1. Evasion Techniques and Breaching Defenses: General Course Information

Welcome to the Evasion Techniques and Breaching Defenses (PEN-300) course!

PEN-300 was created for security professionals who already have some experience in offensive techniques and penetration testing.

This course will help you develop the skills and knowledge to bypass many different types of defenses while performing advanced types of attacks.

Since the goal of this course is to teach offensive techniques that work against client organizations with hardened systems, we expect students to have taken the PEN-200 course and passed the OSCP exam or have equivalent knowledge and skills.

1.1. About The PEN-300 Course

Before diving into the course related material, it is important to spend a few moments on basic terminology.

IT and information security professionals use various terminology for offensive operations and attacks. To prevent confusion, we are going to define some of the main terms as we understand them and as they apply to this course.

A penetration test is an engagement between a client organization and a penetration tester. During such an operation, the penetration tester will perform various sanctioned attacks against the client organization. These can vary in size, duration, and complexity.

A penetration test can have various entry points into the targeted organization. In an assumed breach penetration test, the penetration tester is given standard or low-privileged user access to an internal system and can perform the attacks from there. In this type of test, the focus is on the internal network. Additional information may be provided by the client to aid the test.

A slightly more complex test is an external penetration test, which can leverage social engineering and attacks against internet facing infrastructure.

Both types of penetration tests will attempt to compromise as much of the internal systems of the client organization as possible. This often includes attacking Active Directory and production systems. No matter how a penetration test is conducted, the overall goal is to test the security of client organizations IT infrastructure.

Instead of testing the security of the IT infrastructure, it is possible to test the security response of the organization. This is typically called a red team test (red teaming) or adversary simulation and works by mimicking the techniques and procedures of advanced attackers.

The main purpose of a red team test is to train or test the security personnel in the client organization, which are referred to as the blue team. While many techniques between penetration tests and red team tests overlap, the goals are different.

PEN-300 will provide the knowledge and techniques required to perform advanced penetration tests against mature organizations with a developed security level. It is not a Red Team course.

The topics covered in this course includes techniques such as client-side code execution attacks, antivirus evasion, application whitelisting bypasses, and network detection bypasses. The second half of the course focuses on key concepts such as lateral movement, pivoting, and advanced attacks against Active Directory.

Since PEN-300 is an advanced penetration testing course, we will generally not deal with the act of evading a blue team. Instead, we will focus on bypassing automated security mechanisms that block an attack.

1.2. Provided Material

Next let's take a moment to review the individual components of the course. You should now have access to the following:

• The PEN-300 course materials

• Access to the PEN-300 VPN lab network

• Student forum credentials

• Live support

• OSEP exam attempt/s

Let's review each of these items.

1.2.1. PEN-300 Course Materials

The course includes online book modules and the accompanying course videos. The information covered in the book modules and the videos are complementary, meaning you can read the book modules and then watch the videos to fill in any gaps or vice versa.

In some modules, the book modules are more detailed than the videos. In other cases, the videos may convey some information better than the book modules. It is important that you pay close attention to both.

The book modules also contain exercises for each chapter. Completing the course exercises will help students solidify their knowledge and practice the skills needed to attack and compromise lab machines.

1.2.2. Access to the PEN-300 VPN Lab Network

Once you have signed up for the course, you will be able to download the VPN pack required to access the lab network via the course lab page in the OffSec Training Library. This will enable you to access the PEN-300 VPN lab network, where you will be spending a considerable amount of time.

Lab time starts when your course begins and is metered as continuous access.

If your lab time expires, or is about to expire, you can purchase a lab extension at any time. To purchase additional lab time, use the "Extend" link available at top right corner of the OffSec Training Library. If you purchase a lab extension while your lab access is still active, you can continue to use the same VPN connectivity pack. If you purchase a lab extension after your existing lab access has ended, you will need to download a new VPN connectivity pack via the course lab page in the OffSec Training Library.

Students who have purchased a subscription will have access to the lab while the subscription is active. Your subscription will be automatically renewed, unless cancelled via the billing page.

