Ethical offence, with permission The pen testing method from permission and scope to the report, testing web apps in permitted labs, and Active Directory and identity attacks, with how to detect and stop each one.
Lessons 0 Overview The pen testing method from permission and scope to the report, testing web apps in permitted labs, and Active Directory and identity attacks, with how to detect and stop each one. 1 The penetration testing method: permission, scope and the report A penetration tester is not a "good hacker" trying whatever comes to mind. They are a professional working under a written contract, a set scope and known phases, and their work is measured by a report that helps the company fix things. Here you learn permission and rules of engagement, the test phases, scoring flaws with CVSS 4.0, and writing a report both a manager and a developer can read. 2 Testing web apps in the lab: the proxy, permissions and injection In the junior stage you met the OWASP Top 10. Here you test it with your own hands in permitted labs: how a proxy sees every request, how to test permissions with two accounts, why broken access control stays number one, how injection happens and why parameterised queries stop it, what SSRF is, then how to write the fix and the test that keeps it from coming back. 3 Active Directory and identity: attack paths and how to close them In most companies whoever owns Active Directory owns everything, which is why ransomware gangs go for it first. Here you get Kerberos in plain words, and the best-known identity attacks (spraying, Kerberoasting, pass-the-hash, DCSync and the golden ticket) from the defender's side: how to detect and stop them, and how to see attack paths as a graph before the attacker does. 4 Wrap-up and resources The takeaways and glossary of this track.