## Blue team, meet your next must-have skillset

Join us for **Offense for Defense**, a high-impact, hands-on cybersecurity course built specifically for **blue team professionals, systems administrators, SOC analysts, threat hunters, and incident responders**. This training arms defenders with the **tactics, tools, and mindset of attackers**, empowering teams to proactively identify weaknesses and design better detection and response. All while learning from one of the most prominent names in cybersecurity instruction and enterprise penetration testing, **Tim Medin.**

Through Tim and Offensive Security Consultant and Social Engineering Expert **Jason Downey**, You will gain **real-world experience** with tools like **Atomic Red Team** and the **MITRE ATT&CK Framework**, simulating real attacks to test and enhance your defensive posture. From **OSINT and initial access vectors** to **Active Directory attacks, evasion tactics, privilege escalation, and lateral movement**, you'll walk away with actionable skills to harden your environment against the most persistent threats.

### Don’t Just Play Defense - Own the Field

Join cybersecurity teams across the globe who are transforming their defense strategies with offensive knowledge. **Train smarter. Defend Harder. Now, on your schedule.**

## Lab Environment

You'll be working from a Kali Linux and a Windows system to access other Windows systems on the same Active Directory Domain, but with the easiest set up ever.

**In fact, there is no setup.** It is all accessible and handled in your browser! No giant downloads. No messing with VMware. No annoying VPN setup. No configuration or compatibility issues.

Unlike the big guys, your lab network is specific to you. No one (but you) can break your network. And you can revert your lab network anytime you want to. You can access the lab network immediately after you sign up. Like we said, no giant downloads, funky setup, or VPN issues.

## What You Will Be Able to Do

<nowiki>*</nowiki> denotes the section has a practical, hands-on lab exercise

### Understand the Adversary Mindset

- Think like an attacker to defend like a pro
- Understand why offensive techniques matter for defenders
- Gain strategic insight into attacker behavior, and how it let's you get ahead

### Practical Attack Emulation *

- Realistic attack simulation using Atomic Red Team
- Leveraging the MITRE ATT&CK framework for detection engineering
- Building resilient detections by simulating adversarial Tactics, Techniques, and Procedures (TTPs)

### OSINT & Recon: What Attackers Know Before the Breach *

- Understand what information is interesting to an attacker, and why
- See your organization the way an attacker does
- Enumerate your external footprint and exposure without scanning
- Understand public data exposure risks

### Initial Access Techniques & Detection

- Understand the most common methods attackers use to gain initial access
- Learn why social engineering, phishing, and vishing are so effective and what you can do to help prevent it
- Understand the impact of credential attacks, phishing, and public-facing exploits

### Password Attacks - Credential Stuffing and Password Guessing *

- Account defenses using password manages, MFA, passkeys, and hardware key
- Protecting accounts with Managed Service Accounts (MSA, lMSA, and gMSA) and Local Administrator Password Solution (LAPS)
- Practical effective and safe password stuffing/guessing techniques

### Evading Detection

- Understand how and why attackers evade defenses
- Effective evasion by Living Off the Land (LOL) and using builtin tools and features
- Strategies for implementing Application Control (formely Application Whitelisting)

### Privilege Escalation (PrivEsc) and Persistence *

- Understand common techniques for PrivEsc and Persistence including registry, service, and scheduled task abuse
- Practical steps to identify PrivEsc opportunities, allowing you to mitigate before the breach
- Understand different types of persistence and the pros and cons of each

### Abusing Built-in Windows Protocols *

- Understand the weaknesses of NBNS, LLMNR, mDNS and other protocols and how they can be abused to leak access
- Coercing authentication and relay attacks
- Using Responder to gain credentials

### File Share Pillaging and Data Exposure Identification *

- Understand the risks of overshared information, even it is on internal systems
- Common misconfigurations in SMB/NFS shares
- Share auditing and cleanup playbooks

### Lateral Movement *

- Understand why attackers move their goals
- Learn why attackers don't need super privileged accounts (e.g., Domain Admin) to accomplish their goals
- Execute practical lateral movement attacks using common tools and protocols

