CFR-410 study plan
CFR-410 · Give each week a clear focus.
8 weeks · About 7 hours per week
Attack (attack simulation, reconnaissance, vulnerability exploitation, Metasploit, web application vulnerabilities)
Map the attack lifecycle (reconnaissance through post-exploitation) and write a one-line defensive control that interrupts each stage
Enumerate a lab host with Nmap service/version and default-script scans, then record open ports, versions, and likely CVEs in a findings table
Perform passive reconnaissance against a fictional target: WHOIS, DNS enumeration, certificate transparency, and OSINT on employees
Set up an isolated attack lab (hypervisor, vulnerable VM, attacker VM) and document the network diagram and snapshot baseline
Your checkpoint
A reconnaissance report for one lab target containing the attack-stage map, Nmap output summary, OSINT findings, and a ranked list of three exploitable entry points
Attack (attack simulation, reconnaissance, vulnerability exploitation, Metasploit, web application vulnerabilities)
Configure Metasploit (msfconsole, workspace, database) and run a full exploit workflow: search, use, set options, exploit, session
Exploit at least two lab vulnerabilities (e.g., a known CVE service and a misconfiguration) and capture proof of access with screenshots and command transcripts
Explain payload types (staged vs. stageless, meterpreter vs. shell) and select the correct payload for a given network constraint
Practice post-exploitation enumeration on a compromised lab host: users, privileges, network shares, and persistence indicators
Your checkpoint
An exploitation log for two lab targets with the exact Metasploit module, options, payload, obtained session type, and a post-exploitation findings summary
Attack (attack simulation, reconnaissance, vulnerability exploitation, Metasploit, web application vulnerabilities)
Identify and test the OWASP Top 10 categories against a deliberately vulnerable web app (SQLi, XSS, broken access control, SSRF)
Use an intercepting proxy to capture, modify, and replay requests, and document the tampered request/response pair
Perform a basic web vulnerability scan and manually validate at least one reported finding to rule out a false positive
Write remediation guidance for each confirmed web finding mapped to a specific defensive control (input validation, parameterized queries, CSP, least privilege)
Your checkpoint
A web application assessment sheet covering at least four vulnerability classes with request/response evidence, severity, and a mapped remediation for each
Attack (attack simulation, reconnaissance, vulnerability exploitation, Metasploit, web application vulnerabilities) & Analyze (log analysis, active monitoring, threat analysis, digital forensics)
Correlate attack artifacts from weeks 1-3 with the log sources they would generate (web server, auth, EDR, firewall)
Build a detection hypothesis for each exploit you ran and state the exact log event that would confirm it
Configure a log collection pipeline (e.g., Syslog/agent to a SIEM or indexer) that ingests at least three source types
Write and test three detection queries that surface the attacks you performed
Your checkpoint
A detection matrix linking each attack performed to its log source, expected event, and a working query, plus proof the pipeline ingests three source types
Analyze (log analysis, active monitoring, threat analysis, digital forensics)
Triage a provided or self-generated log set to separate benign noise from suspicious activity using a documented methodology
Analyze authentication logs for brute-force, password spraying, and impossible-travel patterns and calculate the thresholds you would alert on
Perform active monitoring: baseline normal traffic on the lab network, then flag anomalies with a stated rationale
Document an incident timeline from first indicator to containment recommendation using at least three corroborating sources
Your checkpoint
An incident triage report with a chronological timeline, evidence citations per event, a severity call, and a containment recommendation
Analyze (log analysis, active monitoring, threat analysis, digital forensics)
Collect volatile and non-volatile forensic artifacts from a lab host in the correct order of volatility
Acquire and verify a disk image (hash before and after) and preserve chain-of-custody documentation
Examine artifacts for persistence and execution evidence: autoruns, scheduled tasks, prefetch, and event log clearing
Analyze memory or disk artifacts to recover one piece of evidence that supports or refutes the week-5 incident hypothesis
Your checkpoint
A forensic acquisition and analysis packet containing the order-of-volatility checklist, image hashes, chain-of-custody form, and an artifact findings write-up
Address (implementing protections for data, access, software, networks, and systems)
Harden a lab host against the week-2 exploits and re-run the same attacks to confirm the controls block them
Implement access controls: least-privilege accounts, MFA on a test service, and role separation, then verify with an authorization test
Apply network protections: segmentation rules, a default-deny firewall policy, and TLS configuration validated with a scanner
Protect data at rest and in transit: encryption, key handling, and a backup/restore test with a documented recovery point
Your checkpoint
A before/after hardening report showing the original exploit attempt failing, the specific control applied, and evidence of the verification test for each control
Address (implementing protections for data, access, software, networks, and systems) & Attack (attack simulation, reconnaissance, vulnerability exploitation, Metasploit, web application vulnerabilities) & Analyze (log analysis, active monitoring, threat analysis, digital forensics)
Configure application and software protections: secure build settings, dependency scanning, and patch verification on the lab host
Run a full attack-detect-defend cycle on one target and record where each phase succeeded or failed
Complete two timed mixed-domain practice sets and log every missed question by domain and root cause
Build a one-page personal weak-area remediation list with the specific lab exercise that closes each gap
Your checkpoint
A full-cycle capstone report (attack, detection, defense) plus a scored practice-set log and a prioritized weak-area remediation plan
Milestones
Week 2: You can independently take a lab host from scan to interactive session and explain every Metasploit option you set without notes
Week 4: Every attack you executed in weeks 1-3 has a mapped log event and a working detection query that fires on it
Week 6: You produce a defensible incident timeline and a forensically sound acquisition with verified hashes and chain-of-custody documentation
Week 8: Re-running your week-2 exploits against the hardened host fails, and your practice-set log shows no domain below your target score threshold