SANS SEC560 Network Penetration Testing and Ethical Hacking 2017 دانلود دوره

شرکت SANS یکی از شرکت های قدرتمند در حوزه امنیت اطلاعات می باشد که سایت این شرکت به آدرس دارای مطالب بسیار مفید و کاربردی در مورد امنیت شبکه و اطلاعات است. هزینه دوره های شرکت SANS بسیار بالا بوده و امکان شرکت در این دوره ها برای اغلب افراد امکان پذیر نمی باشد ولی این شرکت مقالات بسیار مفید وکاربردی در سایت خود به صورت رایگان قرار داده است که می توانید از آن ها استفاده نمایید. یکی از بخش های سایت شرکت SANS، بخش مربوط به هشدارهای امنیتی یا SANS Awareness می باشد که در آن به صورت کوتاه در یک تا سه صفحه به اعلام هشدارهای امنیتی نموده است.

لینک دانلود SEC560 Network Penetration Testing and Ethical Hacking 2017

حجم: 9.52 گیگابایت

دانلود بخش اول
دانلود بخش دوم
دانلود بخش سوم
دانلود بخش چهارم
دانلود بخش پنجم
رمز فایل:

SEC560 Network Penetration Testing and Ethical Hacking 2017

As a cybersecurity professional, you have a unique responsibility to find and understand your organization’s vulnerabilities and to work diligently to mitigate them before the bad guys pounce. Are you ready? SEC560, the flagship SANS course for penetration testing, fully arms you to address this duty head-on.


With comprehensive coverage of tools, techniques, and methodologies for network penetration testing, SEC560 truly prepares you to conduct high-value penetration testing projects step-by-step and end-to-end. Every organization needs skilled information security personnel who can find vulnerabilities and mitigate their effects, and this entire course is specially designed to get you ready for that role. The course starts with proper planning, scoping and recon, then dives deep into scanning, target exploitation, password attacks, and web app manipulation, with over 30 detailed hands-on labs throughout. The course is chock full of practical, real-world tips from some of the world’s best penetration testers to help you do your job safely, efficiently…and masterfully.


SEC560 is designed to get you ready to conduct a full-scale, high-value penetration test – and on the last day of the course you’ll do just that. After building your skills in comprehensive and challenging labs over five days, the course culminates with a final full-day, real-world penetration test scenario. You’ll conduct an end-to-end pen test, applying knowledge, tools, and principles from throughout the course as you discover and exploit vulnerabilities in a realistic sample target organization, demonstrating the knowledge you’ve mastered in this course.


You will learn how to perform detailed reconnaissance, studying a target’s infrastructure by mining blogs, search engines, social networking sites, and other Internet and intranet infrastructures. Our hands-on labs will equip you to scan target networks using best-of-breed tools. We won’t just cover run-of-the-mill options and configurations, we’ll also go over the lesser known but super-useful capabilities of the best pen test toolsets available today. After scanning, you’ll learn dozens of methods for exploiting target systems to gain access and measure real business risk. You’ll dive deep into post-exploitation, password attacks, and web apps, pivoting through the target environment to model the attacks of real-world bad guys to emphasize the importance of defense in depth.

Course Syllabus

SEC560.1: Comprehensive Pen Test Planning, Scoping, and Recon

In this section of the course, you will develop the skills needed to conduct a best-of-breed, high-value penetration test. We will go in-depth on how to build penetration testing infrastructure that includes all the hardware, software, network infrastructure, and tools you will need to conduct great penetration tests, with specific low-cost recommendations for your arsenal. We will then cover formulating a pen test scope and rules of engagement that will set you up for success, including a role-play exercise. We’ll also dig deep into the reconnaissance portion of a penetration test, covering the latest tools and techniques, including hands-on document metadata analysis to pull sensitive information about a target environment, as well as a lab using Recon-ng to plunder a target’s DNS infrastructure for information such as the anti-virus tools the organization relies on.

