.

Finally took the plunge, started 08/05/12

<<

dbest

Jr. Member
Jr. Member

Posts: 79

Joined: Thu Jun 23, 2011 1:14 pm

Post Sat Aug 11, 2012 12:10 am

Re: Finally took the plunge, started 08/05/12

satish.lx wrote:I don't know why every bufferover flow document talking about 32bit OS exploit (EIP, ESP etc..)

I didn't find any single document about 64bit OS exploit (RIP, RSP etc..) Because it has totally different register set..


Slightly off-topic, but I suppose this may help:
http://turkeyland.net/projects/overflow/index.php
CISM, CEH, CISA, ISO 27001 LA
<<

YuckTheFankees

User avatar

Sr. Member
Sr. Member

Posts: 332

Joined: Fri Apr 08, 2011 3:07 pm

Post Sat Aug 11, 2012 1:04 am

Re: Finally took the plunge, started 08/05/12

thank you for the link!
OSCP in progress
<<

sh4d0wmanPP

Newbie
Newbie

Posts: 42

Joined: Sat Aug 11, 2012 6:42 am

Post Sat Aug 11, 2012 7:55 am

Re: Finally took the plunge, started 08/05/12

Right now I have not signed up and am studying many different attacks and the theory behind it. However I feel overwhelmed as well since there is so much to cover.

Besides reading many of the papers mentioned here I practise as well on smashthestack.org (mainly IO). There are many different challenges that expose you to the various types of vulnerabilities, helps you to identify them and gives you an understanding how to exploit them in a timely manner. Of course I document everything and write my own little scripts or code where I need it. You never know when you need it again.

I struggle a bit with GDB as I am used to Immunity, Olly or IDA. Yeah yeah, I am a Windows guy hehe.

There is cheatsheet worth printing:
darkdust.net/files/GDB%20Cheat%20Sheet.pdf

And of course an Intel Assembler 80x86 one:
http://www.jegerlehner.ch/intel/

Anyway it is a good prep for the OSCP cert I think. Will be signing up after OSWP. Good luck everybody  :)
EXIN ISO/IEC 27002: ISF & ISMAS, ITIL Foundation, Comptia Security+, CCNA, CCNA Security, Wip: OSWP
<<

YuckTheFankees

User avatar

Sr. Member
Sr. Member

Posts: 332

Joined: Fri Apr 08, 2011 3:07 pm

Post Sun Aug 19, 2012 7:10 am

Re: Finally took the plunge, started 08/05/12

Update: Today will be my 16th day with the course and so far the course has met my expectations. I have currently put 42 hours into the course and I am happy to say I have gained root on 5 boxes so far . Every time I gain root on a system, my confidence in the lab goes up ten fold. Given, they might not of been the hardest systems in the vulnerable network but never-the-less, I have learned SO MUCH in the last 2 weeks.

At this point in time, I am thinking about taking the OSCP exam somewhere near the end of September/beginning of October.
OSCP in progress
<<

shadowzero

User avatar

Full Member
Full Member

Posts: 120

Joined: Sat Jun 02, 2012 10:03 pm

Post Sun Aug 19, 2012 8:16 am

Re: Finally took the plunge, started 08/05/12

YuckTheFankees wrote:Update: Today will be my 16th day with the course and so far the course has met my expectations. I have currently put 42 hours into the course and I am happy to say I have gained root on 5 boxes so far . Every time I gain root on a system, my confidence in the lab goes up ten fold. Given, they might not of been the hardest systems in the vulnerable network but never-the-less, I have learned SO MUCH in the last 2 weeks.

At this point in time, I am thinking about taking the OSCP exam somewhere near the end of September/beginning of October.


