• Building a successful SOC
• Functions of SOC
• Heart of SOC- SIEM
• Gartner’s magic quadrant

• IBM QRadar SIEM component architecture and data flows
• Using the QRadar SIEM User Interface

• Working with offense triggered by events
• Working with offense triggered by flows
• Working with events of an offense

• Monitor QRadar Notifications and error messages.
• Monitor QRadar performance
• Review and interpret system monitoring dashboards.
• Investigate suspected attacks and policy breaches
• Search, filter, group, and analyze security data

• Investigate the vulnerabilities and services of assets
• Investigate events and flows
• Use index management
• Index and Aggregated Data Management
• Use AQL for advanced searches
• Creating Alerts for intrusions
• Explain error messages and notifications.
• Analyze a Real-World Scenario.
• Creating Reports
• Case Studies

• Creating log source types
• Leveraging reference data collections
• Developing custom rules
• Creating Custom Action Scripts
• Developing Anomaly Detection Rules

• OWASP Top 10 Vulnerabilities
• Threat Modelling Principle
• Site Mapping & Web Crawling
• Server & Application Fingerprinting
• Identifying the entry points
• Page enumeration and brute forcing
• Looking for leftovers and backup files

• Authentication scenarios
• User enumeration
• Guessing passwords – Brute force & Dictionary attacks
• Default users/passwords
• Weak password policy
• Direct page requests
• Parameter modification
• Password flaws
• Locking out users
• Lack of SSL at login pages
• Bypassing weak CAPTCHA mechanisms
• Login without SSL

• Web Agent Model
• Preparing for Web Agent installation
• Install the Web Agent
• Unattended installs
• Settings Added to Web Server
• Test the Web Agent
• Troubleshooting
• Unix Installation Review

• Role-based access control (RBAC)
• Authorization bypassing
• Forceful browsing
• Client-side validation attacks
• Insecure direct object reference

• Input validation techniques
• Blacklist VS. Whitelist input validation bypassing
• Encoding attacks
• Directory traversal
• Command injection
• Code injection
• Log injection
• XML injection – XPath Injection | Malicious files | XML Entity
• bomb
• LDAP Injection
• SQL injection
• Common implementation mistakes – authentication
• Bypassing using SQL Injection
• Cross Site Scripting (XSS)
• Reflected VS. Stored XSS
• Special chars – ‘ &<>, empty

• Path traversal
• Canonicalization
• Uploaded files backdoors
• Insecure file extension handling
• Directory listing
• File size
• File type
• Malware upload

• Session management techniques
• Cookie based session management
• Cookie properties
• Cookies – secrets in cookies, tampering
• Exposed session variables
• Missing Attributes – httpOnly, secure
• Session validity after logoff
• Long session timeout
• Session keep alive – enable/disable
• Session id rotation
• Session Fixation
• Cross Site Request Forgery (CSRF) – URL Encoding
• Open redirect

• Web Services Assessment
• Web Service Testing
• OWASP Web Service Specific Testing
• Testing WSDL
• Sql Injection to Root
• LFI and RFI]
• OWASP Top 10 Revamp

• TCP/IP Packet Analysis
• Overview of Network Security
• Port and Protocols & Analysis
• Linux Server Installation
• Windows Client / Linux Installation
• Basic commands (Windows / Linux)
• Kali Linux Installation

• Introduction
• ICMP Packet Analysis
• ARP Packet Analysis
• 3 way handshake Analysis
• Tracert Command Analysis
• Packet Forensics
• Nmap Packet Forensics

• Network Sweeping
• OS Discovery
• SYN Scan
• UDP Scan
• XMAS Scan
• FIN Scan
• NULL Scan

• Fragment Scan
• Data Length Scan
• TTL Scan
• Source Port Scan
• Decoy Scan
• Spoof IP Scan
• Spoof MAC Scan
• Data String Scan
• Hex String Scan
• IP Options Scan

• Metasploit Basic
• Msfvenom
• Auxiliary scanner
• Windows Reverse TCP
• Windows HTTPS Tunnel
• Hidden Bind TCP
• Macro Payloads
• Shell on the Fly (Transport)
• Bypass User Access Control
• Pass the Hash
• Post Exploitation

• Hydra
• Medussa
• Crunch
• CeWL
• WCE
• Mimikatz
• cUPP
• Online attacks

• Introduction & Lab setup
• Banner Grabbing/Banner Hiding
• Port forwarding /Time Scheduling
• Brute forcing/Secure
• Pivoting/Tunneling [windows]