### Practical Kerberos *

- Learn Kerberoasting from the creator himself (Tim Medin), as well as other Kerberos attacks
- Understand other common Kerberos attacks (Silver Ticket, Golden Ticket, Over-pass-the-Hash, Pass-the-Ticket)
- Understand secure Kerberos implementation and delegation

### Active Directory (AD): Defense at the Core *

- Understand AD misconfigurations and their risk to the organization
- Hardening and monitoring guidance for AD
- Identify AD misconfigurations and vulnerabilities using PingCastle and Bloodhound

### Active Directory Certificate Services (AD CS) *

- Common AD CS misconfigurations that can lead to privilege escalation, data theft, and persistence
- Practical exploitation techniques for abusing AD CS
- Remediation and secure implementation best practices

### Hands-On Labs

- Guided exercises for each attack/defense concept
- Simulated network environments
- Practical takeaways
- Full video walkthrough of every lab exercise.

Offense for Defense (O4D) is a course for blue team security professionals who want to learn real-world offensive tactics to transform your defensive strategy. Move beyond alerts: Learn how to identify, emulate, and defeat adversary tactics.

Offense for Defense

Step into **Penetration Testing: Beyond the Basics** an immersive, hands-on course designed for security professionals ready to leave the beginner tier behind and operate like true offensive specialists. 

Your instructor? One of the most trusted names in enterprise penetration testing in the world and the creator of Kerberoasting **Tim Medin** CEO of Red Siege Information Security. Tim is joined by Red Siege Principal Security Consultant **Mike Saunders**, bringing two of the industry’s top offensive operators directly to your screen. This isn’t theory taught by observers — it’s a course built and delivered by **active, in-the-field penetration testers** who perform these techniques every day on real engagements.

This is where the fundamentals meet real-world execution. You’ll sharpen your edge with **advanced enumeration** tactics that reveal hidden targets fast, master **initial access techniques** drawn from real adversaries, and build the instincts to prioritize what truly matters in an engagement.

Once you have a foothold, the course takes you deeper: cultivating **situational awareness** to read the network’s terrain, exposing valuable systems through subtle clues, and then unleashing **practical pivoting and lateral movement** methods to expand access and demonstrate true impact.

Because nearly every enterprise runs on Windows, you’ll finish with an in-depth exploration of **Active Directory and Kerberos** exploitation — learning how attackers escalate privileges, maintain persistence, and how to replicate those paths safely for your clients.

We know you are ready to elevate your work beyond checklists and scanning tools, this course delivers the techniques, mindset, and precision required to perform high-value penetration tests for your clients and organizations.


## Key Takeaways

* **Target Identification** – You can’t exploit systems and services you don’t know exists. In this course you’ll learn tips and tricks to quickly and safely identify high value targets for deeper testing.
* **Initial Access** – Initial Access (IA) comes in many forms. According to the latest Verizon Data Breach Investigation Report (VDBIR), Initial Access is gained through compromised passwords, phishing, and to a lesser degree, exploitation. We’ll cover all these techniques as part of a practical penetration test.
* **Situation Awareness** – Once a system is compromised, a penetration tester needs to gain information from the system to learn about the target environment for further attacks. A lot of valuable information can be gained from the network once a single host has been exploited/compromised.
* **Pivoting and Lateral Movement** – When a real-world bad guy gains access to a system, they do not stop. They are going to work to extend their reach. In this course, we’ll cover common ways for lateral movement to model real world attackers, and to find issues beyond the surface.
* **Windows Domain and Kerberos** – Nearly every organization uses Active Directory (AD). No penetration testing course would be complete without a deep dive into identifying issues in AD, and abusing those issues for privilege escalation, lateral movement, and persistence.


## Lab Environment

You'll be working from a Kali Linux and a Windows system to access other Windows systems on the same Active Directory Domain, but with the easiest set up ever.

**In fact, there is no setup.** It is all accessible and handled in your browser! No giant downloads. No messing with VMware. No annoying VPN setup. No configuration or compatibility issues.

Unlike the big guys, your lab network is specific to you. No one (but you) can break your network. And you can revert your lab network anytime you want to. You can access the lab network immediately after you sign up. Like we said, no giant downloads, funky setup, or VPN issues.

