Advanced Penetration Testing

Advanced Penetration Testing (APT)

The course will teach you how to perform a professional security test as well as how to produce the next most important thing… the findings and the report!

The ranges progress in difficulty and reflect an enterprise level architecture. There will be defenses to defeat and challenges to overcome. This is not your typical FLAT network! As the range levels increase you will encounter the top defenses of today and learn the latest evasion techniques.

The format you will use has been used to train 1000s of penetration testers globally, it is proven and effective!

  • The APT is a Follow-on to the ECSA
  • You should have completed the ECSA Practical
  • Prepares you for the LPT Master Certification. Learn More
  • Teaches you how to assess targets and escalate privileges.
  • You will learn a repeatable and measurable approach to penetration testing

Road Map To Certification

Advanced Penetration Testing

iLabs Demo:

About the Program

This program is meticulously designed to demonstrate the advanced concepts including that of scanning against defenses, pivoting between networks, deploying proxy chains and using web shells.

The “virtual cyber ranges” bring 100% practicality into the training sessions and are designed to provide professional skills that demonstrate how professional pentesters determine the attack surface of targets within required time frames and complexities and gain access to the machines and escalate privileges.

The practical environment ranges progress in difficulty and reflect enterprise network architectures. This environment includes defenses and challenges which candidates of the LPT program must defeat and overcome. This is not done through a typical FLAT network! As candidates progress through the various range levels, each encounter will present the top defenses of today and they will learn the latest best practices, tips and tricks, and even evasion techniques.

This training format will help build thousands of penetration testers globally and will prove to be effective!

The Planet’s Most Advanced Penetration Testing Range

The Advanced Penetration Testing course from EC-Council is built on the backbone of the EC-Council’s Advanced Penetration Testing Cyber Range (ECCAPT) and this was designed by experts who each have more than 25 years of professional security testing across the globe.

The range is designed to provide challenges across every level of the attack spectrum.

The ECCAPT consists of entire network segments that replicate an enterprise network — this is not a computer game simulation, this is an accurate representation of an enterprise network that will present the latest challenges Licensed Penetration Tester (Master) Licensed Penetration Tester (Master) to the pen tester. Since the targets and technology continue to change, the ECCAPT is dynamic and machines and defenses will be added as they are observed in the wild. Finally, the targets and segments are progressive in nature, once you get into one machine and or segment, the next one will challenge you even more.

The final range consists of challenges that will require the skills and concepts that have been covered in the course and consist of multiple visible as well as hidden subnets to prepare you for the possible challenges of the LPT (Master) range.

Finally, the ranges are designed to teach professional-level skills to identify the attack surface of targets within a required time frame and, once this has been accomplished, to gain access to the machines and escalate privileges as required. The greater the variety of targets you encounter with and without defenses, the better of a professional penetration tester you will become.

The practical environment ranges progress in difficulty and reflect real enterprise network architecture. This environment includes defenses and challenges which you must defeat and overcome.

This is not your typical flat network! As you progress through the range levels, each encounter will present the top defenses of today and you will learn the best and latest evasion techniques.

This training format has helped thousands of penetration testers globally and is proven to be effective. Everything presented in the course is through an enterprise network environment that must be attacked, exploited, evaded, and defended.

Who Is It For?

This new program is built for ECSA credentialed members who require advanced pentesting skills and a professional level certification to attest their skills to employers.

  • Penetration Testers
  • Network Administrators
  • IT Auditors
  • Information Security Engineers
  • Security Consultants

Module 1Module 2Module 3Module 4Module 5Module 6Module 7Module 8Module 9

Module One: Introduction to Vulnerability Assessment and Penetration Testing

  • Review of vulnerability assessment
  • Types of vulnerability scanners
  • Challenges faced by vulnerability scanners
  • Creating a Security Testing Plan
  • Explaining the Hacking Methodology
  • Concepts of Evasion


Module Two: Information Gathering Methodology

  • Information Gathering with NSLOOKUP and Dig
  • DNS Enumeration with dnsenum and dnsrecon
  • Enumeration with fierce
  • Creating a Security Testing Plan
  • Registrars and Whois
  • Google Hacking Database
  • Enumeration with Metagoofil
  • Cloud Scanning with Shodan

