The Ethical Hacker Network - OSCP Walkthrough

MaXe

Hero Member

Offline

Posts: 669

I've just upgraded myself to a cyborg muahahaa!!1

Re: OSCP Walkthrough

« Reply #90 on: November 03, 2010, 09:24:45 AM »

Quote from: j0rDy on November 03, 2010, 03:20:09 AM

*just a post to hijack the threat back...

Im still working on this, and i will not let it go until i pass. Currently im starting to go over the course material again and see if i can reflect it to the steps i took during the exam. I will post a real update when i find the time to do so. I will keep you guys updated!

Check out these books from Syngress too:
- The Metasploit Toolkit (may seem a bit outdated)
- The Penetration Testers Open Source Toolkit vol. 2 (highly recommendable)

Also if you don't know a scripting language, learn Python or Perl, or perhaps Ruby and then a Web Application language like PHP as well. That will help you a lot

The most important thing you need to do, is to find out why you possibly failed if you did, and then know what you need to improve on accurately and then take your time to learn this area a lot more, even if you already know it.

Anyway, good luck :-)


	Logged

I'm an InterN0T'er

xcircusmusician

Newbie

Offline

Posts: 7

Re: OSCP Walkthrough

« Reply #91 on: December 09, 2010, 04:42:35 PM »

Does anyone have advice concerning the tools involved in the OSCP certification?? Thanks in advance!!!


	Logged

hayabusa

Hero Member

Offline

Posts: 1631

Re: OSCP Walkthrough

« Reply #92 on: December 09, 2010, 05:35:07 PM »

Not a lot we can really give, except to say, every tool needed IS in BackTrack, as well as many you wont' need. <evil grin> sorry. NDA for the class (non-disclosure) doesn't really let us say much more. The only other thing I can really say is, get really comfortable with doing tasks by hand, as there are times when you're forced to use the basic tools, rather than, say, the vulnerability scanners / db_autopwn, etc.

Good luck!


	Logged

~ hayabusa ~

"All men can see these tactics whereby I conquer, but what none can see is the strategy out of which victory is evolved." - Sun Tzu, 'The Art of War'

OSCE, OSCP , GPEN, C|EH

sil

Hero Member

Offline

Posts: 549

Re: OSCP Walkthrough

« Reply #93 on: December 09, 2010, 09:57:15 PM »

I always thought autopwn was a no no. Anyhow, I say, familiarize yourself with the attack vectors and canvas. Once you understand what you're attacking, you'll soon be able to determine which tool is suitable. Remember, if you're without a hammer and need to drive in a nail, you could always use the opposite end of a screw driver if you have the right aim, practice.

Don't focus on tools too much, focus on understanding what is occuring during an exploitation. Once you get this down to a science, you'll know which tools to use and why you may need to understand them all as well as understand the attack vector/canvas.

Tip: Why use a webscanner like nikto all the time when you could use a combo of sleep, links and a dictionary? Most webapp scanners are brutally noisy.

E.g.:

Code:

cat /your/directory/of/wordlists/directorynames.txt
while
read word
do
links -dump http://target.com/$word ; sleep 30
done

Get the picture? Something like this is LESS likely to trigger alerts, still functions similar to something like dirbuster and accomplishes directory enumeration. Its all about what your target is, what your goal against that target is, and what is available to you to attack it.


	Logged

http://www.infiltrated.net/mgz/puppylecter.jpg

MaXe

Hero Member

Offline

Posts: 669

I've just upgraded myself to a cyborg muahahaa!!1

Re: OSCP Walkthrough

« Reply #94 on: December 10, 2010, 06:15:59 AM »

Sil: Nikto does more than request website directories. It also checks the HTTP options and reports them (especially if TRACE, PUT, etc. is found), it even tries to send some custom http headers you may forget to try.

I should however note, that I don't use Nikto alone. It's good as an assistant tool and there are some evasive options (and most likely timing options too) you can use, but for a primary tool it's not good enough though as previously mentioned, as an assistant tool it's perfect at least for me. It does however, create a lot of noise too, but not more noise than Owasp Dirbuster, that one creates a huge overhead.

Also, the default user agent of Nikto, contains the word Nikto. So if you just fire up Nikto without altering anything, some websites will deny you access. (Based on user agent.)

I'm glad you explained the use of bash scripting to the other viewers of this thread as well, it's useful to know Wink


« Last Edit: December 10, 2010, 06:18:56 AM by MaXe »	Logged

I'm an InterN0T'er

sil

Hero Member

Offline

Posts: 549

Re: OSCP Walkthrough

« Reply #95 on: December 10, 2010, 06:43:54 AM »

Quote from: MaXe on December 10, 2010, 06:15:59 AM

I know this. One of my friends created one of the first generation scanners of its (Nikto) kind - Whisker. I was using Nikto an example about relying and or focusing solely on tools: http://www.infiltrated.net/pentestingextended.html when it comes down to it, I prefer curl + POST/GET + shell scripts see: http://www.ethicalhacker.net/component/option,com_smf/Itemid,54/topic,5851.msg31013/topicseen,1/


	Logged

http://www.infiltrated.net/mgz/puppylecter.jpg

j0rDy

Hero Member

Offline

Posts: 590

Re: OSCP Walkthrough

« Reply #96 on: January 11, 2011, 12:07:34 PM »

Time to hijack my threat back Cool

Exam retake time...