  • A Tour of the SANS Slingshot Penetration Testing Virtual Machine
  • Formulating an Effective Scope and Rules of Engagement
  • Document Metadata Treasure Hunt
  • Utilizing Recon-ng to Plunder DNS for Useful Information

CPE/CMU Credits: 7

  • The Mindset of the Professional Pen Tester
  • Building a World-Class Pen Test Infrastructure
  • Creating Effective Pen Test Scopes and Rules of Engagement
  • Detailed Recon Using the Latest Tools
  • Effective Pen Test Reporting to Maximize Impact
  • Mining Search Engine Results
  • Document Metadata Extraction and Analysis

SEC560.2: In-Depth Scanning

We next focus on the vital task of mapping the target environment’s attack surface by creating a comprehensive inventory of machines, accounts, and potential vulnerabilities. We will look at some of the most useful scanning tools freely available today and run them in numerous hands-on labs to help hammer home the most effective way to use each tool. We will also conduct a deep dive into some of the most useful tools available to pen testers today for formulating packets: Scapy and Netcat. We finish the day covering vital techniques for false-positive reduction so you can focus your findings on meaningful results and avoid the sting of a false positive. And we will examine the best ways to conduct your scans safely and efficiently.

  • Getting the Most Out of Nmap
  • OS Fingerprinting and Version Scanning In-Depth
  • The Spectacular Scapy Packet Manipulation Suite
  • The Nmap Scripting Engine
  • The Nessus Vulnerability Scanner
  • Enumerating User Accounts
  • Netcat for the Pen Tester

CPE/CMU Credits: 6

  • Tips for Awesome Scanning
  • Tcpdump for the Pen Tester
  • Nmap In-Depth: The Nmap Scripting Engine
  • Version Scanning with Nmap
  • Vulnerability Scanning with Nessus
  • False-Positive Reduction
  • Packet Manipulation with Scapy
  • Enumerating Users
  • Netcat for the Pen Tester
  • Monitoring Services during a Scan

SEC560.3: Exploitation

In this section, we look at the many kinds of exploits that penetration testers use to compromise target machines, including client-side exploits, service-side exploits, and local privilege escalation. We’ll see how these exploits are packaged in frameworks like Metasploit and its mighty Meterpreter. You’ll learn in-depth how to leverage Metasploit and the Meterpreter to compromise target environments. We’ll also analyze the topic of anti-virus evasion to bypass the target organization’s security measures, as well as methods for pivoting through target environments, all with a focus on determining the true business risk of the target organization.

  • Client-Side Attacks with Metasploit
  • Exploiting Network Services and Leveraging the Meterpreter
  • Evading Anti-Virus Tools with the Veil Framework
  • Metasploit Databases and Tool Integration
  • The Dilemma of Shell versus Terminal Access Illustrated
  • Bypassing the Dilemma with Pivoting Relays

CPE/CMU Credits: 6

  • Comprehensive Metasploit Coverage with Exploits/Stagers/Stages
  • Strategies and Tactics for Anti-Virus Evasion
  • In-Depth Meterpreter Analysis, Hands-On
  • Implementing Port Forwarding Relays for Merciless Pivots
  • How to Leverage Shell Access of a Target Environment

SEC560.4: Post-Exploitation and Merciless Pivoting

Once you’ve successfully exploited a target environment, penetration testing gets extra exciting as you perform post-exploitation, gathering information from compromised machines and pivoting to other systems in your scope. This section of the course zooms in on pillaging target environments and building formidable hands-on command line skills. We’ll cover Windows command line skills in-depth, including PowerShell’s awesome abilities for post-exploitation. We’ll see how we can leverage malicious services and the incredible WMIC toolset to access and pivot through a target organization. We’ll then turn our attention to password guessing attacks, discussing how to avoid account lockout, as well as numerous options for plundering password hashes from target machines including the great Mimikatz Kiwi tool. Finally, we’ll look at Metasploit’s fantastic features for pivoting, including the msfconsole route command.

  • Windows Command Line Challenges
  • Creating Malicious Services and Leveraging the Wonderful WMIC Toolset
  • PowerShell for Post-Exploitation
  • Password Guessing with THC-Hydra
  • Metasploit Psexec and Hash Dumping
  • Metasploit Pivoting and Mimikatz Kiwi for Credential Harvesting

CPE/CMU Credits: 6

  • Windows Command Line Kung Fu for Penetration Testers
  • PowerShell’s Amazing Post-Exploitation Capabilities
  • Password Attack Tips
  • Account Lockout and Strategies for Avoiding It
  • Automated Password Guessing with THC-Hydra
  • Retrieving and Manipulating Hashes from Windows, Linux, and Other Systems
  • Pivoting through Target Environments
  • Extracting Hashes and Passwords from Memory with Mimikatz Kiwi

