.

Advice for next certifications wanted

<<

UNIX

User avatar

Hero Member
Hero Member

Posts: 1244

Joined: Mon Apr 28, 2008 9:20 am

Post Wed Sep 01, 2010 1:07 am

Advice for next certifications wanted

I'm wondering which certs to go after next, so any recommendations/ thoughts are welcome. Currently I'm holding Sec+, CEH and CCNA.

Some certifications I'm considering at the moment:

  • Offensive Security Certified Professional (OSCP): Don't think there is much to tell about it. My only concern is time, which is pretty short since I'm a full time student as well as working as a security consultant.
  • Offensive Security Wireless Professional (OSWP): The few reviews I read were all positive. Seems to be doable with little time as well. Only concern is about it's partly kind of outdated syllabus.
  • GIAC Certified Penetration Tester (GPEN): Am I correct that I can't go for this exam through Pearson/ Prometric? Can you do self-study and go only for the exam?
  • OSSTMM Professional Security Tester (OPST): Would be interested in this one too, but it seems here again that you have to do a class in order to go for the exam.
  • Computer Hacking Forensic Investigator (CHFI)/ Licensed Penetration Tester (LPT): Well, since I already have the CEH it might be worth to get those as well. Not sure though..
  • elearnsecurity's Certified Professional Penetration Tester (eCPPT): Sounds funny too, not sure about it's required skill level though. Since I'm already doing a lot of penetration testing this one might focus too much on more basic things.

Any thoughts on those or similar ones which would fit in? Time and money should be considered as well. Currently not interested in any Cisco, MS, Checkpoint and similar certifications.
Last edited by UNIX on Wed Sep 01, 2010 1:11 am, edited 1 time in total.
<<

caissyd

User avatar

Hero Member
Hero Member

Posts: 894

Joined: Thu Dec 31, 2009 11:20 am

Location: Ottawa, Canada

Post Wed Sep 01, 2010 7:51 am

Re: Advice for next certifications wanted

Hi awesec,

GIAC Certified Penetration Tester (GPEN): Am I correct that I can't go for this exam through Pearson/ Prometric? Can you do self-study and go only for the exam?

I did GSEC without taking the course. I bought a few books, studied and wrote the exam. And yes, you have to register with Pearson/ Prometric for the exam.

If you only take the exam, it is $899. It comes with two practice exams that are quite representative of the real one. You can also buy other practice exams at $99 a piece.

What I did is I bought a practice exam and did it before even starting to study. It gave me a very good feeling of what I should be concentrating on. I then studied for about 3 months. I then bought the exam (you have up to 4 months between the purchase and the exam date). I did the first practice exam, studied another 2 weeks, did the other practice exam then I took the test.

It went pretty well for me!  :)

Also, OSCP is a very, very good course. Not too expensiveand very, very good. I encourage you doing OSCP next. I am doing the exam in 2 days!

Good luck!
OSCP, GPEN, GWAPT, GSEC, CEH, CISSP
(aka H1t.M0nk3y)
<<

dynamik

Recruiters
Recruiters

Posts: 1119

Joined: Sun Nov 09, 2008 11:00 am

Location: Mile High City

Post Wed Sep 01, 2010 8:06 am

Re: Advice for next certifications wanted

  • You can only get 30 days lab-time initially and add more 30-day increments as time allows. It's marginally more expensive that way, but it's not terrible. You can do a lot of self-study/home-lab work as well. I'd get 30 right off the bat and then add another 30 when you feel ready to really dive back into it.
  • A guy I know from Techexams.net just passed his and posted a pretty detailed write-up here: http://kimiushida.com/bitsandpieces/ram ... rack_wifu/ I haven't taken the exam yet, but I've gone through the materials, and his thoughts mimic my own
  • As mentioned, you can challenge any SANS/GIAC exam for $899, and you get two practice exams with that. With the questions in the practice exams, and the day-by-day break-down on the course page, you can do a pretty good job of prepping on your own. You can also bring in any resources you want (your notes, man pages for tools, etc.). You are correct that these are not offered at VUE/Prometric. I believe they use KRYTERION. The one I took my GSEC/GPEN at was a rickety old airplane hanger that felt like it would collapse when the trains and airplanes went by. The proctor was hot though, so it was totally worth it.
  • I personally haven't been too impressed with the EC-Council exams. I got the CEH because it's somewhat popular, but I'm going to focus my future efforts elsewhere. YMMV
  • Did you read Haddix's review of it? That should give you a pretty good idea. My manager, whom I consider to be a relatively competent pen tester, is loving this course. It's on my list after I wrap up the OSWP and OSCP (though I might squeeze it in before I update my PWB materials to v3)
  • CISSP!? ;)
Last edited by dynamik on Wed Sep 01, 2010 8:08 am, edited 1 time in total.
The day you stop learning is the day you start becoming obsolete.
<<

rattis

User avatar

Hero Member
Hero Member

Posts: 1172

Joined: Mon Jul 27, 2009 1:25 pm

Post Wed Sep 01, 2010 10:18 am

Re: Advice for next certifications wanted

awesec wrote:I'm wondering which certs to go after next, so any recommendations/ thoughts are welcome. Currently I'm holding Sec+, CEH and CCNA.

