By completing this course, learners will be able to:

• Develop advanced penetration testing techniques for hardened enterprise environments.
• Perform client-side attacks and develop customized payloads.
• Understand process injection, migration, and in-memory execution techniques.
• Assess and bypass antivirus and application-whitelisting controls in authorized environments.
• Work with Windows and Linux post-exploitation techniques.
• Perform credential attacks and advanced lateral movement.
• Assess Microsoft SQL environments and linked SQL servers.
• Exploit advanced Active Directory permissions and Kerberos delegation weaknesses.
• Analyze and compromise multi-domain and multi-forest Active Directory environments.
• Combine multiple attack techniques to conduct realistic end-to-end penetration tests.
• Prepare for the practical OSEP certification examination.

Module 1: Evasion Techniques and Breaching Defenses – General Course Information

• About the PEN-300 course
• Provided course materials
• Access to the internal VPN lab network
• Student forum and support
• Course exercises
• PEN-300 VPN labs
• Control panel and machine reverts
• Client machines and Kali virtual machine
• Lab behavior and restrictions
• OSEP examination overview

Module 2: Operating System and Programming Theory

• Programming theory
• Programming language concepts
• Programming fundamentals
• Windows concepts
• Windows APIs
• Windows Registry

Module 3: Client-Side Code Execution With Office

• Staged and non-staged payloads
• Building droppers
• HTML smuggling
• Phishing with Microsoft Office
• VBA fundamentals
• PowerShell integration
• Phishing pretexting
• Shellcode execution
• Win32 API interaction
• PowerShell shellcode runners
• In-memory PowerShell execution
• Proxy-aware communication

Module 4: Client-Side Code Execution With Windows Script Host

• Creating JScript droppers
• JScript execution on Windows
• JScript and C#
• Visual Studio fundamentals
• DotNetToJscript
• Win32 API calls from C#
• Shellcode runners
• SharpShooter
• In-memory PowerShell techniques

Module 5: Process Injection and Migration

• Process injection and migration theory
• Process injection with C#
• DLL injection
• Reflective DLL injection
• Process hollowing

Module 6: Introduction to Antivirus Evasion

• Antivirus software overview
• Simulating target environments
• Locating signatures in files
• Metasploit encoders and encryptors
• Antivirus bypass techniques using C#
• Payload encryption
• Sleep timers and behavioral techniques
• Office and VBA antivirus bypass
• PowerShell obfuscation and evasion

Module 7: Advanced Antivirus Evasion

• Intel architecture and Windows concepts
• WinDbg fundamentals
• Antimalware Scan Interface (AMSI)
• AMSI analysis and hooking
• AMSI bypass techniques
• PowerShell internals
• UAC bypass techniques
• JScript AMSI bypass techniques

Module 8: Application Whitelisting

• Application whitelisting concepts
• AppLocker configuration and rules
• Trusted folders
• DLL-based bypass techniques
• Alternate Data Streams
• Third-party execution
• PowerShell Constrained Language Mode
• Custom PowerShell runspaces
• AppLocker bypasses using C#
• JScript, MSHTA, and XSL techniques

Module 9: Bypassing Network Filters

• DNS filtering
• Web proxy restrictions
• IDS and IPS sensors
• Full packet capture systems
• HTTPS inspection
• Domain fronting
• DNS tunneling

Module 10: Linux Post-Exploitation

• User configuration files
• VIM-based post-exploitation techniques
• Linux antivirus bypass
• Shared library fundamentals
• Shared library hijacking
• LD_LIBRARY_PATH
• LD_PRELOAD exploitation

Module 11: Kiosk Breakouts

• Kiosk enumeration
• Browser enumeration
• Command execution
• Filesystem exploration
• Firefox profile analysis
• System information enumeration
• Post-exploitation
• Interactive shell simulation
• Privilege escalation
• Windows kiosk breakout techniques

Module 12: Windows Credentials

• Local Windows credentials
• SAM database
• Local administrator security
• Access tokens
• Token impersonation
• Kerberos authentication
• Domain credentials
• Mimikatz
• Memory dumping
• Offline credential processing

Module 13: Windows Lateral Movement

• Remote Desktop Protocol
• RDP-based lateral movement
• Reverse RDP proxying
• RDP as a console
• Credential exposure through RDP
• Fileless lateral movement
• Authentication and execution concepts
• Fileless movement using C#

Module 14: Linux Lateral Movement

• SSH keys
• SSH persistence
• SSH ControlMaster hijacking
• SSH-Agent and agent forwarding
• Ansible enumeration
• Ansible commands and playbooks
• Credential exposure through Ansible
• Artifactory enumeration and exploitation
• Kerberos on Linux
• Keytab files
• Credential cache files
• Kerberos with Impacket

Module 15: Microsoft SQL Attacks

• Microsoft SQL in Active Directory
• MS SQL enumeration
• MS SQL authentication
• UNC path injection
• Hash relay techniques
• SQL privilege escalation
• Code execution
• Custom assemblies
• Linked SQL servers

Module 16: Active Directory Exploitation

• Active Directory object security permissions
• GenericAll and WriteDACL abuse
• Kerberos delegation
• Unconstrained delegation
• Constrained delegation
• Resource-Based Constrained Delegation
• Active Directory forest architecture
• Trust relationships
• Forest enumeration
• Forest compromise
• Cross-forest trust exploitation
• Additional forest compromise

Module 17: Combining the Pieces

• Initial enumeration
• Gaining an initial foothold
• Post-exploitation enumeration
• Attacking delegation
• Privilege escalation
• Credential and ticket-based attacks
• Lateral movement
• Domain compromise
• Becoming Domain Administrator

Module 18: Trying Harder – The Labs

• Real-life penetration testing simulations
• Combining techniques across multiple systems
• End-to-end attack scenarios
• Applying advanced evasion and post-exploitation techniques

5 Days

PEN-300 is heavily focused on practical application. The course provides access to hands-on lab environments where learners can apply the techniques covered throughout the modules.

The practical work includes:

• Client-side exploitation exercises.
• Custom payload and tooling development.
• Process injection and migration exercises.
• Antivirus and AMSI evasion scenarios.
• Application-whitelisting bypass exercises.
• Network filter and proxy bypass scenarios.
• Windows and Linux post-exploitation.
• Credential harvesting and processing.
• Windows and Linux lateral movement.
• Microsoft SQL attack scenarios.
• Active Directory exploitation.
• Multi-domain and multi-forest attack scenarios.
• End-to-end enterprise penetration testing exercises.
• Seven Challenge Labs designed to simulate complex real-world engagements and reinforce the skills required for the OSEP examination.

• Penetration Testers
• Senior Penetration Testers
• Offensive Security Professionals
• Red Team Professionals
• Security Consultants
• Vulnerability Assessment Professionals
• Application Security Professionals
• Security Engineers
• Cybersecurity Researchers

• Kali Linux and the Linux command line.
• Target enumeration and vulnerability identification.
• Bash, Python, and PowerShell scripting.
• Exploiting vulnerabilities such as SQL injection, file inclusion, and local privilege escalation.
• Active Directory fundamentals and basic AD attacks.
• Windows and Linux administration.
• Basic exploit development concepts.
• C# programming is an advantage, particularly for the custom tooling and Windows-focused sections.