GIAC Penetration Tester

Good tests are won in the first hours. You collect public information from DNS, search engines, metadata and social sources, and turn it into target lists, naming conventions and likely weak points.

• Passive and active reconnaissance
• DNS enumeration and zone information
• Search engines and public code and document leaks
• Metadata from files and public websites
• Employee and technology profiling
• Organizing recon data into a target list

You build A reconnaissance report for a practice domain, with a ranked target list.

Scanning decides where to spend time. You choose the technique to find live hosts, scan ports and services, identify operating systems, and tune scans to the network’s limits and the test’s need for stealth.

• Host discovery methods and when each works
• TCP and UDP port scanning with Nmap
• Service and operating system detection
• Scan timing, evasion and firewalls
• Scripting scans and parsing results
• Netcat for manual probing and banner grabbing

You build A scanning plan and results map for a lab network of mixed systems.

Scanner output is a lead list, not a finding list. You run vulnerability scans, read the results, verify what is real, and choose which weaknesses are worth exploiting under the rules of the engagement.

• Authenticated and unauthenticated scanning
• Scanner configuration and safe checks
• Verifying findings and removing false positives
• Linking vulnerabilities to exploits
• Prioritizing by exploitability and impact
• Scanning web applications at a basic level

You build A verified findings list from a vulnerability scan, with evidence for each confirmed weakness.

Exploitation proves a weakness is real. You learn how exploits, payloads and shells work, then use Metasploit at an intermediate level to deliver them, manage sessions, and choose a payload that fits the target and the scope.

• Exploit types: server-side, client-side and local
• Payloads, shells and staging
• Metasploit modules, options and workspaces
• Generating and delivering standalone payloads
• Meterpreter sessions and handlers
• Exploit reliability and avoiding service damage

You build Exploited lab hosts with a documented chain of steps and evidence for each.

A foothold is the start of the work. You pull data from compromised machines, raise privileges, and pivot through the host to reach networks the test machine could not see, while recording each step for the report.

• Situational awareness on a compromised host
• Collecting files, credentials and configuration data
• Windows and Linux local privilege escalation
• Port forwarding and SOCKS proxies
• Routing traffic through Meterpreter and other tools
• Cleaning up and documenting changes

You build A pivot from a first host into a second network, with route diagrams and collected evidence.

Passwords are still the shortest path through most networks. You identify hash formats, obtain them from hosts and the network, crack them with the method that fits, and attack logins with guessing and spraying within the rules.

• Hash formats: LM, NT, NetNTLM and Linux hashes
• Capturing and relaying authentication on a network
• Cracking with Hashcat and John
• Wordlists, rules and masks
• Online guessing and password spraying
• Pass the hash and using hashes without cracking

You build A cracking campaign against a set of lab hashes, with method choices and results analyzed.

Domain control is the usual end goal. You map a domain, attack Kerberos with techniques such as Kerberoasting and AS-REP roasting, escalate through misconfiguration, and learn the persistence techniques that keep administrator access.

• Active Directory structure and trust relationships
• Domain enumeration and attack path mapping
• How Kerberos works and where it breaks
• Kerberoasting and AS-REP roasting
• Delegation abuse and misconfigured permissions
• DCSync, ticket forging and domain persistence
• Reporting domain findings clearly

You build A domain compromise path in a lab Active Directory, from low-privilege user to domain administrator.

Identity in the cloud is a new front. You learn how Entra ID works, the ways to authenticate to Azure, how federation and single sign-on are set up, and the typical attacks on tenants and on applications registered in them.

• Entra ID tenants, users, groups and roles
• Authentication methods and token types
• Federation and single sign-on configurations
• Password spraying and token theft against cloud identity
• Application registrations, consent and service principals
• Moving from identity access to Azure resources

You build An attack path in a lab Azure tenant, from a user token to a sensitive resource.

C2 is how an operator keeps access over time. You study how it is designed, which channels it uses, how popular frameworks implement it, and what each choice means for the stealth and stability of a test.

• C2 architecture: implants, listeners and redirectors
• Channels: HTTP and HTTPS, DNS and others
• Beaconing, jitter and sleep behavior
• Popular open-source and commercial C2 frameworks
• Operational security during a test
• How defenders detect C2 traffic

You build A working C2 setup in a lab, with a profile and the detections it triggers.

Run a complete engagement against a lab organization. You plan, scan, exploit, pivot, crack, take the domain and the cloud tenant, and write the report that a client’s technical staff and executives would each read.

• Scoping and planning the engagement
• Recon, scanning and vulnerability analysis
• Exploitation, pivoting and credential attacks
• Domain and cloud compromise
• Writing and presenting the report

You build A complete penetration test report with evidence, attack narrative and prioritized recommendations.