OSEP

KO | EN

gitlite — search

#python #java #python3 #arduino #golang #machine-learning #rust #html #flask #javascript #seismology #nodejs

★ 15 Open GitHub ↗

No description available.

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

```

██████╗ ██╗  ██╗██╗                    ██████╗ ███████╗███████╗██████╗ 
			██╔═████╗╚██╗██╔╝██║                   ██╔═══██╗██╔════╝██╔════╝██╔══██╗
			██║██╔██║ ╚███╔╝ ██║         █████╗    ██║   ██║███████╗█████╗  ██████╔╝
			████╔╝██║ ██╔██╗ ██║         ╚════╝    ██║   ██║╚════██║██╔══╝  ██╔═══╝ 
			╚██████╔╝██╔╝ ██╗███████╗              ╚██████╔╝███████║███████╗██║     
			 ╚═════╝ ╚═╝  ╚═╝╚══════╝               ╚═════╝ ╚══════╝╚══════╝╚═╝

https://x.com/0xL4wliet (@0xL4wliet)

```
# PEN-300: Advanced Evasion Techniques and Breaching Defenses

Building on the skills acquired in PEN-200, OffSec’s PEN-300 course explores advanced penetration testing techniques against hardened targets. Learners gain hands-on experience bypassing security defenses and crafting custom exploits in real-world scenarios, enhancing their expertise in ethical hacking and vulnerability assessment.

This self-paced course culminates in a challenging exam, leading to the OffSec Experienced Penetration Tester (OSEP) certification. Achieving the OSEP certification distinguishes professionals with advanced penetration testing skills, making them highly sought-after experts in securing organizations from sophisticated threats.

# Official Link

Link: https://www.offsec.com/courses/pen-300/

# Exam Day
<h3 align="center">
08-10-2024 (15 Days/Preparation)
</h3>

# Related Resources
- Official student Forum: https://forums.offensive-security.com
- Live Support & Discord: https://help.offsec.com/hc/en-us
- Exam Guide: https://help.offsec.com/hc/en-us/articles/360050293792-OSEP-Exam-Guide
- *This repo is so influenced by r0r0x-xx & nullg0re*
## Chapter 1 - Copyright
Just a Copyright .. ^^ No further resources

## Chapter 2 - General Course Information
- OSEP - Offensive Security Experienced Penetration Tester (REVIEW): https://www.youtube.com/watch?v=iUPyiJbN4l4&t=128s
- OSEP Review - What YOU Need to Know! (UPDATED EXAM): https://www.youtube.com/watch?v=R1apMwbVuDs

## Chapter 3 - Operating System and Programming Theory

### Chapter 3.1 - Programming
- Bash: https://www.youtube.com/watch?v=smbeKPDVs2I
- Python: https://www.youtube.com/playlist?list=PLBf0hzazHTGM_dncTqO9l-0zUQYP0nNPU
- PowerShell: https://resources.infosecinstitute.com/topic/powershell-for-pentesters-part-1-introduction-to-powershell-and-cmdlets/
- C#: 
	- https://www.youtube.com/watch?v=GhQdlIFylQ8
	- https://github.com/mvelazc0/defcon27_csharp_workshop
	- https://www.tutorialspoint.com/csharp/index.htm
- Introduction to VBA: https://docs.microsoft.com/en-us/office/vba/library-reference/concepts/getting-started-with-vba-in-office

### Chapter 3.2 - System
- Win32 API’s:
	- https://posts.specterops.io/offensive-p-invoke-leveraging-the-win32-api-from-managed-code-7eef4fdef16d
	- https://rastamouse.me/blog/process-injection-dinvoke/
	- https://www.pinvoke.net/
- Windows Registry:
	- https://en.wikipedia.org/wiki/Windows_Registry
	- https://www.lifewire.com/windows-registry-2625992
- WoW64:
	- https://en.wikipedia.org/wiki/WoW64
	- https://learn.microsoft.com/fr-fr/windows/win32/winprog64/wow64-implementation-details