Module Three: Scanning and Enumeration

  • Scanning with Nmap
  • Scanning with the Tool Dmitry
  • Scanning with the Tool Netdiscover
  • Scanning with the Tool sslscan
  • Scanning and Scripting with the Tool hping3
  • Scanning the Internet
  • Using Metasploit Databases and Workspaces
  • Enumeration of Targets
  • Mastering the Nmap Scripting Engine

Module Four: Identify Vulnerabilities

  • Vulnerability Sites
  • Vulnerability Analysis with OpenVAS
  • Web Application Vulnerability Scanners
  • Customizing and Optimizing Scan Policies
  • Web Vulnerability Scanning within Metasploit
  • Analysis of Vulnerability Findings
  • Custom Script Design

Module Five: Exploitation

  • Exploit Sites
  • Manual Exploitation
  • Exploitation with Metasploit
  • Searching for Exploits
  • Remote Exploitations with SMB, RDP and SSH
  • Web Application Exploitation
  • Customization of Shells
  • Staged and Stageless Payloads
  • Custom Exploits

Module Six: Post Exploitation

  • Disabling protections
  • Local Assessment
  • Harvesting Information
  • Scripts for pilfering
  • Leveraging backdoors
  • Mangling log files
  • Escalation of privileges
  • Data search and extraction techniques
  • Achieving an advanced shell
  • File transfers

Module Seven: Advanced Tips and Techniques

  • Scanning with Nmap against Defenses
  • Session routing
  • Performing pivoting
  • Executing a double pivot
  • Custom payloads for network traversal
  • Using proxies
  • Leveraging web shells
  • Custom web shells to avoid detection

Module Eight: Preparing a Report

  • Importance of a report
  • Avoiding the common mistakes
  • Compiling data in Magic Tree
  • Designing the report structure
  • Essential report components

Module Nine: Practice Ranges

ANSINAVY COOLARMY COOLMARINE CORPS COOLAIR FORCE COOL

EC-Council is dedicated to working with the US Department of Defense to bring the highest standards of Training, Education and Certification to our military.

 

Independent Accreditation ensures Quality of Certification

 

EC-Council Certifications are developed to the highest standards and have achieved numerous accreditations including ANSI 17024 for:

 

 


 

EC-Council Cyber Security Certifications and the US NAVY

 

Six EC-Council Certifications are recognized by the United States Navy in over 100 Cyber Security Job roles, across 18 occupations. Ranging from Commander in Executive Cyberspace Leadership to Cyber Warfare Engineer, Special Agents, Incident Handlers, to Cryptologic Warfare Engineers, Cybersecurity careers with the US NAVY are exciting, holding an EC-Council certification provides great opportunity for advancement in a US NAVY career.

The decisions of Department of the NAVY to incorporate industry recognized certifications into the Cyber IT & Cyber Security Workforce Framework ensures as our service personnel advance their careers and eventually transition to civilian life, their skills and credentials are widely recognized by the Industries they will continue to work in as Veterans.

Certifications recognized, accepted, and often funded by the US NAVY include:

 

Funding opportunities for career advancement are available for Active Duty NAVY personnel through the NAVY COOL program.

US NAVY approves EC-Council Certifications across 18 Occupations and over 100 Job roles


Cryptologic Warfare LDO

  • Cryptologic Warfare LDO


CTN-Cryptologic Technician Networks

  • CTN – Global Network Operations Director
  • CTN – Global Network Operations Manager
  • CTN – Global Network Operations Technician


Cyber IT/CSWF Cyber Defense Infrastructure Support

  • CNDSP-IS
  • CPT Network Infrastructure Service Specialist
  • Systems Security Engineer


Cyber IT/CSWF Executive Cyberspace Leadership

  • Commander
  • Deputy Commander


Cyber IT/CSWF Security Program Management (CISO)