1.2.3. The OffSec Student Forum

The Student Forum is only accessible to OffSec students. Access does not expire when your lab time ends. You can continue to enjoy the forums long after you pass your OSEP exam.

On the forum, you can ask questions, share interesting resources, and offer tips (no spoilers). We ask all forum members to be mindful of what they post, taking particular care not to ruin the overall course experience for others by posting complete solutions. Inappropriate posts may be moderated.

Once you have successfully passed the OSEP exam, you will gain access to the sub-forum for certificate holders.

1.2.4. Live Support and Discord

Live Support can be accessed by clicking the "Connect to Discord" in the upper right-hand corner of the OffSec Training Library. Live Support will allow you to directly communicate with our Student Administrators.

Student Administrators are available to assist with technical issues, but they may also be able to clarify items in the course material and exercises. In addition, if you have tried your best and are completely stuck on a lab machine, Student Administrators may be able to provide a small hint to help you on your way.

Remember that the information provided by the Student Administrators will be based on the amount of detail you are able to provide. The more detail you can give about what you've already tried and the outcomes you've been able to observe, the better.

1.2.5. OSEP Exam Attempt

Included with your initial purchase of the PEN-300 course is an attempt at the OffSec Experienced Penetration Tester (OSEP) certification.

To book your OSEP exam, go to your exam scheduling calendar. The calendar is located in the OffSec Training Library under the course exam page. Here you will be able to see your exam expiry date, as well as schedule the exam for your preferred date and time.

Keep in mind that you won't be able to select a start time if the exam labs are full for that time period, so we encourage you to schedule your exam as soon as possible.

1.3. Overall Strategies for Approaching the Course

Each student is unique, so there is no single best way to approach this course and materials. We want to encourage you to move through the course at your own comfortable pace. You'll also need to apply time management skills to keep yourself on track.

We recommend the following as a very general approach to the course materials:

1. Review all the information included in the resources provided after the registration process.
2. Review the course materials.
3. Complete the course exercises.
4. Attack the lab machines.

1.3.1. Course Materials

Once you have reviewed the information above, you can jump into the course material. You may opt to start with the course videos and then review the information for that given module in the book modules or vice versa depending on your preferred learning style. As you go through the course material, you may need to re-watch or re-read modules to fully grasp the content.

Note that all course modules except this introduction, Operating System and Programming Theory and Trying Harder: The Labs have course videos associated with them.

In the book modules you will occasionally find text in red font which is centered. These blocks of text represent additional information provided for further context but is not required to understand to follow the narrative of an attack. Note that the information in these blocks is not mentioned in the course videos.

We recommend treating the course like a marathon and not a sprint. Don't be afraid to spend extra time with difficult concepts before moving forward in the course.

1.3.2. Course Exercises

We recommend that you fully complete the exercises for each module prior to moving on to the next module. They will test your understanding of the material and build your confidence to move forward.

The time and effort it takes to complete these exercises may depend on your existing skillset. Please note that some exercises are difficult and may take a significant amount of time. We want to encourage you to be persistent, especially with tougher exercises. They are particularly helpful in developing that OffSec "Try Harder" mindset.

Caution

Note that copy-pasting code from the book modules into a script or source code may include unintended whitespace or newlines due to formatting.

Some modules will have extra mile exercises, which are more difficult and time-consuming than regular exercises. They are not required to learn the material, but they will develop extra skills and aid you towards the exam.

1.4. About the PEN-300 VPN Labs

The PEN-300 labs provide an isolated environment that contains two sets of machine types. The first type is the virtual machines associated with a given book module, while the other is the set of challenges presented once you have completed the course videos and the book modules.

Note that all virtual machines in this course are assigned to you and are not shared with other students.

1.4.1. Control Panel

Once logged into the PEN-300 VPN lab network, you can access your PEN-300 control panel. The PEN-300 control panel will help you revert your client and lab machines or book your exam.

