Course Overview

VAPT training provides a wide understanding of Vulnerability Assessment (VA) and Penetration Testing (PT) methodologies used to identify, analyze, and exploit security weaknesses in networks, systems, and applications. Key topics covered are Vulnerability Assessment Methodologies & Tools, Penetration Testing Phases & Techniques, Network Security Testing & Exploitation, Web Application Security & OWASP Top 10, Post-Exploitation and Privilege Escalation, and finally Reporting & Documentation of Findings. By the end of the course, learners will be equipped with practical skills to conduct comprehensive security assessments, making them ready for roles like Penetration testers, Security analysts, or Ethical Hackers.

Syllabus

Chapter I- Introduction to VAPT

• Understanding Vulnerability Assessment and Penetration Testing
• Differences between Vulnerability Assessment and Penetration Testing
• Ethical hacking methodologies and legal considerations
• Importance of cybersecurity in modern organizations

Chapter II- Setting Up the Lab Environment

• Introduction to Kali Linux
• Installing and configuring Virtual Machines (VMs)
• Setting up Metasploitable 2, OWASP-BWA, and vulnerable applications
• Using penetration testing tools and frameworks

Chapter III- Information Gathering and Reconnaissance

• Passive vs. Active Reconnaissance
• OSINT Framework
• Host Discovery
• Using WHOIS, Shodan, and Google Dorking
• DNS Lookup, Wappalyzer, and Wayback Machine
• Email Footprinting

Chapter IV- Scanning and Enumeration

• Network scanning with Nmap and Zenmap
• Host Discovery using Nmap
• Port Scanning
• Vulnerability Scanning using Nmap
• Enumerating services
• FTP, SMB, SSH, RDP, Telnet, SMTP, VNC, and MySQL Enumeration
• Service Credential Brute Forcing using Hydra

Chapter V- Vulnerability Assessment

• Introduction to vulnerability scanning
• Vulnerability Analysis Life Cycle
• Understanding terms such as CVE, CVSS, and NVD
• Automated vs. Manual vulnerability assessment
• Using Nessus, Burp Suite Professional, and Nikto
• Interpreting scan results and risk analysis
• Generating Report

Chapter VI- Penetration Testing Methodologies

• Planning and executing penetration tests
• Black Box, White Box, and Gray Box Testing
• Understanding OWASP Top 10 vulnerabilities
• Reporting and documenting findings

Chapter VII- Network Penetration Testing

• Identifying open ports and services
• Exploiting misconfigurations and weak credentials
• Conducting attacks such as Man-in-the-Middle (MITM), Brute Force attacks
• Conducting Exploitation and Post Exploitation
• Performing Privilege Escalation on Windows and Linux machines
• Conducting Credential Looting
• Pivoting in Networks

Chapter VIII- Web Application Penetration Testing

• Understanding OWASP Top 10 Web Vulnerabilities
• SQL Injection, Cross-Site Scripting (XSS), and Command Injection attacks
• Directory Traversal, File Upload, and API vulnerabilities
• Broken Access Control, SSRF, CSRF, and Information Disclosure
• Exploiting authentication and session management flaws
• Burp Suite for manual web application testing

Chapter IX- Exploitation and Privilege Escalation

• Exploiting vulnerabilities with Metasploit Framework
• Windows and Linux privilege escalation techniques
• Post-exploitation techniques and maintaining access
• Covering tracks and avoiding detection

Chapter X- Social Engineering and Phishing Attacks

• Understanding social engineering techniques
• Creating phishing campaigns using SET (Social Engineering Toolkit)
• Spear phishing, credential harvesting, and email spoofing
• Countermeasures and security awareness training

Chapter XI- Writing Penetration Testing Reports

• Documenting findings and risk assessment
• Writing professional security assessment reports
• Recommendations and mitigation strategies
• Presenting findings to stakeholders