Stalking the CEH

SephStorm

Well, since i've decided to do what ive been putting off forever, i've finally decided to attack the ethical hacking part of my career (Bad pun intended.)

At this point I believe I will start with the CEH. ELS's student program will probable follow, we'll see what kind of timeframe I am looking at later. This thread will hopefully serve to chronicle my progress towards this exam, and hopefully keep me motivated and on track.

First and foremost, I am not looking at this point at ordering the official guide for financial reasons, and reviews of the material would seem to indicate that the money could go elsewhere.

So my first question is, what should be the first book that I should read? What kind of timeframe should I set for myself to master this exam material? should I look into an online hacking boot camp? I think I am firm on security knowledge at the Security+ level, and I have user level Linux knowledge, no programming knowledge.

Thanks in advance for your replies!

Bl8ckr0uter

Here is what I am using:

Network Security Bible Amazon.com: Network Security Bible (9780470502495): Eric Cole: Books

Hackers: The art.. Amazon.com: Hacking: The Art of Exploitation, 2nd Edition (9781593271442): Jon Erickson: Books

Hacking Exposed: Amazon.com: Hacking Exposed: Network Security Secrets and Solutions, Sixth Edition (9780071613743): Stuart McClure, Joel Scambray, George Kurtz: Books: Reviews, Prices & more

I plan to buy these:

Amazon.com: CEH Certified Ethical Hacker Study Guide (9780470525203): Kimberly Graves: Books

Amazon.com: Gray Hat Hacking The Ethical Hackers Handbook 3/E (9780071742559): Allen Harper, Shon Harris, Jonathan Ness, Chris Eagle, Gideon Lenkey, Terron Williams: Books: Reviews, Prices & more

Amazon.com: The Web Application Hacker's Handbook: Discovering and Exploiting Security Flaws (9780470170779): Dafydd Stuttard, Marcus Pinto: Books

I am also going to go through the elearn course. How soon do you plan on doing it? Do you meet the two year requirement?

SephStorm

I don't know when i'll be taking the test, but I am already studying now, with the skillports and the Graves study guide. I doubt I officially meet the two year requirement, but I wouldn't be the only CEH without it. I have an EC-Council cert and the Security+ which validates 1 year of experience, so I think i'll be fine with them, and I can get the letter.

Bl8ckr0uter

SephStorm wrote: »

I don't know when i'll be taking the test, but I am already studying now, with the skillports and the Graves study guide. I doubt I officially meet the two year requirement, but I wouldn't be the only CEH without it. I have an EC-Council cert and the Security+ which validates 1 year of experience, so I think i'll be fine with them, and I can get the letter.

Sec+ validates 1 year of exp? Do you have a link that shows that?

SephStorm

not officially, but per the comptia website: " it is recommended that CompTIA Security+ candidates have at least two years of technical networking experience, with an emphasis on security."

I guess its two years now, but anyway, if you buy into the validation of skills viewpoint, the Sec+ should, according to the vendor, validate two years of experience.

Chris:/*

I am doing the studies for CEH currently. I believe that Security+ shows you have a little more competency that 1 year experience in the field. I am also surprised at the lack of challenge I am having with CEH personally but that is more than likely because of my experience.

I would also add the CEH prep guide which is outstanding for preparing for the test. If you want videos the onlineexpert.com websites hacking exposed series is perfect for this test.

Bl8ckr0uter

SephStorm wrote: »

not officially, but per the comptia website: " it is recommended that CompTIA Security+ candidates have at least two years of technical networking experience, with an emphasis on security."

I guess its two years now, but anyway, if you buy into the validation of skills viewpoint, the Sec+ should, according to the vendor, validate two years of experience.

I don't know if they would buy this. You'll be going for it before I will so let me know what they say.

SephStorm

forgot to update this- SS

Well, I did say I would chronicle my progress, so a rundown of this week.

I started studying this week, and one of my primary resourses is the Graves study guide. I read chapters 1 & 2, and started on chapter 3. As always, it is amazing reading information on the information gathering stage of hacking, as you can see just what information is out there about your orginization, and sometimes, you yourself.

I don't think I have any major problems with this section except that I really didnt have a hard target to test, while technicly I can use any company for this phase, and indeed I used ARIN and whois to lookup a few, I feel that ultimatly you are gathering this info to prepare an attack, and I have no intention of hacking any of these companies (unless they pay me for it. ; ). I also looked at Hacking Exposed vol6, the corresponding chapter, but it went, I think, overboard for my purposes. Excellent for use when actually using against a target, not so much I think for study?

Chapter 3 is the Scanning and enumeration section. I am only part way through this section, but I decided to throw up some practical excercise here. I used the Heorot.net De-ICE live cd 100.1. Now this "lab" has only limited usefulness because it is designed, I think, with a specific purpose in mind. on purpose, it is not "metasploitable" and certain things have been "broken" to add a touch of difficulty.

So after setting up my lab as decribed in the forum post on Heorot, I started my test. I am most familiar with NMAP, so I fired it up and took a swing. (FYI, I have done the scenario before, but I acted, for the most part as if I had not. Besides, I had forgotten many parts.) I attempted to practice the scenario with a touch of realisim, so first I preformed a scan to see if the host was online, followed by a scan, with the timing set to 3 as an attempt at staying a quiet as possible. I descoved several open ports, and preformed version detection on them. (again, I think the CD comes into account here, but I know its part of the methodology.)

At this point, I had my first real question, how does a beginner know where to go from here? From my previous experience, I knew what port to look at first. A year ago, I didnt. So how would I know what ports to look at and how to attack them?

An any case, I continued the 100.1 excercise up until the priviledge escalation portion, because I was using a different version of BT, that didnt have the needed password list to complete the excercise, and I sure as heck didn't remember it. But one thing I made sure to do was look at the tools presented for each purpose. NMAP and Hydra (cmd-line) were the ones I used. I was unfamiliar with Hydra, so I looked it up. I used the instructions given by the tool to perform the excersise, I did a YT search, but the video I looked at used the GUI option, which doesnt really help you learn much I dont think...

anyway, today I want to finish Chapter 3 and perhaps move on to Chapter 4. We'll see what the day brings...

ibcritn

SephStorm I see your affiliated with the military if you have a .mil or .gov email you can sign up for the DoD classes offered through the Carnegie Mellon CERT they just added a 45hour video/lab training for CEH.

Therhino

ibcritn wrote: »

SephStorm I see your affiliated with the military if you have a .mil or .gov email you can sign up for the DoD classes offered through the Carnegie Mellon CERT they just added a 45hour video/lab training for CEH.

Do you have a link for this?

ibcritn

Therhino wrote: »

Do you have a link for this?

Check them out they have tons of training resources...it really is top notch since you get access to Labs. Link

SephStorm

Thanks for the heads up, previously all had seen was CISSP, CCNA Security, and Security+ stuff on there.

ibcritn

SephStorm wrote: »

Thanks for the heads up, previously all had seen was CISSP, CCNA Security, and Security+ stuff on there.

Yep. At the time I was actively taking the CISSP training, so I saw about 2 weeks ago they added CEH training. I have done about half the labs for the training and they are pretty decent. I recommend searching the library for Snort labs (as I didn't have IDS experience) Snort analysis was a big weak point for me, but I did find the way you read Snort rules to be similar to Cisco ACLs rules

SephStorm

I havent seen any nays, so ill post this: Shon Harris | Security certification, CISSP Exam Practices, Online Training, Risk Management

Computadora

Nice find, now we don't have to worry about providing our registration information to them for marketing reasons.

SephStorm

whoops, i put that in the wrong thread...