For direct assistance contact us! +91-9999508202 [email protected]
Select Page

OFFENSIVE CTF

Offensive CTF training fill the gaps between tools, techniques and procedures used by pentesters during engagements.  Offensive CTF training covers Critical infrastructure security issues, Network Penetration testing, Hunting critical web app threats, malware development , attacking active directory  and C2 operations in pentesting engagements.  From past 5 years with our offensive CTF training , we are on the mission to equip the corporate workforces to fight against the APT attacks and mature existing cyber security posture of enterprises. 

We are focusing on the overall development of a candidate, hence in the initial stage of the training, we will focus on fundamental concepts of administrating Linux, customization of Linux environment as per need, and detailed understanding of Windows systems.

On the Next stage, we will focus on PowerShell scripting methodologies and identifying & exploiting critical Web application attacks.

Finally, its time of hunting live an evil, we will cover up the methods of evading the defenses, Linux and windows assessments, Active directory lateral movement and various post-exploitation techniques with industry-focused use-cases.  Further we will focus on Offensive operations with custom malware development and cobalt strike – C2 operations will extend the existing pentesting abilities to next level .

Overall Offensive CTF training will help you to understand the configurational and poor policies implementation issues in the organizations. Also, this training will improve your KRA/KPA to get more benefits in Job.

Offensive ctf training
who should attend this training?
  • Blue Team professionals
  • SOC Analysts
  • Incident Responders
  • Security Professionals
  • System Administrators
  • Network Administrators
  • Network Engineers
  • Database Admins
  • Endpoint Security Professionals
  • Security Auditors
why should i take this training?

Advanced persistent threats are increasing day by day because of weak Access control policies and administration. To address all of the issues in the overall infrastructure of the organization we have designed this core advanced training for corproate professionals .

prerequisite of the training ?

The candidate should be skilled in basic Linux operations, Active directory services, and common databases .

OR

Certcube Associate Pentester level Knowledge

what is the total duration of the training ?

It’s an Instructor-led online training and the total duration of the training is 75-80 hours.

How many sessions will be organized in a week?

There are two training slots for weekdays: –

1. Monday, Wednesday, and Friday.

2. Tuesday, Thursday, and Saturday

Session duration – 1.5 to 2-hour session

Evening Slots are available for working professionals.

Weekend Batches are also available for a group of professionals.

 

How to register for offensive CTF ?

Please drop a mail at [email protected] or call/WhatsApp on  +919999508202.

DETAILED SYLLABUS

ENVIRONMENT SETUP AND ENUMERATION PRIMER

  • Pentesting standards and ROE guidelines
  • Prod environments vs Compliance centric environments
  • Linux Advanced Commands & Usages
  • Hashing and brute forcing techniques
  • Types of shells & Restricted Privileges
  • Automated and Manual service enumeration
  • Scanning primer for pentesters
  • File transfer anatomy
  • Windows Server Administration essentials.
  • Understanding the backend basics via Web application deployment with database .
  • Vulnerability Scanning with commercial tools .

CRITICAL WEB ATTACKS

  • Web application architecture and web fundamentals
  • Poor implementation of web servers
  • Authentication bypass and SQLi attacks
  • Session Hijacking and broken access control
  • Encodings for RCE
  • SQL injection to RCE
  • Command Injection to RCE
  • Local File inclusion to RCE
  • Remote File inclusion to RCE
  • File upload to RCE
  • SSRF and XML to RCE
  • Multiple CMS Critical attacks and Remote code execution .
  • Defense in depth

LINUX PRIVILEGE ESCALATIONS AND BEYOND ISSUES

  • Linux Sudoers misconfigurations
  • SUID  & SGID implementations issues
  • Cron Jobs and wildcard misconfigurations
  • Docker Implementations issues
  • File access and capabilities misconfigurations
  • Kernel and software vulnerabilities
  • Linux Capabilities issues
  • Other Beyond Linux Insecurities
  • Secure system hardening guidelines
  • Custom exploit development for buffer overflow
  • Defences against buffer overflow attacks
  • Fixing Public exploits for reverse shells