Some certifications I'm considering at the moment:

  • Offensive Security Wireless Professional (OSWP): The few reviews I read were all positive. Seems to be doable with little time as well. Only concern is about it's partly kind of outdated syllabus.

Any thoughts on those or similar ones which would fit in? Time and money should be considered as well. Currently not interested in any Cisco, MS, Checkpoint and similar certifications.


I haven't seen the material being outdated while going through it. The biggest issues I've had with it have been piecing together my lab, and finding enough time to actually read while taking notes.

What about something like the LPI (Linux professional Institute), Something Redhat, or GSEC?
OSWP, Sec+
<<

UNIX

User avatar

Hero Member
Hero Member

Posts: 1244

Joined: Mon Apr 28, 2008 9:20 am

Post Wed Sep 01, 2010 10:46 am

Re: Advice for next certifications wanted

Thanks for sharing your thoughts. OSCP is certainly something I'm going for, as well as OSCE (as well as AWE, when it becomes available as an online training :)). Only have to decide when this will be. Since those are pretty time intensive and need a good portion of one's attention, I don't want to rush through it in order to just get the certificate but rather really devote my time for it.

CISSP is another one which I'm certainly getting, however, I'm still lacking the 5 years security related experience at this point. So this one has to wait some more time before getting absorbed.

GSEC isn't that interesting for me, since I see it more as an entry-level based cert. GPEN seems to fit better for me. I only found one Kryterion center in my country, though I'd have to travel about 4 hours to get there. SANS generally have quite a few other courses I'd be interested in (GREM, SECURITY 709/ 580/ 660/ ...) but they are just too expensive at the moment for me paying out of pocket.

I read Haddix' review, yes, that's one of the reasons why I'm considering it. I'll see if I can get a closer look at it and decide then. I also read the review about the OSWP you linked, which also points out the somehow outdated material I'm little worried about it. Nevertheless it's probably a great course and worth the money (equipment is already available, so no problem at this part).

Didn't think about the linux related certifications, good point.

What do you think about this route:
OSWP > elearnsecurity > OSCP

Or better switch OSWP and elearnsecurity? Guess GPEN would have to wait then too.
<<

rattis

User avatar

Hero Member
Hero Member

Posts: 1172

Joined: Mon Jul 27, 2009 1:25 pm

Post Wed Sep 01, 2010 10:52 am

Re: Advice for next certifications wanted

@awesec

See I was thinking the G-certs were more like the cisco certs. You know, you have to have the basic one (CCNA) before you can take any of the other ones.

So I thought GSEC was a pre-req for GPEN.

As for OSWP being out dated. I keep forgetting that it's using BT3.

@dynamik

That link was great. Thanks
OSWP, Sec+
<<

ziggy_567

User avatar

Sr. Member
Sr. Member

Posts: 378

Joined: Tue Dec 30, 2008 1:53 pm

Post Wed Sep 01, 2010 11:21 am

Re: Advice for next certifications wanted

@chrisj

See I was thinking the G-certs were more like the cisco certs. You know, you have to have the basic one (CCNA) before you can take any of the other ones.

So I thought GSEC was a pre-req for GPEN.


None of the GIAC certs are requirement for another with the exception of the GSE. You must have certain pre-reqs complete before you can sit for the GSE. They've recently revised the requirements. It used to be GSEC/GCIH/GCIA with at least two gold.You can find information about the current pre-reqs at:

http://www.giac.org/certifications/gse.php#prereq

But any other GIAC certification can be taken at any time with or without any other certifications.
--
Ziggy


eCPPT - GSEC - GCIH - GWAPT - GCUX - RHCE - SCSecA - Security+ - Network+
<<

UNIX

User avatar

Hero Member
Hero Member

Posts: 1244

Joined: Mon Apr 28, 2008 9:20 am

Post Wed Sep 01, 2010 11:26 am

Re: Advice for next certifications wanted

@chrisj: I wouldn't mind if it was only about BT3 or 4. I am talking about the contents, which are mostly based on WEP only.
<<

rattis

User avatar

Hero Member
Hero Member

Posts: 1172

Joined: Mon Jul 27, 2009 1:25 pm

Post Wed Sep 01, 2010 11:39 am

Re: Advice for next certifications wanted

@awesec

I really don't see that as a problem. With the exception of 1 AT&T / 2-wire device, all the other wireless networks I pick up in my office park are WEP based.

