Skip to content
CampusPrep
CY-702 (A) · Penetration Testing and Vulnerability Analysis/Official Syllabus

Penetration Testing and Vulnerability Analysis (CY-702 (A)) - Official Syllabus

1
Unit 1

Introduction to penetration testing, Information Gathering and Scanning

  • Introduction to penetration testing
  • Legal and ethical considerations
  • Types of penetration testing
  • Penetration testing methodologies
  • Foot printing and reconnaissance techniques
  • Network scanning and enumeration
  • SINT (Open-source intelligence) gathering
  • Vulnerability scanning tools
2
Unit 2

Exploitation and Post-Exploitation, Web Application Security

  • Exploiting system and network vulnerabilities
  • Privilege escalation techniques
  • post-exploitation activities
  • Maintaining access and pivoting
  • Introduction to web application security
  • Common web application vulnerabilities
  • Web application penetration testing methodologies
  • Web vulnerability scanners and tools
3
Unit 3

Wireless Network Security, Social Engineering and Physical Security

  • Wireless network security concepts
  • Wi-Fi vulnerabilities and attacks
  • Wireless penetration testing techniques
  • securing wireless networks
  • Introduction to social engineering
  • Techniques and tactics of social engineering
  • Physical security vulnerabilities and testing
  • Mitigating social engineering and physical security risks
4
Unit 4

Cryptography and Secure Communications, Reporting and Remediation

  • Basics of cryptography
  • Cryptographic algorithms and protocols
  • Encryption, decryption, and key management
  • secure communication channels
  • Documentation and reporting of findings
  • Prioritizing and mitigating vulnerabilities
  • engaging stakeholders and communicating recommendations
  • post-testing activities and continuous improvement
5
Unit 5

Advanced topics, red teaming and practical exercises

  • Mobile application security
  • Cloud security and testing
  • (Internet of Things) security
  • red teaming and adversary simulation
  • Review of real-world penetration testing cases
  • Practical hands-on exercises
  • Capture the Flag (CTF) competitions
  • Final project and presentations

Laboratory Experiments

  • Learn how to use tools like Nmap, Nessus, or OpenVAS to perform network scans and identify open ports, services, and potential vulnerabilities.
  • Practice scanning a target network and analysing the results to identify potential attack vectors.
  • Set up a vulnerable web application (e.g., OWASP Juice Shop or Damn Vulnerable Web Application) and practice identifying and exploiting security flaws.
  • Understand wireless network security concepts such as WEP, WPA, and WPA2 encryption.
  • Practice writing comprehensive penetration testing reports that highlight identified vulnerabilities, their impact, and recommended remediation steps.

Reference Books

  • The Web Application Hacker's Handbook: Finding and Exploiting Security Flaws — Dafydd Stuttard, Marcus Pinto — Wiley — 2nd edition, 2011
  • Metasploit: The Penetration Tester's Guide — David Kennedy, Jim O'Gorman, Devon Kearns, Mati Aharoni
  • The Basics of Hacking and Penetration Testing: Ethical Hacking and Penetration Testing Made Easy — Patrick Engebretson
  • The Tangled Web: A Guide to Securing Modern Web Applications — Michal Zalewski
  • The Art of Software Security Assessment: Identifying and Preventing Software Vulnerabilities — Mark Dowd, John McDonald, Justin Schuh
Go to where you left off?

Quick Add to Notes

Save questions, your own notes and screenshots into notes filed by unit. It takes a free account.

Create free account

Have an account? Log in