Legitimized [GIAC Penetration Tester Certification (GPEN)] Expert – Led Video Course – MASTERYTRAIL

Lesson 1: Introduction to GPEN Certification

1.1 Overview of GIAC & SANS
1.2 Purpose of GPEN Certification
1.3 Target Audience & Prerequisites
1.4 Penetration Testing as a Career
1.5 Domains Covered in GPEN Exam
1.6 Skills Validated by GPEN
1.7 GPEN Exam Format & Requirements
1.8 Preparation Strategies
1.9 Recommended Resources & Labs
1.10 Benefits of GPEN Certification

Lesson 2: Penetration Testing Methodologies

2.1 Overview of PT Methodologies
2.2 OSSTMM
2.3 OWASP Testing Guide
2.4 NIST SP 800-115
2.5 PTES Framework
2.6 Differences Among Methodologies
2.7 Choosing the Right Methodology
2.8 Integration of Standards in GPEN
2.9 Aligning with Compliance (PCI, HIPAA)
2.10 Documentation Practices

Lesson 3: Legal & Ethical Considerations

3.1 Importance of Legal Awareness
3.2 Rules of Engagement (RoE)
3.3 Permission & Authorization Letters
3.4 Scope Definition
3.5 Ethical Guidelines for Pen Testers
3.6 Laws Related to Hacking & Cybercrime
3.7 Compliance Obligations
3.8 Penetration Testing Liability
3.9 Client Confidentiality & NDAs
3.10 Case Studies on Legal Issues

Lesson 4: Scoping and Engagement Planning

4.1 Understanding Business Requirements
4.2 Defining Objectives
4.3 Scope Identification
4.4 Engagement Contracts
4.5 Communication Protocols
4.6 Timeframe & Deadlines
4.7 Resource Allocation
4.8 Tool Selection Considerations
4.9 Handling Scope Creep
4.10 Deliverables Agreement

Lesson 5: Information Gathering Fundamentals

5.1 Passive Reconnaissance Overview
5.2 Active Reconnaissance Overview
5.3 Open Source Intelligence (OSINT)
5.4 Social Engineering Recon Basics
5.5 Domain Name System (DNS) Research
5.6 Search Engines & Metadata Analysis
5.7 WHOIS & Geolocation Tools
5.8 Recon-ng Framework
5.9 Data Correlation Methods
5.10 Reporting Collected Intelligence

Lesson 6: Network Scanning

6.1 Fundamentals of Network Scanning
6.2 ICMP Probing
6.3 Port Scanning Concepts
6.4 TCP vs UDP Scans
6.5 Banner Grabbing
6.6 Common Tools (Nmap, Masscan)
6.7 Interpreting Scan Results
6.8 Identifying Live Hosts
6.9 Detecting Firewalls & IDS/IPS
6.10 Stealth Scanning Techniques

Lesson 7: Enumeration Techniques

7.1 Understanding Enumeration
7.2 SMB Enumeration
7.3 SNMP Enumeration
7.4 LDAP Enumeration
7.5 NFS & RPC Enumeration
7.6 Email Harvesting
7.7 Username & Password Harvesting
7.8 Tools: enum4linux, rpcclient
7.9 Automating Enumeration
7.10 Reporting Findings

Lesson 8: Vulnerability Scanning

8.1 Vulnerability Concepts
8.2 Scanning Tools (Nessus, OpenVAS)
8.3 Authentication & Credentialed Scans
8.4 Interpreting Scan Reports
8.5 Prioritization of Vulnerabilities
8.6 False Positives & Negatives
8.7 Mapping Vulns to Exploits
8.8 Compliance Reporting
8.9 Integration with SIEM Tools
8.10 Continuous Scanning

Lesson 9: Exploitation Fundamentals

9.1 Understanding Exploits
9.2 Exploit Classification
9.3 Metasploit Framework Basics
9.4 Crafting Payloads
9.5 Client-Side Exploits
9.6 Server-Side Exploits
9.7 Browser Exploits
9.8 Exploit Evasion Techniques
9.9 Post-Exploitation Preparation
9.10 Documentation of Exploits

Lesson 10: Password Attacks

10.1 Password Cracking Principles
10.2 Brute Force Attacks
10.3 Dictionary Attacks
10.4 Rainbow Tables
10.5 Hybrid Attacks
10.6 Credential Dumping
10.7 Online vs Offline Attacks
10.8 Tools: John the Ripper, Hashcat
10.9 Password Security Best Practices
10.10 Countermeasures

