In case anyone didnt see this (I dont see it on the menu to the left) one of our EHNet contributors posted a video review on YT.

http://youtu.be/R5-u3v-UnNI

My nick is sAsK see you guys soon.

just a question, shouldnt some of your statements be commented rather than echoed?

I just want to comment here, I understand what the OP is going through here, having been through some similar situations recently. Often the problem is not somone wanting to screw you or any such thing, but plain and simple, in MOST cases (Tom's being partialy excluded), I see little reason that someone cannot contact people, or put a message on their site, whatever the case may be.

When the storm was incoming, I was supposed to take some training through Training Camp. The class was supposed to be in Orlando, a few days later, i saw the schedule was changed (wasnt contacted.) I assumed it was because the storm was projected to hit there. Well they moved it up to PA (which is closer to where the storm hit... surprise) I waited a few days after the storm and tried to call, they were out of the office, But from what I was able to determine, the storm did not cause significant damage to the PA area. So because I hadnt heard anything, I was forced to change my plans, luckily I was able to.

So what could they have done? Well, many vendors placed notices on their sites stating that the training may be affected, this company did not, and left me out of touch for days...unacceptable when someone can login to an OWA, or other remote email system and send a message. I understood the situation, but allowances have their limits.

I am taking some time off right now, originally I wasnt going to, but I needed to see my family, and I figured it would be a good start to my PWB course... As of yet I havent been contacted since winning the course, I figured something was going on, and I waited. 3 months no contact. I contacted OffSec, and they are trying to contact Don, I hope to hear from him soon. I know myself and a few others are waiting patiently, but honestly I just dont have the luxury when I can be sent overseas at a moments notice.

just wait until their bank stops using SSL/TLS. we'll see how long it takes before the lawsuits stop...

Good, insightful review, I am glad to see it. I am wondering though, as you mentioned, for someone intending on doing penetration testing, when you aren't taught different ways of achieving an objective, could that develop bad habits later, in addition to limiting one's skillset? I think that maybe some in depth analysis of your exam try from the offsec team could possibly help that.

Right now i'm planning on completing CCNA this month (with more practice after my course and cert), CCNA Security in December, and review of my CPT/CEH material and programming in January followed by an eventual PWB class... still waiting on any kind of word on that.

CCCURE and CYBER DEFENSE MAGAZINE FORM STRATEGIC PARTNERSHIP

cdupuis writes "

My good friend who many of you may know by name, Gary S. Miliefsky, has started his own magazine.  As you may know he has been a lead cover story writer for Hakin9 for the past few years among many other activities in our field.  I am very excited to have establish a partnership with Cyber Defense Magazine (CDM).  Gary was one of my students dozen of years ago,  even at that time he was a forward thinker,  he was showing us an appliance he built to do vulnerability scanning and detection on networks,  at the time the concept seemed a bit nebulous but today it is a common practice.  That's how far ahead he's always thinking.

His new publication is Cyber Defense Magazine (CDM) and it includes a monthly email newsletter called CDM - Cyber Warnings.  The question is always,  what's the price of all of this? The answer is simple, the Digital Edition is FREE.  You can sign up for the Magazine and the monthly emails at NO COST.  If you want a print edition of the publication, there's a reasonable subscription fee, but why not just get the free edition?  No strings attached.

CDM has also established a partnership with the University of Massachuset (UMASS),  Gary has started the Cyber Defense Test Labs (CDTL) to perform independent lab reviews of next generation INFOSEC products for his new magazine.

I know this magazine is going to be very high quality because Gary has a great deal of hands-on experience in this field.  He is a member of ISC2.org, CISSP® and Advisory Board of the Center for the Study of Counter-Terrorism and Cyber Crime at Norwich University.  A dynamic speaker, he has presented at two White House Summits on cyber security, the RSA Conference, CSI, and many others.  Gary served as an informal advisor to President Clinton and helped the President's Critical Infrastructure Protection Board, under the Bush Administration, which is now known as the National Infrastructure Advisory Council (NIAC) and operates within the U.S. Department of Homeland Security, in their development of The National Strategy to Secure Cyberspace.  Gary is a Founding Member of the US Department of Homeland Security (http://www.DHS.gov), he currently serves on the advisory board of MITRE on the CVE Program (http://CVE.mitre.org) and is a founding Board member of the National Information Security Group (http://www.NAISG.org).

Cyber Defense Magazine is focused on best practices, new ideas and innovations and next generation INFOSEC companies that are on the cutting edge at solving problems in INFORMATION SECURITY.  As Gary told me his publication is less worried about the balance sheet of an innovator and more about how well their technology works to solve critical security problems for our members and readers.  This is philosophically different from other publications that focus on Cisco, Microsoft, IBM, Symantec, McAfee, etc. who are found to be more vulnerable, every week with holes listed on the CVE site at MITRE.  I like this approach and can't wait to see who Gary and his team of writers think are the ‘innovators'.

He gave me a sneak peek of what's coming in the January edition:
January Edition

    RSA Conference 2013 Special Edition
    CDTL Anti-virus & Mobile security product reviews
    Cyber crime, Cyber war predictions
    Cloud and Mobile Computing
    Government Regulations and
    Crossing the Distribution Chasm

And much more...

Together, we'll be sharing information, authoring content, and helping lead IT Professionals to CCCURE.org Quizzes and online resources.

Please visit Cyber Defense Magazine – Your Premier Source for IT Security Information and signup today for your always free electronic subscription to the excellent monthly newsletter and quarterly editions of the magazine.

Thank you for the review, I often wondered if I should attend HH.

strange...

im not happy with TC right now, their site needs some updates, and I dont know if the class I was planning on attending is still scheduled... They were closed yesterday, we'll see what happens today.

Good review! maybe i'll eye the GCIH after the current course im taking in a few weeks.

How disturbing. I should be attending a course with them in a few weeks, I intend to bring this up to the staff if it hasnt been resolved by then.

This bulletin was just posted:

http://technet.microsoft.com/en-us/security/bulletin/MS12-054

I see that the vulnerability is in the way that MS implements the Remote Access Protocol, some form of the RDP protocol if my understanding is correct. My question is, besides RE'ing the fix when it is released, how does one go about building an exploit for this vulnerability? At first I thought just manipulating the packets themselves would be enough, but I have no idea how one would generate application specific packets... I'm not trying to do so, but I am tring to understand the process.

Oh I know, thats why im looking outside.

Thats what i've determined so far, but im looking for a good resource for learning those concepts in a way that makes sense. I am hoping that the course presents those concepts well, Ive also heard of the learn to code website, perhaps that would be a good option or resource?

Just wondering, CBT Nuggets has a python course, could someone get through the OSCP with just python knowledge? And how difficult would it be to go from python to ASM or C/CPP/C#? or other languages required for an infosec career?