# Advanced Penetration Testing **URL:** https://legacy-community.ine.com/c/cyber-security/pta/27.md [Latest](https://legacy-community.ine.com/latest.md) · [Categories](https://legacy-community.ine.com/categories.md) · [Tags](https://legacy-community.ine.com/tags.md) --- ## [About the Advanced Penetration Testing category](https://legacy-community.ine.com/t/about-the-advanced-penetration-testing-category/106)
**Author:** [@Don](https://legacy-community.ine.com/u/Don)\ **Replies:** 0
This category is dedicated to students undertaking the Advanced Penetration Testing (PTA) Learning Path for job readiness as a Sr. Pentester for enterprise environments or in prep for the eCPTXv2 certification exam. Us… --- ## [Ewptx csrf lab referer header](https://legacy-community.ine.com/t/ewptx-csrf-lab-referer-header/3162)
**Author:** [@jhosepnoel-80ab7f3de](https://legacy-community.ine.com/u/jhosepnoel-80ab7f3de)\ **Replies:** 1\ **Last updated:** [June 27, 2023, 4:25pm UTC](https://legacy-community.ine.com/t/ewptx-csrf-lab-referer-header/3162 "2023-06-27T16:25:53Z")
Hello everyone, I have a problem with exercises 4 and 5 in the CSRF laboratory, when the referer header is sent, the file name does not appear, so the protection mechanism with the referer header cannot be avoided as in … --- ## [Issues with AD lab 1-3](https://legacy-community.ine.com/t/issues-with-ad-lab-1-3/3243)
**Author:** [@JustBob](https://legacy-community.ine.com/u/JustBob)\ **Replies:** 4\ **Last updated:** [June 6, 2023, 3:17am UTC](https://legacy-community.ine.com/t/issues-with-ad-lab-1-3/3243 "2023-06-06T03:17:12Z")
I have started the AD lab 1,2,3 and according to the task and the solution, nothing is where it should. In lab 2 I could not find the RDP machine to connect to. In Lab 3 the starting points are not there. What is goin… --- ## [Cannot access Github externally to download Red-teaming Active Directory Lab #1 (ELS.LOCAL)](https://legacy-community.ine.com/t/cannot-access-github-externally-to-download-red-teaming-active-directory-lab-1-els-local/3191)
**Author:** [@MushBrain](https://legacy-community.ine.com/u/MushBrain)\ **Replies:** 2\ **Last updated:** [June 6, 2023, 2:05am UTC](https://legacy-community.ine.com/t/cannot-access-github-externally-to-download-red-teaming-active-directory-lab-1-els-local/3191 "2023-06-06T02:05:55Z")
Hey @AlexisA, I’m trying to go through the Red Teaming Lab #1 for ELS.Local and in the tasks it says to go install Convenant on the Attacker Machine. However, there is no access to the internet to do this. Are there… --- ## [Need help to find lab info on Red-teaming Active Directory Lab #1 (ELS.LOCAL)](https://legacy-community.ine.com/t/need-help-to-find-lab-info-on-red-teaming-active-directory-lab-1-els-local/1233)
**Author:** [@koonl-fb4afc92794942](https://legacy-community.ine.com/u/koonl-fb4afc92794942)\ **Replies:** 6\ **Last updated:** [May 4, 2023, 12:10am UTC](https://legacy-community.ine.com/t/need-help-to-find-lab-info-on-red-teaming-active-directory-lab-1-els-local/1233 "2023-05-04T00:10:55Z")
Hi. I was trying to find the ip address and credential for the Windows VM andd Kali VM for lab#1 but I could not find it. I might be missing something here. Can someone please advise where can I find the lab info for l… --- ## [AD lab1](https://legacy-community.ine.com/t/ad-lab1/2999)
**Author:** [@b1ackArr0w](https://legacy-community.ine.com/u/b1ackArr0w)\ **Replies:** 7\ **Last updated:** [May 4, 2023, 12:09am UTC](https://legacy-community.ine.com/t/ad-lab1/2999 "2023-05-04T00:09:05Z")
can I get some help here? I’m trying to do PTx Lab 1, and I’m totally lost, after spawning the lab via the browser, what’s next? --- ## [Script NOT availble](https://legacy-community.ine.com/t/script-not-availble/3433)
**Author:** [@carine.constant-75bd](https://legacy-community.ine.com/u/carine.constant-75bd)\ **Replies:** 0\ **Last updated:** [February 19, 2023, 8:08pm UTC](https://legacy-community.ine.com/t/script-not-availble/3433 "2023-02-19T20:08:45Z")
In course web-application-penetration-testing-extreme, video Second Order SQL Injection Explotation are showing a lesson with PHP script to execute exploit. But, the script is NOT availble for download. I copy script and… --- ## [All Red Teaming Active Directory Labs Are Under Maintenance](https://legacy-community.ine.com/t/all-red-teaming-active-directory-labs-are-under-maintenance/1730)
