Seems like a fairly poor excuse to me, but if that is their stance then potentially you've had a lucky escape. As much as you want the job in infosec, the company that you end up working for has to give back in return for your work. If they rejected you based on not being loyal before they offer you a job? Something isn't right somewhere.

From my own experience (UK) there are pentest jobs out there, but most are looking for people who are already experienced (standard catch22 scenario).

Hope things get better going forward, keep the faith

Hey, welcome 

Good career path? Depends on how much you want it. Infosec can be a great career IF you enjoy it enough to be willing to put the required work in without coming to hate the job. Unfortunately I can't really help you too much there, only you can truely answer.

I'm from the wrongside of the pond to give a US answer to what you should study but EthicalHack3r/Ryan Dewhurst (also UK based) has just posted about his experiences of 'ethical hacking' degree courses. Hopefully will help you.

Finally just learn everything you can, about everything you can whilst you're young and enjoy the learning; and try not to get too focused on where you want to be. At you age I was intending to be an accountant beancounter.

Hope this helps

Might be overkill depending on circumstance, but I have a personal server running dokuwiki.

Works perfectly for me needs and can access from anywhere. Plus if/when you need to collaborate/expand just allow another access and all previous info can be shared.

I find the Kindle great for fiction books, but for technical books I've found it unworkable where formatting and/or illustrations are important.

YMMV, but I'm sticking to dead tree versions of technical resources for the time being.

I just passed the v6 material.

As Chippybox said, a lot of the tools discussed are outdated, to the point where most of my study time went into learning about legacy stuff that I've never encountered in the real world any more.

If you're looking for C|EH to give you the knowledge required to start out in the field then I'd move to v7, or look at alternatives if training centres are still focusing on v6.

Either way, good luck

Wondering who else is attending?

I'm going to be in London 19th-21st, would be good to meet up with some EH-Net'ters in person and talk tech

Nice one j0rDy 

I'd half typed a response (would have been frist), then remembered the date and hoped you were kidding.

well played

Link is dead for me, try here.

Not sure how I forgot that as I wrote the article, it's been one of those days....

Hi,

I wrote two posts a while back detailing my my lab's network setup that I use for testing. Will hopefully give you an idea and point in the right direction:

• Virtual Lab Network
• Virtual Lab Machines

Hope this helps,
--Andrew Waite

Hi All,

I've just ticked off the latest certification I've been working on (CheckPoint Certified Security Expert - CCSE).

Once the dust and celebrations (pizza and beer) settle I'm looking forward to what's next. First choice at the moment is to self study for C|EH, but I'm struggling to find any study guides covering v7, can anyone point me in the direction of anything I've missed?

Alternatively, I've already got some guides covering v6. How much difference is there between the two, do I stand a chance studying for one and taking the other?

Thanks in advance,
--Andrew

(p.s. apologises if this has already been answered, tried searching the forums (and Google) but came up empty.)

Hey Bushman,

this may not cover everything that you're looking for but, the there is a 'permission memo' provided on the Counter Hack site which should give you a starting point.

Welcome to the forum.

I'd guess it depends how intelligently Nemesis is mimicking then true open port.

For example, if it's just throwing a syn-ack packet in response to a syn then you should be able to just look for one port that doesn't behave like the rest, that will be the real service. With nmap I'd suggest trying the version detection flag (-sV) and look for different output.

Similarly you could easily script nc to connect to each open port, pass some arbitrary input, and look for differences in response. Again I'd expect all of the Nemesis ports to respond in the same manner, with the real port being unique.

Depending on how convincing the Nemesis responses are, you may need to craft some complex data/input before you identify a difference, but you will get there. If not, and Nemesis is responding exactly like the real service, then you've just opened the same service on multiple ports

Hope this helps, let me know how you get on, would be interested to confirm how well the above works in practice....

+1, I did the same, nothing like a rookie error on a public board

which part? Unless I'm missing something I can't see anything in the code you've uploaded that indicates a shell.

Again, not a Joomla expert so I'm going blind on some things, but:

'Edited' index file includes two additional php files (helper.php & toolbar.php). Are these a legitimate part of the framework? Are they also edited? Are they required? What do they do?

looks like the edited file removes an authorisation call, suspicion levels rising...

Finally, the edited index file looks like to calls a function to get a gzipped copy of the configuration file.

From my knowledge of Joomla this could be legit (if you're seeing it across multiple systems, any chance you've just upgraded Joomla?). But at worst looks like a data leakage issue, I'd still suggest focusing on locating the original compromise, this looks to be more a symptom than a cause.

Can anyone shed any additional light?