ECSA review

Zaff1990

Hi Mike, currently i am taking ECSA course. I already finished all the challenges except the last one in challenge 5 which is to find the password of arnold. I did run cain and abel but somehow not discovered for the password. Appreciate your assistance if you can give any clue on this.

Mike7

Zaff1990 wrote: »

Hi Mike, currently i am taking ECSA course. I already finished all the challenges except the last one in challenge 5 which is to find the password of arnold. I did run cain and abel but somehow not discovered for the password. Appreciate your assistance if you can give any clue on this.

Please email aspencert@eccouncil.org with your questions. They were awesome!

infosyntex

Dear Mike,

I find out all the alive host in three subnets configured in ECSA iLabs as per challenge 1 requirement but the problem is 2 of the challenges asked to peform explitation on the machine named XXXXX but the information I gathered durring the reconnaisance have no machines by these names. What should I do? Should I contact the Support in ECSA Dashboard or work with the information I have?

batrebios

Hi Guys, Im creating my report for ECSA. I need help from your master who know about the report.

What should i write on :
1.4 Final Report Delivery date
4 Result Analysis
5 Recomendation (because i put all the recommendation on each challange)
6.1 Required Work Efforts
6.2 Research

Where should i put about the CVE ?

Thank You in Advance

batrebios

infosyntex wrote: »

Dear Mike,

I find out all the alive host in three subnets configured in ECSA iLabs as per challenge 1 requirement but the problem is 2 of the challenges asked to peform explitation on the machine named XXXXX but the information I gathered durring the reconnaisance have no machines by these names. What should I do? Should I contact the Support in ECSA Dashboard or work with the information I have?

Hi There, you may restart first your lab and try to scan again. some time i experience the issue and restart solved my problem. if the issue still exist, you may need others tools to get the name. Hope can help.

[Deleted User]

In all honesty, if you guys need to reach out to a forum to get help with E|CSA, this is not the course for you and you need a lot more reading/practice. I'm taking the E|CSA practical part now and after only 15 days and about 7 of those days I didn't do anything, I got enough points to pass the practical part. It is not that hard to pass. Use the C|EH methodology and you will pass. Reference your E|CSA material and videos and i'm sure you will pass. You just need to think and not give up. Do not message me asking for help as I will not give it.

higherho

Submitted my ECSA pen test report this past Friday. The challages were not that hard. Especially considering when you can crack the box multiple ways (as long as the challenge doesn’t say it has to be a specific way). I did need to take some time on the sql / xss one but when it dawned on me, then I ran through it quickly. The damn report itself took my 9 hours to do. Freaking getting all my screenshots right and explanation for each one of my steps took the longest.

My picture on the very first page of the report was creative a little bit. I was in a game of thrones mood so I did something along that nature haha. After this, I’m going for my OSCP. Fun times ahead!

higherho

Passed the pen test report / challenges Going to take the exam in like two weeks or so.

muhammadbahgat

i have a question in challenge #10 can any one help me i use sqlmap but no result ????

[Deleted User]

Passed the practical part of ECSA. Planning on taking the written exam before end of year.

muhammadbahgat

what is the explite u use in challenge # 10 can you help me

Mike7

muhammadbahgat wrote: »

what is the explite u use in challenge # 10 can you help me

Please email aspencert@eccouncil.org with your questions. They were awesome!

You can also provide your LinkedIn URL.

Mike7

kMastaFlash wrote: »

Passed the practical part of ECSA. Planning on taking the written exam before end of year.

Congrats!

moudane

Hi guys,

Well I finished my lab time a couple of months ago but did not complete enough challenges to get the required 70 points especially those with 10 points. Maybe I will extend it and try again because I was really tired and gutted .

Wish all candidates luck !!!

faiz1977

I have Finish all my Labs Challanges in 21 days...Preparing my report. Just wanted to know if I need to close the training labs also .. As I found them very basic and step by step . So it is mandiatory to complete the practise sessions also since I have days remaining can work on them .. and close them.

[Deleted User]

To anyone who has taken the ECSA multiple choice exam, how did you find it? Was it a hard exam? Anything in particular to study? Thanks. Trying to make this my last cert for 2017! Took the practical exam and passed just need to take the MCQ exam soon or my voucher will expire! Exam is booked for 12/30.

Mike7

With you hands-on knowledge, the exam should be a walk in the park.
Anyway, read the course materials and good luck for the exam.

den2017nick

Hi All,

couple of of quick things:

1) I cannot download ECSA_Assignment.pdf for some reason, I am assuming this file will mention networks to scan for Challenge 1, otherwise how did you did you guys figure out 172 and 10 networks??? I did raise a ticket on this with eccouncil

2) Also my Day 1 labs seem to expire in 12 hours, is that normal? I thought we had 30 full days?