SEC560.5: In-Depth Password Attacks and Web App Pen Testing

In this section of the course, we’ll go even deeper in exploiting one of the weakest aspects of most computing environments: passwords. You’ll custom-compile John the Ripper to optimize its performance in cracking passwords. You’ll look at the amazingly full-featured Cain tool, running it to crack sniffed Windows authentication messages. We’ll see how Rainbow Tables really work to make password cracking much more efficient, all hands-on. And we’ll cover powerful “pass-the-hash” attacks, leveraging Metasploit, the Meterpreter, and more. We then turn our attention to web application pen testing, covering the most powerful and common web app attack techniques with hands-on labs for every topic we address. We’ll cover finding and exploiting cross-site scripting (XSS), cross-site request forgery (XSRF), command injection, and SQL injection flaws in applications such as online banking, blog sites, and more.

  • Custom Compiling and Leveraging John the Ripper to Crack Passwords
  • Sniffing Windows NTLM Authentication and Cracking It with Cain
  • Rainbow Table Attacks with Ophcrack
  • Pass-the-Hash Attacks with Metasploit and the Meterpreter
  • Scanning Web Servers with Nikto
  • Using the ZAP Proxy to Manipulate Custom Web Applications
  • Exploiting Cross-Site Request Forgery Vulnerabilities
  • Attacking Cross-Site Scripting Flaws
  • Leveraging Command Injection Flaws
  • Exploiting SQL Injection Flaws to Gain Shell Access of Web Targets

CPE/CMU Credits: 6

  • Password Cracking with John the Ripper
  • Sniffing and Cracking Windows Authentication Exchanges Using Cain
  • Using Rainbow Tables to Maximum Effectiveness
  • Pass-the-Hash Attacks with Metasploit and More
  • Finding and Exploiting Cross-Site Scripting
  • Cross-Site Request Forgery
  • SQL Injection
  • Leveraging SQL Injection to Perform Command Injection
  • Maximizing Effectiveness of Command Injection Testing

SEC560.6: Penetration Test & Capture the Flag Workshop

This lively session represents the culmination of the network penetration testing and ethical hacking course. You’ll apply all of the skills mastered in the course so far in a full-day, hands-on workshop during which you’ll conduct an actual penetration test of a sample target environment. We’ll provide the scope and rules of engagement, and you’ll work with a team to achieve your goal of finding out whether the target organization’s Personally Identifiable Information (PII) is at risk. As a final step in preparing you for conducting penetration tests, you’ll make recommendations about remediating the risks you identify.

  • A Full-Day Exercise Applying What We’ve Learned Throughout the Course
  • Modeling a Penetration Test Against a Target Environment

CPE/CMU Credits: 6

  • Applying Penetration Testing and Ethical Hacking Practices End-to-End
  • Scanning
  • Exploitation
  • Post-Exploitation
  • Merciless Pivoting
  • Analyzing Results
  • Criteria
12 دیدگاه
  1. saeedrostami136274 says

    سلام خسته نباشید عالی بود
    ممنون میشم شماره SANS-504 بزارید واقعا عالی بود

  2. jnicou38 says

    vaghean dametoon garm , aali hastid

  3. blackmamba25 says

    wow ?

  4. Merlin08 says

    اجرتان با امام حسین!

  5. sharifi198431 says

    خیلی ممنون
    شرکت تو دوره هایSANS برای ما اصلا راحت نیست.
    ممنون که ریسورس های عالی رو در اختیار ما میذارید.

  6. hamedhacker7648 says

    لطفا کتابهای SANS 585 : Advanced Smartphone Forensics 2017 روهم بزارید.خیلی احتیاجش دارم.ممنون میشم ازلطفی که میکنید

  7. jnicou38 says

    ممنون می شم اگه کتابهای این مجموعه را هم بزارید

  8. muhammadabdal38 says

    Thanks 🙂

  9. mahdi says

    سلام و خسته نباشید.
    ممنونیم از زحماتتون.
    خیلی عالی و سایت بی نظیر داین.

    VM يا USB این دوره رو هم دارین ؟؟

  10. نیما says

    بخش اول دانلود نمیشه!!!

    1. technet24 says

      مجدد بررسی کنید.

  11. حرح says

    خدا قوت. واقعا عالی هستین
    لطفا PDF این دوره رو هم بذارین. خیلی ممنون


آدرس ایمیل شما منتشر نخواهد شد.