  • Chief Information Security Officer (CISO)
  • Common Control Provider
  • Cybersecurity Officer
  • Enterprise Security Officer
  • Facility Security Officer
  • Information Technology (IT) Director
  • Principal Security Architect
  • Risk Executive
  • Security Domain Specialist
  • Senior Agency Information Security (SAIS) Officer


Cyber IT/CSWF Vulnerability Assessment and Management

  • Blue Team Technician
  • Close Access Technician
  • CNDSP AU
  • Network Security Vulnerability Technician (NSVT)
  • Penetration Tester


Cryptologic Warfare Officer

  • Cryptologic Warfare Officer


Cyber IT/CSWF All Source Analysis

  • Computer Network Defense (CND) Analyst


Cyber IT/CSWF Cyber Operations Planning

  • CPT Operations Officer
  • CPT Platoon Leader
  • Network Warfare Cyber Planner




Cyber IT/CSWF Incident Response

  • CNDSP IR
  • Incident Handler
  • Intrusion Analyst
  • Network Security Vulnerability Technician (NSVT)


Cyber IT/CSWF Strategic Planning and Policy Development

  • Chief Information Officer (CIO)
  • Chief Information Security Officer (CISO)
  • Command Information Officer
  • Information Security Policy Analyst
  • Information Security Policy Manager
  • Policy Writer and Strategist
  • Cyberspace Workforce Developer and Manager (CSWF-PM) (DCWF Role Code 751)
  • Cyberspace Policy and Strategy Planner (DCWF Role Code 752)


Cyber Warfare Engineer

  • Cyber Warfare Engineer


Cryptologic Warfare Technician CWO

  • Cryptologic Warfare Technician CWO


Section 2Cyber IT/CSWF Cyber Defense Analysis

  • CNDSP Analyst
  • CNDSP Manager
  • CPT CND Manager
  • CPT Interactive Operator
  • CPT Systems Architect
  • Cyber Security Analyst
  • Incident Analyst


Cyber IT/CSWF Digital Forensics

  • Computer Forensic Analyst
  • Computer Network Defense (CND) Analyst
  • Digital Forensic Examiner
  • Digital Media Collector
  • Forensic Analyst
  • Forensic Analyst (Cryptologic)
  • Forensic Technician
  • Network Forensic Examiner


Cyber IT/CSWF Investigation

  • Computer Crime Investigator
  • Special Agent


Cyber IT/CSWF Threat Analysis

  • Computer Network Defense (CND) Analyst
  • Threat Analyst


Cyber Warrant Officer CWO

  • Cyber Warrant Officer CWO


*All information represented here can be found on the NAVY COOL site. To find what EC-Council Certifications map to your eligible Job role, select “Full Credential Search” then under Credential Agency, select or search for “International Council of E-Commerce Consultants”.

 

EC-Council Cyber Security Certifications and the US ARMY

 

Five EC-Council Certifications are recognized by the United States ARMY across 15 occupations. Ranging from Cyber Operations Technician to Target Digital Network Analyst. Our certifications are in use as baseline credentials across ARMY Cyber throughout intelligence as well as deployed infantry. EC-Council is proud to work with various groups in the ARMY to support the Mission of ARMY Cyber.

Certifications recognized, accepted, and often funded by the US ARMY include:

 

Funding opportunities for career advancement are available for Active Duty ARMY personnel through the ARMY COOL program.

US ARMY approves EC-Council Certifications across 15 Occupations

  • Cryptologic Cyberspace Intelligence Collector - Analyst
  • CYBER Operations Technician
  • Information Protection Technician
  • Military Intelligence (MI) Systems Maintainer/Integrator
  • Senior Network Operations Technician
  • Cryptologic Cyberspace Intelligence Collector - Analyst
  • CYBER Operations Technician
  • Information Protection Technician
  • Military Intelligence (MI) Systems Maintainer/Integrator
  • Senior Network Operations Technician
  • Counterintelligence Agent
  • Cyber Operations Specialist
  • Infantryman
  • Information Technology Specialist
  • Nodal Network Systems Operator-Maintainer

 

EC-Council Cyber Security Certifications and the Marine Corps

 

Five EC-Council Certifications are recognized by the United States Marine Corps in 79 Cyber Security Job roles, across 17 occupations. Ranging from Cyber Security Technician, to Signals Intelligence and Electronic Warfare Operator, to Cyber Security Chief.

