Reddit mentions of The Hacker Playbook 3: Practical Guide To Penetration Testing

Well, it mostly depends on what you’re trying to achieve. You definitely do not want to drop tools on the disk of the compromised machine if stealth is the main goal. You would load stuff into memory instead (reflective PE injection, reflective DLL injection (Powersploit toolkit) in case of Windows, /dev/shm in case of linux) and that way leave a minimal footprint for the blue team.


As to what would get picked up, that depends on the configurations. Process injection, process hollowing, outgoing connections, etc. can all be detected with the right (YARA) rules. Your best bet would be to use non-standard protocols such as DNS (look up dnscat2), ICMP and use the compromised host as sort of a pivot. Sending tool traffic through it instead of installing the needed tools on it.


Here are two writeups from the real world:

https://www.exploit-db.com/papers/41915

https://packetstormsecurity.com/files/155392/HackBack-A-DIY-Guide-To-Rob-Banks.html


Here are some other resources you may like (including DA compromise):

https://medium.com/@adam.toscher/top-five-ways-i-got-domain-admin-on-your-internal-network-before-lunch-2018-edition-82259ab73aaa

https://youtu.be/dKUS26BlKlc

https://youtu.be/q7DfaaUHXYE

https://www.amazon.com/Hacker-Playbook-Practical-Penetration-Testing-ebook/dp/B07CSPFYZ2


PS: I do not condone malpractice. Provided links are purely educational... Also sorry for the formatting, on mobile. Feel free to DM with more questions, this is a wide topic.

check out r/oscp Lots of blogs being posted over there almost on a weekly basis on what people did to get ready for the test and about the test.

> I have just set up simple virtual lab (Metaspolitable + Kali ) so where should I start ?! Is there any curriculum or learning path I need to follow to make my life easier ?!

What is your background when it comes to this stuff?

https://www.jpsecnetworks.com/week-1-oscp-preparation-lab-setup/

You need also learn about Windows exploitation

>Would you recommend specific course where you can get all what you need for OSCP in one place ?!

https://www.offensive-security.com/information-security-certifications/oscp-offensive-security-certified-professional/

They already have a course to get you going. If you are totally new to this world, check out CEH, it will hold you hand and at least introduce you to the concepts of pentesting but the cert doesnt mean jack shit unless you are going for a 8750 requirement.

elearning has some basic pentesting courses to get you started and its a lot more hand holding that OSCPs material. However they seem to focus on relying on metasploit a lot more than you are allowed to use

https://www.amazon.com/Hacker-Playbook-Practical-Penetration-Testing-ebook/dp/B07CSPFYZ2

A lot depends on the school and the program- some are operations focused, others are management focused. What school are you going to? It sounds like you're pretty well ahead already, so I wouldn't worry too much, especially as you will be reading a lot for school, but if I had to give you one book, I'd go with the Hacker's Playbook https://www.amazon.com/Hacker-Playbook-Practical-Penetration-Testing-ebook/dp/B07CSPFYZ2. Its a far better book that the for dummies series.

Hacking: The art of exploitation

The Web Application Hackers Handbook

The Tangled Web: A Guide To Securing modern Web Applications

The Hacker Playbook 2

The Hacker playbook 3

Black Hat Python: Python Programming for Hackers and Pentesters

Super helpful! Thanks for the response. Might be dumb but what does CEH stand for? I'll avoid it as it sounds like I should.

I bought this book and this book I'll do all the excercises in them.

What are the CTF's you mention?

Thanks again though, very helpful.