VAPT

Vulnerability Assessment Training

Course Description:

In this Vulnerability Assessment training course, you learn how to create a network security vulnerability assessment checklist by exposing infrastructure, server, and desktop vulnerabilities, create and interpret reports, configure vulnerability scanners, detect points of exposure, and ultimately prevent network exploitation.

Prerequisites

  • Basic understanding of network security and security issues
  • Knowledge of TCP/IP Networking,OSI Model, Network security goals and concerns

TOPICS:

Module 1: Introduction

  • Defining vulnerability, exploit, threat and risk
  • Creating a vulnerability report
  • Conducting an initial scan
  • Common Vulnerabilities and Exposure (CVE) list

Module 2: Scanning and exploits

  • Vulnerability detection methods
  • Types of scanners
  • Port scanning and OS fingerprinting
  • Enumerating targets to test information leakage
  • Types of exploits: worm, spyware, backdoor, rootkits, Denial of Service (DoS)
  • Deploying exploit frameworks

Module 3: Uncovering infrastructure vulnerabilities

  • Uncovering switch weaknesses
  • Vulnerabilities in infrastructure support servers
  • Network management tool attacks

Module 4: Attacks against analyzers and IDS

  • Identifying Snort IDS bypass attacks
  • Corrupting memory and causing Denial of Service

Module 5: Exposing server vulnerabilities

  • Scanning servers: assessing vulnerabilities on your network
  • Uploading rogue scripts and file inclusion
  • Catching input validation errors
  • Performing buffer overflow attacks
  • SQL injection
  • Cross–Site Scripting (XSS) and cookie theft

Module 6: Revealing desktop vulnerabilities

  • Scanning for desktop vulnerabilities
  • Client buffer overflows
  • Silent downloading: spyware and adware
  • Identifying design errors

Module 7: Implementing scanner operations and configuration

  • Choosing credentials, ports and dangerous tests
  • Preventing false negatives
  • Creating custom vulnerability tests
  • Customizing Nessus scans
  • Handling false positives

Module 8: Creating and interpreting reports

  • Filtering and customizing reports
  • Interpreting complex reports
  • Contrasting the results of different scanners

Module 9: Researching alert information

  • Using the National Vulnerability Database (NVD) to find relevant vulnerability and patch information
  • Evaluating and investigating security alerts and advisories
  • Employing the Common Vulnerability Scoring System (CVSS)

Module 10: Identifying factors that affect risk

  • Evaluating the impact of a successful attack
  • Determining vulnerability frequency
  • Calculating vulnerability severity
  • Weighing important risk factors
  • Performing a risk assessment