GIAC Experienced Penetration Tester

Offensive operations start with what can be learned without touching the target. You gather information from file metadata, open-source intelligence, infrastructure documents and automated recon tools, and turn it into a working picture of the environment.

• File metadata and document leakage
• Open-source intelligence on an organization
• Infrastructure documentation and public records
• Automated reconnaissance tooling
• Combining sources into a target profile
• Deciding what reconnaissance justifies the next step

You build A reconnaissance profile for a lab organization, built from public and non-public sources.

Scanning in a live engagement must balance speed, stealth and accuracy. You probe networks to map hosts, service versions, weaknesses and infrastructure, and choose scan settings that fit the lab’s scope and time.

• Host discovery across a lab network
• Service and version identification
• Mapping infrastructure from scan results
• Scan timing and stealth trade-offs
• Prioritizing scan results for exploitation
• Documenting scan coverage

You build A network map of a lab environment with hosts, services and a prioritized target list.

Some flaws exist only to open a path to something else. You use tools to exploit network weaknesses, turn an unreachable host or subnet into one you can reach, and confirm the access without breaking the lab.

• Common network access vulnerabilities
• Tools for exploiting network-level weaknesses
• Confirming access without causing disruption
• Chaining a network exploit into further access
• Recording evidence of the exploited path
• Recognizing when a network flaw is a dead end

You build A documented exploit chain that opens access to a previously unreachable subnet in the lab.

Credentials remain the fastest route once you have a foothold. You use guessing and cracking utilities to get past logins, and use what you find to expose policy violations that matter to the engagement.

• Obtaining credentials and hashes in the lab
• Choosing a cracking or guessing approach by context
• Common cracking and guessing utilities
• Policy violations that cracking reveals
• Using cracked credentials to progress
• Recording password findings for the report

You build A password attack log for the lab engagement, with cracked credentials and the access each one opened.

A foothold becomes useful only when you move beyond it. You pivot across the network and raise permissions, reaching systems and data that were out of scope from the start.

• Pivoting through a compromised host
• Mapping what a new vantage point can reach
• Local and domain privilege escalation techniques
• Credential reuse across hosts
• Reaching restricted segments through pivoting
• Recording the path for the final report

You build A lateral movement and privilege escalation path through the lab, with each hop documented.

Domain environments are often the heart of an enterprise test. You apply penetration testing methods to Active Directory, finding the misconfigurations and trust relationships that let an operator move from a user to the domain.

• Enumerating domain structure and trusts
• Misconfigurations that lead to escalation
• Delegation and permission abuse
• Moving from user access to administrative access
• Persistence considerations within the lab’s scope
• Documenting domain compromise clearly

You build A domain compromise write-up for the lab Active Directory, from initial access to elevated control.

Much offensive tooling runs from Linux, and knowing it well speeds every other module. You apply Linux-based tooling and methods throughout a test, from scripting to exploitation support.

• A Linux attack platform and its toolset
• Scripting to support manual testing
• Linux-based exploitation and post-exploitation tools
• File transfer and pivoting from Linux
• Troubleshooting tools in a live lab
• Keeping a Linux toolkit organized under time pressure

You build A working Linux toolkit and script set used across the lab engagement, with notes on each tool’s role.

Holding access through a live engagement means keeping a channel open without being shut down. You maintain contact with a command and control framework while staying undetected within the lab’s monitoring.

• Establishing a C2 channel in the lab
• Choosing a channel type for the environment
• Staying undetected against lab monitoring
• Handling connection loss and re-establishing access
• Operational discipline during a live engagement
• Documenting C2 use for the report

You build A maintained C2 channel through the lab engagement, with notes on evasion choices made.

Run the whole engagement end to end. You recon, scan, exploit, crack, pivot, escalate, take the domain and keep command and control alive, then document the entire operation as a client report would require.

• Scoping and starting the engagement
• Recon, scanning and initial access
• Credential attacks and lateral movement
• Domain compromise and command and control
• Writing the final report

You build A complete lab engagement report covering every stage from reconnaissance to domain compromise.