This interactive lab will guide you through the process of conducting a penetration test on a simulated corporate network. You'll learn how to identify vulnerabilities, exploit them ethically, and provide remediation recommendations.
The lab is designed to provide hands-on experience with popular penetration testing tools like Metasploit, Nmap, and more.
The skills taught in this lab are for educational purposes only. Always obtain proper authorization before performing security testing on any system. Unauthorized penetration testing is illegal and unethical.
Penetration testing follows a structured methodology to systematically identify and exploit vulnerabilities in a controlled manner. The main phases include:
Gathering information about the target system or network using both passive and active techniques. This may include OSINT (Open Source Intelligence), DNS enumeration, and social engineering.
Actively probing the target to identify open ports, running services, operating systems, and potential vulnerabilities. Tools like Nmap, Nessus, and OpenVAS are commonly used in this phase.
Leveraging discovered vulnerabilities to gain unauthorized access to systems. This may involve using tools like Metasploit, custom exploit code, or manual techniques to exploit weaknesses.
After gaining access, collecting sensitive information, establishing persistence, escalating privileges, and pivoting to other systems on the network to demonstrate potential impact.
Documenting findings, including discovered vulnerabilities, exploitation methods, and specific remediation recommendations. The report should be comprehensive yet understandable to both technical and non-technical stakeholders.
This lab provides a safe, isolated environment where you can practice penetration testing techniques without legal or ethical concerns. The virtual network consists of deliberately vulnerable machines that simulate real-world scenarios.
You'll have access to common penetration testing tools including:
Reconnaissance involves gathering information about your target to understand its infrastructure, technologies, and potential entry points. This phase is crucial as it forms the foundation for the rest of your penetration test.
You've been engaged to perform a penetration test on the following organization:
Start by gathering information using passive techniques that don't directly interact with the target systems:
Now that you've gathered basic information about the target network, it's time to actively scan for open ports, running services, and potential vulnerabilities. This phase helps identify specific attack vectors for the exploitation phase.
After identifying potential vulnerabilities during the scanning phase, you can now attempt to exploit these weaknesses to gain unauthorized access to the target systems. Remember to document all successful exploits for the final report.
Use Metasploit to exploit known vulnerabilities in the target systems. The framework includes numerous exploit modules, payloads, and post-exploitation tools.
Automated SQL injection tool that detects and exploits SQL injection vulnerabilities in web applications. Useful for testing the employee portal login form.
Fast and flexible online password cracking tool that supports numerous protocols including SSH, FTP, HTTP, SMB, and more. Use it for brute force login attempts.
Web application security testing platform that can intercept and modify HTTP/HTTPS traffic, find vulnerabilities, and exploit web application flaws.
After gaining initial access to the target systems, the post-exploitation phase focuses on maintaining access, escalating privileges, and extracting valuable information. This phase demonstrates the potential impact of the identified vulnerabilities.
Common post-exploitation activities include:
The final phase of a penetration test is to compile a comprehensive report documenting your findings, the methodology used, and providing actionable recommendations for remediation. A good penetration test report helps the organization understand their security posture and prioritize fixes.
A well-structured penetration test report typically includes:
This penetration test was conducted against Acme Secure Technologies' network infrastructure between April 5-7, 2025. The assessment identified several critical and high-risk vulnerabilities that could allow malicious actors to compromise the organization's systems and data.
The most significant findings include:
Overall, the security posture of the organization is concerning. Immediate remediation of the identified vulnerabilities is strongly recommended to prevent potential data breaches or system compromise.
Description: The employee portal login form at http://192.168.1.25/login.php is vulnerable to SQL injection attacks, allowing authentication bypass and unauthorized access to the application.
Evidence: Authentication bypass was achieved using the payload
admin' or 1=1 -- in the username field. This provided access to the
portal with administrative privileges.
Impact: An attacker can bypass authentication, access sensitive employee data, and potentially extract database contents including user credentials.
Recommendation: Implement parameterized SQL queries or prepared statements to prevent SQL injection. Use an ORM framework if possible and validate all user inputs.
Description: The Apache Tomcat Manager application on http://192.168.1.20:8080/manager/ uses default credentials, allowing unauthorized access to the web application management interface.
Evidence: Access was gained using the credentials
tomcat:s3cret, which are well-known default credentials for Tomcat
installations.
Impact: An attacker can deploy malicious web applications to the server, which can lead to remote code execution and complete system compromise.
Recommendation: Change default credentials immediately. Implement a strong, unique password and consider implementing IP restrictions for accessing the management interface.
Description: The Samba share "backups" on 192.168.1.35 allows anonymous access without authentication, exposing sensitive files.
Evidence: Access was gained using the command smbclient
//192.168.1.35/backups -N, which connected without requiring credentials.
Sensitive files such as configuration backups and employee lists were accessible.
Impact: An attacker can access sensitive company data, including configuration files that may contain credentials and employee information.
Recommendation: Reconfigure the Samba share to require authentication, implement proper access controls, and review the necessity of sharing sensitive files.
This certificate is awarded to
For successfully completing the Penetration Testing Lab and demonstrating proficiency in ethical hacking techniques, vulnerability assessment, and security reporting.
Aziz Alghamdi
Instructor
May 1, 2025
Date