I just received confirmation that I have passed the 7-day eLearn Security web application penetration testing challenge and have officially been awarded the eWPT. And after taking both this and OSCP...I feel like I should compare the two...since it was not at all what I had expected.
COURSE MATERIAL:
- Offensive Security's course material consists of a large PDF document and a series of videos
- eLearn Security's course material consists of a series of slide shows and a series of videos
WINNER??? - eLearn Security
I think that eLearn's course material was better presented and easier to digest. The slideshow approach was more straight to the point without the extra fluff.
LABS:
- Offensive Security offers a massive playground with 50+ systems of all different configurations. Don't expect any guidance here...TRY HARDER.
- eLearn's labs are very focused. Launch a single system sandbox and perform a very focused task. You know what you are going to be doing going into it, and you just have to master that one thing. You need guidance...just keep "asking Cicero" for tips and he will eventually tell you exactly what you need to do to complete the challenge. Don't worry about trying harder...instead, TRY ASKING FOR HELP...
WINNER??? - Offensive Security
Personally, I think that OffSec, though more frustrating...does do a better job of preparing you for the challenge. Its tempting to click for help when you are frustrated...and the fact that its there, will probably hurt you more than help you.
CHALLENGE EXAM:
- OSCP is a 24 hour challenge with an additional 24 hours allowed for reporting. In the end...the OSCP challenge is NOT NEARLY as difficult as some of the boxes in the OffSec PWB/PWK lab environment.
- eWPT is a 7 day challenge with an additional 7 days available for reporting. In the end...the eWPT challenge is SIGNIFICANTLY harder than anything you did in the lab environment. Though you have covered everything needed to pass the exam, the only time you will string the exploits together (instead of working with them in an isolated sandbox) is during the challenge. If you mastered each of the objectives, you can probably pull it off...but it will be difficult. The 7 day reporting period is overkill...I had my report turned in after 2 days.
WINNER??? - ITS A TIE
The eWPT exam is (at least in my opinion) significantly harder than the OSCP exam was. But then again, you also have a lot longer to do it. I think they were probably equally difficult given the amount of time you are provided. I passed both on my first attempt, but both were down to the wire (only had 3 hours left when I completed OSCP, and down to the last day on eWPT).
FINAL VERDICT:
Despite what I have commonly heard...eLearn's training is definitely not inferior to OffSec's. Its a different approach to learning, but all-in-all, each provides you with enough to get you going. And you aren't going to pass either without some serious persistence. Both are awesome courses. Also, they are very different courses. eWPT is only on Web-Apps and OSCP is almost exclusively on service testing (a very small intro to web-apps). There is no appropriate order here. One is not harder than the other. So take what interests you more...or take them both
Hope this helps...