## Chapter 4 - Client Side Code Execution With Office

- Staged vs. Non-staged Payloads: https://buffered.io/posts/staged-vs-stageless-handlers/
- Droppers / Stagers: 
	- https://en.wikipedia.org/wiki/Dropper_(malware)
	- https://rastamouse.me/blog/asb-bypass-pt2/ - Use Wayback Machine (2021)
- HTML Smuggling (Not HTTP Request Smuggling):
	- https://outflank.nl/blog/2018/08/14/html-smuggling-explained/
	- https://github.com/Arno0x/EmbedInHTML
- Phishing With Microsoft Office
	- https://digitalguardian.com/blog/what-macro-malware
	- https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/macro-malware
	- https://support.microsoft.com/en-us/office/automatically-run-a-macro-when-opening-a-workbook-1e55959b-e077-4c88-a696-c3017600db44
	- https://stackoverflow.com/questions/51296291/auto-open-sub-vba/51296480
- Phishing Pretexts:
	- https://github.com/L4bF0x/PhishingPretexts
- Calling Win32 APIs from VBA:
	- https://www.aeternus.sg/how-to-use-windows-api-in-vba/ - *Use Wayback Machine (2020)*
	- https://renenyffenegger.ch/notes/development/languages/VBA/Win-API/index
	- https://learn.microsoft.com/en-us/dotnet/visual-basic/programming-guide/com-interop/walkthrough-calling-windows-apis
- VBA Shellcode Runners:
	- https://www.scriptjunkie.us/2012/01/direct-shellcode-execution-in-ms-office-macros/
	- https://www.bitdam.com/2018/05/22/propertybomb-an-old-new-technique-for-arbitrary-code-execution-in-vba-macro/ - *Use Wayback Machine (2020)*
	- https://github.com/infosecn1nja/MaliciousMacroMSBuild - *Doesn't work so well (This is OLD VERSION) !!*
- PowerShell Shellcode Runner:
	- https://devblogs.microsoft.com/scripting/use-powershell-to-interact-with-the-windows-api-part-1/
	- https://www.raydbg.com/2017/Call-Native-Win32-API-in-PowerShell/
	- https://github.com/PowerShellMafia/PowerSploit/blob/master/CodeExecution/Invoke-Shellcode.ps1
	- https://powersploit.readthedocs.io/en/latest/CodeExecution/Invoke-ReflectivePEInjection/
	- https://stackoverflow.com/questions/63593930/how-to-call-a-win32-api-function-from-powershell
	- https://www.defcon.org/images/defcon-21/dc-21-presentations/Bialek/DEFCON-21-Bialek-PowerPwning-Post-Exploiting-by-Overpowering-Powershell.pdf
- PowerShell in Memory:
	- https://isc.sans.edu/forums/diary/Fileless+Malicious+PowerShell+Sample/23081/
	- https://github.com/PowerShell/PowerShell/blob/master/src/Microsoft.PowerShell.CoreCLR.Eventing/DotNetCode/Eventing/UnsafeNativeMethods.cs
- DelegateType Reflection:
	- https://learn.microsoft.com/en-us/dotnet/csharp/programming-guide/delegates/
	- https://learn.microsoft.com/en-us/dotnet/fundamentals/reflection/how-to-hook-up-a-delegate-using-reflection
	- https://www.powershellgallery.com/packages/poke/1.0.0.2/Content/delegate.ps1
- Proxy-Aware PowerShell Communications:
	- http://woshub.com/using-powershell-behind-a-proxy/
	- https://stackoverflow.com/questions/14263359/access-web-using-powershell-and-proxy
	- https://cloudrun.co.uk/powershell/configuring-powershell-to-work-behind-a-proxy-server/
	- https://medium.com/river-yang/powershell-working-behind-a-proxy-with-authentication-eb68a337f222
## Chapter 5 - Client Side Code Execution with Windows Script Host