## Just Getting Started?
This is designed to be a course for Penetration Testers who are experienced and looking to gain more knowledge in their field. If you’re new to penetration testing and looking for a solid place to start, we recommend taking [John Strand’s Introduction to Pentesting](https://www.antisyphontraining.com/product/introduction-to-pentesting-with-john-strand/). It covers the core concepts, tools, and workflows you’ll need to hit the ground running, making it a great foundation to return to once you’re ready to move into Tim Medin’s **Beyond the Basics**.

## What You Will Be Able to Do

<nowiki>*</nowiki> denotes the section has a practical, hands-on lab exercise

### Infrastructure

- How to set up and maintain a dedicated penetration testing lab environment with pre-configured attack hosts and target systems
- Understand why you should use the lab to safely test new tools and techniques before deploying them against production networks
- How to maintain clean, ready-to-use systems that ensure reliable, repeatable testing conditions for every engagement

### Recon *

- Conduct passive and active reconnaissance using tools such as OSINT frameworks, Shodan, and WHOIS lookups to enumerate targets without direct engagement
- Map an organization's attack surface by identifying exposed assets, subdomains, employee data, and technology stack through open-source intelligence gathering
- How to gather actionable intelligence on a target organization using passive OSINT tools — including Shodan, crt.sh, Hunter.io, and LinkedIn — without sending a single packet to the target network
- Understand what information is interesting to an attacker
- Perform manual and automated DNS reconnaissance using tools like DNSrecon to uncover target IP ranges and subdomains
- Leverage OSINT platforms such as Shodan, DNSDumpster, and crt.sh to identify exposed services and hosts without active scanning
- Harvest usernames and email addresses from Hunter.io and LinkedIn to build target lists for social engineering or password attacks

### Scanning *

- Perform host discovery, port scanning, and service enumeration using tools like Nmap and Masscan to identify live systems and potential entry points
- Interpret scan results to identify vulnerable services, misconfigurations, and open ports that represent exploitable opportunities within a target environment
- Run efficient and effective scans a tips to stay in scope
- Use Masscan for high-speed port discovery and combine it with Nmap for detailed service version and OS fingerprinting
- Extend scans with the Nmap Scripting Engine (NSE) to extract richer information from target systems

### Initial Access *

- Understand the most common methods attackers use to gain initial access
- Learn why social engineering, phishing, and vishing are so effective and what you can do to help prevent it
- Build targeted user and password lists for credential-based attacks
- Use Hydra to perform password guessing and spraying attacks against SMB services on Domain Controllers
- Enumerate Active Directory users with Impacket's GetADUsers and validate captured credentials across domain-joined systems

### Assumed Breach and C2 *

- Operate from an assumed-breach scenario to simulate post-exploitation activity, establishing command-and-control (C2) channels using
- Use Impacket to run payloads remotely on remote systems without requiring an interactive login
- Run external .NET assemblies through Sliver to extract detailed system information and extend C2 capabilities

### Situational Awareness *

- Enumerate a compromised host to gather intelligence about the broader network environment, including defensive tooling, firewall rules, and configuration patterns
- Identify defensive tools, monitoring agents, and security controls present on a compromised host in order to adapt tradecraft accordingly
- Identify stored credentials, sensitive data, and other high-value artifacts on compromised systems
- Make informed targeting decisions to prioritize next steps and move through large networks faster and more effectively

### Password Cracking *

- Extract password hashes from Windows systems (both local and the domain), local databases, memory, and configuration files, and evaluate password policy weaknesses within a target environment
- Use Hashcat to crack multiple hash formats including NTLM and LM hashes using wordlists, masks, and rules
- Generate advanced password candidates using masking and rule-based techniques to improve cracking success rates

### Credential Interception *

- Analyze and abuse insecure protocols and broadcast traffic (LLMNR, NBNS/NBT-NS, mDNS) to coerce authentication and harvest credential material from network hosts
- Use Responder to actively poison LLMNR and NBNS requests and capture NetNTLMv2 authentication hashes
- Crack captured NetNTLMv2 hashes with Hashcat and use recovered credentials for further access

