security.crudtastic.com

SANS is bringing world-class training to Queensland for SANS Brisbane 2010 on 24-29 May! (http://www.sans.org/info/54773) Why not choose the beauty of the city along the Brisbane River as the backdrop for your training? Register by 14 April to receive the best savings on the following courses:

- Security 401: SANS Security Essentials Bootcamp Style (GSEC) taught by Mark Hofman, SANS Certified Instructor

- Security 560: Network Penetration Testing and Ethical Hacking (GPEN) taught by Eric Conrad, SANS Certified Instructor

Below is a brief snapshot of what each course covers. For complete course descriptions see: http://www.sans.org/info/54774

- SEC 401: Security 401: SANS Security Essentials Bootcamp Style (GSEC).
In this course you will learn the language and underlying theory of computer security. At the same time you will learn the essential, up-to-the-minute knowledge and skills required for effective performance if you are given the responsibility for securing systems and/or organizations. This course meets both of the key promises SANS makes to our students: (1) You will gain up-to-the-minute knowledge you can put into practice immediately upon returning to work; and, (2) You will be
taught by the best security instructors in the industry.

Maximize your training time and turbo-charge your career in information security by learning the full SANS Security Essentials curriculum needed to qualify for the GSEC certification.

- SEC 560: Network Penetration Testing and Ethical Hacking (GPEN) covers the ingredients for successful network penetration testing to help attendees improve their enterprise’s security stance.

FIND SECURITY FLAWS BEFORE THE BAD GUYS DO! We address detailed pre-test planning, including setting up an effective penetration testing infrastructure and establishing ground rules with the target organization to avoid surprises and misunderstanding. Then, we discuss a time-tested methodology for penetration and ethical hacking across the network, evaluating the security of network services and the operating systems behind them.

Both courses are associated with a GIAC Certification (GSEC and GPEN). Put the skills you’ll learn to practical use and more than GIAC certified professionals who make the info sec industry safe!  Visit http://www.giac.org/info/54779 for more information and register for your certification attempt today!

SANS training is well-known for being relevant and pragmatic. All SANS instructors are industry leaders and experts who understand the challenges you face on a daily basis.  Their real-world experience increases the practical value of the course material.  Here are some comments from recent alumni:

“The SANS class (SEC401) stands out above the rest because of the subject matter experts who teach the classes and labs.” – Shirlee Eitel-Birgham, State of Nevada

“Anyone who is in the network penetration testing field should take this course (SEC560) to improve your current skills and learn new ones.” - Nick Ramser, Ohio State University

“This is the way you need to learn: roll up your sleeves, dig in to the fundamentals and the nitty-gritty technical details, and then go ’hands-on’ to practice and reinforce what you’ve been taught.” – Joseph Price, DoD

Classes will be held at the Marque Brisbane Hotel, which is located in the heart of the city and just a minute walk to the Brisbane River. The central location is the ideal base from which to explore some of Brisbane’s best attractions. Cruise the river, shop along Queen Street, enjoy the Treasury Casino or the South Bank Parklands. A special discount rate of AUS $179 S/D will be honored based on space availability. This discount is only available through 22 April, so take advantage of this special offer and make your reservations today! For more information see http://www.sans.org/info/54784

To follow or tweet about this event, use hashtag #sansbrisbane. Follow SANS at http://twitter.com/SANSInstitute

Get the training you need to advance your career.  Start making your training and travel plans now to join us for SANS Brisbane 2010! (http://www.sans.org/info/54773)

Hi kids!! It’s been a few weeks now since I resat the OSCP exam. GOOD NEWS!! I PASSED!! Now I guess I should chronicle the trials and tribulations of journey that was the Offensive-Security Pentesting with Backtrack course. Grab a drink, make yourself comfortable and read on!

The road to the OSCP certification is a long and intense one. I went into it after completing a few SANS courses that I really thought would have given me the basics for this cert, and to a point, they did .. but it was only the very basics. Now don’t get me wrong, the SANS courses are excellent, and I will always be a massive fan of the great work they have done, but this my friends, was something totally different!

Full of bravado I looked at the overview of the course and secretly thought to myself “pinch of piss” (thats an Australian term by the way – I’m not sure how I could translate it into other languages) and signed up for 4 weeks of lab access. That was the easiest part! I was about to have my ass handed to me in ways that I have never experienced before in my life! I was about to hear the term “try harder” more than I ever expected, at my most confused/annoyed/frustrated states, those 2 words can send you over the edge! Heading into the IRC channel to discuss things often resulted in someone typing !bob, this triggers the channel bot to message you with “Bob is laughing at you!” EFF BOB!!

But, these things, as annoying as they sound, are what in fact make you try harder, and understand things that little bit more. When you research something and work it out yourself, you stand a much better chance of remembering it. The basics in the lab book (which to most people aren’t really basic) gives you the foundation to do so much more. The basics, along with your own crazy imagination, are what will get you through the exam. Did I mention that the exam was 24 hours? Oh yeah .. it’s 24 hours!

I did all the course work, did most of the “Extra-mile” work (the extra-mile questions are the really good juicy questions that get you ready for the exam .. if you don’t do them, you won’t pass – I promise you), extended my lab time by another month and felt real good going into the exam. WRONG!! I spent 24 hours going around in circles. I went in with a game plan, got a rush of blood, put my game plan in another pair of pants, washed that pair of pants, and then lent said pants to a friend! My friend Chris has done an awesome write up of this event! Now, I did manage to get a root on a couple of servers, and shell access on a couple more, but it was never going to be a pass (my exam was actually just before Christmas, I was praying on the Christmas spirit to pass me hahaha).

I was never in the mindset of giving up anywhere along the line, after 24 hours with no sleep I was still really excited about how much I had achieved! Sure, I didn’t pass, but who would have thought that after 8 weeks I would be able to do what I was doing (I don’t want to tell you .. it’ll give away too much information). I was pumped and I was going to redo the exam and pass!! This is where poor Chris fell apart, it was ok, we sat him down, slapped him stupid and got him back on board! Getting Chris back on track was the best thing .. he really helped motivate me when I really couldn’t be assed to study. When I got stuck on stuff, he was there to try and explain stuff. Try and get a study buddy if you can, it makes a heap of difference!

We booked our exam again, and gave ourselves a bit of time off before getting back into it. This time we were a lot more focused. We knew what we had to do, and we had a great plan (that we wouldn’t blow away this time). We both did a lot of pre work for this second attempt (Chris probably did more than me, but who’s keeping track – hahaha). Then the big day came …

WE BOTH SMASHED IT!!!

It all paid off for! I managed to get quite a lot done in the first 45 mins (to the point where I could have passed), but I wanted to get the lot, I was going to get all the machines! The final machines were tough, tough because one was so blindingly easy that I missed that my exploit I did had actually worked (RETARD!!), I believe that I did the exact same thing on my first attempt and only realised about an hour before my exam was up hahaha. The other machine was just hard .. hard, hard, hard!

The end result is, I got all of the goals! I passed the exam, I am now an OSCP! The exam was the most rewarding thing I have done, and I am proud to say this is the first security related exam that I have EVER failed! This course has already given me opportunities I would have never had before, It was one of the best things I have done and I couldn’t be happier.

If you’re reading this and thinking about taking the course, DO IT! Leave yourself enough time to go through the material a few times, leave yourself enough time to try and get root on ALL the lab machines, have fun and don’t get too bogged down in things. When it’s all too hard, go and get some fresh air or move on to something else. I hope everyone enjoys the course as much as I did!! I actually enjoyed it so much, that I have just signed up for the WiFu course that is offered – but that’s a post for another time!