Certified Penetration Testing Professional (CPENT)

Categoría:
Tecnología de la Información /
El programa Profesional certificado en pruebas de penetración (CPENT) de EC-Council le enseña cómo realizar una prueba de penetración eficaz en un entorno de red empresarial que debe ser atacado, explotado, evadido y defendido. Si solo ha estado trabajando en redes planas, el rango de práctica en vivo de CPENT le enseñará a llevar sus habilidades al siguiente nivel enseñándole cómo realizar pruebas de penetración de sistemas IoT, sistemas OT, cómo escribir sus propios exploits, construir sus propias herramientas, realice explotación de binarios avanzados, doble pivote para acceder a redes ocultas y también personalice scripts/exploits para ingresar a los segmentos más internos de la red.

 

Objetivos

• Demostrar un enfoque repetible y mensurable para las pruebas de penetración.
• Realizar técnicas y ataques avanzados para identificar vulnerabilidades de inyección SQL, Cross site scripting (XSS), LFI, RFI en aplicaciones web.
• Presentar un informe profesional y aceptado por la industria que logre la aceptación técnica y de gestión.
• Obtenga acceso a metodologías de pruebas de penetración patentadas por EC-Council.
• Escribir códigos de explotación para obtener acceso a un sistema o aplicación vulnerable.
• Explotar vulnerabilidades en Sistemas Operativos como Windows, Linux.
• Realizar una escalada de privilegios para obtener acceso raíz a un sistema.
• Demostrar pensamiento innovador y lateral.
• Garantizar la integridad y el valor de la certificación de pruebas de penetración, en un examen de certificación totalmente en línea y supervisado de forma remota.

• Hackers éticos
• Probadores de penetración
• Administradores de servidores de red
• Administradores de cortafuegos
• Probadores de seguridad
• Administradores de Sistemas y Riesgos
• Profesionales de evaluación
• Analista Forense de Ciberseguridad
• Analista de ciberamenazas
• Seguridad en la nube
• Analista de Seguridad de la Información
• Consultor
• Analista de seguridad de aplicaciones
• Ingeniero de Garantía de Ciberseguridad
• Centro de Operaciones de Seguridad (SOC)
• Analista
• Red de Operaciones Técnicas
• Ingeniero
• Ingeniero de Seguridad de la Información
• Probador de penetración de seguridad de red
• Ingeniero de seguridad de redes
• Arquitecto de seguridad de la información
Module 01: Introduction to Penetration Testing and Methodologies

  • Penetration Testing Concepts
  • LPT Penetration Testing Methodology
  • Guidelines and Recommendations for Penetration Testing

 

Module 02: Penetration Testing Scoping and Engagement

  • Request for Proposal
  • Preparing Response Requirements for Proposal Submission
  • Setting the Rules of Engagement
  • Establishing Communication Lines
  • Timeline
  • Time/Location
  • Frequency of meetings
  • Time of Day
  • Identifying Personnel for Assistance
  • Handling Legal Issues in Penetration Testing Engagement
  • Preparing for the Test
  • Handling Scope Creeping During Pen Testing

 

Module 03: Open Source Intelligence (OSINT)

  • OSINT through the WWW
  • OSINT through Website Analysis
  • OSINT through DNS Interrogation
  • Automating the OSINT Process using Tools/Frameworks/Scripts

 

Module 04: Social Engineering Penetration Testing

  • Social Engineering Penetration Testing Concepts
  • Social Engineering Penetration Testing Using E-mail Attack Vector
  • Social Engineering Penetration Testing Using Telephone Attack Vector
  • Social Engineering Penetration Testing Using Physical Attack Vector
  • Reporting and Countermeasures/Recommendations

 

Module 05: Network Penetration Testing – External

  • Port Scanning
  • OS and Service Fingerprinting
  • Vulnerability Research
  • Exploit Verification

 

Module 06: Network Penetration Testing – Internal

  • Footprinting
  • Network Scanning
  • OS and Service Fingerprinting
  • Enumeration
  • Vulnerability Assessment
  • Windows Exploitation
  • Unix/Linux Exploitation
  • Other Internal Network Exploitation Techniques
  • Automating Internal Network Penetration Test Effort
  • Post Exploitation
  • Advanced Tips and Techniques

 

