HomeCalendarCertificationsColumnsFeaturesForumResourcesVitals
 
Image
 
linkedin_logo.png rss_logo.jpg
twitter_logo.png youtube_logo.jpg
Latest Additions
 
EH-Net Login
Welcome Guest.
Lost Password?
No account yet? Register
Who's Online
We have 45 guests and 1 member online
 
Advertisement

You are here: Home arrow Ethical Hacking Discussions and Related Certificationsarrow Web Applicationsarrow Best WebApp Pentest Course?
EH-Net
May 21, 2013, 06:09:40 PM *
Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
News: Go back to The Ethical Hacker Network Online Magazine Home Page
 
   Home   Help Calendar Login Register  
Pages: [1] 2   Go Down
« previous next »
  Print  
Author Topic: Best WebApp Pentest Course?  (Read 16702 times)
0 Members and 1 Guest are viewing this topic.
H1t M0nk3y
Hero Member
*****
Offline Offline

Posts: 864



View Profile
« on: July 12, 2010, 09:31:12 AM »
Hi,

I will soon be ready to take a Web Application penetration testing course. My goal is to learn in-depth web app security. I have been a web app developer for 10 years and I have been in the security field for about 2 years now. So I am looking for an intermediate/advance course. I am looking on courses dedicated on web apps.

Also, I pay everything from my own pocket, so I am looking for the best value.

So far, I found:

  • SANS 542: Web App Penetration Testing and Ethical Hacking (GWAPT) - $4000 with the exam
  • InfoSec Institute: Learn to Pen Test and Secure Web Apps - $3825
  • BlackHat: The Web Application Hacker's Handbook - Live Edition - $1895 (late registration)
  • BlackHat: Web Application (in)Security - $1895 (late registration)

Do you know about other courses? Which one would you suggest?
Logged
OSCP, GPEN, GWAPT, GSEC, CEH, CISSP
mambru
Jr. Member
**
Offline Offline

Posts: 98


View Profile
« Reply #1 on: July 12, 2010, 08:55:44 PM »
Hi H1t M0nk3y,

A colleague currently is in the 3rd week of the GWAPT course and he is not satisfied with the level of the course so far.

Regarding the other courses, I have no references.
Logged
xXxKrisxXx
Hero Member
*****
Offline Offline

Posts: 512



View Profile
« Reply #2 on: July 13, 2010, 12:17:41 AM »
Don't forget the LearnSecurityOnline's course "So You Wanna Be A Web App Pentester" course. It's by far the cheapest on the list. I'd love to hear some reviews on it.

http://www.learnsecurityonline.com/offerings/courses/224-so-you-wanna-be-a-webapp-pentester
Logged
eCPPT, GCIH, OSCP, OSWP
H1t M0nk3y
Hero Member
*****
Offline Offline

Posts: 864



View Profile
« Reply #3 on: July 13, 2010, 06:32:35 AM »
@mambru Did you colleague say why he is not satisfied with the GWAPT course? I am curious why...

@xXxKrisxXx Thanks, I did forget about it! In the course description, they say:
Quote
How Is The Course Delivered & What Do You Get
All of the courseware will be delivered in PDF format

- 5 sets of powerpoint slides in PDF format
- 1 document (103 page course document) in PDF format
- 1 web app tools install walkthrough document
- 4 lab documents

I wonder what is the difference with this course and, let say, buying 6 or 7 books...

I think I am gonna take it. For $300, you can't go wrong. I will write a review as soon as I am done, probably late in September.
Logged
OSCP, GPEN, GWAPT, GSEC, CEH, CISSP
secureseven
Jr. Member
**
Offline Offline

Posts: 79



View Profile
« Reply #4 on: July 13, 2010, 09:12:38 AM »
Also, there is eLearnSecurity. Web application is one of the three main focuses included in the course (System and Network security is also included). It is pretty in depth and is fairly cheap @ $599 (until the end of July). You also get a discount being an EH-Net member.
Logged
http://twitter.com/mikesantillana
eLearnSecurity Team Member.
mambru
Jr. Member
**
Offline Offline

Posts: 98


View Profile
« Reply #5 on: July 13, 2010, 10:13:33 AM »
Quote
@mambru Did you colleague say why he is not satisfied with the GWAPT course? I am curious why...

He says the technical level is far too low. Also, both instructors (Kevin Johnson & Set Misenar) spend too much time in simple things, while other important aspects are almost skipped.
Logged
H1t M0nk3y
Hero Member
*****
Offline Offline

Posts: 864



View Profile
« Reply #6 on: July 13, 2010, 11:47:02 AM »
@secureseven Did you take the eLearnSecurity course yourself? I looked at it the other day but I wasn't sure...

@mambru Thanks
Logged
OSCP, GPEN, GWAPT, GSEC, CEH, CISSP
secureseven
Jr. Member
**
Offline Offline

Posts: 79



View Profile
« Reply #7 on: July 13, 2010, 11:56:22 AM »
I'm currently taking it, and I find it rather informative with in depth descriptions and good examples of tool usage. I haven't finished all modules yet due to being busy, but the material never expires and you can start the certification process whenever you're ready.