- JScript Execution: https://docs.microsoft.com/en-us/previous-versions/windows/desktop/indexsrv/running-a-jscript-query
- JScript Basic Dropper: https://github.com/hlldz/SpookFlare
- HTA, VBA, JScript, CScript Payload Creation and Obfuscation:
	- https://github.com/tyranid/DotNetToJScript
	- https://github.com/med0x2e/GadgetToJScript
- SharpShooter:
	- https://github.com/mdsecactivebreach/SharpShooter

## Chapter 6 - Process Injection and Migration

- Process Injection:
	- https://github.com/3xpl01tc0d3r/ProcessInjection
	- https://github.com/secrary/InjectProc
	- https://rastamouse.me/blog/process-injection-dinvoke/ - *User WayBack Machine*
	- https://www.ired.team/offensive-security/defense-evasion/parent-process-id-ppid-spoofing
- DLL Injection
	- https://en.wikipedia.org/wiki/DLL_injection#:~:text=In%20computer%20programming%2C%20DLL%20injection,did%20not%20anticipate%20or%20intend
	- https://medium.com/bug-bounty-hunting/dll-injection-attacks-in-a-nutshell-71bc84ac59bd
	- https://www.youtube.com/watch?v=yKoD5Oy8CKQ
	- https://github.com/milkdevil/injectAllTheThings
	- http://blog.opensecurityresearch.com/2013/01/windows-dll-injection-basics.html  - *User WayBack Machine*
- Reflective DLL Injection
	- https://github.com/stephenfewer/ReflectiveDLLInjection
	- https://clymb3r.wordpress.com/2013/04/06/reflective-dll-injection-with-powershell/
	- https://github.com/PowerShellMafia/PowerSploit/blob/master/CodeExecution/Invoke-ReflectivePEInjection.ps1
- Process Hollowing
	- https://gist.github.com/smgorelik/9a80565d44178771abf1e4da4e2a0e75
	- https://github.com/caesartcs/ProcessHollowing
	- https://github.com/m0n0ph1/Process-Hollowing
	- https://trustedsec.com/blog/the-nightmare-of-proc-hollows-exe

## Chapter 7 - Introduction to Antivirus Evasion

- Metasploit Encryptors: https://blog.rapid7.com/2019/11/21/metasploit-shellcode-grows-up-encrypted-and-authenticated-c-shells/
- .NET/C# AES Payload Encryption:
	- https://sevrosecurity.com/2019/05/25/bypass-windows-defender-with-a-simple-shell-loader/ - *User WayBack Machine*
	- https://github.com/cribdragg3r/Simple-Loader

## Chapter 8 - Advanced Antivirus Evasion
- Antimalware Scanning Interface (AMSI):
	- https://rastamouse.me/2018/10/amsiscanbuffer-bypass---part-1/ - *User WayBack Machine*
	- https://rastamouse.me/blog/asb-bypass-pt2/ - *User WayBack Machine*
	- https://rastamouse.me/blog/asb-bypass-pt3/ - *User WayBack Machine*
	- https://rastamouse.me/blog/asb-bypass-pt4/ - *User WayBack Machine*
- AntiScan.me: https://antiscan.me/

## Chapter 9 - Application Whitelisting

- Theory: https://www.techtarget.com/searchsecurity/definition/application-whitelisting#:~:text=Application%20whitelisting%20is%20the%20practice,networks%20from%20potentially%20harmful%20applications
- Bypass:
	- https://github.com/api0cradle/UltimateAppLockerByPassList
	- https://github.com/0xVIC/myAPPLockerBypassSummary

