CANVAS Training

A two day class that teaches students how to best use CANVAS for vulnerability exploitation and penetration testing.

CANVAS 2-DAY COURSE SYLLABUS

Day 1:
  Introduction to CANVAS and Recon

  - become familiar with the CANVAS GUI.
  - logs and reporting in CANVAS
  - commandline usage.
  - host discovery via portsweep, udpsweep and manual methods.
  - operating system (OS) detection.
  - database detection (Oracle, MSSQL).
  - traceroute and portscanning.
  - user and network share enumeration.
  - definition of CANVAS nodes.


  Exploitation and Bouncing
  - the three phases of exploitation.
  - choosing an exploit.
  - executing an exploit.
  - handling network address translation (NAT) and setting callbacks.

  Post-Exploitation
  - spawning a process.
  - uploading and downloading files.
  - executing commands via the shell.
  - uploading a MOSDEF trojan.
  - privilege escalation.

  Day 2 - Bouncing, Client-Sides and Automation

  Bouncing
  - how to bounce attacks from compromised hosts.
  - choosing effective bouncing points.

  Client-Sides
  - setup and execution of client-side attacks.

  Automation
  - running commands on multiple hosts.
  - attacking multiple hosts.
  - vulnerability scanning and automated attacks.
  - customization of post-exploitation commands.
  - custom MOSDEF development.