90DaysOfCyberSecurity

KO | EN

gitlite — search

#javascript #python #hacktoberfest #react #ai #typescript #llm #go #golang #android #machine-learning #rust #deep-learning #linux

90DaysOfCyberSecurity

★ 10 Open GitHub ↗

Making this repository for preparation of eCPPT, CPENT, and OSCP. Will proceed to other things in this domain later on.

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# Conquering Offensive Security in 90 days
Making this repository for preparation of **eCPPT and CPENT**. Will proceed to other things in this domain later on.  
   
   **Inspired by:** 90daysofdevops by michaelcade

Started: 1st June 2024

**Key:**  
   ✔️ : Completed  
   ❌ : Incomplete  
   ⭕ : In progress  
   🔸 : Linux Notes  
   🔹 : Windows Notes  
   📝: Important notes for Exam

## Week 1 (Active Directory Exploitation):
### Day 1:
- [✔️] [Active Directory Basics](https://tryhackme.com/module/hacking-active-directory)
### Day 2:
- [✔️] [Breaching Active Directory](https://tryhackme.com/module/hacking-active-directory)
### Day 3:
- [✔️] [Enumerating Active Directory](https://tryhackme.com/module/hacking-active-directory)
### Day 4:
- [✔️] Run the commands and tools for Practicing Enumeration in a [Deliberately Vulnerable AD](https://github.com/Orange-Cyberdefense/GOAD)
### Day 5:
- [✔️] [Lateral Movement and Pivoting](https://tryhackme.com/module/hacking-active-directory)
### Day 6:
- [✔️] [Exploiting Active Directory](https://tryhackme.com/module/hacking-active-directory)
### Day 7:
- [✔️] [Persisting Active Directory](https://tryhackme.com/module/hacking-active-directory)

## Week 2 (Active Directory Exploitation & General Win. PrivEsc):
### Day 8:
- [✔️] [Credentials Harvesting](https://tryhackme.com/module/hacking-active-directory)
### Day 9:
- [✔️] For Practicing Windows Virtual Machine, you can check [HTB Platform](https://hackthebox.com) or [GOAD](https://github.com/Orange-Cyberdefense/GOAD)
- I practiced the concepts on an easy VM in [TryHackMe](https://tryhackme.com/r/room/blue).
### Day 10:
- [✔️] For Practicing Windows Virtual Machine, you can check [HTB Platform](https://hackthebox.com) or [GOAD](https://github.com/Orange-Cyberdefense/GOAD)
- I practiced the concepts on an easy VM in [TryHackMe](https://tryhackme.com/r/room/attacktivedirectory).
### Day 11:
- [✔️] Learnt the process of exploiting Certificates in AD on [TryHackMe](https://tryhackme.com/r/room/cve202226923).
### Day 12:
- [✔️] Practiced exploiting Certificates in AD some more on [TryHackMe](https://tryhackme.com/r/room/adcertificatetemplates).
### Day 13:
- [✔️] Practiced using Metasploit on an Easy Windows VM on [TryHackMe](https://tryhackme.com/r/room/ice).
### Day 14:
- [✔️] Practiced different types of Privelege Escalations on a Medium difficulty Windows VM on [TryHackMe](https://tryhackme.com/r/room/windows10privesc).  
   ❕ P.S: This can be used as a reference list to perform privelege escalation.

## Week 3 (Active Directory Exploitation & Windows CTFs):
### Day 15:
- [❌] Practiced different types of Privelege Escalations on a Medium difficulty Windows VM on [TryHackMe](https://tryhackme.com/r/room/windowsprivescarena).
### Day 16:
- [✔️] Practiced the skills learnt previously on a Hard difficulty vulnerable AD environment on [TryHackMe](https://tryhackme.com/r/room/ra). 
### Day 17:
- [✔️] Practiced the skills learnt previously on a Hard difficulty vulnerable AD environment on [TryHackMe](https://tryhackme.com/r/room/ra).
### Day 18:
- [✔️] Practiced the skills learnt previously on another Hard difficulty vulnerable AD environment on [TryHackMe](https://tryhackme.com/r/room/resetui).  
   ❕ P.S: Can be used as a practice VM to learn and apply random windows privelege escalation tools.
### Day 19:
- [✔️] Practiced the skills learnt previously on another Hard difficulty vulnerable AD environment on [TryHackMe](https://tryhackme.com/r/room/resetui).
### Day 20:
- [✔️] Completed an Easy difficulty vulnerable Windows VM [TryHackMe](https://tryhackme.com/r/room/outlookntlmleak)
- [✔️] Started a Medium difficulty vulnerable Windows VM [TryHackMe](https://tryhackme.com/r/room/vulnnetactive)
### Day 21:
- [❌] Completed a Medium difficulty vulnerable Windows VM [TryHackMe](https://tryhackme.com/r/room/vulnnetactive)
- [❌] Did another Medium difficulty vulnerable Windows VM [TryHackMe](https://tryhackme.com/r/room/stealth)  
   ❕ P.S: Used privesc.ps1 script to enumerate for Privelege Escalation.