Lesson 11: Windows Exploitation

11.1 Windows Architecture Overview
11.2 Common Windows Vulnerabilities
11.3 Exploiting SMB Services
11.4 Windows Privilege Escalation
11.5 Pass-the-Hash Attacks
11.6 Windows Credential Dumping
11.7 Exploiting Active Directory
11.8 Exploit Frameworks for Windows
11.9 Post-Exploitation in Windows
11.10 Defense Evasion Techniques

Lesson 12: Linux Exploitation

12.1 Linux Architecture Overview
12.2 Exploiting NFS & RPC
12.3 Exploiting SUID Binaries
12.4 Cron Job Exploits
12.5 Local Privilege Escalation
12.6 Kernel Exploits in Linux
12.7 Exploiting Weak File Permissions
12.8 Tools for Linux Exploitation
12.9 Remote Linux Exploits
12.10 Maintaining Persistence

Lesson 13: Web Application Basics

13.1 Web Application Architecture
13.2 HTTP & HTTPS Fundamentals
13.3 Cookies & Sessions
13.4 Authentication Mechanisms
13.5 Authorization Models
13.6 Data Storage & DB Interaction
13.7 Web Security Risks (OWASP)
13.8 Recon on Web Applications
13.9 Tools for Web Analysis
13.10 Reporting Weaknesses

Lesson 14: Web Application Attacks

14.1 SQL Injection Basics
14.2 Advanced SQL Injection
14.3 Cross-Site Scripting (XSS)
14.4 Cross-Site Request Forgery (CSRF)
14.5 File Inclusion Attacks
14.6 Command Injection
14.7 Directory Traversal
14.8 Exploiting Authentication Flaws
14.9 Business Logic Attacks
14.10 Reporting Web Exploits

Lesson 15: Wireless Attacks

15.1 Wireless Security Basics
15.2 WPA2 & WPA3 Overview
15.3 Wireless Reconnaissance
15.4 Deauthentication Attacks
15.5 Cracking Wi-Fi Passwords
15.6 Rogue Access Points
15.7 Evil Twin Attacks
15.8 Bluetooth Exploits
15.9 Tools for Wireless Attacks
15.10 Wireless Security Controls

Lesson 16: Social Engineering

16.1 Social Engineering Principles
16.2 Human Attack Surface
16.3 Phishing Attacks
16.4 Vishing & Smishing
16.5 Physical Security Exploits
16.6 Pretexting & Impersonation
16.7 OSINT-Driven Social Engineering
16.8 Tools for Social Engineering
16.9 Case Studies of Attacks
16.10 Defenses Against SE

Lesson 17: Password Cracking Advanced

17.1 Advanced Cracking Techniques
17.2 GPU Acceleration with Hashcat
17.3 Distributed Cracking Frameworks
17.4 Password Hash Types
17.5 Windows Hash Dumping
17.6 Linux /etc/shadow Exploitation
17.7 Credential Reuse Attacks
17.8 Password Spraying
17.9 Cloud-based Cracking Tools
17.10 Password Policy Bypass

Lesson 18: Exploiting Databases

18.1 Database Enumeration
18.2 SQL Injection Review
18.3 Exploiting MySQL
18.4 Exploiting MSSQL
18.5 Exploiting Oracle Databases
18.6 NoSQL Attacks (MongoDB)
18.7 Default Credentials in DBs
18.8 Tools for Database Exploits
18.9 Exfiltrating Sensitive Data
18.10 Mitigations

Lesson 19: Exploitation with Metasploit

19.1 Metasploit Architecture
19.2 Auxiliary Modules
19.3 Exploit Modules
19.4 Payloads in Metasploit
19.5 Meterpreter Basics
19.6 Privilege Escalation Modules
19.7 Pivoting with Metasploit
19.8 Automation with Resource Scripts
19.9 Exploit Customization
19.10 Reporting from Metasploit

Lesson 20: Client-Side Exploits

20.1 Attack Vectors on Clients
20.2 Malicious Documents (Office/PDF)
20.3 Drive-by Downloads
20.4 Exploiting Browser Vulnerabilities
20.5 Exploiting Plugins (Flash, Java)
20.6 Malvertising Campaigns
20.7 Phishing-Delivered Exploits
20.8 Payload Delivery Mechanisms
20.9 Tools for Client Exploits
20.10 Defense & Mitigation

