Information Gathering & Reconnaissance (10%)

• Perform Host Discovery and Port Scanning on Target Network
• Enumerate Information From Services Running on Open Ports

Initial Access & Client-Side Attacks (10%)

• Develop Payloads For Initial Access
• Identify and Exploit Vulnerabilities in Web Browsers
• Develop Web Delivery Payloads For Client-Side Execution

Manual Web Application Attacks (15%)

• Perform Web Application Enumeration to Identify Potential Vulnerabilities & Misconfigurations
• Identify and Exploit Common Web Application Vulnerabilities For Initial Access (SQLi, XSS, Command Injection, etc)
• Exfiltrate Data and Credentials From Compromised Web Applications and Databases
• Utilize Credentials and Data From Compromised Web Apps To Extend Access On The Target Network

Exploitation & Post-Exploitation With C2 Frameworks (20%)

• Setup & Configure PowerShell-Empire for Post-Exploitation
• Perform Local Enumeration With PowerShell-Empire Modules
• Identify and Exploit Privilege Escalation Vulnerabilities
• Establish Persistence on Target Systems With PowerShell-Empire
• Perform Credential Access to Obtain Password Hashes and Other Credentials
• Perform Lateral Movement through Network Pivoting

Exploit Development (20%)

• Develop/Modify Custom Exploit Code For Initial Access and Privilege Escalation
• Identify and Exploit Windows Memory Corruption Vulnerabilities (Stack Overflow, Buffer Overflow)
• Identify and Exploit Linux Memory Corruption Vulnerabilities (Stack Overflow, Buffer Overflow)
• Bypass Linux Memory Protection Countermeasures (ASLR)

Active Directory Penetration Testing (25%)

• Perform Active Directory Enumeration
• Perform Password Spraying For Initial Access
• Abuse Active Directory Authentication Protocols For Initial Access (NTLM, Kerberos)
• Perform Active Directory Lateral Movement Techniques (Pass-the-Hash, Pass-the-Ticket)
• Establish Persistence on Active Directory via Silver and Golden Tickets
• Identify and Exploit Local Privilege Escalation Vulnerabilities