1.4.2. Reverts

Each student is provided with twelve reverts every 24 hours. Reverts enable you to return a particular set of lab machines to its pristine state. This counter is reset every day at 00:00 GMT +0. If you require additional reverts, you can contact a Student Administrator via email (help@offensive-security.com) or contact Live Support to have your revert counter reset.

The minimum amount of time between lab machine reverts is five minutes.

Each module (except this introduction and the modules Operating System and Programming Theory and Trying Harder: The Labs) will have an entry from a drop-down menu. Before starting on the exercises or following the information given in the course videos or book modules you must access the control panel and revert the entry associated with the given module.

Note that it is not possible to revert a single virtual machine for a given module or lab. When a revert is triggered all virtual machines for that given module are reverted. For modules later in the course this can take a while due to the number of machines in use. This is done to ensure stability of the lab machines within Active Directory environments.

Once you have been disconnected from the VPN for an extended period any active virtual machines will be removed and once you connect to the VPN again you must request a revert. Therefore, please ensure that you copy any notes or developed scripts to your Kali Linux VM before disconnecting from the labs.

After completing the course modules and associated exercises, you can select challenges from the control panel. This will revert a set of machines used to simulate targets of a penetration test. Note that you will not be given any credentials for these clients as they simulate black box penetration tests.

1.4.3. Client Machines

For each module you will be assigned a set of dedicated client machines that are used in conjunction with the course material and exercises.

The number and types of machines vary from module to module, and it is not possible to have client machines from multiple modules active at the same time. Once a new module is selected any client machines from the current module are removed.

All machines used in this course have modern operating systems like Windows 10, Windows Server 2019, and Ubuntu 20.04.

1.4.4. Kali Virtual Machine

This course was created and designed with Kali Linux in mind. While you are free to use any operating system you desire, the book modules and course videos all depict commands as given in Kali Linux while running as a non-root user.

Additionally, the Student Administrators only provide support for Kali Linux running on VMware, but you are free to use any other virtualization software.

The recommended Kali Linux image is the newest stable release in a default 64-bit build.

1.4.5. Lab Behavior and Lab Restrictions

The following restrictions are strictly enforced in the internal VPN lab network. If you violate any of the restrictions below, OffSec reserves the right to disable your lab access.

1. Do not ARP spoof or conduct any other type of poisoning or man-in-the-middle attacks against the network.
2. Do not perform brute force attacks against the VPN infrastructure.
3. Do not attempt to hack into other students' clients or Kali machines.

1.5. About the OSEP Exam

The OSEP certification exam simulates a live network in a private lab that contains a single large network to attack and compromise. To pass, you will need to either obtain access to a specific section of the network or obtain at least 100 points by compromising individual machines.

The environment is completely dedicated to you for the duration of the exam, and you will have 47 hours and 45 minutes to complete it.

To ensure the integrity of our certifications, the exam will be remotely proctored. You are required to be present 15 minutes before your exam start time to perform identity verification and other pre-exam tasks. To do so, click on the Exam tab in the OffSec Training Library, which is situated at the top right of your screen. During these pre-exam verification steps, you will be provided with a VPN connectivity pack.

Once the exam has ended, you will have an additional 24 hours to put together your exam report and document your findings. You will be evaluated on quality and accuracy of the exam report, so please include as much detail as possible and make sure your findings are all reproducible.

Once your exam files have been accepted, your exam will be graded, and you will receive your results in ten business days. If you achieve a passing score, we will ask you to confirm your physical address so we can mail your certificate. If you have not achieved a passing score, we will notify you, and you may purchase a certification retake using the appropriate links.

We highly recommend that you carefully schedule your exam for a two-day window when you can ensure no outside distractions or commitments. Also, please note that exam availability is handled on a first come, first served basis, so it is best to schedule your exam as far in advance as possible to ensure your preferred date is available.

For additional information regarding the exam, we encourage you to take some time to go over the OSEP exam guide.

1.6. Wrapping Up

In this module, we discussed important information needed to make the most of the PEN-300 course and lab. In addition, we also covered how to take the final OSEP exam.

We wish you the best of luck on your PEN-300 journey and hope you enjoy the new challenges you will face.