Pentesting Studies, CTF, and other Prep work for OSCP

dstock7337

Hello All,

I have started preparing for OSCP and transition from being a systems engineer into a security engineer/analyst, specifically performing vulnerability assessments, pentesting, and mitigation strategy.

As part of my studies for my Master's degree, I participated in my first CTF, National Cyber League, which had schools across the country participating. I figured that this would help me better gauge what I would be getting myself into.

Given the cost of labs and exam with OSCP, I wanted to do as much prep work before going into it. This way I figured would help me make better use of my time during that window and have a better shot at passing the first go around.

I had already been self-studying CEH with CBT nuggets, Cybrary, my personal lab, and several books I've obtained covering the material. In addition, the NCL had hands on labs giving a taste of doing a pentest before the actual games had started. On top of that, the NCL provided a pre-season to get a taste of doing the challenges, which I was successful on and placed into the silver bracket. Given these things, I had some tempered confidence that I would do good with most challenges and some that I would have difficulty with.

That confidence deflated the in the first game. It hit me in the face and hard. It was even more challenging than I had thought. By the end, I still placed into the upper 35% but I knew I had a lot more learning to do.

I really seemed to struggle with Web app exploitation, specifically dealing with SQL injections and footprinting what type of DB it was running.
Nevertheless I've taken those lessons learned and have a better idea on what to focus on with self-studies.

Seeing that I'd like to avoid experiencing another big eye-opener/slap in the face with OSCP, I'd like to know what you all have used to prepare for the OSCP.

Thank you!

TheFORCE

I'm doing the PTSv3 which gives you a voucher for the eJPT (Junior Penetration Tester). It takes you through a step by step process of where to start and what to look for without actually giving you all the hints. Like, find X server but only use x tool and y tool. Then you are suppose to use the tools to do certain tasks so you can find info to access the server. It's pretty interesting, at least for me, not having any prior pen testing experience but having IT experience, i still find it really interesting. They have about 12 labs i think and each one is different, the modules are short but should provide you enough to create a methodology on how to attack a target. The other certifications like the eCCPT are a bit more advanced but i think these are good foundations for the OSCP. Step by step to climb the ladder.

edit: forgot to mention "vulnhub" they have plenty of VM's that you can try to exploit and a lot of people post their way of attacking in various guides in case you get stuck.

BlackBeret

This book - https://www.amazon.com/Penetration-Testing-Hands-Introduction-Hacking/dp/1593275641
Over the wire - OverTheWire: Wargames
Vulnhub - https://www.vulnhub.com/ (Conduct a Google search for vulnhub and OSCP to find ones similar to lab/exam boxes).
The metasploitable project is a good resource to check out too.

dstock7337

Thanks for the info TheFORCE and BlackBeret! I'll check them out.

xXxKrisxXx

One of the best resources for PWK preparation today on the web is https://www.cybrary.it/course/advanced-penetration-testing/. Georgia is an OSCP and she's incorporated a lot of material that is inside of it into this free course on Cybrary.

dstock7337

Thanks! I recently started using Cybrary and I like it a lot.

Offtopic

I have exactly same problem - how to gain some hands on experience quickly to get exposure to InfoSec tools. Some of the tools i wanted to see in action include Firewalls Load Balancer DLP Pen testing tools etc.
I have contacted several individual trainers, training colleges, quick training institutes etc. i have even contacted several institues in other countries.
It has been very frustrating. i am unable to find any source that can provide me quick access to above for few hours.
I am sure there must be. Irtial networks somewhere that can be used to get a good practical introduction to Information Security.
But where are they?

McxRisley

Offtopic, You don't need to call institutes and pay for courses and time. You can setup your own home lab like everyone else and learn that why, there are several free and affordable courses that will give you hands on experience. The recommended course above from cybrary.it is a good one but you will have many problems with it since it is a bit dated. There are a few courses on udemy.com that are much better for this and will actually work properly, "Learn ethical hacking from scratch" is a great course and will teach you all of the basics. The instructors name is zaid. I hope this helps.

Offtopic

McxRisley
Thank you very much for pointing some of the resources. I will certainly check them out.