You'll see overlap because there is a methodology to pen testing. Techniques, however, are different between vendors. Depending on who you ask, you'll get different answers on which pen test certs are "worth it." One could argue that taking ALL of them would fill in the gaps the other vendors might have. Obviously, unless you have an unlimited training budget, that's not likely realistic, so you need to prioritize what you want.
As you've noticed, there are several "beginner" pen test certs and far less "advanced" ones. GXPN claims to be advanced, and it certainly is more advanced than some of them but in my opinion its lacking in some areas, for example.
A point of clarification:
What percentage of knowledge overlap would there be between OCSP and OSCE? Would someone who has completed OSCP & OSCE get value out of obtaining GPEN?
OSCE and P are very different certs. OSCP is pentest focused, OSCE is exploit development focused (mostly).
I personally started with OSCP and then went back and looked at the GPEN material. I decided that I wanted to spend that 5K somewhere else.
However, at my company we like to push people into GPEN first, then push them to OSCP. They seem to work well together.
Keep in mind, a lot of this stuff is teaching you methodology and "how to think" the rest is really just sharpening your own techniques and skills. Regardless of all the education you get, the best way to get really good at this, is to get real world experience in real environments.
Show Posts
Tools : Symbolic Exploit Assistant project is looking for collaborators