Certifications recognized, accepted, and often funded by the US Marine Corps include:

 

Funding opportunities for career advancement are available for Active Duty MARINE CORPS personnel through the Marine COOL program.

US ARMY approves EC-Council Certifications across 15 Occupations


Aviation Logistics Information Management System (ALIMS) Specialist

  • Aviation Logistics Information Management System (ALIMS) Specialist


Cyber IT/CSWF Cyber Defense Analysis

  • CNDSP Analyst
  • CNDSP Manager
  • CPT CND Manager
  • CPT Interactive Operator
  • CPT Systems Architect
  • Cyber Security Analyst
  • Incident Analyst


Cyber IT/CSWF Investigation

  • Computer Crime Investigator
  • Special Agent


Cybersecurity Technician

  • Cybersecurity Technician


Cyber IT/CSWF All Source Analysis

  • Computer Network Defense (CND) Analyst


Signals Intelligence and Electronic Warfare Operator/Analyst

  • Signals Intelligence and Electronic Warfare Operator/Analyst


Communications Chief

  • Cyber Network Systems Chief
  • Telecommunications Systems Chief
  • Transmissions Chief


Cyber IT/CSWF Cyber Defense Infrastructure Support

  • CNDSP-IS
  • CPT Network Infrastructure Service Specialist
  • Systems Security Engineer


Cyber IT/CSWF Threat Analysis

  • Computer Network Defense (CND) Analyst
  • Threat Analyst




Information Security Technician

  • Information Security Technician


Cyber IT/CSWF Incident Response

  • CNDSP IR
  • Incident Handler
  • Intrusion Analyst
  • Network Security Vulnerability Technician (NSVT)


Signals Intelligence/Electronic Warfare Technician

  • Signals Intelligence/Electronic Warfare Technician


Cryptologic Cyberspace Analysts

  • Cryptologic Cyberspace Analysts


Cyber IT/CSWF Digital Forensics

  • Computer Forensic Analyst
  • Computer Network Defense (CND) Analyst
  • Digital Forensic Examiner
  • Digital Media Collector
  • Forensic Analyst
  • Forensic Analyst (Cryptologic)
  • Forensic Technician
  • Network Forensic Examiner


Cyber IT/CSWF Vulnerability Assessment and Management

  • Blue Team Technician
  • Close Access Technician
  • CNDSP AU
  • Network Security Vulnerability Technician (NSVT)
  • Penetration Tester


Intelligence Surveillance Reconnaissance (ISR) Systems Engineer

  • Intelligence Surveillance Reconnaissance (ISR) Systems Engineer


Cyber Security Chief

  • Cyber Security Chief
  • Cyber Network Operator
  • Cyber Network Systems Chief
  • Intelligence Surveillance Reconnaissance (ISR) Systems Engineer



 

EC-Council Cyber Security Certifications and the US Air Force

 

Four EC-Council Certifications are recognized by the United States Air Force in 150 Cyber Security Job roles, across 8 occupations. Occupations are recognized in fields like; Cyber Transport Systems, Intelligence, and Cyber Warfare Operations.

Certifications recognized, accepted, and often funded by the US AIR FORCE include:

 

Funding opportunities for career advancement are available for Active Duty AIR FORCE personnel through the AIR FORCE COOL program.


