Accident.com

accidentcom

Open Source Intelligence (OSINT) has been one of the most useful skills I have learned. Many of the mindsets, methods, and tools it uses can be applied to a variety of tasks, like job hunting, pen-testing, or research for writing tasks. There are many great resources out there that help in learning and developing this skill, and this blog post aims to provide a repository and a structured format to guide you on your journey to learn this amazing skill. How To Read? This post should be read in full without clicking on all the cool links or trying out the stuff I am talking about. This will allow you to absorb the message of this post. Afterward, you can briefly go over it again, click all the links, and try all the stuff. OSINT? I will not spend a long time providing a definition of what is. There are plenty of discussions about this out there, and I do not think a perfect definition is of much value to someone starting to learn this skill. For the purpose of this series of blog posts, OSINT will be the activity of collecting and analyzing open-source data to answer specific questions. There is much more to this definition than meets the eye, but we will leave it at that in the meantime and come back to it later. OSINT The OSINT Mindset I hear you screaming, "Booh, give us some tools and tricks," and I will soon do so. I just want to briefly mention that a proper mindset is the foundation of being a good OSINTer. But it is the same as in martial arts: while a proper mindset is key, they still start by teaching you how to stand and throw punches before discussing when and why you want to and don’t want to hit someone. Therefore, I will show you some OSINT punches first, but I ask you to not neglect the importance of learning about an “OSINT Mindset” and hope you come back to it once you feel confident enough to throw some punches. Searching For Stuff If you want to analyze open source information to answer certain questions (aka. OSINT), you obviously have to know where to find all the information you need to answer your questions. Disclaimer: Many people view OSINT as an activity that is only about finding information. While it is crucial for OSINT just sucking up information does not do justice to the INTelligence part of OSINT. The ways of finding information are just countless, and if you follow some OSINT creators on X (which you should), you will receive new sources, hacks, and dorks almost on a daily basis. The first thing you should learn is how to google it, but do it the right way. This is so-called Google Dorking. I will not do another guide about it because there are plenty of them out there, but you can check out the great blog written by HackTheBox: , and you can use the information in it to find some more guides that will help you develop this skill. Many of the search operators detailed in this blog post work on other search engines like Yahoo, Bing, Yandex, and other specialized search engines. https://www.hackthebox.com/blog/What-Is-Google-Dorking And that is the next point we want to talk about: . Specialized Search Engines Google is great and all, but sometimes you have some special thing you want to search for. At this point, it is handy to have some more niche search engines at hand, like or for internet-connected devices, or for source code, or for data leaks and breaches.
This amazing GitHub profile, , lists a lot of search engines and some more amazing stuff, so you should browse through it and take notes. shodan.io netlas.io grep.app intelx.io https://github.com/cipher387 But you don’t always need a specialized search engine; the search operator can do wonders. Sure, a specialized GitHub, Amazon S3 Bucket, or paste search engine is fun, but do not forget the good old , , or search queries. Sometimes, they have better results than custom search engines. site site:github.com site:amazonaws.com site:pastebin.com I feel like you have heard a lot of theories. It's time to give you a juicy OSINT snack. One of my favorite Google Dorks: site:amazonaws.com “Confidential” You go ahead and figure out what it does, and as a homework assignment, find some domains for the other cloud providers that you can use this dork with. Taking Notes Now, we can find quite a bit of information, but we have to keep it organized somehow. Here, you need three things: something to take notes, something to do mind maps, and (maybe) something to do free-hand sketches. Notes are obviously to save all the nice tidbits of information you have collected. You should have a certain kind of structure that works for you. Sometimes, I like to dump stuff in a large document and move it around and be a bit messy; some like their stuff in a nice and clean structure. You have to test and find out what works for you. Mind maps are great for investigations because investigations are about connecting the dots, and well, that is what mind maps do. They allow you to show how information is connected and what path your investigation follows. Free-hand sketches do not have to follow any structure; you are only limited to the things you can produce with a pen. This is really great for times when you need ideas to flow, like at the beginning of an investigation or at a pivotal point in your investigation. The question now is: What tool should I use? Technically, OneNote can do all of those things. Some people really love Notion or Obsidian. I will not recommend any tool because this is a lot about individual preferences and styles. I will just give you some considerations when choosing an application: For your main notes application, you have to use something that allows you to organize your notes in different sections and categories. So using Word or txt files is a terrible idea. Notebook format: If you work on high-profile cases and/or sensitive information, you might want to consider a solution with local notes rather than something that relies on cloud storage. Sensitivity of data: While applications like OneNote could do all the things you need, they might not do all of them well. So, you have to consider the trade-off between convenience and functionality. All-in-one vs. tailor-made: If you have that one special investigation device, you do not need to think about it. If you like to work from multiple locations on multiple devices with varying operating systems, you need to have something that syncs your notes wherever you are. See also the consideration of data sensitivity. Cross-platform/device: AI just recently emerged, but plenty of applications now allow you to interact with and enhance your notes via AI. Consider if these features are beneficial to you or if your data might be too sensitive for them. AI and other special features: Pivoting In OSINT knowing how to pivot is (caution: bad joke) pivotal. What does that mean? You need to be able to use information from source A to get better information from source B. You also need the ability to get from something like a social media profile to information like a physical address. You need to be able to correlate everything you do and uncover during your investigation. This is what real analysts do. I even wrote a whole blog about it, and you can check it out here: . This concept can only be fully understood and learned by practicing your skills. https://security-by-accident.com/unearting-sources-osint/ Asking the right questions This is something I was referring to in the section about “The OSINT Mindset,” and I did not talk more about it because I knew you were not ready for it. Even though every OSINT process MUST BEGIN with a well-defined question, the OSINT learning journey must begin with uncovering some hidden stuff, or else you will not be able to appreciate the fascinating power of OSINT. But why are questions so important in OSINT? Imagine this: You are a professional OSINT investigator. A client gives you an assignment. Your target is “Peter James van Doe.” The client sends you his LinkedIn profile. Immediately, you start investigating. You know about this great hack someone showed you that allows you to get the email he used to create his LinkedIn account. This email is amazing; he uses it everywhere, where you find passwords, social media accounts, forum posts, and all that stuff. You are having a blast, but you end up OSINTing nonstop till it is way after midnight. You send your client an email telling him how well the investigation is going. The next morning, your client calls. She says, “And? Should I hire this guy as an accountant?”. "Oh, f***ing hell.”, you think. You’ve had a fun evening by wasting some time because you did not know why you were doing all this OSINT. Sure, you have some rough idea of whether that guy is trustworthy or not. But can you give your client a high-confidence assessment? Can you bill your client for all those hours you spent? Sure, the investigation was fun, and doing OSINT investigations for fun and just pulling all the tricks and tools you have is great for sharpening your OSINT skills, but it IS NOT a PROFESSIONAL OSINT investigation. So before you start your investigation, think about the “WHY?” and “WHAT?” before you think about anything else, and only start investigating after you have clearly written down these points. And afterward you can concern yourself with the HOW? and then you may start investigating. I could write a lot more about this point, but it was done before by one of OSINT’s finest, and you can check out his article here: . Please do give it a good read. https://medium.com/secjuice/osint-as-a-mindset-7d42ad72113d Where tools? You read this article because you wanted some cool OSINT tools, right? Well, I am not going to give them to you YET. If you have read the article in the previous section, you will know why. But stay tuned for the next part of this series. There will be tools, I promise. And now? Well, you do not really have tools, but you have something far better. You are equipped with the foundational skills and concepts of a good analyst. Now, go ahead and ask some questions you want to learn more about. Use the concepts and skills from this article and answer them. On this journey, you will become a better analyst (if you do it right), and you will automatically find some tools you can use. And as a little treat, I will share with you one of my other posts that talks about one of the most fun OSINT topics that you can explore: . https://security-by-accident.com/leaks-breaches-osint/ But seriously, please do some real investigating with questions, notes, mind maps, and stuff. Also, follow me on X for some OSINT and security knowledge: and wherever you have read this blog post. https://twitter.com/Secbyaccident Homework: Follow OSINT people on social media. Join some OSINT discord servers and make some connections in the OSINT community. Understand why you want to learn OSINT. This will help you understand what skills you will need to pick up. Further Reading: Here are some OSINT fundamentals: TCM OSINT course: https://www.youtube.com/watch?v=qwA6MmbeGNo&pp=ygUWb3NpbnQgdGhlIGN5YmVyIG1lbnRvcg%3D%3D&ab_channel=TheCyberMentor Inteltechniques (one of the best in OSINT stuff): https://inteltechniques.com/ Also published . here

Your OSINT Study Plan (Part 1): Sharpening Up The Basics

Working in cybersecurity can be a very fulfilling career, but most jobs require some amount of experience or formal training. While there are many great courses and certifications for learning pen-testing out there, it might be the case that they are simply above your budget. But that is totally fine. I think it is still possible to get job-ready knowledge about and pen-testing from free resources. cybersecurity A little warning: While I feel like it is possible to spend no money on your way to the first pen-testing job, it is the case that some paid resources provide knowledge in a condensed and easy-to-digest form. Having access to those resources might accelerate your learning journey. So I will provide some recommendations on which of them are worth it and which are not. I also created a GitHub repo with free cybersecurity resources. Check it out, and feel free to add some: https://github.com/her0marodeur/awesome-free-cybersecurity A few words about my own career I got really lucky in terms of getting a job. My first contact with cybersecurity was back in my