### Privilege Escalation *

- Identify and exploit local privilege escalation vectors on Windows and Linux systems, including misconfigured services, weak file permissions, and unpatched kernel vulnerabilities
- Use SharpUp and PowerUp to automatically identify privilege escalation opportunities on Windows systems
- Exploit unquoted service path vulnerabilities to create and verify administrator-level accounts
- Understand how elevated access unlocks additional pillaging options, including hash extraction, token theft, and persistence mechanisms

### Persistence *

- Establish persistent access on compromised systems using techniques such as scheduled tasks, registry run keys, startup folders, and implanted backdoors
- Implement stealthy persistence mechanisms designed to survive reboots and blend in with legitimate system activity to reduce detection risk
- Generate standard and service executable payloads with Sliver and deploy them to compromised hosts using Impacket's smbclient
- Establish user-level persistence via Windows registry modifications
- Implement elevated persistence through Windows services and WMI Event Filters to survive reboots and maintain privileged access

### Lateral Movement *

- Move between hosts within a network using common attacker techniques to expand access
- Leverage legitimate administration tools (WMI, PsExec, WinRM, SMB) to blend lateral movement with normal network traffic and evade detection
- Pivot laterally through the network using Sliver with alternate credentials to reach additional systems
- Demonstrate expanded network access to validate the real-world impact of discovered vulnerabilities

### Kerberos *

- Understand the Kerberos authentication protocol and perform attacks such as Kerberoasting and Silver Ticket to gain access furhter in the domain
- Identify Service Principal Names (SPNs) tied to user accounts and extract Kerberos tickets for offline password cracking (Kerberoasting)
- Crack extracted Kerberos ticket hashes with Hashcat to recover service account passwords
- Forge Silver Tickets to impersonate users and access network services — including for non-existent accounts — without requiring authentication

### Kerberos Part II *

- Understand other common Kerberos attack vectors
- Extract the KRBTGT account's password hash and Kerberos keys from a Domain Controller
- Forge a Golden Ticket using the KRBTGT keys to gain unrestricted, persistent access across the domain
- Understand additional Kerberos attack techniques including pass-the-ticket and overpass-the-hash to extend domain-level access

### Active Directory Certificate Services (AD CS) *

- Use Certify (Windows) and Certipy (Linux) to enumerate Certificate Authorities and identify misconfigured certificate templates
- Exploit ESC1 vulnerabilities to obtain certificates for privileged users without their credentials
- Convert and leverage captured certificates to authenticate as high-privileged accounts and gain access to critical domain systems

Take your penetration testing knowledge to the next level with Tim Medin!

Penetration Testing: Beyond the Basics

The Full Spectrum of Cyber Security Training. Attack Smarter. Defend Harder. 

OFF / DEF Red Siege Training Bundle

# Understanding Kerberos

This is this is the Kerberos Workshop from Tim Medin and the team at Red Siege. This is an excerpt of the material from two different courses.
- [Offense for Defense](https://app.coursestack.com/on-demand/5c7ef587-1321-49e3-8652-0442dd90514a/summary)
- [Penetration Testing: Beyond the Basics](https://training.redsiege.com/courses/98a5cb98-cfc8-446f-b790-3a581189a0d8)

Both of the above courses are available live and virtually at [WWHF Deadwood 2026](https://wildwesthackinfest.com/event/pre-conference-training-at-wwhf-deadwood-2026/).

Additionally, both classes are available in a [discounted bundle](https://training.redsiege.com/bundles/a3c39973-99da-4e7e-aaad-2c3b182e55e4)!

**In this module, you’ll go beyond surface-level explanations and dive deep into how Kerberos truly works.** You’ll break down the structure of tickets, how they’re encrypted and signed, and why each piece matters for both defense and attack scenarios. More importantly, you’ll learn these concepts from **Tim Medin**, the creator of the **Kerberoasting** and one of the foremost experts in enterprise penetration testing.

Tim doesn’t just teach theory, he teaches from experience. You’ll get **hands-on practice with real-world tools** to perform Kerberoasting yourself and understand why it continues to be one of the most impactful Kerberos attacks in use today. From there, you’ll extend your skills into other advanced Kerberos attacks: the **Silver Ticket** and **Golden Ticket** attacks, as well as **pass-the-ticket** and **overpass-the-hash**.

