The Cybersecurity Nexus (CSX) Vulnerability and Exploitation Course (CVEC) provides students, who possess a basic understanding of penetration testing, a deeper understanding of vulnerability identification and exploitation capabilities. Students will work with real systems in real environments and will leverage real vulnerability analysis and exploitation tools in a live environment. Upon completion, students will understand the how to successfully exploit and maintain a presence within information systems.
Continuing Professional Education (CPE) Credit Count: 18
This lab instructs students on the basics of open source researching a target domain.
OpenVAS is a popular open-source vulnerability scanner and management tool. One of the tools included with OpenVAS is the Greenbone Security Assistant (GSA), a web application which connects to the OpenVAS manager daemon to provide a GUI for vulnerability management. In this lab, you'll become familiar with how these tools work and how to use them.
Conducting a vulnerability scan is important. In this lab, students will learn how to interpret the results from the vulnerability scans.
It's important to realize not all exploits require scripted code and payloads. Sometimes a simple Nmap scan - coupled with a Telnet connection and a clever username - is all you need!
Privilege escalation exploits are one of the most common exploit types. By exploiting flaws in the OS, this type of exploit allows a user to elevate their level of system access. Once elevated, a user can make permanent changes and gain control of the vulnerable system.
This lab will take students through creating backdoors in systems as well as implementing inadvertent backdoors and exploitations.
When a system is accessed, either by normal or clandestine operations, evidence is left behind in log files. Sanitation of those log files is important to cover up any activity that had taken place.
Once a system has been compromised with administrator level access all sensitive system information is available to the attacker. In this lab, we'll take you through obtaining that system information.
This is a challenge lab for the CVEC series which is based on the materials covered in the previous 8 labs.