Module 07: Network Penetration Testing – Perimeter Devices

  • Assessing Firewall Security Implementation
  • Assessing IDS Security Implementation
  • Assessing Security of Routers
  • Assessing Security of Switches

 

Module 08: Web Application Penetration Testing

  • Discover Web Application Default Content
  • Discover Web Application Hidden Content
  • Conduct Web Vulnerability Scanning
  • Test for SQL Injection Vulnerabilities
  • Test for XSS Vulnerabilities
  • Test for Parameter Tampering
  • Test for Weak Cryptography Vulnerabilities
  • Tests for Security Misconfiguration Vulnerabilities
  • Test for Client-Side Attack
  • Tests for Broken Authentication and Authorization Vulnerabilities
  • Tests for Broken Session Management Vulnerabilities
  • Test for Web Services Security
  • Test for Business Logic Flaws
  • Test for Web Server Vulnerabilities
  • Test for Thick Clients Vulnerabilities
  • WordPress Testing

 

Module 09: Wireless Penetration Testing

  • Wireless Local Area Network (WLAN) Penetration Testing
  • RFID Penetration Testing
  • NFC Penetration Testing

 

Module 10: IoT Penetration Testing

  • IoT Attacks and Threats
  • IoT Penetration Testing

 

Module 11: OT and SCADA Penetration Testing

  • OT/SCADA Concepts
  • Modbus
  • ICS and SCADA Pen Testing

 

Module 12: Cloud Penetration Testing

  • Cloud Penetration Testing
  • AWS Specific Penetration Testing
  • Azure Specific Penetration Testing

 

Module 13: Binary Analysis and Exploitation

  • Binary Coding Concepts
  • Binary Analysis Methodology

 

Module 14: Report Writing and Post Testing Actions

  • Penetration Testing Report: An Overview
  • Phases of Report Development
  • Report Components
  • Penetration Testing Report Analysis
  • Penetration Testing Report Delivery
  • Post-Testing Actions for Organizations

 

Appendix A: Penetration Testing Essential Concepts

  • Computer Network Fundamentals
  • TCP/IP Protocol Suite
  • TCP/IP Protocol Suite: Application Layer Protocols
  • TCP/IP Protocol Suite: Transport Layer Protocols
  • TCP/IP Protocol Suite: Internet Layer Protocols
  • TCP/IP Protocol Suite: Link Layer Protocols
  • IP Addressing and Port Numbers
  • Network Terminology
  • Network Security Controls
  • Network Security Devices
  • Network File System (NFS)
  • Windows Security
  • Unix/Linux Security
  • Virtualization
  • Web Server
  • Web Application
  • Web Markup and Programming Languages
  • Application Development Framework and their Vulnerabilities
  • Web API’s
  • Web Sub Components
  • Web Application Security Mechanisms
  • Working of Most Common Information Security Attacks
  • Information Security Standards, Laws and Acts

 

Appendix B: Fuzzing

Appendix C: Mastering Metasploit Framework

Appendix D: PowerShell Scripting

Appendix E: BASH Environment and Scripting

Appendix F: Python Environment and Scripting

Appendix G: Perl Environment and Scripting

Appendix H: Ruby Environment and Scripting

Appendix I: Active Directory Penetration Testing

Appendix J: Database Penetration Testing

  • Information Reconnaissance
  • Database Enumeration: Oracle
  • Database Enumeration: MS SQL Server
  • Database Enumeration: MySQL
  • Vulnerability and Exploit Research
  • Database Exploitation: Oracle
  • Database Exploitation: MS SQL Server
  • Database Exploitation: MySQL

 

Appendix K: Mobile Device Penetration Testing

  • Communication Channel Penetration Testing
  • Server-side Infrastructure Penetration Testing
  • Application Penetration Testing

 

Appendix L: CEH Refresher

  • Network Penetration Testing: External
  • Network Penetration Testing: Internal
  • Windows Exploitation
  • Other Internal Network Exploitation Techniques
  • Advanced Tips and Techniques
  • Network Penetration Testing: Perimeter Devices
  • Web Application Penetration Testing
  • Wireless Penetration Testing
  • Cloud Penetration Testing

Exam Facts

Delivery Online (Web based)
Format Multiple choice
Proctoring Live
Duration 24 hours
# of questions
Pass Grade 70 %

 

Related Certification

  • Certified Penetration Testing Professional (CPENT)