Network and AD Penetration Testing

Outcome: Run an engagement the professional way, and build a segmented lab with a multi-domain Active Directory forest to test it in.

Topics

• Lab: segmented subnets, Linux and Windows hosts and a multi-domain Active Directory forest in VirtualBox
• Law and ethics: the IT Act, written authorization, scope and rules of engagement
• Why clients commission VAPT: ISO 27001, PCI DSS, CERT-In, RBI and SEBI requirements
• Methodology: PTES and NIST SP 800-115; internal, external and assumed-breach tests
• CVE, CWE and CVSS v4; evidence handling and note-taking

Hands-on labs

• Build and snapshot the advanced lab
• Draft the rules of engagement for a sample client

Deliverable

Lab diagram and a rules-of-engagement document

Job skills covered

• Engagement management
• Compliance-driven VAPT

Outcome: Map an organization's external and internal attack surface and enumerate every live host and service in scope.

Topics

• Passive OSINT: DNS, certificate transparency, search engines, code repositories and leaked credentials
• Internet-wide search engines (Shodan, Censys) and checking results against scope
• Nmap in depth: discovery, TCP and UDP scans, timing, version detection and the scripting engine
• Service enumeration: SMB, SNMP, LDAP, NFS, SMTP, SSH, RDP, HTTP and databases
• Scripting for testers: writing and adapting Bash, Python and PowerShell to automate enumeration

Hands-on labs

• External attack-surface map of a fictional company
• Full enumeration of a segmented lab
• Write a Python script that parses Nmap output

Deliverable

Attack-surface inventory

Job skills covered

• Reconnaissance
• Nmap
• Scripting (Python, Bash, PowerShell)

Outcome: Run credentialed and uncredentialed scans, validate and prioritize the results, review configurations against benchmarks and assess wireless security.

Topics

• Nessus: scan policies, credentialed and uncredentialed scans
• Triage: false positives, manual validation and business context
• Prioritization with CVSS v4, EPSS and CISA's Known Exploited Vulnerabilities catalog
• Configuration review against CIS Benchmarks for Windows, Linux and network devices
• Wireshark: protocol analysis and clear-text credentials
• Wireless assessment: WPA2 and WPA3, handshake capture and cracking, rogue access points (lab demonstration)

Hands-on labs

• Credentialed scan with manual validation of the top findings
• CIS benchmark review of a Windows server

Deliverable

Validated vulnerability assessment summary

Job skills covered

• Vulnerability assessment
• Nessus
• Configuration review
• Wireless security

Outcome: Exploit confirmed weaknesses safely, by framework and by hand, and attack passwords within agreed limits.

Topics

• Metasploit: modules, payloads, sessions and the database
• Manual exploitation: finding, reading and adapting public exploit code
• Common service misconfigurations and default credentials
• Password attacks: spraying and brute force within agreed limits, and hash cracking with Hashcat rules and masks and John the Ripper
• Pass-the-hash and credential reuse

Hands-on labs

• Exploit Linux and Windows targets with and without Metasploit
• Crack captured hashes with rules and masks

Deliverable

Exploitation evidence log

Job skills covered

• Exploitation
• Password attacks
• Metasploit

Outcome: Escalate to administrator on Linux and Windows, pivot through segmented networks and move laterally the way real attackers do.

Topics

• Linux privilege escalation: sudo, SUID, cron, capabilities and kernel issues
• Windows privilege escalation: services, scheduled tasks, stored credentials and token privileges
• Tunneling and pivoting: SSH, SOCKS proxies, Chisel and Ligolo-ng, including double pivots
• Lateral movement: WinRM, PsExec-style execution, WMI and RDP
• Persistence concepts, cleaning up after a test, and how defenders see your activity in Sysmon

Hands-on labs

• Escalate on Linux and Windows targets
• Pivot through two subnets to reach an isolated host

Deliverable

Attack-path evidence across the segmented network

Job skills covered

• Privilege escalation
• Pivoting
• Lateral movement

Outcome: Take a multi-domain forest from a low-privilege user to domain and forest admin, and recommend the fixes that break each path.

Topics

• Domains, forests, trusts, GPOs and ACLs
• Enumeration with NetExec (nxc), LDAP queries and BloodHound attack-path analysis
• Kerberoasting, AS-REP roasting, NTLM relay and authentication coercion
• ACL abuse with bloodyAD
• Delegation attacks: unconstrained, constrained and resource-based constrained delegation
• Active Directory Certificate Services (AD CS) attacks with Certipy
• DCSync, golden and silver ticket concepts, and attacks across forest trusts
• Hybrid identity with Entra ID (introduction); hardening: tiered administration, Windows LAPS, gMSA, SMB and LDAP signing

Hands-on labs

• Attack the lab forest from a low-privilege user to forest admin
• Exploit a misconfigured certificate template

Deliverable

Attack-path diagram and hardening plan

Job skills covered

• Active Directory
• Kerberos and NTLM
• AD CS
• BloodHound and Impacket

Outcome: Use an AI assistant safely to speed up analysis and writing, and turn findings into a report managers and engineers can act on.

Topics

• Using an LLM assistant to summarize scan output, suggest next steps and draft commands, then verifying every answer in the lab
• Client data and confidentiality: what never goes into a public AI service
• Report structure: executive summary, scope, methodology, findings and remediation
• Writing a finding: impact, evidence, reproduction steps, CVSS v4 rationale and a specific fix
• Peer review, and presenting findings to a client

Hands-on labs

• Rewrite a weak finding into a reviewed one
• Summarize a large scan export with AI, then check it against the evidence

Deliverable

Peer-reviewed report sections

Job skills covered

• Report writing
• Client communication
• Responsible AI use

Outcome: Show you can do the job: compromise an unseen segmented network and forest against the clock, then defend your report.

Topics

• Assess an unseen segmented network and Active Directory forest end to end
• CTF challenges across the course's tools and techniques
• Technical and management report with an attack-path diagram
• Technical oral exam on your findings

Hands-on labs

• Timed practical assessment

Deliverable

Network and Active Directory penetration test reports (R-05, R-06)

Job skills covered

• End-to-end network and AD penetration testing