Module 5: Exploitation Fundamentals: Concepts, Case Studies and Defence
Understand, at concept level, what vulnerabilities, exploits, payloads and sessions are, how a flaw travels from discovery to patch, and what the 2017 SMB wave (MS17-010) taught defenders. Labs analyse patch reports, inventories, IDS alerts and incident timelines. No attack tooling or procedures are taught or simulated.
- Level
- Intermediate
- Study time
- 6 hours
- Lessons
- 5
- Practice labs
- 3
- Assessments
- 2
- Format
- Self-paced, online
What you will learn
By the end of this course you will be able to:
- Understand how a confirmed vulnerability can lead to controlled, authorised access, and what that means for defenders.
- Explain in general terms the difference between a vulnerability, an exploit, a payload and a session.
- Identify exposed and unpatched systems from a patch-compliance report and an asset inventory.
- Interpret IDS alerts and an incident timeline from a worm-like SMB outbreak, and recommend remediation and containment steps.
Before you start
Module 4: Vulnerability Assessment
Tools you will use
Course outline
5 lessons in 2 modules.
Sub-module 5.1: Exploitation concepts
- Vulnerability, exploit, payload and session: the vocabulary
- The vulnerability-to-patch lifecycle
Sub-module 5.2: Case study MS17-010 and known CVEs
- Case study: MS17-010 and the 2017 SMB wave
- What defenders saw: inventories, alerts and containment
- Worked example: triaging an SMB exposure
Practice labs and assessments
Labs run in the browser as simulations. They never touch a real system.
3 practice labs
- Patch compliance and exposure review Beginner, 25 min
- IDS alerts and the asset inventory Intermediate, 35 min
- Incident timeline and recommendations Advanced, 40 min, final lab
2 assessments
- Module 5 knowledge check
- Module 5 final quiz
The pass mark is 70%. You can retake an assessment.
Take Module 5: Exploitation Fundamentals: Concepts, Case Studies and Defence
Request access and your instructor will set up your account.