LINUX SERVER & DATABASE PRIVILEGE ESCALATION

  • Poor implementation of the database in environments
  • Database misconfigurations
  • User-defined function issues
  • Database to RCE
  • Exploiting the databases for privilege escalation
  • Detailed Linux enumeration and exploitation
  • Exploit modification and troubleshoot the errors
  • Linux post-exploitation recipes
  • System hardening and Configuration review procedures

PIVOTING AND PORT FORWARDING

  • Restricted environments MindTap
  • Tunneling / pivoting fundamentals
  • Proxyhchains and routing internal networks
  • Exploit local services with port forwarding
  • Maintaining access with tunneling / pivoting
  • Port Knocking foundations 
  • Port knocking attacks

POWERSHELL FOR PENTESTERS

  • Powershell basics cmdlets usage
  • Powershell file handling and Downloading data
  • Exfiltrating data and registry operations
  • Powershell shellcode and droppers
  • Payload obfuscation with powershell
  • AMSI service protections and bypassing methodologies
  • Automating the Enumeration and data exfiltration with Powershell .

WINDOWS PRIVILEGE ESCALATION ATTACKS

  • Windows System Commands and usages
  • Windows Registry Insecurities
  • Hot Fixes and vendor-neutral software issues
  • Stored credentials exfiltration
  • Authentication and poor password security implementations
  • Environment Access control and poor permissions
  • Windows services enumeration and exploitation
  • Insecure service implementations
  • Path related misconfigurations
  • DLL hijacking possibilities
  • Beyond misconfiguration issues
  • Exploit troubleshooting and fixation
  • Windows post-exploitation attacks on system takeover
  • Buffer overflow attack in thick client applications
  • Windows systems defense in depth

AV EVASION AND C2 FOR PENTESTERS

  • Understanding of AV scanning engines and EDR platforms
  • Automated shellcode development tools
  • Offensive C# for pentesters
  • Process Injections for system takeover
  • Encoding Operations for evasion
  • Shellcode development with automation to evade protections
  • Custom shellcode development with Microsoft Office
  • Cobalt strike C2 setup for red teaming
  • Customizing malleable c2 profiles for OPSEC
  • Offensive Operations with Cobalt strike
  • Metasploit for automating the offensive security operations

ACTIVE DIRECTORY PENTESTING

  • Traditional Pentesting vs Assume Breach-based Assessments
  • Active Directory Lab Implementation Overview
  • Kerberos & NTLM authentication procedure
  • Automated and Manual Domain enumeration primer
  • Stored credentials and services issues in AD
  • Password Spraying and Pass the hash attacks
  • Pass the ticket vs overpass the hash attacks
  • Kerberosting attacks
  • Exploiting the domain delegations
  • Escalating group policies and OU for lateral movements
  • Exploiting misconfigured service principals
  • Lateral movement attacks
  • Data exfiltration and Complete Takeover
  • Windows and AD defense in depth

Our clients

Testimonials

The Online Sessions are more practical based than theory ,the course “Offensive CTF” highly up-to dated which includes all the basics to Core practical topics.The faculty have wider experience in Corporate Sector which gives the students a major plus point to know about the corporate sectors .This course is totally worth to do if you want to upgrade yourself at corporate level and learn bits and bytes of professional pentesting.
Ekansh

Cyber security Consultant, Accenture

I have opted for offensive CTF challenges; the course structure was very much brief and well-designed for the students.
Overall it was a good experience, and learned so many new things which will help in the real-world assessment
Thanks Naresh, for the wonderful knowledge sessions

Yasgwanth

Cyber Security Engineer, Alshaya Group

We're Here To Help!

Office

3500 , 1st Floor , Raja Park , New Delhi -110034

Hours

M-S: 10am - 11pm