## Chapter 9 - Bypassing Network Filters

- Domain Fronting:
	- https://digi.ninja/blog/domain_fronting.php
	- https://attack.mitre.org/techniques/T1090/004/
	- https://medium.com/@malcomvetter/simplifying-domain-fronting-8d23dcb694a0
- DNS Tunneling:
	- https://www.paloaltonetworks.com/cyberpedia/what-is-dns-tunneling
	- https://unit42.paloaltonetworks.com/dns-tunneling-how-dns-can-be-abused-by-malicious-actors/
## Chapter 11 - Linux Post-Exploitation

- Antiscan.me: https://antiscan.me/
- Shared DLL Hijacking: 
	- https://www.contextis.com/en/blog/linux-privilege-escalation-via-dynamically-linked-shared-object-library
	- https://www.boiteaklou.fr/Abusing-Shared-Libraries.html
	- https://sumit-ghosh.com/articles/hijacking-library-functions-code-injection-ld-preload/
- Command List: https://github.com/mubix/post-exploitation/wiki/Linux-Post-Exploitation-Command-List
## Chapter 12 - Kiosk Breakout

- Kiosk Breakouts / Attacks:
	- https://www.trustedsec.com/blog/kioskpos-breakout-keys-in-windows/
	- https://sra.io/blog/sitekiosk-breakout/
	- https://www.boiteaklou.fr/Abusing-Shared-Libraries.html
	- https://www.engetsu-consulting.com/blog/kiosk-breakout-windows
	- https://ppn.snovvcrash.rocks/pentest/infrastructure/kiosk-breakout
## Chapter 13 - Windows Credentials

- Local Windows Credentials:
	-  SAM Dump: https://medium.com/@sanjumalhotra26/dumping-credentials-from-sam-file-using-mimikatz-and-cracking-with-john-the-ripper-and-hashcat-ce5bbf2f4f5a
	- Hardening the Local Admin Account (LAPS):
		- https://rastamouse.me/blog/laps-pt1/ - *Use WayBack Machine*
		- https://rastamouse.me/blog/laps-pt2/ - *Use WayBack Machine*
		- https://github.com/kfosaaen/Get-LAPSPasswords
		- https://blog.netspi.com/running-laps-around-cleartext-passwords/
- Access Token: https://foxglovesecurity.com/2017/08/25/abusing-token-privileges-for-windows-local-privilege-escalation/

## Chapter 14 - Windows Lateral Movement

- 
# Study Plan

- Start: 23-09-2024
- End: 08-10-2024
- Duration: 15 Days
- Plan:
	- Day 1: Revise All PDF & Take Note + Challenge Lab 1
	- Day 2: Revise Chapters 01-05 (+Alternative resources) + Challenge Lab 2
	- Day 3: Revise Chapters 06-11 (+Alternative resources) + Challenge Lab 3 => Doesn’t gone well ( Had A lot of Work :( !) 
	- Day 4: Revise Chapters 06-13 (+Alternative resources) + Challenge Lab 4
	- Day 5: Revise Chapters 14-17 (+Alternative resources) + Challenge Lab 5
	- Day 6: Revise Chapters 18-19 (+Alternative resources) Challenge Lab 6

