Hacking Cloud Infrastructure
Virtual Learning: 2,050€ + IVA
REF: NSSHCI Catálogo: Cybersecurity Área: Claranet Cyber Security (NotSoSecure), Cybersecurity
Duração:
2 dias
Próxima Data:
Consulte-nos
Local:
Online
Descrição
As cloud innovation gives birth to new technologies and new threats, now is the time to modernize your cloud security skills and bring them up to the industry standard. Join this hands-on, 2-day course to push your cloud hacking and vulnerability remediation skills to the next level and widen your career prospects. Get your hands dirty with our popular virtual labs and learn from experienced, practicing penetration testers with a legacy of training at Black Hat.
*PVP por participante. A realização do curso nas datas apresentadas está sujeita a um quórum mínimo de inscrições.
Destinatários
Cloud administrators and architects Penetration testers and red teamers CSIRT/SOC analysts and engineers/blue teams Developers Security/IT managers and team leads
-
Área: Cybersecurity
-
Certificação Associada: N/A
Programa:
Module 1: INTRODUCTION TO CLOUD COMPUTING
- Introduction to cloud and why cloud security matters
- Comparison with conventional security models
- Shared responsibility model
- Legalities around Cloud Pentesting
- Attacking Cloud Services
Module 2: ENUMERATION OF CLOUD ENVIRONMENTS
- DNS-based enumeration
- Open-Source Intelligence Gathering (OSINT) techniques for cloud-based asset identification
- Username enumeration
Module 3: ATTACKING MICROSOFT AZURE AD ENVIRONMENT
- Introduction to MS Azure
- MS Azure application attacks (App Service, Function App, Enterprise Apps)
- MS Azure service exploitation (Database, Key Vault, Automation account)
- Abuse MS Azure Service Principle Misconfiguration
- MS Azure AD or Entra ID Authentication Methods
Module 4: GAINING ENTRY VIA EXPOSED SERVICES
- Serverless-based attacks (AWS Lambda)
- PaaS attack: server-side request forgery (SSRF Exploitation over AWS ElasticBeanStalk)
- Attacking AWS Incognito misconfiguration
Module 5: AWS: IDENTITY AND ACCESS MANAGEMENT (IAM)
- AWS IAM policies and roles
- IAM policy evaluation
- Roles and permissions-based attacks
- Shadow admin attacks
Module 6: Attacking storage services (AWS, Azure, GCP)
- Exploring files storage
- Exploring shared access signatures (SAS) URLs in MS Azure
- Exploit misconfigured storage service
Module 7: POST EXPLOITATION
- Persistence in cloud
- Post-exploit enumeration
Module 8: CONTAINERS AS A SERVICE (CAAS) AND KUBERNETES (K8S) EXPLOITATION
- Understanding how container technology works (namespaces, cgroup, chroot)
- From Docker to K8S
- Identifying vulnerabilities in Docker images
- Exploiting misconfigured containers
- Exploiting Docker environments and breaking out of containers
- Exploring K8S environments
- K8S exploitation and breakouts
- Pivoting to host OS
Module 9: CAPTURE THE FLAG
- A timed competition to test your new skills and reinforce everything you’ve learnt
Pré-requisitos:
Delegates must have the following to make the most of the course:
- Basic to intermediate knowledge of cybersecurity (1.5+ years’ experience)
- Experience with common command line syntax
Partilha:
Precisas de ajuda a encontrar o teu futuro?