• Introduction & Lab setup
• Banner Grabbing/Banner Hiding
• Port forwarding /Time Scheduling
• Brute forcing/Secure
• Pivoting/Tunneling
• Multiple way to secure ssh

• Introduction & Lab setup
• Banner Grabbing/Banner Hiding
• Port forwarding /Time Scheduling
• Brute forcing/Secure
• Pivoting/Tunneling

• Introduction & Lab setup
• Banner Grabbing/Banner Hiding
• Port forwarding /Time Scheduling
• Brute forcing/Secure
• Penetration testing with SWAKS

• Introduction & Lab setup
• DNS Enumeration
• DHCP Packet Analysis with Wireshark
• DHCP Starvation attack
• Rogue DHCP Server
• Tools (Gobbler, responder, Yersinia)

• Introduction & Lab setup
• SMB Enumeration
• SMB Null Sessions
• Enum4Linux
• NetBIOS Spoofing
• Banner Grabbing/Banner Hiding
• Brute forcing/Secure
• Pivoting/Tunneling
• Penetration Testing with (PS exec, eternal blue )
• Multiple way to connect smb

• Introduction & Lab setup
• Banner Grabbing/Banner Hiding
• Port forwarding /Time Scheduling
• Brute forcing/Secure
• Penetration Testing with Metasploit and Nmap

• MSSQL Brute force Attack
• Enumerate MSSQL configuration setting
• Identifying SQL Server logins
• Identify Database owner
• Identify a User With masquerade privilege
• Execute SQL Statement
• Retrieve MSSQL Password Hashes of Users
• Decode Password Hashes of Users
• Extracting MYSQL Schema Information

• Introduction and Lab setup
• MYSQL Brute Force Attack
• mysql banner user/file/ Enumeration
• Stealing MYSQL information
• Check File Privileges
• Enumerate MYSQL writeable directories
• Extract MYSQL Username with Hash Password
• Crack Hash Password with John the Ripper
• Secure MYSQL through port forwarding
• Prevent Mysql against brute force attack

• Introduction & Lab setup
• Banner Grabbing/Banner Hiding
• Port forwarding /Time Scheduling
• Brute forcing/Secure
• Pivoting/Tunneling
• DOS Attack

• Introduction & Lab setup
• Banner Grabbing/Banner Hiding
• Port forwarding /Time Scheduling
• Brute forcing/Secure
• Penetration Testing with Metasploit and Nmap
• Pivoting/Tunneling

• Introduction
• ARP Poisoning
• MAC Address Snooping
• DNS Spoofing
• DNS Poisoning
• Capture NTLM Hashes
• Xerosploit

• Socks proxy lab setup
• SSH
• FTP
• HTTP

• Setup Snort Lab in Ubuntu
• Understanding Snort Rules
• Introduction to IPtables
• Introduction to Windows Firewall
• ICMP Detect
• TCP Packet Detect
• Detect Nmap Scan
• Detect Dos Attack
• Antivirus Evasion with veil

• Introduction to DOS Attack
• Botnet
• D-DOS Attack
• SYN Flood Attack
• UDP Flood
• Smurf Attack
• Packet Crafting
• Others DOS Attack Tools

• Introduction to Social Engineering Attack
• Payload and Listener Attack
• Java Applet Attack
• HTA Attack
• MSFPC
• DOS Attack
• PowerShell Attack Vector
• VNC Attack

• Persistence
• s4u_persistence
• VSS_Persistence
• Registry Persistence
• Netcat
• Clear Event Logs

• Nessus
• GFI Languard
• Nexpose
• Openvas
• MBSA

MITREAtt&ck – Cyber Att&ck Lifecycle
Pyramid of pain
Cyber Kill Chain
Threat Intelligence using MITREAtt&ck

• MITRE PRE-ATT&CK threat modelling methodology for pre-exploit activities
• Enterprise Matrix: Windows, MacOS, Linux, Etc.
• Mobile
• ICS.

ATT&CK portable detection tests
Raw Data vs Finished Reports
Case Studies.

MITRE ATT&CK Navigator
Utilizing the MITRE ATT&CK Matrix
MITRE ATT&CK Use Cases
Warming Up Using ATT&CK for Self-Advancement.

Concept of Active Defense
MITRE SHIELD
Defensive Recommendation with SHIELD
MITRE CAR
Getting started using MITRE ATT&CK for Threat Hunting
Different TTP’s on attacking Active Directory

Set up MITRE Caldera
Atomic Red Team Test
MITRE LAB Practical.