Client Systems

  • Computer Operation Series
  • Computer Science Series
  • Cryptanalysis Series
  • Cryptography Series
  • Information Technology Management Series
  • Intelligence Series
  • Telecommunications Mechanic


Cyber Surety

  • Security Administration Series
  • Intelligence Series
  • Information Technology Management Series
  • Computer Science Series
  • Computer Operation Series
  • Security Administration Series


Cyber Transport Systems

  • Intelligence Series
  • Information Technology Management Series
  • Cryptography Series
  • Cryptanalysis Series
  • Computer Science Series
  • Computer Operation Series


Flight Engineer

  • Air Safety Investigating Series
  • Aircraft Attending
  • Aircraft Electrician
  • Aircraft Engine Mechanic
  • Aircraft Mechanic
  • Aircraft Operation Series
  • Aircrew Technician Series
  • Chief Electrician
  • Electrician
  • Electrician-Maintenance
  • Electronic Digital Computer Mechanic
  • Electronic Industrial Controls Mechanic
  • Electronic Integrated Systems Mechanic
  • Electronic Measurement Equipment Mechanic
  • Electronics Mechanic
  • Electronics Technical Series
  • Electronics Technician
  • Second Electrician
  • Third Electrician



Computer Systems Programming

  • Intelligence Series
  • Information Technology Management Series
  • Electronics Technician
  • Electronics Technical Series
  • Computer Science Series
  • Computer Operation Series


Cyber Systems Operations

  • Telecommunications Mechanic
  • Security Administration Series
  • Intelligence Series
  • Information Technology Management Series
  • Computer Science Series
  • Computer Operation Series
  • Computer Clerk and Assistant Series


Cyberspace Warfare Operations

  • Information Technology Management Series
  • Cryptography Series
  • Cryptanalysis Series
  • Computer Science Series
  • Computer Operation Series
  • Computer Clerk and Assistant Series


Fusion Analyst

  • Statistical Assistant Series
  • Intelligence Series
  • Information Technology Management Series
  • Computer Science Series



What is LPT Master?

Upon completion of the program, candidates will be prepared to challenge the LPT Master exam. LPT Master brings to you a new range of real world challenges that will not only test your Pen-testing skills but guarantees you an experience that is not built for the weak hearted. If you have been looking for a way to test your Pen-testing abilities, this is your chance to prove you have what it takes.

Being an LPT (Master) means that you can find chinks in the armor of defense-in-depth network security models with the help of network pivoting, making exploit codes work in your favor, or by writing Bash, Python, Perl, and Ruby scripts. The exam demands that you think on your feet, be creative in your approach, and not rely on the conventional techniques. Outsmarting and out maneuvering the adversary is what sets you apart from the crowd. This completely hands-on exam offers a challenge like no other by simulating a complex network of a multinational organization in real time. This experience will test your perseverance and focus by forcing you to outdo yourself with each new challenge.

The LPT (Master) is the world’s first fully online, remotely proctored LPT (Master) practical exam, which challenges the candidates through a grueling 18 hours of performance based, hands-on exam categorized into three practical exams for six-hour duration each. The exam requires the candidates to demonstrate a methodical approach to test and validate security defenses. The LPT (Master) exam is developed with close collaboration with SMEs and practitioners around the world after a thorough job role, job task, and skills-gap analysis.

You will be presented with a complex network of a simulated multi-national organization with several militarized and Demilitarized zones, and will be asked to perform a near real-life black-box penetration testing. The LPT Master exam requires you to demonstrate mastery over advanced penetration testing techniques including exploit writing, LFI, RFI, proxy chaining, multi-layered pivoting.

Eligibility Requirements

There is no predefined eligibility criteria for those interested in attempting the LPT (Master) exam. For complete information click here


Critical Testing Design Ingredients

Progressive assessment patterns

Studies prove that progressive assessment patterns produce higher reliable results as compared to traditional assessment patterns. The LPT (Master) certification exam is designed as real-world scenario in a progressive 3 level challenge that includes defensive and offensive challenges which you must defeat and overcome. This is not the typical FLAT network! As the candidate progresses through the levels, it challenges the candidates’ knowledge, skill and ability of compromising different systems while leveraging on advanced evasion techniques.

Time-bounded Gamified Design

The reality and essence of a real-time penetration testing experience is a blend of time and stress constraints. A number of psychology studies show that time bounded tests with a gamified design (vs an open-ended test without simulation) can bring about higher levels of influences on performance, resulting in invalid outcomes. The LPT (Master) challenges are designed to push candidates to perform under time pressure, requiring a demonstration of higher level of skill as candidates move through different difficult levels of the exam.

