was setting up Kali, [I've done this prior](https://cybersec.th4ntis.com/lab-setup/kali-vm) so I skipped this section.

I used the [pre-made VM](https://www.kali.org/get-kali/#kali-virtual-machines) (using [7-Zip](https://www.7-zip.org/download.html) to extract it) using the VMWare Pro software.

### Intro to Linux

[I've worked with Linux prior to this](https://cybersec.th4ntis.com/linux), so I have my own notes on these sections as well:

[Common Commands](https://cybersec.th4ntis.com/linux/common-commands) - [Permissions](https://cybersec.th4ntis.com/linux/permissions) - [Sudo](https://cybersec.th4ntis.com/linux/sudo) - [Files and File contents](https://cybersec.th4ntis.com/courses/pnpt/broken-reference)

### Scripting with Bash

{% file src="<https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2FY9MOhtDILE5f9BYNcfYz%2FScripting%20with%20Bash.pdf?alt=media&token=659dd3d7-e7ba-46d6-a6d5-9fa57b288492>" %}

## Intro to Python

{% file src="<https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2FZN7zmIqVhoKvExijesW4%2FIntro%20to%20Python.pdf?alt=media&token=f3985014-dde0-4bed-bb45-c221e06341f6>" %}

## The Ethical Hacker Methodology

{% file src="<https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2FBqzLt8dWQZmAbMtwLiRx%2FEthical%20Hacker%20Methodology.pdf?alt=media&token=89063e14-5784-450b-b5c5-7214d5be7018>" %}

## Information Gathering (Reconnaissance)

I have a section on [OSINT](https://cybersec.th4ntis.com/osint) and [OSINT tools/methods](https://cybersec.th4ntis.com/osint/osint-tools) here.

{% file src="<https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2F6rlFxmbVTXLa9vb0gRgz%2FInformation%20Gathering%20(Reconnaissance).pdf?alt=media&token=d67af5fb-a706-4ee3-b1fd-8aaced91dea3>" %}

## Scanning and Enumeration

As I have worked with these tools prior, I have other notes here as well.

[Nmap](https://cybersec.th4ntis.com/courses/pnpt/broken-reference) - [Dirb/Dirbuster](https://cybersec.th4ntis.com/courses/pnpt/broken-reference) - [GoBuster](https://cybersec.th4ntis.com/courses/pnpt/broken-reference) - [Metasploit](https://cybersec.th4ntis.com/courses/pnpt/broken-reference)

{% file src="<https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2FpkPrdQCPwRIJci5J329K%2FScanning%20and%20Enumeration.pdf?alt=media&token=4b22fb9c-a198-49b3-acf3-90080caff5c8>" %}

## Vuln Scanning with Nessus

As I have worked with Nessus prior, my notes in general can be found [here](https://cybersec.th4ntis.com/courses/pnpt/broken-reference).

{% file src="<https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2FjrIjflHfmS7Zn6VXxI0l%2FVulnerability%20Scanning%20with%20Nessus.pdf?alt=media&token=f5564a67-0d68-4fb4-80d2-bbf16ddc1191>" %}

## Exploitation Basics

{% file src="<https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2FQ5huY4juct3EL30Oorck%2FExploitation%20Basics.pdf?alt=media&token=4ce530a6-ddec-4b73-be4c-64625376e0e3>" %}

## New Capstone

{% file src="<https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2F9UzLBlHtpH8e9SsNJe4Z%2FCapstone%20-%20Blue.pdf?alt=media&token=8339c2c4-90cf-486d-82fb-e265d3562edb>" %}

{% file src="<https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2FTZtojGe8r9ahRnnuZKW0%2FCapstone%20-%20Academy.pdf?alt=media&token=e5b19dd2-3b6b-4121-9a88-be2b7eab1ea3>" %}

For Dev I did need to change the VM settings to NAT and run `dhclient` to get an IP.

{% file src="<https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2F8Nw1cvNZrdfGgweLZIP1%2FCapstone%20-%20Dev.pdf?alt=media&token=9d727800-5edc-4554-9983-3fd330db5d62>" %}

{% file src="<https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2FqfEMdmvv7ChjWKrYXqzk%2FCapstone%20-%20Butler.pdf?alt=media&token=32d091c2-dc16-4dd2-8cc9-50c5eabee719>" %}

For Black Pearl I did need to change the VM settings to NAT and run `dhclient` to get an IP.

