Wrap-up and resources
Key Takeaways
- 1. The penetration testing method: permission, scope and the report: A test starts with a signed paper and ends with a report, with organised phases in between. A tester's value is not the number of flaws but how clearly each one's risk and fix are explained, ranked by their effect on the business.
- 2. Testing web apps in the lab: the proxy, permissions and injection: Always test the web with a proxy and two accounts: most serious flaws today are permissions the server never checks. Injection is stopped by keeping data apart from commands, not by cleaning input. And every flaw you find should end in an automatic test that fails if it returns.
- 3. Active Directory and identity: attack paths and how to close them: An attacker in AD is not after a flaw but a path: from an ordinary account to domain admin through forgotten rights and sessions. Cut the paths with tiering (domain admins sign in only to tier-zero machines), unique passwords with LAPS, gMSA service accounts, watch 4769 and 4662, and map your own paths before the attacker does.
Glossary
| Term | Definition | Part |
|---|---|---|
| Rules of engagement | Scope, window, prohibitions and emergency contacts, written and signed. | 1 |
| Grey box | A test with partial information such as an ordinary account. | 1 |
| CVSS 4.0 | A technical severity score from 0 to 10 by FIRST. | 1 |
| Intercepting proxy | A tool between browser and server that captures and edits requests (Burp, ZAP). | 2 |
| IDOR | Reaching someone else's object by changing its ID because the server skips the ownership check. | 2 |
| Parameterised query | Command and data are sent separately, so no injection. | 2 |
| TGT | A ticket proving who you are for hours, signed with the krbtgt key. | 3 |
| Kerberoasting | Requesting service account tickets and cracking them offline (T1558.003). | 3 |
| DCSync | Pretending to be a DC to replicate passwords (T1003.006). | 3 |
Resources for this lesson
Grouped by type. Start with the official docs for precision, or an article or video for the explanation.
reference5
NIST SP 800-115The technical guide to information security testing and assessment.nist.govFIRST: CVSS v4.0 specificationThe official specification for computing severity scores.first.orgOWASP Web Security Testing GuideThe reference guide to testing web applications step by step.owasp.orgMicrosoft: Enterprise access modelMicrosoft's model for separating privileged access into planes.learn.microsoft.comWindows LAPS overviewHow to give every machine a unique, rotating local admin password.learn.microsoft.com
Done with this lesson?
Sign in to save your progress.