## Week 4 (Double Pivoting):
### Day 22:
- [✔️] Started [Double Pivoting](https://pentest.blog/explore-hidden-networks-with-double-pivoting/).
### Day 23:
- [✔️] Practicing the concepts on an Easy Difficulty [Double Pivoting VM](https://tryhackme.com/r/room/wreath)
### Day 24:
- [✔️] Practicing the concepts on an Easy Difficulty [Double Pivoting VM](https://tryhackme.com/r/room/wreath)

Continued: 8th July
### Day 25:
- [✔️] Practicing the concepts on an Easy Difficulty [Double Pivoting VM](https://tryhackme.com/r/room/wreath)
### Day 26:
- [❌] Practicing the concepts on an Easy Difficulty [Double Pivoting VM](https://tryhackme.com/r/room/wreath)   
   ⚠️ Note: Have to practice and revise all the concepts later.   
  ❕ P.S: The tools provided here to be used in the exam.   
### Day 27:
- [✔️] Started practicing concepts on a Medium difficulty [CTF on THM](https://tryhackme.com/r/room/empline)
### Day 28:
- [✔️] Completed the [CTF](https://tryhackme.com/r/room/empline)

## Week 5 (CTF Exercises):
### Day 29:
- [✔️] Practiced concepts on a Medium difficulty [CTF on THM](https://tryhackme.com/r/room/containme1)
### Day 30:
- [✔️] Completed the [CTF](https://tryhackme.com/r/room/containme1)
### Day 31:
- [❌] Started practicing concepts on a Hard difficulty [CTF on THM](https://tryhackme.com/r/room/internal)
### Day 32:
- [❌] Continued practicing concepts on a Hard difficulty [CTF on THM](https://tryhackme.com/r/room/internal)
### Day 33:
- [❌] Completed the Hard difficulty [CTF on THM](https://tryhackme.com/r/room/internal)
### Day 34:
- [❌]
### Day 35:
- [❌]

## Week 6 (OWASP TOP 10):
### Day 36:
- [✔️] Started SQL Injection Labs on [PortSwigger](https://portswigger.net/web-security/sql-injection)
### Day 37:
- [✔️] Using SQLMap completed SQL Injection Labs on [PortSwigger](https://portswigger.net/web-security/sql-injection)
### Day 38:
- [✔️] Worked on AWS Concepts
### Day 39:
- [✔️] Completed CSRF Labs on [PortSwigger](https://portswigger.net/web-security/csrf)
### Day 40:
- [✔️] Completed File Upload Labs on [PortSwigger](https://portswigger.net/web-security/file-upload)
### Day 41:
- [✔️] Completed XML External Entity Labs on [PortSwigger](https://portswigger.net/web-security/xxe)
### Day 42:
- [✔️] Revised all the concepts and topics learnt this week.

## Week 7 (Initial Foothold Practice):
### Day 43:
- [✔️] Completed Medium Difficulty Lab on [TryHackMe](https://tryhackme.com/r/room/blog)   
  ❕ P.S: Wordpress Scanning guidelines in this VM.
### Day 44:
- [✔️] Completed Easy Difficulty Lab on [TryHackMe](https://tryhackme.com/r/room/blaster)
- [✔️] Completed Metasploit Basic Lab on [TryHackMe](https://tryhackme.com/module/metasploit)
### Day 45:
- [✔️] Completed Metasploit Exploitation Lab on [TryHackMe](https://tryhackme.com/module/metasploit)   
    🔹Learnt: SMB and SMTP enumeration as well as dumping hash through metasploit.
### Day 46:
- [⭕] Completed Hard Difficulty Lab on [TryHackMe](https://tryhackme.com/r/room/retro)
### Day 47:
- [✔️] Completed Easy Difficulty Lab on [TryHackMe](https://tryhackme.com/r/room/startup)   
    :small_orange_diamond:Learnt: FTP for initial foothold and cronjobs for privesc.
- [✔️] Completed Easy Difficulty Lab on [TryHackMe](https://tryhackme.com/r/room/ignite)   
    :small_orange_diamond:Learnt: Fuel CMS exploit and php shell upload for privesc.
### Day 48:
- [✔️] Completed Easy Difficulty Lab on [TryHackMe](https://tryhackme.com/r/room/bolt)   
    :small_orange_diamond:Learnt: Bolt CMS exploit through msf, no privesc in this.
- [✔️] Completed Easy Difficulty Lab on [TryHackMe](https://tryhackme.com/r/room/chillhack)   
    :small_orange_diamond:Learnt: FTP and Command Injection variations for initial foothold. SSH key-gen, mysql and GTFOBins for lateral movement / privesc.
### Day 49:
- [✔️] Completed Metasploit Meterpreter Lab on [TryHackMe](https://tryhackme.com/module/metasploit)   
    🔹Learnt: Lateral movement and privesc using meterpreter through exploiting smbshares and NTLM Hash etc.