**Author:** [@julian-55283238](https://legacy-community.ine.com/u/julian-55283238)\ **Replies:** 4\ **Last updated:** [October 5, 2022, 6:13am UTC](https://legacy-community.ine.com/t/all-red-teaming-active-directory-labs-are-under-maintenance/1730 "2022-10-05T06:13:09Z")
I was trying to do the Red Teaming Active Directory labs, but when I try to start the labs it shows “under maintenance”: Under maintenance We're sorry, but this lab is currently under maintenance. Please try another lab… --- ## [Exam VPN not starting](https://legacy-community.ine.com/t/exam-vpn-not-starting/2840)
**Author:** [@sunny9-540ee105f3f14](https://legacy-community.ine.com/u/sunny9-540ee105f3f14)\ **Replies:** 4\ **Last updated:** [September 11, 2022, 3:01am UTC](https://legacy-community.ine.com/t/exam-vpn-not-starting/2840 "2022-09-11T03:01:10Z")
So this is frustrating after spending good amount on buying an exam, I cannot start exam VPN. Does anyone having an issue? I raised with support but it seems it will take 2-3 days which is not acceptable due to exam hav… --- ## [Maybe a dumb question?](https://legacy-community.ine.com/t/maybe-a-dumb-question/2200)
**Author:** [@droidmasta-5a3b7b9d2](https://legacy-community.ine.com/u/droidmasta-5a3b7b9d2)\ **Replies:** 1\ **Last updated:** [May 6, 2022, 10:08am UTC](https://legacy-community.ine.com/t/maybe-a-dumb-question/2200 "2022-05-06T10:08:51Z")
In the AD labs… I’m doing Red teaming active directory lab 1 right now for instance. Aside from how navigation through the links at the top is broken and it’s one unsegmented mess of priceless material… It’s not clearly … --- ## [Red Teaming Active Directory Lab#1 (Covenant C2 vs ELS.LOCAL)](https://legacy-community.ine.com/t/red-teaming-active-directory-lab-1-covenant-c2-vs-els-local/2205)
**Author:** [@droidmasta-5a3b7b9d2](https://legacy-community.ine.com/u/droidmasta-5a3b7b9d2)\ **Replies:** 1\ **Last updated:** [May 6, 2022, 9:58am UTC](https://legacy-community.ine.com/t/red-teaming-active-directory-lab-1-covenant-c2-vs-els-local/2205 "2022-05-06T09:58:53Z")
Having a LOT of trouble compiling the SpoolSample.cs I don’t have much experience with C code and what I do is with c++ but I didn’t think it was THIS different. First I tried cross compiling with i686-w32-mingw64-gcc d… --- ## [Red-teaming Active Directory Lab #1 (ELS.LOCAL)](https://legacy-community.ine.com/t/red-teaming-active-directory-lab-1-els-local/2218)
**Author:** [@nimanthad8-68ad32cfb](https://legacy-community.ine.com/u/nimanthad8-68ad32cfb)\ **Replies:** 0\ **Last updated:** [May 4, 2022, 11:35am UTC](https://legacy-community.ine.com/t/red-teaming-active-directory-lab-1-els-local/2218 "2022-05-04T11:35:26Z")
I am unable to bypass CLM thru victim acount.However, according to the walkthrough, the CLM was bypassed through an admin account. How can I get the admin account details ? it is not mentioned in the walkthrough --- ## [PTX - Establishing A Shell Through The Victim's Browser](https://legacy-community.ine.com/t/ptx-establishing-a-shell-through-the-victims-browser/2174)
**Author:** [@alexander.huffm-b354](https://legacy-community.ine.com/u/alexander.huffm-b354)\ **Replies:** 1\ **Last updated:** [April 28, 2022, 1:16am UTC](https://legacy-community.ine.com/t/ptx-establishing-a-shell-through-the-victims-browser/2174 "2022-04-28T01:16:16Z")
I’ve been working on starting the Establishing A Shell Through The Victim’s Browser lab for a couple days now, and I keep running into problems. I didn’t think Kali needed BeEF installed, first of all (had to install th… --- ## [Great PTX/eCPTXv2 external resources](https://legacy-community.ine.com/t/great-ptx-ecptxv2-external-resources/614)
**Author:** [@Z3r0n37](https://legacy-community.ine.com/u/Z3r0n37)\ **Replies:** 1\ **Last updated:** [April 27, 2022, 4:53am UTC](https://legacy-community.ine.com/t/great-ptx-ecptxv2-external-resources/614 "2022-04-27T04:53:43Z")
I wanted to share some useful links with you :smiley: If you have any cool resource, please share them here and I’ll add them to the list! CheatsheetsWindows Red Team Cheat Sheet | Security Blog RedTeam\_CheatSheet.ps1 … --- ## [Red-teaming Active Directory Lab #1 (Covenant C2 vs ELS.LOCAL)](https://legacy-community.ine.com/t/red-teaming-active-directory-lab-1-covenant-c2-vs-els-local/1644)