Deep-dive analytical approach

If you think you can “wing it”, think again. The LPT (Master) challenges are designed to test your skills on key aspects of penetration testing at various intervals, each in a different scenario. There is no way to memorize the answers or “wing it”. This process ensures that you have the required analytical eye to capture important data and use this to proceed towards the end goal of completing the task. With this, we will be able to certify your skills of being able to exploit vulnerabilities as a world-class penetration tester.

Virtual Lab Environment

EC-Council will provide the entire cyber-range through its cloud based cyber range, iLabs. The LPT (Master) labs are designed to give the user the ultimate hands-on experience. Each exercise category has its own Virtual Private Cloud that comes preconfigured with vulnerable websites, Victim Machines, and the environment is LOADED with tools. This also includes all the supporting tools required to explore and launch your attacks.

Remote Live Proctoring

EC-Council launches the world’s first remotely proctored, online penetration testing exam as a critical industry requirement to verify the identity of candidates while providing a controlled environment to protect the sanctity of such a high stake exams. This process ensures the credibility to the LPT (Master) credential by eliminating external influences that can affect exam results. While this exam does not limit the candidate to leverage their research skills and take advantage of documented resources available, the proctored exam maintains a close monitoring of the exam session to ensure complete compliance to examination requirements.

Report Writing

To successfully earn the LPT (Master) credential, candidates are expected to fully document their Penetration Test outcomes in a professional Penetration Test report. This is an important requirement as many Penetration Testers are unable to prepare professional reports to management or clients hence reducing drastically the value of the Penetration Test exercise, since the outcomes and proposed remediation are not properly documented and communicated. The report will be reviewed and scored by an assessment rubric built by subject matter experts in the Penetration Testing domain.

Add the Mobile Security Tool Kit to Your Training

For the past several years we have offered our training on a mobile device so that you can take your training with you and eliminate the need to stream the videos. This device is the next generation mobile device. This is a fully loaded pen test tool kit comes equipped with a custom Linux Hacking OS and, wait for it… we can load your course (or 2) onto the device. In the sage words of Ray Bradbury, “Something Wicked This Way Comes.”

Terms of Use

Getting Started

Terms of Use

Note: The STORM mobile security tool kit contains the STORM Linux (a Raspbian based, customized distro of Linux) including all of the associated security tools. These tools are very powerful and all proper precautions should be adhered to at all times.

Always remember that the difference between illegal and ethical hacking comes down to one word; permission. It is illegal to utilize these or any other pen testing tools on a network or website without permission.

As stated in the terms and conditions, EC-Council is not responsible for illegal use of these tools and you accept the full liability for its usage. The entire code of ethics can be found here.

Specs

  • Broadcom BCM2837B0, Cortex-A53 (ARMv8) 64-bit SoC @ 1.4GHz Mobile System with Case
  • 1GB LPDDR2 SDRAM
  • 7 inch Touch Screen Display
  • 2.4GHz and 5GHz IEEE 802.11.b/g/n/ac wireless LAN, Bluetooth 4.2, BLE
  • Gigabit Ethernet over USB 2.0 (maximum throughput 300 Mbps)
  • Extended 40-pin GPIO header
  • Full-size HDMI
  • 4 USB 2.0 ports
  • CSI camera port for connecting a Raspberry Pi camera

  • DSI display port for connecting a Raspberry Pi touchscreen display
  • 4-pole stereo output and composite video port
  • Micro SD port for loading your operating system and storing data, with Hacker StormOS, Raspbian-based OS included.
  • 5V/2.5A DC power input
  • USB 2.0 A to B Micro Power Cable. [The Storm can be powered from a 5V micro-USB source, Power Supply not included with base package.]
  • Power-over-Ethernet (PoE) support (requires separate PoE HAT)
  • Rollup Water Resistant Keyboard
  • Field Case Organizer for all your gear

Introducing the STORM!

Hack like the Pros

Take Your Hacking by STORM!

Still have questions?

1-888-330-HACK Mon - Fri / 8:00 AM - 5:00 PM