By the end, you’ll not only understand the inner workings of Kerberos but also know how attackers exploit its weaknesses—and how to recognize and defend against those techniques.

This "Pay What You Can" course can be as low as $20! 

## Lab Environment

You'll be working from a Kali Linux to access systems on the same Active Directory Domain, but with the easiest set up ever. 

**In fact, there is no setup.** It is all accessible and handled in your browser! No giant downloads. No messing with VMware. No annoying VPN setup. No configuration or compatibility issues.

Unlike the big guys, your lab network is specific to you. No one (but you) can break your network. And you can revert your lab network anytime you want to. You can access the lab network immediately after you sign up. Like we said, no giant downloads, funky setup, or VPN issues.

Learn Kerberos from Tim Medin - the creator of Kerberoasting, and get hands-on with the real-world attacks, tools, and defenses every modern penetration tester needs to know.

Kerberos Workshop

## Hide the Payload. Expand the Toolkit. 

Unprotected shellcode gets flagged fast by modern AV & EDR. This course teaches students why that happens and how to approach obfuscation in a more practical, methodical way. It starts with the fundamentals of what shellcode is, how common frameworks can lead to recognizable signatures, and why failing to obfuscate payloads can lead to early detection before operations even begin. 

From there, students move into a broad set of hands-on techniques designed to make shellcode less obvious. The course structure in the deck includes Caesar Cipher, XOR, AES, and RC4 encryption, Base64 encoding, a two-array method, shellcode represented as UUIDs, IP addresses, and MAC addresses, Jargon encoding, Jigsaw obfuscation, Delta encoding, and hiding shellcode in GIFs, with 16 total lab exercises. 

The course also sets expectations the right way. It makes clear that these techniques help hide shellcode, but they do not automatically make the rest of a loader safe. The deck explicitly notes that decryption routines and common execution patterns can still be detected, and that students will learn how to check where those detections are coming from.

This course is taught by Mike Saunders, Principal Red Siege Consultant, drawing from his vast Red Team and Penetration Testing experience to provide real-world tools and techniques still being used on today engagements today.

## Who This Course Is For

This course is built for:

* Red teamers who want more options for shellcode transformation and concealment.
* Penetration testers looking to go beyond basic payload generation.
* Offensive security professionals who want more hands-on exposure to obfuscation techniques.
* Detection-minded operators and malware analysts who want to better understand how these methods work in practice. The deck supports this positioning by focusing on shellcode detection, evasion-minded transformation methods, and lab-based implementation.


## Lab Environment

You'll be working from a Windows VM, but with the easiest set up ever. **In fact, there is no setup.** It is all accessible and handled in your browser! No giant downloads. No messing with VMware. No annoying VPN setup. No configuration or compatibility issues. 


## What You Will Learn

Students will learn how to:

* Understand why shellcode from common frameworks is often detected.
* Apply practical obfuscation methods across encoding, encryption, and alternate storage formats.
* Work through hands-on examples using provided scripts, templates, and code output.
* Evaluate whether detection is coming from the shellcode, the deobfuscation routine, or the loader itself. These points come directly from the learning objectives, course structure, and clarification sections in the deck

## Why take this course

**Because raw payloads are not enough.** If you rely on well-known shellcode without changing how it looks or how it is stored, you are more likely to be identified early. This course gives students practical exposure to multiple obfuscation approaches so they can better understand detection tradeoffs, experiment with different methods, and add more tools to their offensive toolkit. That value proposition is grounded in the deck’s explanation of why shellcode is hidden, its emphasis on varied techniques, and its hands-on lab format. 

## Key takeaways

* 16 hands-on labs
* Multiple real obfuscation approaches
* Practical exercises using scripts and code templates
* Coverage of both technique and detection considerations
* Clear discussion of the limits of obfuscation alone


Learn modern, practical shellcode obfuscation techniques through 16 hands-on labs covering encryption, encoding, alternate representations, and detection testing.

Bundles

Courses