• Penetration Testing Benefits
• Types of Penetration Testing
• Penetration Testing Methodologies
• Law & Compliance
• Planning, Managing & Reporting

• Finding Files
• Services in Kali
• SSH Service
• FTP Services
• HTTP Service
• SNMP Service
• Mysql Services
• Service Management
• IP Protocols, Networking Protocols, IPSec, VOIP
• Network Architecture, Mapping & Target Identification

• Locate
• Which
• Find
• Sed
• Awk
• Cut
• Sort
• Grep
• Head
• Tail
• Wget
• Cat

• Getting start with NC
• Connecting to a Server
• Fetching HTTP header
• Chatting
• Creating a Backdoor
• Verbose Mode
• Save Output to Disk
• Port Scanning
• TCP Delay Scan
• UDP Scan
• Reverse TCP Shell Exploitation
• Randomize Port
• File Transfer
• Reverse Netcat Shell Exploitation
• Banner grabbing

• TCP Connect Scan with wireshark
• Network sweeping with wireshark
• SYN Scan with wireshark
• UDP Scan with wireshark
• FIN Scan with wireshark
• Null Scan with wireshark
• OS Discovery with wireshark
• NSE Scripts with wireshark
• Nmap Firewall Scan

• Overview
• Structure, interpretation and analysis of DNS records
• DNS Enumeration
• Forward DNS Lookup
• Reverse DNS Lookup
• Zone Transfers
• NetBIOS & SMB Enumeration
• Null Sessions
• Enum4Linux
• SMB NSE Scripts
• MYSQL Enumeration
• MSSQL Enumeration
• SMTP Enumeration
• VRFY Script
• Python Port
• SNMP Enumeration
• SNMP MiB
• SNMPWalk

• Overview
• Google Search
• Google Hacking
• GHDB
• NNTP Newsgroups & Information Leakage from Mail Headers

• Dirb
• Dirbuster
• Dirsearch
• Metasploit

• Domain Reconnaissance
• User Enumeration
• Active Directory
• Windows Patch Management Strategies
• Desktop Lockdown & Exchange Server

• Php reverse shell
• Python reverse shell
• Perl reverse shell
• Bash reverse shell
• Msfvenom shell

• Overview
• Vulnerable Code
• Stack Overflow
• Heap Overrun/Overflow

• Overview DEP, ASLR and CFG
• Fuzzing
• Crash Replication
• Controlling EIP
• Locating space for our Shellcode
• Bad Characters
• Redirecting Execution
• Introducing Mona
• Shellcode Payload

• Overview DEP, ASLR and Canaries
• Controlling EIP
• Locating Space
• First Stage Shellcode
• Locating RET
• Generating Shellcode

• Overview
• Finding Exploits
• Exploit-DB
• Fixing Exploits 1
• Fixing Exploits 2
• Cross-Compiling

• FTP
• Python HTTP Server
• php http server
• HFS Tool
• Netcat
• CURL
• Wget
• TFTP
• Python SMB Server
• Powershell File Transfer
• Bitsadmin

• Suid Binaries
• AbsuingSudo’s Right
• Kernel Exploit
• Path Variables
• Multiple Ways to edit /etc/passwd file

• Suid Binaries
• AbsuingSudo’s Right
• Kernel Exploit
• Path Variables
• Multiple Ways to edit /etc/passwd file

• Weak File Permissions
• Always Install Elevated
• Bypass UAC
• Unquoted Service Path
• Kernel Exploits

• Overview
• Web Servers Flaws
• Web Protocols
• Local File Inclusion
• SQL Injection
• Authentication Bypass
• Error Based Enum
• Blind SQL Injection
• Attack Proxies
• XSS, LDAP & XML Injection
• SQLMap
• Web APIs
• Web Sub-Components

• Overview
• Crunch
• Passing the Hash
• Password Profiling
• Online Attacks
• Medusa
• Ncrack
• Hydra
• Password Hashes
• Cracking Hashes
• LM / NTLM

• Overview
• Port Forwarding
• SSH Tunnels
• Dynamic Proxies
• Proxy Chains

• Overview
• AUX Modules
• SNMP Modules
• SMB Modules
• WEBDAV Modules
• Database Services
• Exploits
• Payloads
• Meterpreter
• Meterpreter in Action
• Additional Payloads
• Binary Payloads
• Multihandler
• Porting Exploits
• Post Exploitation

• Overview
• Shellter
• Veil-Evasion
• thefatrat

• WordPress lab Setup & Pentesting
• Joomla Lab Setup & Pentesting
• Drupal Lab Setup & Pentesting