Lesson 21: Post-Exploitation Fundamentals

21.1 Goals of Post-Exploitation
21.2 System Recon After Exploit
21.3 Collecting Sensitive Data
21.4 Maintaining Access
21.5 Clearing Tracks
21.6 Privilege Escalation Review
21.7 Lateral Movement Concepts
21.8 Persistence Techniques
21.9 Exfiltration Methods
21.10 Reporting Post-Exploitation

Lesson 22: Windows Post-Exploitation

22.1 Gathering System Info
22.2 Dumping SAM & LSASS
22.3 Pass-the-Hash Attacks
22.4 Token Impersonation
22.5 Kerberos Attacks (Pass-the-Ticket)
22.6 Exploiting Scheduled Tasks
22.7 WMI Abuse
22.8 PowerShell Post-Exploitation
22.9 Persistence via Registry
22.10 Defensive Countermeasures

Lesson 23: Linux Post-Exploitation

23.1 Linux System Enumeration
23.2 Credential Harvesting
23.3 Exploiting Cron Jobs
23.4 Log File Manipulation
23.5 Rootkits & Backdoors
23.6 Pivoting from Linux Systems
23.7 Maintaining SSH Access
23.8 Exploiting Misconfigurations
23.9 File System Recon
23.10 Covering Tracks

Lesson 24: Privilege Escalation Techniques

24.1 Overview of Priv Esc
24.2 Windows Privilege Esc
24.3 Linux Privilege Esc
24.4 Misconfigured Services
24.5 Kernel Exploits
24.6 Exploiting Sudo Rights
24.7 DLL Injection
24.8 Priv Esc Automation Tools
24.9 Case Studies
24.10 Mitigations

Lesson 25: Lateral Movement

25.1 Lateral Movement Concepts
25.2 Windows Lateral Movement
25.3 PsExec & WMI Techniques
25.4 Exploiting RDP
25.5 Pass-the-Ticket Across Systems
25.6 Linux Lateral Movement
25.7 Exploiting SSH Keys
25.8 Pivoting with Tunnels
25.9 Detecting Lateral Movement
25.10 Mitigation Strategies

Lesson 26: Persistence Techniques

26.1 Importance of Persistence
26.2 Windows Persistence Methods
26.3 Scheduled Tasks Abuse
26.4 Registry Modifications
26.5 Service Creation Exploits
26.6 Linux Persistence Methods
26.7 SSH Key Insertion
26.8 Cron Jobs for Persistence
26.9 Advanced Rootkits
26.10 Defenses

Lesson 27: Active Directory Exploitation

27.1 AD Overview
27.2 Recon in AD
27.3 Kerberos Attacks
27.4 Golden Ticket Exploits
27.5 Silver Ticket Exploits
27.6 Pass-the-Ticket Techniques
27.7 BloodHound Recon Tool
27.8 AD Priv Escalation
27.9 Lateral Movement in AD
27.10 AD Security Controls

Lesson 28: Exploiting Cloud Environments

28.1 Cloud Pen Testing Basics
28.2 AWS Exploits
28.3 Azure Exploits
28.4 GCP Exploits
28.5 Cloud Misconfigurations
28.6 Exploiting API Keys
28.7 Serverless Attacks
28.8 Cloud Recon Tools
28.9 Data Exfiltration in Cloud
28.10 Cloud Security Best Practices

Lesson 29: Password Attacks in AD

29.1 Credential Harvesting in AD
29.2 Brute Forcing Kerberos Tickets
29.3 Kerberoasting Attacks
29.4 AS-REP Roasting
29.5 Exploiting Cached Credentials
29.6 Password Spraying in AD
29.7 Exploiting Weak Service Accounts
29.8 Tools for AD Cracking
29.9 Countermeasures
29.10 Best Practices

Lesson 30: Exploiting Web Servers

30.1 Web Server Enumeration
30.2 Apache Exploits
30.3 IIS Exploits
30.4 Nginx Exploits
30.5 Exploiting SSL/TLS Weaknesses
30.6 Directory Traversal on Servers
30.7 Upload Vulnerabilities
30.8 Exploiting CMS Platforms
30.9 Tools for Web Server Attacks
30.10 Hardening Measures

