It's been about four months since I signed up for SANS SEC-542, Web App Penetration Testing and Ethical Hacking. My primary motivation for this particular course was due to my long-standing knowledge gap in the web applications area. If I'm to be configuring WAFs, load balancers, and IPS sensors, it would be highly beneficial to understand how applicable these tools are in defending against common web attacks such as XSS, CSRF, various injection techniques, etc..
To start off, I have no development background. I don't write JavaScript, Python, or PHP for a living in any capacity. I knew this would be a hindrance going in, but I have to face the music at some point in my career. I also don't have a web-layer mindset as I'm still very much more used to the packet-level, thinking in terms of addresses, ports, layer 4 headers, etc.. I figured this course would be a good stretch for me. The only thing in my background that would be of any help is some understanding of HTML from building my small websites over a decade ago.
542 follows a pentesting methodology: recon, mapping, discovery, and exploitation. There are lots of tools and lab exercises throughout the class. The instructor (Kevin Johnson) used SamuraiWTF as the basis for the lab work. He's one who created SamuraiWTF after all, so who better to present the material. The OnDemand course I took had lots of his stories, opinions, anecdotes, as well as the usual drinking-from-a-firehose flood of information one would expect from any SANS course. There's a lot to absorb and if you come from a network infrastructure role like I do, it can get pretty overwhelming.
I typically go through a SANS course within a few weeks and follow-up on the GIAC exam a month later. In my current job, I have much less time to devote to continuing education so it took me practically the entire four months of my available OnDemand time to get through it, plus prepare for the exam. And for someone like me who isn't used to thinking in terms of HTTP, AJAX, database queries, and web services, it was painful. I must have listened to the MP3 sets at least four times through during my commutes and it still wasn't sinking in as much as I wanted it to.
The course touches upon scripting languages such as JavaScript, Python, and PHP so one can recognize the basic structure when looking at page sources or examining content through an interception proxy. While I believe this is a crucial / mandatory skill for a web app pentester, 542 doesn't really expect you to become a developer or even a competent scripter from this class alone. It's not intended to make you a coder.
The class did open my eyes to and clarify many aspects of web applications which were either previously vague for me or unknown, such as SOAP, JSON, AJAX, Flash / ActionScript, same origin policy, etc.. My understanding on these areas are more refined now and if I'm at another con where people are talking about them, I'll at least have some idea of the conversation context.
But this course will not turn anyone into a pentester overnight. If you're completely new to web security, you're not going to come out of the class ready to perform professional vulnerability assessments for clients. I just passed the GWAPT exam and even I wouldn't hire myself for such a job. However, I think the material in 542 is pretty solid and covers a wide range of topics which are important for knowing how to approach such work.
The exam itself was the newer 2-hour, 75-question format. Unlike previous GIAC exams that I've taken, many of the questions in the new format will require some thought and analysis to answer correctly. There are a few which you could reference in the course materials, but a lot of them require the examinee to put together adjacent learned-subjects to formulate the right path. This is a welcome change.
Another change in the new format is that the counter representing questions answered correctly / incorrectly are only updated every fifteen questions, unlike previously where it updated after every question, forcing someone like me to keep a hawk-eye to check my progress after every answer submission to gauge my exam survival rate.
I finished the GWAPT exam in a little over an hour and I barely squeaked by the ninety-percent mark with a total of 90.67%. Before taking the exam, I had a strong feeling that I could easily fail this one as I've heard from others that the practice exams and the real ones were noticably different in difficulty. I got 93% on the one practice exam I took a few nights before. This was the first time where I did worse on the real exam compared to my practice version. However, there were some very good questions on both the practice and live exams that really made one pause and analyze the screen output. I felt these were the type of questions worthy of being on GIAC exams. There were a few which were way too obvious what the answer was, but overall the quality of questions seemed to have improved. Either that or web app stuff just really challenges me, even if it's first-grade level stuff.
Another thing to keep in mind is that in a few days (as of this writing), GIAC exams will no longer be done through Kryterion, but rather Pearson VUE.
I still think there is no substitute for actually "doing" the work and being able to demonstrate it. For this reason I think Offensive Security's approach to testing is much more realistic, although there's a place for SANS-style instruction. There's also an advanced version of 542 (642) which comes out soon:
https://www.sans.org/security-training/advanced-web-app-penetration-testing-ethical-hacking-5036-tid
Although I'm no pentester, I still think I got a good deal out of 542. Going through it hurt, but I somehow made it. It took quite a bit of mind-numbing persistence to stay focused as a lot of the material didn't click naturally for me, but that's just a shortcoming I have to deal with. For the moment, I'm really, really SANS / GIACed out. This is my fifth GIAC cert and instead of going for another cert, I need to read normal infosec books and spend more time applying knowledge that I've learned in all these courses. Otherwise it's going to evaporate quickly.
