CyberSec First Responder – Advanced (CFR-A): Attack

Overview

This course will be useful to anyone who is an experienced cybersecurity practitioner and would like to take their skills to the next level. You will begin a multi-stage process by performing reconnaissance and simulating an attack using Metasploit. You'll then exploit code-execution, injection, and web-app vulnerabilities. Lastly, you'll exploit access, network, data, and file-configuration vulnerabilities. These all contribute to the first stage of the overall CFR-A program: Attack. This is the first course in a multi-course Specialization. All of the courses in this Specialization require that you use the provided virtual machines, which include all of the necessary tools and system configurations for the activity environment. The course setup instructions provided in the first module of this course go into more detail about the hardware and software requirements.

Syllabus

Getting Oriented to Your Tools and Environment

Whether you're thinking like an attacker or a defender, it's always good to start by knowing what you're up against. This first lesson will ensure you're suitably acquainted with the systems and software that comprise the overall class environment. You'll also become more familiar with the role(s) each system or software plays throughout the course, as well as your initial role as a threat actor.

Exploiting Software Vulnerabilities

In this lesson, you'll conduct a simulated attack campaign by focusing on exploiting flaws in software. You'll execute different types of attacks on different types of software to see how these flaws can lead to significant compromise.

Exploiting System Vulnerabilities

Your simulated attack campaign will continue and eventually conclude with this lesson, which shifts the focus from exploiting software vulnerabilities to exploiting flaws in systems. These flaws exist regardless of how up to date or regularly patched the organization's software is, so attackers won't hesitate to use them as a vector if the software-based attacks prove ineffective.