## Week 8 (Revision):
### Day 50:
- [✔️] Started Revising [Double Pivoting](https://tryhackme.com/r/room/wreath)
### Day 51:
- [✔️] Completed [Double Pivoting](https://tryhackme.com/r/room/wreath)   
    🔹Learnt:    
    1. Miniserv exploitation and sshuttle to the second machine for pivoting.    
    2. Gitstack exploitation through powershell exploit redirected to our own machine using socat.
    3. Used PS for persistent access and mimikatz for priv esc.
    4. Used Evil-Winrm to connect to the admin on second machine then setup chisel for portforwarding.
    5. Finally, exploit the php upload vulnerability through obfuscated code.
### Day 52:
- [✔️] 🔸🔹 Revision: Metasploit Modules.
### Day 53:
- [✔️] 🔸🔹 Revision: SMB Enumeration through **enum4linux -a** and bruteforce through **crackmapexec**.
### Day 54:
- [✔️] 🔹 Revision: Windows VM remote through **xfreerdp** and users / groups enumeration through **PS**.
### Day 55 and 56:
🔹 Revision:
- [✔️] [Active Directory Basics](https://tryhackme.com/module/hacking-active-directory)
- [✔️] [Breaching Active Directory](https://tryhackme.com/module/hacking-active-directory)   
  📝: MSF and CME for username enumeration through passwords. Change password on first login in AD through impacket.    
  📝: Hashdump using PSExec from MSF, evil-winrm for remote connection.    
- [✔️] [Enumerating Active Directory](https://tryhackme.com/module/hacking-active-directory)   
  📝: Sharhound and Bloodhound for Enumeration and impacket for dumping NTLM Hashes.
### Week 9 (Revision and learning to use various AD tools):
### Day 57:
- [✔️] [Lateral Movement and Pivoting](https://tryhackme.com/module/hacking-active-directory)   
  📝: 
### Day 58:
- [✔️] [Exploiting Active Directory](https://tryhackme.com/module/hacking-active-directory)   
  📝: Mimikatz, Kekeo, (some other tools)[https://happycamper84.medium.com/exploiting-active-directory-tryhackme-walkthrough-aff708643d3a] etc. Print Spooler service exploitation through impacket-ntlmrelayx, importance of **kdbx** file, runas for running cmd as another user.
### Day 59:
- [✔️] Practiced on [HTB](https://www.hackthebox.com/machines/mantis)   
    🔹: **Kerbrute** for username enumeration, **Hex** decoding, **sqsh** for connection to MSSQL database, **responder** for capturing traffic, **CME** for enumerating SMB and MSSQL, executing **bloodhound** through terminal, SID extraction with **lookupsid**, **python ms14-068** exploit, **psexec** to take the shell.
### Day 60:
- [✔️] Practiced on [HTB](https://www.hackthebox.com/machines/sauna)   
    🔹: **Dig** for zone transfer of DNS, **Get-NPUsers** for No-PreAuth and post username enumeration check, **Ldapsearch** for dumping any LDAP information, **rpcclient** and **smbclient** for their respective services, **CME** to bruteforce winrm and smb, **rubeus** for performing kerberoasting, **manual PS** commands for local password hunting, **Mimikatz** for performing DC-Sync attack.
### Days 61 to 63:
- [✔️] Researched Metasploit for privilege escalation. Used the **always elevated** module.
- [✔️] Researched **CME** for bruteforcing winrm, ldap, and smb.
- [✔️] Researched **hydra** for bruteforcing rdp and ssh on different ports.
- [✔️] Researched **john** and **hashcat** for making (zip2john, keepass2john etc.) and bruteforcing hashes.
- [✔️] Learnt **keepass** exploitation. 
### Week 10 ():
### Days 64 and 65:
- [✔️] Enumerating kerberos through **kerbrute**, ASREP Roasting through **GET-NPUsers**.
- [✔️] Researched techniques for enumeration through **Powershell**. 
### Days 66 to 69:
- [✔️] Learnt various buffer overflow techniques through solving machines on TryHackMe namely [buffer overflow, bufferoverflow prep, and brainpan 1](https://tryhackme.com/r/hacktivities/search?page=1&kind=all&searchText=buffer).
### Day 70:
- [✔️] Learnt the process of making a professional report.
## eCPPT Exam Break
### Week 11 (CPENT Practice Range):
### Day 71:
- [✔️] Started to find helpful material for CPENT.
### Days 72 to 74:
- [✔️] Started Practice Range for CPENT.
- [✔️] Continued Active Directory Range.
- [✔️] CPENT Notes (FQDN)
### Day 75:
- [✔️] Studied CPENT Notes Further
### Day 76:
- [✔️] SMB Exploitation and Privelege Escalation (CPENT Notes).
### Day 77:
- [✔️] Binary Analysis (CPENT Notes).
### Week 12 (CPENT Practice Range):
### Days 78 to 84:
- [✔️] Further Binary Analysis (CPENT Notes).
- [✔️] Reviewed bruteforce concepts (SSH, WINRM, SMB, and RDP etc)
### Week 13 (CPENT Practice Range):
### Days 85 and 89:
- [⭕]

90DaysOfCyberSecurity

Today's picks

Was this content helpful?

Recent Feedback

90DaysOfCyberSecurity

Today's picks

Was this content helpful?

Recent Feedback

Download README