I'm happy to see you here and to the end of this course, but don't close this
tab yet. In this section, we will have a quick review of what you learned, and
we'll discuss some tips on how we can learn more about Discovery and
PowerShell. We covered a lot of interesting topics in this course, and I hope
you're able to learn something new.
We started this course by discussing on how PowerShell can
help you on your Red Team engagement.
Remember, using Windows native features like PowerShell reduces your
chance of getting detected by the defense team.
We also cover in this course how to enumerate host information with
PowerShell, and in there, we created a few scripts that help you to
gather all the information you need from a host.
After that, we covered how to scan a network to find live hosts and open ports.
We created together a script that helps us to identify
our next targets in the environment.
Another really important enumeration that we covered here is how to extract
information from the Active Directory, including domain users,
domain groups, and etc. At last, we just saw an example of how to use a
PowerShell open source library for offensive security.
In here we explored the Kerberoasting attack, but there are
several other attacks that you could perform, like the AS‑REP
roasting. A lot of interesting stuff, right? And if you don't
remember some of those topics, feel free to pause this video here,
go back, and review the content. If you want to get the most out of this course,
I have a few suggestions for you. First, practice the skills you learned. If
you haven't been following the demos in your own environment,
it is a good idea doing so. Get a few Windows servers and try to use the
techniques you learned here against some virtual machines.
Also, don't forget to try to code your own tools,
so you get used to writing your own code.
Also in here, we covered the most important reconnaissance features.
In any case, it's always a good idea to review some of the open
source PowerShell tools for exploitation,
like the PowerSploit framework that we discussed. In this way,
you can see some other PowerShell tricks and add your own scripts. And
last, it is important that you practice your skills against a variety of
domains and operational system versions.
Sometimes a specific environment might have different libraries or
versions and the syntax might be slightly different.
So if you're practicing on a variety of domains,
you'll be able to quickly adapt your scripts to whatever
shows up in the writing engagement.
If you're interested in the writing field and PowerShell,
I can recommend a few things as the next steps for you.
First, if you haven't done it yet,
check out the other PowerShell courses here at Pluralsight. There is a
really good course path called PowerShell for Cyber Offense, and this path
details how to use PowerShell throughout all the phases of a writing
exercise. Also, now that we have some new skills,
you can practice them in a live environment. You can create your own labs,
or you can use some of the free labs on the internet.
My favorite ones are hackthebox.eu and the pentestit.ru. In there, you
can play with live machines and practice your skills. If you want to
discover more pen testing and Red Teaming tools,
there's a course path here at Pluralsight called Red Team Tools. In there,
you'll find short courses about dozens of hacking tools.
It is pretty cool, so check it out. And last, if you want to
get into more details about the open source PowerShell
libraries for offensive security,
I would recommend you checking here at Pluralsight some of the courses on
the PowerSploit framework. This toolset implements a lot of attacks in
PowerShell. But remember, it is always a good idea to develop your own tools
so you can avoid detection. So that's it.
That's the end of Network Discovery and Enumeration with PowerShell
course. I hope you enjoyed this course as much as I did, so thank you
for watching, and I'll see you around!