Quote

lets cut the crap about how nervous i was and uncertain if i would finally make it: I PASSED! i cant describe how happy i am that all that hard work finally payed off. i did a lot of research on the parts i messed up the first time, and after a lot of reading, practice and hard work all my effort got me where i wanted to be, an OSCP.

Like i said before, time was my greatest enemy. it took me a heck of a long time to get the steps that i wanted to take to the commands to get them done. when i stumbled upon a nasty twist it just took me too long to figure it out, and that is mainly to blame on the fact i'm quite new to the game. I really enjoyed every minute of it. It is a great course where you will learn more then any other certification course, for sure. The material is clear, to the point, very well understandable for all skill levels and i recommend that if you decide to only do the exam, to take the course just to get an idea of what you can expect. Besides that it is just plain fun to play around in a lab like that. The only remark i have is that the exam could be a little bit more in line with the course, cause some techniques i needed in the exam were not mentioned in the course. After all an exam is to test if you see if you master the material. However, you should be prepared to take the exam journey alone, cause no matter how hard you will try, nobody from the forums or IRC channel will help you, no matter how hard you try Wink

I am hooked on the way offensive security makes you think and work on your own. i discovered you can talk all you want about tools, techniques and hacking in general, you will only truly master it by doing it. i hope you had as much fun reading this as i had writing it, and do not be afraid to ask any questions about the course and exam. I would like to thank the guys at offensive security for this wonderful experience that i will stay with me forever, the admins at the IRC channel for being patience with me and leaving me all by myself in that pit full of lions, snakes and other animals you do not want to be alone with, and last but certainly not least, EH.net and in particular Don, for making all this possible for people like me, and by that i mean all of us. Thank you.
[\quote]


	Logged

ISC2 Associate, CEH, ECSA, OSCP, OSWP

earning my stripes appears to be a road i must travel alone...with a little help of EH.net

H1t M0nk3y

Hero Member

Offline

Posts: 864

Re: OSCP Walkthrough

« Reply #97 on: January 11, 2011, 02:07:44 PM »

Congratulations j0rDy!!!

Persistence is the key! You finally got the knowledge (and the cert). Great jobs for not letting go!


	Logged

OSCP, GPEN, GWAPT, GSEC, CEH, CISSP

ziggy_567

Sr. Member

Offline

Posts: 361

Re: OSCP Walkthrough

« Reply #98 on: January 11, 2011, 02:57:10 PM »

Congratulations!

Its time to update your signature!


	Logged

--
Ziggy

eCPPT - GSEC - GCIH - GCUX - RHCE - SCSecA - Security+ - Network+

hayabusa

Hero Member

Offline

Posts: 1631

Re: OSCP Walkthrough

« Reply #99 on: January 11, 2011, 06:00:31 PM »

Congrats, and welcome to the ranks! BTW, read the internal forums on offensive, for those who are certified. There are plenty of tips and differing ways folks accomplished the exam machines, and there's always more to learn and discuss.

Again, congrats!


	Logged

~ hayabusa ~

"All men can see these tactics whereby I conquer, but what none can see is the strategy out of which victory is evolved." - Sun Tzu, 'The Art of War'

OSCE, OSCP , GPEN, C|EH

chrisj

Hero Member

Offline

Posts: 1163

Re: OSCP Walkthrough

« Reply #100 on: January 11, 2011, 11:06:33 PM »

Congats.


	Logged

OSWP, Sec+

j0rDy

Hero Member

Offline

Posts: 590

Re: OSCP Walkthrough

« Reply #101 on: January 12, 2011, 02:07:08 AM »

Thanks!

Quote from: ziggy_567 on January 11, 2011, 02:57:10 PM

Congratulations!

Its time to update your signature!

Woops, guess i forgot something in my over-excitement Cool


	Logged

ISC2 Associate, CEH, ECSA, OSCP, OSWP

earning my stripes appears to be a road i must travel alone...with a little help of EH.net

UNIX

Hero Member

Offline

Posts: 1234

Re: OSCP Walkthrough

« Reply #102 on: January 12, 2011, 04:42:17 AM »

Congrats, j0rDy. Wink


	Logged

alucian

Full Member

Offline

Posts: 225

Re: OSCP Walkthrough

« Reply #103 on: January 13, 2011, 01:44:22 PM »

Congrats!

I finally decided to fo it, too. Hope I will start in two weeks.
My wife will kill me, my kids will hate me but... I'll be happy

I give myself 2 1/2 months to do it. Hope I am realistic.


	Logged

CISSP ISSAP, CISM/A, GWAPT, GCIH, eCPPT, OSWP

hayabusa

Hero Member

Offline

Posts: 1631

Re: OSCP Walkthrough

« Reply #104 on: January 13, 2011, 10:10:52 PM »

Assuming you have ANY comfort in Linux, at all, and are determined to succeed, 2 1/2 months should be enough time. I can't guarantee it, as I don't know your ability to self-learn, etc, but if you're comfortable self-studying, you should do alright.

Good luck, alucian.

PS - I sympathize on the wife and kids... btdt htts (been there, done that, have the tee shirt)


	Logged

~ hayabusa ~

"All men can see these tactics whereby I conquer, but what none can see is the strategy out of which victory is evolved." - Sun Tzu, 'The Art of War'

OSCE, OSCP , GPEN, C|EH

Pages: 1 ... 5 6 [7] 8 9 10 Go Up

« previous next »