Make sure you leave time to write the report before taking the exam.
<<

YuckTheFankees

User avatar

Sr. Member
Sr. Member

Posts: 332

Joined: Fri Apr 08, 2011 3:07 pm

Post Sun Aug 19, 2012 8:34 am

Re: Finally took the plunge, started 08/05/12

Thanks for the advice, the report has already been on my mind. I've read from multiple reviews that the final report is hundreds of pages...
OSCP in progress
<<

Jamie.R

User avatar

Sr. Member
Sr. Member

Posts: 435

Joined: Mon Aug 06, 2012 9:57 am

Location: UK

Post Sun Aug 19, 2012 8:41 am

Re: Finally took the plunge, started 08/05/12

Just a question is the lab you practice in the same as the exam or are you given another lab ?
| OSWP | eCPPT Silver and Gold | eWPT |

I'm an InterN0T'er
<<

YuckTheFankees

User avatar

Sr. Member
Sr. Member

Posts: 332

Joined: Fri Apr 08, 2011 3:07 pm

Post Sun Aug 19, 2012 8:51 am

Re: Finally took the plunge, started 08/05/12

The exam is not given in the same lab you practice in.
OSCP in progress
<<

sh4d0wmanPP

Newbie
Newbie

Posts: 42

Joined: Sat Aug 11, 2012 6:42 am

Post Sun Aug 19, 2012 9:55 am

Re: Finally took the plunge, started 08/05/12

Do I understand correctly that you have to create 2 reports? One for the student network that you exploit and one for the actual exam?

If so, does not owning all boxes on the student network have an impact on your final grade?

I wish you can clarify this for me.
EXIN ISO/IEC 27002: ISF & ISMAS, ITIL Foundation, Comptia Security+, CCNA, CCNA Security, Wip: OSWP
<<

Jamie.R

User avatar

Sr. Member
Sr. Member

Posts: 435

Joined: Mon Aug 06, 2012 9:57 am

Location: UK

Post Sun Aug 19, 2012 10:07 am

Re: Finally took the plunge, started 08/05/12

great question i would like to know the answer too that too
| OSWP | eCPPT Silver and Gold | eWPT |

I'm an InterN0T'er
<<

YuckTheFankees

User avatar

Sr. Member
Sr. Member

Posts: 332

Joined: Fri Apr 08, 2011 3:07 pm

Post Sun Aug 19, 2012 10:11 am

Re: Finally took the plunge, started 08/05/12

@sh4d0wmanPP ,

I haven't looked to far into the final reports but I would think they would be 2 separate reports. I don't think they would want your lab info mixed in with your final report? But I do not know for sure.

The number of systems you own during the lab will have not hinder your OSCP grade.
I have heard of some people only owning 8 systems and taking the test, but I have also heard about people owning 30-50 systems.
OSCP in progress
<<

UNIX

User avatar

Hero Member
Hero Member

Posts: 1244

Joined: Mon Apr 28, 2008 9:20 am

Post Sun Aug 19, 2012 10:22 am

Re: Finally took the plunge, started 08/05/12

Jamie.R wrote:Just a question is the lab you practice in the same as the exam or are you given another lab ?


The lab environment for practicing and the exam environment are two different ones. Also, it's not a must to document how you owned machines in the practice lab, but recommended. If you are on the edge between pass and fail of the examination, you might have better chances to pass with a report that also contains your efforts in the practice lab environment.
<<

hayabusa

User avatar

Hero Member
Hero Member

Posts: 1662

Joined: Mon Jan 29, 2007 2:59 pm

Post Sun Aug 19, 2012 10:38 am

Re: Finally took the plunge, started 08/05/12

As for the report, I combined mine (but had separate sections.)  My lab notes were an appendix to the exam report.

I don't know what was considered 'proper', but that was how I did it.
~ hayabusa ~ 

"All men can see these tactics whereby I conquer, but what none can see is the strategy out of which victory is evolved." - Sun Tzu, 'The Art of War'


OSCE, OSCP , GPEN, C|EH
<<

cd1zz

User avatar

Recruiters
Recruiters

Posts: 566

Joined: Sun Oct 03, 2010 9:01 pm

Post Sun Aug 19, 2012 1:28 pm

Re: Finally took the plunge, started 08/05/12

My report was combined as well. It was only 78 pages.... not hundreds... :)
<<

YuckTheFankees

User avatar

Sr. Member
Sr. Member

Posts: 332

Joined: Fri Apr 08, 2011 3:07 pm

Post Sun Aug 19, 2012 1:31 pm

Re: Finally took the plunge, started 08/05/12

Thanks for the info guys. My bad, I read one review where the guy said his report was 350ish pages, that's crazy to me...
OSCP in progress
PreviousNext

Return to OSCP - Offensive Security Certified Professional

Who is online

Users browsing this forum: No registered users and 2 guests

.
Powered by phpBB® Forum Software © phpBB Group.
Designed by ST Software