**Author:** [@m.andrei501-0113cc21](https://legacy-community.ine.com/u/m.andrei501-0113cc21)\ **Replies:** 2\ **Last updated:** [January 25, 2022, 1:51pm UTC](https://legacy-community.ine.com/t/red-teaming-active-directory-lab-1-covenant-c2-vs-els-local/1644 "2022-01-25T13:51:32Z")
Red-teaming Active Directory Lab #1 (Covenant C2 vs ELS.LOCAL) I can’t do the CLM Bypass presented in the Lab. I have downloaded the PowerShdll but when trying to run it using rundll32, i get an error saying that it is… --- ## [Ecptx - machine for study and exam](https://legacy-community.ine.com/t/ecptx-machine-for-study-and-exam/1465)
**Author:** [@d4ny04-d6d0278a33e44](https://legacy-community.ine.com/u/d4ny04-d6d0278a33e44)\ **Replies:** 2\ **Last updated:** [December 22, 2021, 4:33pm UTC](https://legacy-community.ine.com/t/ecptx-machine-for-study-and-exam/1465 "2021-12-22T16:33:43Z")
Hello, I’m currently studying for ecptx. I need a suggestion regarding the machine to use during the course and more specifically for the exam. I was planning to buy an m1 macbook, so are there any limitations in terms… --- ## [LAB 3 - Compromising DC problem (moved from wrong tag)](https://legacy-community.ine.com/t/lab-3-compromising-dc-problem-moved-from-wrong-tag/1194)
**Author:** [@Grain](https://legacy-community.ine.com/u/Grain)\ **Replies:** 4\ **Last updated:** [December 22, 2021, 8:12am UTC](https://legacy-community.ine.com/t/lab-3-compromising-dc-problem-moved-from-wrong-tag/1194 "2021-12-22T08:12:22Z")
Hello, I have encountered troubles with LAB 3. During writing this post I have found the solution to part of exercise (still posted it in case somebody had similar problems) but I have problem with last step of compro… --- ## [SharpGPO + Covenant; linked repo not available anymore](https://legacy-community.ine.com/t/sharpgpo-covenant-linked-repo-not-available-anymore/1417)
**Author:** [@friedrich\_o-93cd2df1](https://legacy-community.ine.com/u/friedrich_o-93cd2df1)\ **Replies:** 0\ **Last updated:** [December 8, 2021, 11:49am UTC](https://legacy-community.ine.com/t/sharpgpo-covenant-linked-repo-not-available-anymore/1417 "2021-12-08T11:49:54Z")
For those who come across the topic and want to use Covenant and SharpGPO together; youll want to try the patch below: diff --git a/SharpGPOAbuse/Program.cs b/SharpGPOAbuse/Program.cs index e39762c..2d69b96 100644 --- a… --- ## [Need help on Red-teaming Active Directory Lab #3 (ELS.CORP) (Attack Path 1)](https://legacy-community.ine.com/t/need-help-on-red-teaming-active-directory-lab-3-els-corp-attack-path-1/1404)
**Author:** [@PDX](https://legacy-community.ine.com/u/PDX)\ **Replies:** 0\ **Last updated:** [December 4, 2021, 1:01pm UTC](https://legacy-community.ine.com/t/need-help-on-red-teaming-active-directory-lab-3-els-corp-attack-path-1/1404 "2021-12-04T13:01:18Z")
According to the hints, the first machine (DEV-SYS Server) . After adding dev-user to the Administrators group, I couldn’t list the Administrator token via incognito. I would like to get some advice. I’m not sure if th… --- ## [Red-teaming Active Directory Lab #2 (ELS.BANK): scenario 3 protected users](https://legacy-community.ine.com/t/red-teaming-active-directory-lab-2-els-bank-scenario-3-protected-users/1227)
**Author:** [@friedrich\_o-93cd2df1](https://legacy-community.ine.com/u/friedrich_o-93cd2df1)\ **Replies:** 0\ **Last updated:** [October 21, 2021, 8:04pm UTC](https://legacy-community.ine.com/t/red-teaming-active-directory-lab-2-els-bank-scenario-3-protected-users/1227 "2021-10-21T20:04:19Z")
Spoiler alert… The solution states: With everything set now, we can utilize Rubeus to get a ticket for “exch\_adm” and assign the DCSync rights as we did in Scenario 1 (remember that Domain admins are members of “Prote… --- ## [SharpUp was updated (Red-teaming Active Directory Lab #2 (ELS.BANK))](https://legacy-community.ine.com/t/sharpup-was-updated-red-teaming-active-directory-lab-2-els-bank/1210)
**Author:** [@friedrich\_o-93cd2df1](https://legacy-community.ine.com/u/friedrich_o-93cd2df1)\ **Replies:** 0\ **Last updated:** [October 18, 2021, 6:38pm UTC](https://legacy-community.ine.com/t/sharpup-was-updated-red-teaming-active-directory-lab-2-els-bank/1210 "2021-10-18T18:38:48Z")
Maybe the following is for someone of help SharpUp was updated on 2021-09-13 The old version can be found here: git checkout 0b3f09f Nevertheless it is developed against .net framework version 3.5 which is missing at…