Thanks

den2017nick

Hi Mike,

i would appreciate some some insight on hydra as I have used the wordlists provided and adjusted the -t switch but still nothing. Thanks

Mike7

@den2017nick

Private LAN IPs are in the 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16 subnets as per RFC1918.

Your labs are turned off/suspended once you exit your browser. If you read my review, I used custom nmap switches to speed up the scanning.

If in doubt, you can use Wireshark to investigate the network traffic. The tool you use may not be working or may be dropping connections among other things.

I actually guess correctly one of the passwords.

There are more than enough clues in this thread. Do the other challenges and do some reading and research.

dkorzhevin

Also working on this exam (labs + challenges). Labs are pretty straightforward, with typos in commands

Zaff1990

I already submitted the ECSA report and got the exam voucher on last month. Now planning to take the exam.

All the best to all ECSA candidates!!!

Elegyx

It took me 14 hours to scan 172.16.0.0/12 (even with the switches which I won't give away but they're are online) and so hopefully they can reset my first challenge. I thought we had 30 days to do this?

dkorzhevin

Elegyx wrote: »

It took me 14 hours to scan 172.16.0.0/12 (even with the switches which I won't give away but they're are online) and so hopefully they can reset my first challenge. I thought we had 30 days to do this?

You have more than 1 subnet. What you mean by "I thought we had 30 days to do this" ?

ECC gives you 30 days in total, you can complete challenges in own order or one by one, no matter.

Elegyx

dkorzhevin wrote: »

You have more than 1 subnet. What you mean by "I thought we had 30 days to do this" ?

ECC gives you 30 days in total, you can complete challenges in own order or one by one, no matter.

I understand that part but there's an actual time limit (14 hours) for the first assignment. When you start scanning 172.16.0.0/12 it's taking long so after the 14 hours are up it says "if you exit your lab will be deleted or you can mark it as complete." Welp, I'm not either of those. Also another note. When you're doing these scans of an entire subnet which is naturally going to take forever, I'm getting a message after a while that says "do you want to resume the lab." I have a feeling that the scan is stopping after that message pops up on the screen.

dkorzhevin

Elegyx wrote: »

I understand that part but there's an actual time limit (14 hours) for the first assignment. When you start scanning 172.16.0.0/12 it's taking long so after the 14 hours are up it says "if you exit your lab will be deleted or you can mark it as complete." Welp, I'm not either of those. Also another note. When you're doing these scans of an entire subnet which is naturally going to take forever, I'm getting a message after a while that says "do you want to resume the lab." I have a feeling that the scan is stopping after that message pops up on the screen.

After 14 hours you will be able to re-start lab, for another 14 hours, but from scratch. You should be able to speed up scanning with nmap, using options.

Even 12 hours is more than enough for whole subnet scan with nmap.

xxxkaliboyxxx

Elegyx wrote: »

I understand that part but there's an actual time limit (14 hours) for the first assignment. When you start scanning 172.16.0.0/12 it's taking long so after the 14 hours are up it says "if you exit your lab will be deleted or you can mark it as complete." Welp, I'm not either of those. Also another note. When you're doing these scans of an entire subnet which is naturally going to take forever, I'm getting a message after a while that says "do you want to resume the lab." I have a feeling that the scan is stopping after that message pops up on the screen.

Hi Elegyx,

I'm not taking this exam, but a couple of options to make your scan faster could be;

1. Use the "-T" flag to speed up your scans
2. Once you know which host are live, use the "don't ping flag" in nmap, I think it's -pn or something like that
3. Use a different tool that scans faster than nmap just to see which host are "alive" and then narrow down you options in nmap, see above. Some other scanning tools like MassScan or Angry IP scanner.

Hope this helps

Elegyx

Thanks for the advice all! Feel a little better now knowing that I can still restart a lab even if the timer is up (at least for the next 29 days and counting).

minhnt

have you finished challenge 5. Bruteforce not effect

dkorzhevin

xxxkaliboyxxx wrote: »

1. Use the "-T" flag to speed up your scans
2. Once you know which host are live, use the "don't ping flag" in nmap, I think it's -pn or something like that
3. Use a different tool that scans faster than nmap just to see which host are "alive" and then narrow down you options in nmap, see above. Some other scanning tools like MassScan or Angry IP scanner.

1. You should use something more than -pn and -T flags to scan faster. I found many useful options in official docs (man page)
2. I believe, that all servers reply to ICMP queries.
3. MassScan - cool thing, but nmap should be more than enough Regarding Angry IP - I'd suggest not look at windows tools at all, not waste time and stick with Kali toolset only.