Understanding Offensive Penetration Testing

Understanding the African Cybersecurity Landscape

Introduction to MITRE ATT&CK Framework

Understanding the relationship between MITRE ATT&CK and the Cyber Kill Chain.

Penetration Testing Methodology

Role of Penetration Testers

Building a Security Mindset

Overview of Tools and Technologies

Understanding Infrastructure Resilience

Resilient Network Architecture

Designing a Stealthy Command and Control (C2) Server

Choosing the Right Technology Stack for C2 Server

Identifying Key Infrastructure Components

Installing VMware Workstation

Understanding VMware Networking

Network Toplogy

Maintaining Anonymity

Stealth and Covert Operations

Selecting Hosting Environments

Stealth Infrastructure Setup

Ensuring Resilience against Detection Mechanisms

Honeypots and Deception Technologies

Implementing Stealthy Communication Protocols

Monitoring and Logging

Emerging Technologies C2 Infrastructure

On-Premise(Virtual Machine) Vs Cloud Vs Hybrid Infrastructure

Understanding Initial Access:

Exploring Tactics, Techniques, and Procedures (TTPs)

Common Initial Access Vectors

Learning Objectives

Initial Access Tactics and Techniques

Lab 1: Spearphishing Campaign in an African Context

Lab 2: Exploiting Public-Facing Applications on African Websites

Lab 3: Gaining Access via External Remote Services in an African Organization

Initial Access Quiz

Initial Access Cheatsheet

Learning Objectives

Introduction to Execution in the Cyber Kill Chain

MITRE ATT&CK Framework for Execution

PowerShell as an Execution Tactic

Scripting as a Means of Execution

Execution Tactics and Techniques

Lab 4: PowerShell Exploitation in an African Network

Lab 5: User Execution Techniques in an African Environment

Lab 6: Scripting Attacks Targeting African Organizations

Post-Exploitation Activities

Execution Quiz

Execution Cheatsheet

Learning Objectives

Introduction to Persistence in the Cyber Kill Chain

MITRE ATT&CK Framework for Persistence

Evasion Techniques in Persistence

Persistence Tactics and Techniques

Registry Run Keys/Startup Folder as Persistence Tactics

Service Execution for Persistence

Scheduled Task as a Persistence Technique

Lab 7: Registry Run Keys/Startup Folder Persistence in African Systems

Lab 8: Creating Malicious Services for Persistence

Lab 9: Scheduled Task Persistence in an African Organization

Advanced Persistence Techniques

Persistence Cheatsheet

Persistence Quiz

Learning Objectives

Introduction to Privilege Escalation in the Cyber Kill Chain

MITRE ATT&CK Framework for Privilege Escalation

Common Privilege Escalation Vectors

Privilege Escalation Tactics and Techniques

Lab 10: Exploitation for Privilege Escalation in African Systems

Lab 11: Leveraging Valid Accounts for Privilege Escalation in an African Context

Lab 12: Detecting and Mitigating Privilege Escalation Attempts in African Networks

Privilege' Escalation Quiz

Privilege Escalation Cheatsheet

Learning Objectives

Introduction to Defense Evasion in the Cyber Kill Chain

MITRE ATT&CK Framework for Defense Evasion:

Common Defense Evasion Vectors

Defense Evasion Tactics and Techniques

Lab 13: Masquerading Techniques in African Environments

Lab 14: Timestomp and File Deletion Evasion in African Systems

Lab 15: Detecting and Responding to Defense Evasion Techniques in African Networks

Defense Evasion Quiz

Security Architecture Enhancement

Detection and Mitigation Strategies

Defense Evasion Cheatsheet

Learning Objectives

Introduction to Credential Access in the Cyber Kill Chain

MITRE ATT&CK Framework for Credential Access:

Common Credential Access Vectors

Credential Phishing Attacks

Credential Access Tactics and Techniques

Lab 16: Credential Dumping Techniques in African Systems

Lab 17: Simulating Credential Phishing Attacks in an African Organization

Credential Access Quiz

Security Awareness and Training

Credential Access Cheatsheet

Learning Objectives

Introduction to Discovery in the Cyber Kill Chain

MITRE ATT&CK Framework for Discovery

Active and Passive Information Gathering

Enumeration and Network Scanning

Common Discovery Vectors

Data Sensitivity and Privacy Considerations

Discovery Tactics and Techniques

Lab 19: System Information Discovery in African Environments

Lab 20: Account Discovery Techniques in African Systems

Lab 21: Detecting and Responding to Discovery Attempts in African Networks

Discovery Quiz

Discovery Cheatsheet

Learning Objectives

Introduction to Lateral Movement in the Cyber Kill Chain

MITRE ATT&CK Framework for Lateral Movement

Common Lateral Movement Vectors

Credential Theft and Pass-the-Ticket Attacks

Exploiting Trust Relationships

Lateral Movement Tactics and Techniques

Lab 22: Windows Admin Shares for Lateral Movement in African Systems

Lab 23: Exploiting Remote Desktop Protocol in African Networks

Lab 24: Detecting and Responding to Lateral Movement Attempts in African Environments

Literal Movement Quiz

Endpoint Security Measures

Lateral Movement Cheatsheet

Learning Objectives

Introduction to Collection in the Cyber Kill Chain

MITRE ATT&CK Framework for Collection

Common Collection Vectors

Data Exfiltration Techniques

Collection Tactics and Techniques

Lab 25: Data Staging Techniques in African Environments

Lab 26: Clipboard Data Collection in African Systems

Lab 27: Detecting and Responding to Collection Attempts in African Networks

Collection Quiz

Collection Cheatsheet

Introduction to Exfiltration in the Cyber Kill Chain

MITRE ATT&CK Framework for Exfiltration

Exfiltration Tactics and Techniques

Data Compression and Encryption

Covert Channels for Exfiltration

Lab 28: Command and Control Exfiltration in African Environments

Lab 29: Using Alternative Protocols for Exfiltration in African Systems

Lab 30: Detecting and Responding to Exfiltration Attempts in African Networks

Exfiltration Quiz

Exfiltration Cheatsheet

Learning Objectives

Introduction to Impact in the Cyber Kill Chain

MITRE ATT&CK Framework for Impact

Destruction and Disruption Techniques

Denial of Service (DoS) and Distributed Denial of Service (DDoS)

Impact Tactics and Techniques

Lab 31: Simulating Data Destruction in African Systems

Lab 32: Disk Structure Wipe Techniques in African Environments

Lab 33: Detecting and Responding to Impact Attempts in African Networks

Impact Cheatsheet

Learning Objectives

Importance of Reporting in Offensive Penetration Testing

Client Communication and Debriefing

Creating Comprehensive Reports

Professionalism and Customer Satisfaction

Interactive Reporting and Workshops

Post-Engagement Activities

Client Education and Knowledge Transfer

Components of a Comprehensive Penetration Testing Report