Lesson 31: Wireless Exploitation Advanced

31.1 WPA2 Enterprise Exploits
31.2 EAP Attacks
31.3 Captive Portal Exploits
31.4 Wireless Sniffing with Wireshark
31.5 Aircrack-ng Advanced Use
31.6 Rogue AP with Karma Attacks
31.7 Man-in-the-Middle via Wi-Fi
31.8 Bluetooth Exploits Advanced
31.9 ZigBee and IoT Wireless Exploits
31.10 Wireless Security Monitoring

Lesson 32: Exploiting Mobile Applications

32.1 Mobile App Security Basics
32.2 Android Exploitation
32.3 iOS Exploitation
32.4 Mobile App Recon
32.5 Reverse Engineering APKs
32.6 Mobile Data Storage Exploits
32.7 API Testing for Mobile
32.8 Rooting & Jailbreaking Risks
32.9 Mobile Exploit Tools
32.10 Defenses

Lesson 33: Exploiting APIs

33.1 API Security Basics
33.2 API Reconnaissance
33.3 Exploiting REST APIs
33.4 Exploiting GraphQL APIs
33.5 SOAP Attacks
33.6 Authentication Flaws in APIs
33.7 API Rate Limiting Bypass
33.8 Data Exfiltration via APIs
33.9 Tools for API Pen Testing
33.10 Mitigations

Lesson 34: Exploiting IoT Devices

34.1 IoT Ecosystem Basics
34.2 IoT Reconnaissance
34.3 Exploiting Firmware
34.4 Default Credentials in IoT
34.5 Web Interfaces in IoT
34.6 Wireless Protocol Exploits
34.7 Exploiting Smart Home Devices
34.8 Industrial IoT Exploits
34.9 IoT Exploit Tools
34.10 IoT Security Guidelines

Lesson 35: Exploiting SCADA/ICS Systems

35.1 ICS/SCADA Overview
35.2 Recon in Industrial Networks
35.3 Exploiting PLCs
35.4 Modbus Protocol Exploits
35.5 DNP3 Exploits
35.6 Exploiting HMI Interfaces
35.7 ICS Malware Case Studies
35.8 ICS Exploit Tools
35.9 Safety Concerns in ICS
35.10 Defenses

Lesson 36: Exploiting Email Systems

36.1 Email Infrastructure Basics
36.2 SMTP Exploits
36.3 IMAP/POP Exploits
36.4 Phishing Campaign Simulation
36.5 Exploiting Mail Servers
36.6 SPF/DKIM/DMARC Weaknesses
36.7 Email Spoofing Techniques
36.8 Payload Delivery via Email
36.9 Tools for Email Attacks
36.10 Email Security Practices

Lesson 37: Exploiting VPNs & Remote Access

37.1 VPN Security Basics
37.2 SSL VPN Exploits
37.3 IPsec Weaknesses
37.4 Exploiting RDP Misconfigurations
37.5 Citrix Exploits
37.6 Exploiting VNC
37.7 Brute Forcing Remote Access
37.8 Tools for VPN Exploits
37.9 Real-World VPN Exploits
37.10 Defense Best Practices

Lesson 38: Exploiting Firewalls & IDS/IPS

38.1 Firewall Basics
38.2 Firewall Reconnaissance
38.3 Exploiting Firewall Misconfigs
38.4 IDS/IPS Evasion Techniques
38.5 Fragmentation Attacks
38.6 Port Knocking & Covert Channels
38.7 Tunneling Through Firewalls
38.8 Exploit Payload Obfuscation
38.9 Tools for IDS/IPS Evasion
38.10 Countermeasures

Lesson 39: Exploiting Virtualization & Containers

39.1 Virtualization Basics
39.2 Hypervisor Exploits
39.3 Exploiting VMware
39.4 Exploiting VirtualBox
39.5 Container Security Basics
39.6 Docker Exploits
39.7 Kubernetes Exploits
39.8 Escaping Containers
39.9 Tools for Virtualization Attacks
39.10 Defense Mechanisms

Lesson 40: Exploiting CI/CD Pipelines

40.1 CI/CD Overview
40.2 Git Repository Attacks
40.3 Exploiting Build Servers
40.4 Supply Chain Exploits
40.5 Hardcoded Secrets in Code
40.6 Dependency Attacks
40.7 Exploiting Jenkins Pipelines
40.8 Tools for CI/CD Exploits
40.9 Real-World CI/CD Exploits
40.10 Defenses