## Day 1 Detailed - 23/09/2024
- Duration: 8h 45m 38s
- Tasks:
	- Complete OSEP PDF Chapters & Take Notes
		- [x] Chapter 1
		- [x] Chapter 2
		- [x] Chapter 3
		- [x] Chapter 4
		- [x] Chapter 5
		- [x] Chapter 6
		- [x] Chapter 7
		- [x] Chapter 8
		- [x] Chapter 9
		- [x] Chapter 10
		- [x] Chapter 11
		- [x] Chapter 12
		- [x] Chapter 13
		- [ ] Chapter 14
		- [ ] Chapter 15
		- [ ] Chapter 16
		- [ ] Chapter 17
		- [ ] Chapter 18
		- [ ] Chapter 19
	- Complete Challenge Labs:
		- [ ] Challenge Lab N°: 1
	- Exercises:
		- [x] Chapter 4 Exercises
			- [x] 4.1.2.1 Exercise
			- [x] 4.1.3.1 Exercises
			- [x] 4.2.1.1 Exercise
			- [x] 4.2.2.1 Exercises
			- [x] 4.2.3.1 Exercises
			- [x] 4.3.2.1 Exercises
			- [x] 4.4.1.1 Exercises
			- [x] 4.4.2.1 Exercise
			- [x] 4.5.1.1 Exercises
			- [x] 4.5.2.1 Exercises
			- [x] 4.6.1.1 Exercises
			- [x] 4.6.2.1 Exercises
			- [x] 4.6.3.1 Exercises
			- [x] 4.6.4.1 Exercises
			- [x] 4.7.1.1 Exercises
			- [x] 4.7.2.1 Exercises
			- [x] 4.7.3.1 Exercise
		- [x] Chapter 5 Exercises
			- [x] 5.1.1.1 Exercises
			- [x] 5.1.2.1 Exercises
			- [x] 5.2.1.1 Exercises
			- [x] 5.2.2.1 Exercises
			- [x] 5.2.3.1 Exercise
			- [x] 5.2.4.1 Exercise
			- [x] 5.2.5.1 Exercises
			- [x] 5.2.5.2 Extra Mile
			- [x] 5.2.6.1 Exercises
			- [x] 5.3.1.1 Exercises
		- [x] Chapter 6 Exercises
			- [x] 6.1.2.1 Exercises
			- [x] 6.1.2.2 Extra Mile
			- [x] 6.2.2.1 Exercise
			- [x] 6.3.2.1 Exercises
			- [x] 6.4.2.1 Exercises
		- [x] Chapter 7 Exercises
			- [x] 7.3.1.1 Exercise
			- [x] 7.4.1.1 Exercise
			- [x] 7.4.2.1 Exercises
			- [x] 7.5.1.1 Exercises
			- [x] 7.5.2.1 Exercises
			- [x] 7.6.1.1 Exercises
			- [x] 7.6.2.1 Exercises
			- [x] 7.7.1.1 Exercises
			- [x] 7.7.2.1 Exercises
			- [x] 7.8.1.1 Exercises
			- [x] 7.8.2.1 Exercises
			- [x] 7.8.3.1 Exercises
			- [x] 7.8.3.2 Extra Mile
		- [x] Chapter 8 Exercises
			- [x] 8.2.2.1 Exercises
			- [x] 8.3.1.1 Exercises
			- [x] 8.3.2.1 Exercise
			- [x] 8.4.1.1 Exercises
			- [x] 8.4.2.1 Exercises
			- [x] 8.5.1.1 Exercises
			- [x] 8.5.2.1 Exercises
			- [x] 8.5.2.1 Exercises
			- [x] 8.6.2.1 Exercises
			- [x] 8.6.3.1 Exercises
		- [x] Chapter 9 Exercises
			- [x] 9.1.2.1 Exercises
			- [x] 9.2.1.1 Exercises
			- [x] 9.2.2.1 Exercises
			- [x] 9.2.2.2 Extra Mile
			- [x] 9.2.3.1 Exercises
			- [x] 9.2.3.1 Exercises
			- [x] 9.2.4.1 Exercise
			- [x] 9.3.1.1 Exercises
			- [x] 9.3.2.1 Exercises
			- [x] 9.3.3.1 Exercises
			- [x] 9.3.4.1 Exercise
			- [x] 9.4.2.1 Exercises
			- [x] 9.4.3.1 Exercise
			- [x] 9.4.4.1 Exercises
			- [x] 9.4.5.1 Exercises
			- [x] 9.4.5.2 Extra Mile
			- [x] 9.5.1.1 Exercises
			- [x] 9.5.2.1 Exercises
			- [x] 9.5.2.2 Extra Mile
		- [x] Chapter 10 Exercises
			- [x] 10.1.1.1Exercises
			- [x] 10.1.2.1Exercise
			- [x] 10.2.1.1Exercises
			- [x] 10.3.1.1Exercises
			- [x] 10.6.1.1Exercise
			- [x] 10.6.1.2Extra Mile
			- [x] 10.6.2.1Exercises
			- [x] 10.6.2.2Extra Mile
			- [x] 10.7.2.1Exercises
		- [x] Chapter 11 Exercises
			- [x] 11.1.1.1Exercises
			- [x] 11.1.1.2Extra Mile
			- [x] 11.1.2.1Exercises
			- [x] 11.2.2.1Exercises
			- [x] 11.2.2.1Exercises
			- [x] 11.3.2.1Exercises
			- [x] 11.3.2.2Extra Mile
			- [x] 11.3.3.1Exercises
		- [x] Chapter 12 Exercises
			- [x] 12.1.1.1Exercises
			- [x] 12.2.4.1Exercises
			- [x] 12.2.4.2Extra Mile
			- [x] 12.3.1.1Exercises
			- [x] 12.3.1.2Extra Mile
			- [x] 12.5.1.1Exercises
		- [x] Chapter 13 Exercises
			- [x] 13.1.1.1Exercises
			- [x] 13.1.2.1Exercises
			- [x] 13.2.1.1Exercise
			- [x] 13.2.2.1Exercises
			- [x] 13.2.3.1Exercise
			- [x] 13.3.2.1Exercises
			- [x] 13.4.1.1Exercises
			- [x] 13.4.2.1Exercises
		- [ ] Chapter 14 Exercises
		- [ ] Chapter 15 Exercises
		- [ ] Chapter 16 Exercises
		- [ ] Chapter 17 Exercises
		- [ ] Chapter 18 Exercises