{% file src="<https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2FAurDZPOttB8Zzgd9dr3v%2FCapstone%20-%20BlackPearl.pdf?alt=media&token=875f0fa2-9e16-4c9a-ae3b-1f0589889806>" %}

## Introduction to Exploit Development (Buffer Overflows)

{% file src="<https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2FJpauhwJC5qTEujzc3ojE%2FIntroduction%20to%20Exploit%20Development%20(Buffer%20Overflows).pdf?alt=media&token=50bbad02-3353-4950-98fc-2a8691d77178>" %}

## Active Directory Overview

{% file src="<https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2FWFhte0NH5Uczg8BbD4Rb%2FActive%20Directory(AD)%20Overview.pdf?alt=media&token=0765df7e-fb00-4c21-96b9-82e1386630a9>" %}

For their lab you will need roughly:

* 1x Win Server
* 2x Windows Workstations
* 60GB Disk Space
* 16GB RAM

There is a Cloud Alternative by Kamran Bilgrami that can be found here: [Building Free Active Directory Lab in Azure](https://kamran-bilgrami.medium.com/ethical-hacking-lessons-building-free-active-directory-lab-in-azure-6c67a7eddd7f)

I have done this in the past so my notes and setup can be found: [Lab Setup](https://cybersec.th4ntis.com/lab-setup)

[Windows Server VM](https://cybersec.th4ntis.com/lab-setup/windows-server-vm) - [Windows User VM](https://cybersec.th4ntis.com/lab-setup/windows-user-vm)

## Attacking AD: Initial Attack Vectors

{% file src="<https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2FkKF1VAr4zuxD3PMV5qY4%2FAttacking%20AD_%20Initial%20Attack%20Vectors.pdf?alt=media&token=3717cdaa-5bbe-4ecf-a7df-ac8b815add2b>" %}

## Attacking Active Directory: Post-Compromise Enumeration

{% file src="<https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2F8X9bwJJwHQz0bW1vtgmW%2FAttacking%20Active%20Directory_%20Post-Compromise%20Enumeration.pdf?alt=media&token=88a9ca53-2b29-4973-8035-377590f65ccb>" %}

## Attacking Active Directory: Post-Compromise Attacks

{% file src="<https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2FcSjXTdA8rBT8mXcldZim%2FAttacking%20Active%20Directory_%20Post-Compromise%20Attacks.pdf?alt=media&token=95a586e6-80ae-4529-8057-9ef6ad48f590>" %}

## We've Compromised the Domain - Now What?

{% file src="<https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2FMDnmTQpxqrc2XynlltPb%2FWe_ve%20Compromised%20the%20Domain%20-%20Now%20What_.pdf?alt=media&token=006a511a-287f-465e-aefd-f8f791d30174>" %}

## Additional Active Directory Attacks

{% file src="<https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2FB17XJQYtRsOToM3lh7dC%2FAdditional%20AD%20Attacks.pdf?alt=media&token=ec6b152d-05eb-470f-83a0-bf630a6b1133>" %}

## Active Directory Case Studies

He goes over Blog posts about case studies about pentests.

* [You spent how much on security?](https://tcm-sec.com/pentest-tales-001-you-spent-how-much-on-security/)
* [Digging Deep](https://tcm-sec.com/pentest-tales-002-digging-deep)

## Post Exploitation

{% file src="<https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2FW19VkVSAgvQmP33XLHOk%2FPost%20Exploitation.pdf?alt=media&token=918fb059-7131-44e8-bb19-f2b4a37089d3>" %}

## Web Application Enumeration, Revisited

{% file src="<https://667808901-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FTdW22AGCceN8oUXfdlKI%2Fuploads%2FsrOGU9JXXQkNzOWTg771%2FWeb%20Application%20Enumeration%2C%20Revisited.pdf?alt=media&token=52ff59c3-327f-4fb2-9384-94d18ab4b1b1>" %}

## Find & Exploit Common Web Vulnerabilities

COMING SOON