You can also read the review here:
http://www.ethicalhacker.net/content/view/307/24/
Logged
http://twitter.com/mikesantillana
eLearnSecurity Team Member.
H1t M0nk3y
Hero Member
*****
Offline Offline

Posts: 864



View Profile
« Reply #8 on: July 13, 2010, 12:04:31 PM »
Thanks secureseven.

In the review, they said:

Quote
We contacted Armando, and he told us that there will be a completely stand-alone Web Application course on its way containing much more web hacking fu. In the meantime he is working on adding w3af into the VA section.

I will be looking forward to this!!! Grin
Logged
OSCP, GPEN, GWAPT, GSEC, CEH, CISSP
xXxKrisxXx
Hero Member
*****
Offline Offline

Posts: 512



View Profile
« Reply #9 on: July 13, 2010, 12:09:17 PM »
I'm currently taking the eLearnSecurity course too but you've got to remember he's looking for a more predominant focus in web application attack course. While the web application attacks section is the best section compared to other sections, it'd have slides in the course that H1t M0nk3y would most likely know (this just judging from the certifications in his signature). Essentially he'd put out the money for the course to be mainly interested in the web application section and for the certification you have to pentest a vulnerable web-app.

Heorot's 3DCPT also looked pretty interesting:
http://heorot.net/3dcpt/

Fixed: Typo
« Last Edit: July 13, 2010, 12:11:34 PM by xXxKrisxXx » Logged
eCPPT, GCIH, OSCP, OSWP
H1t M0nk3y
Hero Member
*****
Offline Offline

Posts: 864



View Profile
« Reply #10 on: July 13, 2010, 08:16:12 PM »
You are right xXxKrisxXx, I am really looking at a course dedicated on web app pentesting.

Heorot's 3DCPT looks indeed quite interesting, however:

Quote
Students must have successfully completed the Nidan Certified Penetration Tester course before they can attend the 3DCPT course.

I wonder if we really have to take the other course first...  Embarrassed
Logged
OSCP, GPEN, GWAPT, GSEC, CEH, CISSP
Dark_Knight
Sr. Member
****
Offline Offline

Posts: 292


View Profile WWW
« Reply #11 on: July 13, 2010, 08:19:55 PM »
Quote from: mambru on July 12, 2010, 08:55:44 PM
Hi H1t M0nk3y,

A colleague currently is in the 3rd week of the GWAPT course and he is not satisfied with the level of the course so far.

Regarding the other courses, I have no references.

I recently did the course and I felt it served as a very good introduction to the world of web application pen testing.
Quote from: mambru on July 13, 2010, 10:13:33 AM
Quote
@mambru Did you colleague say why he is not satisfied with the GWAPT course? I am curious why...

He says the technical level is far too low. Also, both instructors (Kevin Johnson & Set Misenar) spend too much time in simple things, while other important aspects are almost skipped.

That wasn't my experience. I will admit that there were areas where I would have preferred if more information was provided. But then that happens in almost ALL courses. I was fairly satisfied with the technical content.
Logged
CEH, OSCP, GPEN, GWAPT, GCIA
http://sector876.blogspot.com
mambru
Jr. Member
**
Offline Offline

Posts: 98


View Profile
« Reply #12 on: July 14, 2010, 01:29:01 AM »
@Dark_Knight Yeah maybe it's a good introductory course, this guy is already a GPEN and has quite some experience doing PTs
Logged
H1t M0nk3y
Hero Member
*****
Offline Offline

Posts: 864



View Profile
« Reply #13 on: July 14, 2010, 06:26:44 AM »
@mambru and @Dark_Knight: I appreciate your comments!

I think I will go through some books instead for the next few months. I haven't seen anything convincing so far. Again, I pay everything myself and before putting $4000 on a course + travel or pay $500 for a bunch of PDFs, I may as well read a few books!

I am pushing right now!  Wink

I will go through a few books on web app pentests and I will see. I may then by a GWAPT practice exam and see where I stand. I did that for GSEC and finally passed the exam without the course!

Thank you everyone for your comments!
Logged
OSCP, GPEN, GWAPT, GSEC, CEH, CISSP
Equix3n-
Sr. Member
****
Offline Offline

Posts: 386



View Profile
« Reply #14 on: July 14, 2010, 06:39:57 AM »
Start with The Web Application Hacker's Handbook then. It's probably the best book out there for web app hacking.
Logged
Pages: [1] 2   Go Up
  Print  
« previous next »
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.18 | SMF © 2013, Simple Machines
Joomla Bridge by JoomlaHacks.com 		Valid XHTML 1.0! Valid CSS!
Page created in 0.091 seconds with 23 queries.
 
Exclusive Deal

sansfire13_245x90_cw90.jpg
SANSFIRE 2013
June 15 - 22

5% Off w/ Code: EHN_5

SANS Deals 4 EH-Netters
5% OFF Any SANS Course in Any Format!
Coupon Code: EHN_5 Including SANS Rocky Mountain 2013 & SANS Boston 2013
Polls
Compared to this year, 2013 will be:
 
Recent Forum Topics
EH-Net News Feeds
Latest Additions
 
         
Free Business and Tech Magazines and eBooks

© 2013 The Ethical Hacker Network
Joomla! is Free Software released under the GNU/GPL License.