Talk to an Instructor:
Jonas Felix
Hands-On Security Lab
Course & Training
This 2-day course provides practical experience with penetration testing techniques in a complex IT environment. Participants will learn to identify vulnerabilities, exploit systems, escalate privileges, and understand security implications in enterprise computing environments.
This hands-on security lab provides practical experience with penetration testing techniques in a complex IT environment. Participants will learn to identify vulnerabilities, exploit systems, escalate privileges, and understand security implications in enterprise computing environments. Prerequisites: Basic Linux command line knowledge and understanding of networking concepts.
In-House Course:
We are happy to conduct tailored courses for your team - on-site, remotely or in our course rooms.
Content:
– Reconnaissance & Service Discovery
... – Network Reconnaissance
... – Cyber Kill Chain
... – Nmap
... – Exercise Overview
... – Network Topology
... – Further Reconnaissance Methods
– Identifying Vulnerable Services and Misconfigurations & Exploiting Common Vulnerabilities
... – Vulnerable Services and Misconfigurations
... – Exercise Overview
... – Key Cybersecurity Terms
... – Exploitation Techniques
– Unpatched Systems: Highlight Impact
... – Unpatched Systems
... – Attack Progression
... – Common Vulnerabilities and Exposures (CVE)
... – Shellshock (CVE-2014-6271)
... – Sudo Buffer Overflow (CVE-2019-18634)
... – CIA triad
... – Mitigation Strategies
– Privilege Escalation
... – Privilege Escalation
... – Exercise Overview
... – Mitigation Strategies
– Kernel Vulnerabilities
... – Kernel Vulnerabilities
... – Malicious Kernel Modules
... – Vulnerable Kernel Modules
... – Mitigation Strategies
... – Kernel Security Mechanisms
– SUID & SGID
... – SUID & SGID
... – Exercise Overview
... – SUID and SGID Permission Notation
– Weak File Permissions & Sudo Misconfigurations
... – Weak File Permissions & Sudo Misconfigurations
... – Exploiting Weak File Permissions
... – Exploiting Sudo Misconfigurations
– Propagation through Shared Storage
... – Propagation through Shared Storage
... – Exercise Overview
... – Exploiting Trust Relationships in Systems
– Exploiting a Vulnerability in Workload Manager
... – Exploiting a Vulnerability in Workload Manager
... – Exercise Overview
... – CVE-2025-43904
... – Exploit Sequence
... – Assessment
– Maintaining Persistence
... – Maintaining Persistence
... – Exercise Overview
... – SSH Authorized Keys
... – Hidden Cron Jobs
... – Shell Configuration Files
... – Web Shells
... – SUID Binary Backdoors
... – Shared Library
... – Systemd Services
... – Detection and Prevention
... – Advanced Persistence Mechanisms
– Data Exfiltration Lab: DNS Tunneling
... – Data Exfiltration Lab: DNS Tunneling
... – Exercise Overview
... – Exfiltration Process
... – Further Exfiltration Methods
– LDAP
... – LDAP
... – Exercise Overview
... – LDAP Vulnerabilities and Attack Vectors
– Attack Stories Workshop
... – Attack Stories Workshop
... – Target Environment: Complex IT Environment
... – Attack Story: The Desperate Scientist
... – Attack Story: The Nation State Espionage
... – Attack Story: The Angry Employee
... – Attack Story: The Rogue AI
... – Attack Story: The Hacktivist Collective
... – Attack Story: The Ransomware Gang
... – Workshop Exercise: Build Your Attack Story
... – Threat Modeling Results
– Thank you!
Disclaimer: The actual course content may vary from the above, depending on the trainer, implementation, duration and constellation of participants.
Whether we call it training, course, workshop or seminar, we want to pick up participants at their point and equip them with the necessary practical knowledge so that they can apply the technology directly after the training and deepen it independently.
Goal:
This two-day Hands-on Security Lab course will provide participants with a solid understanding of the fundamentals and advanced concepts of security in complex IT environments. The goal is for you to be able to implement effective security measures, from network reconnaissance to data exfiltration. The course also focuses on practical applicability, enabling participants to apply what they have learned directly to their own projects.
Form:
A proven mix of concepts, live hacking and collaboration on an exemplary lab environment. Always geared towards the efficient usage of security techniques in real-life projects and production.
Target Audience:
The target audience of this course are software developers, system architects and IT professionals who want to expand their knowledge in the area of cybersecurity with a focus on penetration testing and system security. The course is designed for participants who already have basic Linux command line knowledge and an understanding of networking concepts and want to deepen their understanding of security aspects.
Requirements:
Basic Linux command line knowledge and understanding of networking concepts.
Preparation:
Each participant receives a questionnaire and installation instructions after registration. Matching the answers we send individual feedback.
Request In-House Course:
In-House Kurs Anfragen
Waitinglist for public course:
Sign up for the waiting list for more public course dates. Once we have enough people on the waiting list, we will determine a date that suits everyone as much as possible and schedule a new session. If you want to participate directly with two colleagues, we can even plan a public course specifically for you.
