unicityd

Rattis,

What kind of work are you doing or trying to do? Your plans seem to be split between technical certs on the one hand (GCIH, CWNA/P) and physical certs on the other (PI license, ASIS, locksmithing).

I’m finishing up my master’s degree this year. No immediate plans for additional certs.

For 2015, my goal was to get the EnCase Certified Examiner (EnCE). I got it this summer.

I’m of the same mind as Hayabusa. The CEH is a good first step and will help you get past HR. The eLearnSecurity and Offensive Security certs are more technical (based on feedback from others) and the SANS certs are also supposed to be very good (as is the accompanying training) but they’re expensive. If you’re getting into network pen…[Read more]

It might help if you provided more information about what exactly is going on. How are you being harassed? Do you need to identify the culprit or would you be happy to stop the harassment by doing more to protect your online presence? Do you have some real-life ideas about who this might be? Have you contacted an attorney?

I don’t know how…[Read more]

I’m doing EnCase training in 2015 and am going to try to schedule Forensics I, II and the EnCe review so that I can test for the EnCe before the end of the year. I’m also trying to finish my master’s degree. I’m not sure if I’ll graduate in 2015 or 2016; it depends.

rattis: Congrats on the degree!

I think the actual pen testing part of your question has been well answered. If you’re motivated to improve your scripting skills, you should check out Code Academy. It has free online interactive tutorials for several languages. If you just want to be able to do basic scripting/automation, the Python tutorials should serve you well. If you’re…[Read more]

I don’t think there is any cert that employers will want to see on account of your being from the UK. You just need to look at what would be helpful to any pen tester for getting hired.

I don’t know what employers look for in the UK, but in the US the CEH is probably the most widely recognized pen testing cert. It’s supposed to be relatively…[Read more]

I loved the original TCP/IP Illustrated volume I, but it is dated now. The new edition, which m0wgli linked to, has been updated quite a bit but the work was done by a new author and I don’t know how well it holds up to Stevens’ original.

The TCP/IP Guide is awesome and I used it pretty frequently in my last job. But, I’d already read TCP/IP…[Read more]

I don’t know what “comes naturally” after the OSCP, but there are several other certs that may be useful to you. The CEH is beloved by HR folks and may be good for passing paper screenings. Most actual penetration testers will be more impressed by the OSCP but the HR people may not know what that is.

If you want to work for the U.S. government…[Read more]

Congrats.

Start by building up your knowledge of system administration and networking. You can’t do much with penetration testing without understanding the systems and networks that you want to attack.

Look for an introductory book on Linux. Install Linux on a spare computer or virtual machine (look up VMware). Play. Learn to use the system. Install…[Read more]

@zaixer wrote:

After search I found answers:

Answer here:
https://www.corelan.be/index.php/forum/exploit-writing-win32-stack-bof-direct-ret/question-about-esp-in-tutorial-pt1/

That’s a pretty long thread. Which posting(s) answered your question?

I’m a manager not a pen tester so my needs may be different. I still do some pen and paper note taking, but I’m trying to get away from it. I always end up with stacks of unorganized notes and I can’t get to them if I’m not in the office. Lately, I’ve been using OneNote for my meeting notes and ToDo lists.

For projects, I don’t limit myself to…[Read more]

I used the cccure questions and the Shon Harris practice test book. Both were okay for testing myself on facts and definitions, but they were not very much like the real exam. The exam questions were conceptual questions that wanted to know the best answer, first step, most important, etc. Some of them (hopefully the experimental ones) were…[Read more]

@zaixer wrote:

Hi all,

1-the EBP address is lower than the ESP although it should be higher than it. as per my knowledge ESP should be at the lowest address !

You need to look at the target source code (or step through the executable). Where in the code execution are you? Since EIP is 0x42424242, it looks like your function has just returned.…[Read more]

1. Are you on-board with what we may have to do?

I trust you to make whatever changes are necessary.  It’s not like other sites don’t change.

2. How extensively do you use PMs through our forums?

Not very.  I probably haven’t sent a PM in six months.

3. who’s interested in Blogging for EH-Net?

Maybe.  I’ve been blogging on my own site for a…[Read more]

Degrees and certs are both used as screening tools.  If you don’t have what they’re asking for, your resume may get tossed.  In general, I think degrees are more valuable, but there are cases where a cert will win out; for instance, a CCIE is probably more valuable to a network engineer than a degree.  The ideal move, however, is to get a de…[Read more]

I just wanna learn to write some exploits with c

An exploits has two parts: there is a dropper/delivery program that can be written in C, Python, etc.  That is not complicated to write.  The real trick is finding the vulnerability, figuring out how to exploit it and developing the shell code.  You won’t be able to do much without learning some as…[Read more]

If you’re still interested in Python, I recommend “Practical Programming: An Introduction to Computer Science Using Python”.

http://www.amazon.com/dp/B00A32NYK8/ref=rdr_kindle_ext_tmb

You may also want to check out Zed Shaw’s “Python the Hard Way”; just Google for it.  He runs the site Programming Motherfucker.  It has a lot of good r…[Read more]