Objective

Modern enterprise infrastructure is built in layers: Diverse operating systems, mixed-generation servers, legacy and custom applications, firewalls, and Active Directory/EntraID.

This three-day, hands-on training is for you (IT security practitioners) who want to develop or deepen their skills to operate effectively against realistic, complex enterprise targets. The goal is direct: After the training you can plan and execute a complete infrastructure compromise chain against environments that actively resist it.

Every successful compromise of the network infrastructure has to evade multiple layers of security in a perfect sequence. Imagine yourself in an environment with diverse operating systems, servers, and applications with a legacy as well as in-house developed products and security solutions such as firewall, AV, etc. How do you plan to go ahead and pwn them all? Learn to exploit and compromise targets where Metasploit will not work by default. Look inside exploit code, and tweak them to make it work against your targets. Perform a wide array of tricks to discover, enumerate and pwn services, systems, and domain controllers. Move around in an enterprise network with Active Directory/EntraID. Analyze and exploit enterprise software components. Attack AI-based systems and leverage AI to your advantage in pentesting.

We have prepared a large lab for you to test and extend your skills. You will spend the majority of their time hacking systems, making decisions, and finding solutions to the problems that arise when an exploiting real-world systems. After going through our labs, you will have better skills, more tricks & tools and higher confidence in your next engagements.

Course Content

The course has a strong practical focus. After a short setup-phase, exercises will be hands-on with guidance. Contents and exercises are selected based on the groups' speed and interests. In general, we aim to cover the following contents: