Hey all, I'd like to 1) share a free (while we're in beta) hands-on training resource that will hopefully be of immediate use to those of you just starting your journey and 2) get a feel for where you think there's the largest need in terms of infosec training + certification.
I run White Hat Academy, an infosec training group where we've begun developing a platform to provide hands-on, practical infosec training through a Codecademy-like interface. I'll name a couple things that are the initial focus, and would love to hear back if these are of particular interest or if you'd like to see something else:
-
web app security: we're building a course around *modern* web apps and the upcoming OWASP 2017 Top 10; nothing currently available covers the topics and technologies that most employers actually use and care about. In addition to courses/labs and challenges, we're planning to offer a new
practical certification focused on modern web app security; WAPT is outdated, OSWE is generally outdated + unavailable, and most other options are multiple-choice academic jokes. Given that wider industry recognition is a pre-req for a cert to become valuable (and we've already had a couple dozen employers sign on that this is a good idea), would this cert be of interest? Would you rather just have a monthly subscription to lots of guided practice + "hack this"-style apps?
-
junior pen testing (not web-specific): a lot of our students ask for extra guided practice to help them prep for more involved pentesting + typically the very "self-guided" OSCP. We're considering whether another more junior certification would make sense here as well. The eJPT/eCPPT are... okay, but not great. Would another more junior, practical pentesting certification be of use? Would you rather have more guided materials, a large array of more difficult practice challenges, something else as you prep and grow your pentesting chops?
- we're creating lots of "how to"-style written material + mostly focused on hands-on practice labs. I'm not big on learning tech from videos; it's too easy to tune out, and too difficult to keep the material up to date. Any strong feelings about the
form the content takes?
And getting back to point 1, offering the current resource available... To check out our prototype, which includes some basic content on hacking tool (metasploit, etc) as well as a lot of generally useful IT and scripting practice (bash, user permissions, etc), you can sign up for free at
https://ex.whitehat.academy - if you have any suggestions or run into any issues on the platform itself, please let me know. Thanks for any and all feedback!