Lesson 41: Reporting & Documentation

41.1 Importance of Reports
41.2 Executive Summary Writing
41.3 Technical Details Section
41.4 Risk Ratings & Severity
41.5 Screenshots & Evidence
41.6 Remediation Guidance
41.7 Legal Language in Reports
41.8 Communication of Findings
41.9 Tools for Report Writing
41.10 Sample GPEN Report

Lesson 42: Penetration Testing Tools Overview

42.1 Recon Tools
42.2 Scanning Tools
42.3 Exploitation Tools
42.4 Post-Exploitation Tools
42.5 Password Cracking Tools
42.6 Social Engineering Tools
42.7 Wireless Tools
42.8 API & Web Tools
42.9 Specialized Scripts
42.10 Automation Frameworks

Lesson 43: Custom Exploits & Scripting

43.1 Introduction to Custom Exploits
43.2 Scripting with Python
43.3 Scripting with PowerShell
43.4 Exploit Development Basics
43.5 Buffer Overflows in Exploits
43.6 Automating Recon
43.7 Automating Exploits
43.8 Exploit Framework Customization
43.9 Proof-of-Concept Scripts
43.10 Ethical Considerations

Lesson 44: Penetration Testing in Red Teaming

44.1 Red Team Concepts
44.2 Blue vs Red vs Purple Teams
44.3 Red Team Objectives
44.4 Recon in Red Team Ops
44.5 Exploitation in Red Team Ops
44.6 Persistence in Red Team Ops
44.7 Exfiltration in Red Team Ops
44.8 Tools for Red Teaming
44.9 Case Studies
44.10 Red Team vs GPEN

Lesson 45: Defensive Countermeasures

45.1 Security Awareness
45.2 Network Segmentation
45.3 Patching & Updates
45.4 Firewalls & IDS/IPS
45.5 Logging & Monitoring
45.6 Endpoint Protection
45.7 SIEM Tools
45.8 Incident Response Basics
45.9 Cloud Security Defenses
45.10 Zero Trust Approach

Lesson 46: GPEN Exam Preparation

46.1 Exam Structure
46.2 Question Types
46.3 Time Management
46.4 Hands-On Practice Importance
46.5 Using the SANS OnDemand Course
46.6 Creating a Study Plan
46.7 Practice Tests & Labs
46.8 Review of Key Topics
46.9 Memory Aids & Cheat Sheets
46.10 Day-of-Exam Tips

Lesson 47: Practice Labs ? Recon

47.1 DNS Recon Lab
47.2 WHOIS & OSINT Lab
47.3 Port Scanning Lab
47.4 Nmap Hands-On
47.5 Enumeration with enum4linux
47.6 SNMP Enumeration Lab
47.7 Web Recon with Dirbuster
47.8 Email Harvesting Lab
47.9 Vulnerability Scan with Nessus
47.10 Report Lab Results

Lesson 48: Practice Labs ? Exploitation

48.1 Exploiting SMB with Metasploit
48.2 Windows Priv Esc Lab
48.3 Linux Priv Esc Lab
48.4 SQL Injection Lab
48.5 XSS Exploit Lab
48.6 Wireless WPA2 Cracking Lab
48.7 Password Cracking with Hashcat
48.8 Social Engineering Toolkit Lab
48.9 Active Directory Exploit Lab
48.10 Post-Exploitation Lab

Lesson 49: Case Studies

49.1 Case Study ? SMB Exploit
49.2 Case Study ? SQL Injection
49.3 Case Study ? AD Compromise
49.4 Case Study ? Cloud Exploit
49.5 Case Study ? Wireless Attack
49.6 Case Study ? API Exploit
49.7 Case Study ? Social Engineering Attack
49.8 Case Study ? CI/CD Pipeline Attack
49.9 Case Study ? Red Team Operation
49.10 Lessons Learned

Lesson 50: Final Review & Career Path

50.1 Review of GPEN Domains
50.2 Key Takeaways from Curriculum
50.3 Career Opportunities After GPEN
50.4 Role of Pen Testers in Industry
50.5 Certifications Beyond GPEN (GXPN, OSCP)
50.6 Building a Pen Testing Portfolio
50.7 Continuous Learning Strategies
50.8 Community Participation (CTFs, Forums)
50.9 Ethical Responsibility of GPEN Holders
50.10 Final Preparation Checklist