EH-Net

Dears,

i really get confused with the content of these two courses
sans660 which is advacned penetration testing
and
sans709 which is writing exploits for advanced penetration testers

which one i should go first? and which has really useful contents.

thansk,

SANS 660 is being run for the first time at SANS London 2010, so I can't comment on the entire course, but I know some of the content has come from 709.

My take on the two courses are:
709 is intended for folks that want to find, created and develop their own exploits, or at least have a stellar understanding of how the bad guys and security researches do it.

660 is for those penetration testers who want to take it to the next level and understand, subvert and overcome the defences of modern systems and networks.

I really enjoyed SANS 709 and have a vastly deeper understanding of its topics from taking the course, but it's a very, very targeted group of people that really get the most of it. 660 sounds awesome and a lot less mental pain
 ;-)

My suggestion is that if you've taken SANS 560 then 660 is going to be the best course for you.

thanks for enlighting me What90
and i'm really sorry for not replying early.

actually SANS now offer a new course named "Advanced Exploit Development" 710

what are the differents between it and 709?

so confusing?!!!  ???

Neither  ;D

If you're into really advanced penetration testing, Cracking the Perimeter by Offensive Security is the way to go. They got live and online courses.

If you want to write advanced exploits on Windows, then sign up for their AWE class.

It's most likely also a lot cheaper and you'll also, most likely gain a lot more knowledge.

San 710 - seems to be 2 day course opposed to sans 709 - a 5 day elaborate course on exploit development.
If you are new to exploit development you should start with 709 and move onto 710. sans 710 assumes knowledge of exploit development and teaches reversing microsoft patches and finding undisclosed vulnerabilities which I dont think any other course in the industry offers.

i like to done with SANS Penetration Tesetin/Exploit Development Track and then move to the offensive-security online-training.

because i believe SANS Courses prepare you better!

there's CEPT from infosec institute i think it can offer the same in the exploit development and advanced penetration testing area.

check the course content:
http://www.infosecinstitute.com/courses/advanced_ethical_hacking_training.html
http://www.infosecinstitute.com/courses/expert_penetration_testing_training.html

Neither of them offers lessons on reversing patches to find vulnerabilities which sans 710 does. Nevertheless they look like excellent courses on exploit development.