## Day 2 Detailed - 24/09/2024

- Duration: 7h 45m in Total
- Tasks:
	- Revise Chapters 01-05 (+Alternative resources):
		- [x] Chapter 1
		- [x] Chapter 2
		- [x] Chapter 3
		- [x] Chapter 4
		- [x] Chapter 5
	- Complete Challenge Labs
		- [x] Challenge Lab 1
		- [ ] Challenge Lab 2

## Day 3 Detailed - 25/09/2024
- Duration: 4h
- Tasks:
	- Complete Challenge Labs
		- [x] Challenge Lab 1

## Day 4 Detailed - 26/09/2024
- Duration: 8h 25m 18s
- Tasks:
	- [x] Revise Chapters 06-13 (+Alternative resources)
		- [x] Chapter 6
		- [x] Chapter 7
		- [x] Chapter 8
		- [x] Chapter 9
		- [x] Chapter 10
		- [x] Chapter 11
		- [x] Chapter 12
		- [x] Chapter 13
	- [ ] Complete Challenge Labs
		- [x] Challenge Lab 2
		- [ ] Challenge Lab 3
		- [ ] Challenge Lab 4

## Day 5 Detailed - 27/09/2024
- Duration: 3h 30m
- Tasks:
	- [ ] Revise Chapters 14-17 (+Alternative resources)
		- [x] Chapter 14 (Half of this chapter)
		- [ ] Chapter 15
		- [ ] Chapter 16
		- [ ] Chapter 17
	- [ ] Complete Challenge Labs
		- [ ] Challenge Lab 2
		- [ ] Challenge Lab 3
		- [ ] Challenge Lab 4

## Day 6 + 7 - 27-28/09/2024: Canceled
> Canceled: Have work to complete !

## Day 8 Detailed - 29/09/2024
- Duration: 13h 54m 39s
- Tasks:
	- [ ] Revise Chapters 14-17 (+Alternative resources)
		- [x] Chapter 14
		- [x] Chapter 15
		- [x] Chapter 16
		- [ ] Chapter 17
	- [ ] Complete Challenge Labs
		- [x] Challenge Lab 2
		- [ ] Challenge Lab 3
		- [ ] Challenge Lab 4

OSEP

Explore Similar Repositories

Was this content helpful?

Recent Feedback

Download README