I view them as potential clients  ;)

Get the cert, then use my laptop to track them down, then show them the problem with their network.
OSWP, Sec+
<<

KrisTeason

User avatar

Hero Member
Hero Member

Posts: 515

Joined: Sat Sep 08, 2007 7:48 pm

Location: /dev/null

Post Wed Sep 01, 2010 11:47 am

Re: Advice for next certifications wanted

What do you think about this route:
OSWP > elearnsecurity > OSCP

Or better switch OSWP and elearnsecurity?


I think your psyching yourself out going that route. If your a security consultant, I think the course that would best benefit you would be the OSCP course. Your time will play a factor when going through the material, and with the large lab, your bound to be busy. I would even recommend buying the 90 days just to get the more practice in!

You and I have the same feelings on the OSWP - I'm waiting for them to get some more WPA attacks in there before I take it, so I'd hold out on it. The positive with it and your schedule is being able to practice on your own router at your own leisure is a huge plus. Plus its an OffSec class so your bound to get that hands-on experience during the course and be forced to prove what you've learned on the exam.

eLearnSecurity - If you plan on taking this course, I'd suggest waiting til they've updated the content. I remember Jhaddix making a post in this thread telling Samurai to hold off on it:
http://www.ethicalhacker.net/component/option,com_smf/Itemid,54/topic,5991.msg31895/topicseen,1/#new

I'm in the class currently and I could see it's more aimed towards mainly a beginner to medium level experience range. I remember seeing something on here I believe where it says the course was for people with 0-3 years experience. Since you do some pentesting on your job already, I don't know how much the class would benefit you, I think you'd get a better in depth understanding on the web app attack stuff but you'd know the Network Security and System Security Modules.

@H1t Monkey - Good luck on your exam on Friday!
Last edited by KrisTeason on Wed Sep 01, 2010 11:48 am, edited 1 time in total.
eCPPT (Silver/Gold), eWPT, GSEC, GISP, GCIH, OSCP, OSWP
<<

dynamik

Recruiters
Recruiters

Posts: 1119

Joined: Sun Nov 09, 2008 11:00 am

Location: Mile High City

Post Wed Sep 01, 2010 12:00 pm

Re: Advice for next certifications wanted

awesec wrote:Thanks for sharing your thoughts. OSCP is certainly something I'm going for, as well as OSCE (as well as AWE, when it becomes available as an online training :)). Only have to decide when this will be. Since those are pretty time intensive and need a good portion of one's attention, I don't want to rush through it in order to just get the certificate but rather really devote my time for it.

CISSP is another one which I'm certainly getting, however, I'm still lacking the 5 years security related experience at this point. So this one has to wait some more time before getting absorbed.

GSEC isn't that interesting for me, since I see it more as an entry-level based cert. GPEN seems to fit better for me. I only found one Kryterion center in my country, though I'd have to travel about 4 hours to get there. SANS generally have quite a few other courses I'd be interested in (GREM, SECURITY 709/ 580/ 660/ ...) but they are just too expensive at the moment for me paying out of pocket.

I read Haddix' review, yes, that's one of the reasons why I'm considering it. I'll see if I can get a closer look at it and decide then. I also read the review about the OSWP you linked, which also points out the somehow outdated material I'm little worried about it. Nevertheless it's probably a great course and worth the money (equipment is already available, so no problem at this part).

Didn't think about the linux related certifications, good point.

What do you think about this route:
OSWP > elearnsecurity > OSCP

Or better switch OSWP and elearnsecurity? Guess GPEN would have to wait then too.


As far as the CISSP goes, you'll only need 4 years of experience since your Security+ drops a year off. Most people can scrounge that together with access controls and telecom/network security. You can also become an associate by passing the exam and then you'll become a full CISSP once you hit the experience requirements. It's a lot of material, so you might want to start working on it a little bit at a time. It sucks to work on exclusively *yawn*

I wouldn't recommend the GSEC to someone unless they were fairly new and had their company paying for it. I only did it because it's a GSE pre-req.

I'd do eLearn before the OSCP since it doesn't seem to be quite as involved. The wireless one can be fit in anywhere as it doesn't really have any bearing on the others. In between might make for a nice change of pace.

awesec wrote:@chrisj: I wouldn't mind if it was only about BT3 or 4. I am talking about the contents, which are mostly based on WEP only.


Right, I couldn't care less about the BT version. I want some more info on WPA/WPA2 and the various EAP types.

chrisj wrote:@awesec

I really don't see that as a problem. With the exception of 1 AT&T / 2-wire device, all the other wireless networks I pick up in my office park are WEP based.

