Pentest 101

With the increase on the cyber risk pentests are common now and most companies run them. This very specialized activity requires a good knowledge of the methodology and the tools and techniques of attacks.

Goal of this training is to share techniques having been acquired on the ground, during hundreds of intrusion tests

At the end of this training you will be able to carry out simple intrusion tests yourself on infrastructures as well as on applications and websites.

Advanced Penetration Testing in Real World

Our trainers will share many techniques, tips and tricks to deliver to pentesters, red teamers bug bounty researchers or even defenders during a 2 days 100% “hands-on” workshop.

Mains topics are:

_ buffer overflow 101: find and exploit buffer overflows yourself and bypass OS protections (because a lot of pentesters don’t even know how it works under the hood);

_ web exploitation: manually find and exploit web app vulnerabilities using Burpsuite (yes, running WebInspect, AppScan, Acunetix or Netsparker is fine but you can do a lot more by hand);

_ network exploitation: manually exploit network related vulnerabilities using Scapy, ethercap and Responder (because it works so often when doing internal pentests);

_ passwords: optimize the way you attack offline and online passwords (0day is fun but the way guys come in most of the time is simply by using login/passwords);

_ mobile app hacking: find and exploit Android/iOS app vulnerabilities using Needle, Frida, Cycript, Drozer, etc... (companies move their apps in the cloud and in the mobile world so pentesters have to evolve with that… or die);