ZERO TO OSCP IN 292 DAYS OR HOW

ZERO TO OSCP IN 292 DAYS OR HOW I ACCIDENTALLY THE WHOLE THING Jeremy Chisamore @Chazb 0 t

BACKGROUND • Tinkerer • PC Gamer • AP Computer Science in high school (C++ in 1999 • Wardriving and shenanigans • Bachelor of science in management • Financial advisor at Merrill Lynch • Online Poker Player • PC Builder/Modder/Overclocking Enthusiast )

FUZZY TIMELINE • SPRING 2016 • Read Future Crimes by Marc Goodman • Reached out to NCC Group and others • Started going to NCC Quarterly Meetup and OWASP • FALL 2016 • Started going to TOOOL_NJ, met Shawn, Ben, Matt. K • Complaining about NYC meetups, we started CNJ meetup • WINTER 2016 • Went to first security conference, BSides. Philly with Ben and Matt. K • Talking to pentesters, no one will take me seriously without OSCP

OSCP RESEARCH • • Reddit, Twitter, Techexams. net, Blogs Read the OSCP syllabus Everything is over my head Searching for certs with practical labs and exams Found e. Learn. Security Many people take the e. JPT > e. CPPT > OSCP route SANS out of the question, too costly out of pocket ($6, 500? )

CERTIFICATION TIMES (FULL-TIME STUDYING) PRE-OSCP CHAZ POST-OSCP CHAZ • e. Learn. Security Junior Penetration Tester (e. JPT) 14 days • e. Learn. Security Certified Professional Penetration Tester (e. CPPT) 90 days • Offensive Security Certified Professional (OSCP) 292 Days • I know it’s not zero to OSCP in 292 days, but I can’t change it now

IT’S FINALLY HERE! MY PRECIOUS

WHY I’M GIVING THIS TALK https: //blog. mallardlabs. com/zero-to-oscp-in -292 -days-or-how-i-accidentally-the-wholething-part-1/ https: //blog. mallardlabs. com/zero-to-oscp-in -292 -days-or-how-i-accidentally-the-wholething-part-2/

GENERAL OSCP THOUGHTS • Know what you’re getting yourself into • This is not a “study on weekends” cert • I have no idea how people do this with a job and a wife and kids • Expect late nights/early mornings, lunch breaks • Your significant other and friends and family are going to be pissed • What’s a social life? • Be comfortable with python scripting, networking, and sysadmin • Get ready to rage, Offensive Security known to be trolls, “Try Harder”

MAKE SURE YOU HAVE GOOD MUSIC TO GET YOU THROUGH IT

WHAT I WISH I COULD TELL YOUNGER ME • Don’t abandon programming in high school • Take this cert in 2007, it was easier back then • Take this while you are still employed • Stop doing everything the hard way • Take better notes idiot

MEAT AND POTATOES – OSCP PREP • Beating a dead horse - lots of prep guides and blogs • https: //tulpa-security. com/2016/09/19/prep-guide-for-offsecs-pwk/ • https: //www. abatchy. com/2017/03/how-to-prepare-for-pwkoscpnoob. html • https: //www. offensive-security. com/documentation/penetration-testing -with-kali. pdf • 99. 9% of the learning is in the hands-on labs • Your Google-Fu is going to become next-level (Also Stack. Overflow)

BOOKS • MANDATORY • Penetration Testing: A Hands-On Introduction to Hacking • The Web Application Hacker's Handbook: Finding and Exploiting Security Flaws 2 nd Edition • OPTIONAL • Hacking: The Art of Exploitation, 2 nd Edition • The Hacker Playbook: Practical Guide To Penetration Testing • The Hacker Playbook 2: Practical Guide To Penetration Testing • RTFM: Red Team Field Manual

PRACTICE LABS & VIRTUAL MACHINES • www. hackthebox. eu (closest thing OSCP labs, free or $10/mo) • www. pentesterlab. com (educational and practice challenges, $20/mo) • www. vulnhub. com (downloadable practice VMs, free) • HTB and Pentesterlab between OSCP lab renewals were vital

HTTPS: //GITHUB. COM/CODINGO/RECONNOITRE • A reconnaissance tool made for the OSCP labs to automate information gathering and service enumeration whilst creating a directory structure to store results, findings and exploits used for each host, recommended commands to execute and directory structures for storing loot and flags.

RECONNOITRE OUTPUT

RECONNOITRE RECOMMENDATIONS

YOUTUBE VIDEOS BY IPPSEC - 34+ RETIRED HACKTHEBOX MACHINE WALKTHROUGHS

QUESTIONS?