I view them as potential clients  ;)

Get the cert, then use my laptop to track them down, then show them the problem with their network.



See, I've had the opposite experience. Nearly every business I work with has something stronger in place.

I've seen people do similar things and they are often not well received. Be sure to get permission before you actually do anything with their WAP.

xXxKrisxXx wrote:eLearnSecurity - If you plan on taking this course, I'd suggest waiting til they've updated the content. I remember Jhaddix making a post in this thread telling Samurai to hold off on it:
http://www.ethicalhacker.net/component/option,com_smf/Itemid,54/topic,5991.msg31895/topicseen,1/#new


Don't you get free updates? If so, I wouldn't use that as a reason to hold off. The only reason I recommended doing eLearn first is to really hammer the foundation home before doing the OSCP. The OSCP material is great, but they make a lot of assumptions with your previous knowledge. They don't teach you everything from the ground-up. I agree that the OSCP should be the end-goal.
The day you stop learning is the day you start becoming obsolete.
<<

KrisTeason

User avatar

Hero Member
Hero Member

Posts: 515

Joined: Sat Sep 08, 2007 7:48 pm

Location: /dev/null

Post Wed Sep 01, 2010 12:09 pm

Re: Advice for next certifications wanted

Don't you get free updates? If so, I wouldn't use that as a reason to hold off. The only reason I recommended doing eLearn first is to really hammer the foundation home before doing the OSCP. The OSCP material is great, but they make a lot of assumptions with your previous knowledge. They don't teach you everything from the ground-up. I agree that the OSCP should be the end-goal.


This was taken from eLearnSecurity's web site:
You purchased version 1.x and the update is still in the 1.x release. (This means that you're not entitled to receive 2.0).


We do get updates but I'm under the impression a major update is being done to the course. I didn't fully recommend it because it being at version 1.x currently and I'm currently confused if they're going to make this latest update version 2 of the course. Definitely agree with you dynamic, they don't teach you everything from the ground up, but I kind of auto-assumed awesec was ready for the course because in his first post he said he's a security consultant. I think the OSCP course would be the most beneficial for him right now, plus it's affordable. Main negative is time constraints!
eCPPT (Silver/Gold), eWPT, GSEC, GISP, GCIH, OSCP, OSWP
<<

impelse

Hero Member
Hero Member

Posts: 585

Joined: Mon Feb 16, 2009 3:40 pm

Post Wed Sep 01, 2010 1:32 pm

Re: Advice for next certifications wanted

I am a beginer in this field and I am taking the eLearnsecurity, it is good but in  your case with some exp go for OSCP, you will get more from that.
CCNA, Security+, 70-290, 70-291
CCNA Security
Taking Hackingdojo training

Website: http://blog.thehost1.com/
<<

UNIX

User avatar

Hero Member
Hero Member

Posts: 1244

Joined: Mon Apr 28, 2008 9:20 am

Post Wed Sep 01, 2010 2:39 pm

Re: Advice for next certifications wanted

chrisj wrote:@awesec

I really don't see that as a problem. With the exception of 1 AT&T / 2-wire device, all the other wireless networks I pick up in my office park are WEP based.

I view them as potential clients  ;)

Get the cert, then use my laptop to track them down, then show them the problem with their network.



Sure, many people are still using WEP, unfortunately. However, most corporates I'm dealing with implement stronger protection mechanisms, so my point of view is another one. Although doing it for the fun, I'm also expecting to get something out which aids me in my daily job.

Guess I'll see if I can get any information when offsec is going to update their course. :)
Also thanks for pointing out the eLearnSecurity update plans, Kris. Although I read it myself, I didn't think about this aspect. Since I'm in no hurry for getting the mentioned certs, it's fine for me to wait some more time.

@dynamik: Great to hear, didn't know about the 4 years nor the associate thing. I'll do some more research towards this one. :)
Last edited by UNIX on Wed Sep 01, 2010 2:41 pm, edited 1 time in total.
<<

don

User avatar

Administrator
Administrator

Posts: 4226

Joined: Sun Aug 28, 2005 10:47 pm

Location: Chicago

Post Thu Sep 02, 2010 9:01 am

Re: Advice for next certifications wanted

Hey chrisj,

I know you winked at the end of your 'potential clients' remark, but it is also worth mentioning that the business approach of finding security holes in wireless APs, then approaching the victim with a sales pitch is illegal. Even if you find some way around it, it's still rather unethical.

Be careful. Even if you're out there alone, you still represent us.  :)

Don
CISSP, MCSE, CSTA, Security+ SME
Next

Return to Security

Who is online

Users browsing this forum: No registered users and 1 guest

.
Powered by phpBB® Forum Software © phpBB Group.
Designed by ST Software