teenage years when I Googled “ .” That was back when there were no such resources as HackTheBox and TryHackme. So, a lot of the learning was more theoretical and, in general, kinda slow. How to become a hacker After I finished school, it was time to look for a job. I started out with a student job for a big software company. There, I had the opportunity to work with different security teams. During this time, I did my eJPT certification and got in contact with the internal pen-testing team. They provided me with the opportunity to do an internship and paid for my OSCP. After I finished my Bachelor’s degree, I got offered a full-time job as a pentester. As I mentioned, I got lucky, but I think there are a couple of takeaways from my own story: The demand for pen-testers is currently very high, so many companies are willing to train existing employees. So if you are already working for a company, see if they have an internal pen-testing or security team. The most important characteristics of a pentester (hacker) are willingness to learn and curiosity. Getting them does not cost a penny. One of the mistakes I made was focusing too much on the theory and not getting enough hands-on experience. This is really important, and you should try to get as much practice as possible. The role of certifications and degrees I know you probably want to get into learning right away, but I think we should have a brief discussion about this topic. There is a decade-long ongoing discussion about the difference between and which is better and a lot more. I don’t want to dive into all that stuff. certifications and degrees Generally speaking, a degree or a certification is a verifiable and easy way for employers to assess the skills of an applicant. The OSCP or a computer science degree does show that the candidate has skills and knowledge in a certain area. If you have to filter through hundreds of applications, they give a good orientation. But there are two big things to take into consideration: There are other ways of getting experience and knowledge. I have friends who have maintained Minecraft servers since they were twelve years old, and they have extremely good programming skills, even without having a degree. And their salaries are comparable to some seniors in the industry. Even tho there has been a huge interest in pen-testing in the last couple of years, the demand has skyrocketed as well. That means employers are not getting hundreds of applications. Many times, it is actually the case that pen-testers are getting many job offers just because they have a LinkedIn profile. Paid Certifications to avoid: For some reason, this is still seen as a good certification, but from everything I have heard, they provide a really dry course, and the exam requires you to memorize a lot of stuff. So you can save your money. Certified Ethical Hacker (C|EH): I did this one myself, and it was fun; the exam was really hands-on and enjoyable. The reason I don’t recommend it is that I don’t think it is really beneficial in terms of getting a job because I don’t feel like employers are valuing it. eLearning Security Junior Penetration Tester (eJPT): Paid Certifications you can do (if you have the money): I don’t hold this certification myself, but I did Heath Adams courses back in the day. The content is just great and really well explained. It covers a lot of topics. The exam is more relaxed than the OSCP, and it has industry recognition at the lowest price. Practical Network Penetration Tester (PNPT): The OSCP has its pros and cons, and I wouldn’t recommend that you take a loan to do it or bust your bank account. But in a situation where you can really afford to do it (considering money AND time), I have to admit it has a great course, and it is basically a job guarantee. If you want to learn more about it, check out my blog here: Offensive Security Certified Professional (OSCP): https://infosecwriteups.com/methodology-and-mindset-for-passing-the-oscp-d609592a7dcb Getting the knowledge To know where you should start, you have to know where you stand. It is a big difference if you already have fundamental IT knowledge or if you are coming from a different profession because it is absolutely necessary to understand basic computer science concepts like networking and how programs, web pages, and computers are built and running. Since I suspect that many readers of this article will have this knowledge, I will not talk too much about learning all that stuff. has some really cool courses to learn the basics, and I think installing your own web server and learning the basics of Python really helps a lot. There are also basic computer science courses on sites like . TryHackMe Coursera TryHackMe and HackTheBox As well as for basic knowledge, I think you should really start with for learning the basics of pen-testing; they have some really good paths for this. Sadly, some of them might be only accessible via a paid membership. I think the paid membership is really one of the best investments you can make because it is quite cheap and provides access to a lot of knowledge. TryHackMe If you are thinking about what kind of pen-testing (mobile, web, network, Red Teaming, etc…) to learn first, I suggest you go with web pen-testing because there are many resources about it, and when we talk about Bug Bounty later, most of the targets are available in this area. But if you feel like doing something else, do it; all of this is just my opinion. Additionally, to do the learning path, you should also do some of their boxes that don’t give you any hints about how to solve them. Also, check out for this; they also have some great boxes, but beware of their rating system. I recommend you really start with easy boxes. HackTheBox When solving boxes, I recommend you give yourself a time limit. I recommend something like this: If you don’t have the initial foothold after 30 minutes, you should check a writeup. Afterward, you try 30 mins for privilege escalation, and if you don’t get it, check the writeup again. It might be true that there is no writeup in a real pentest, but doing boxes is about getting as much knowledge as possible. Also, start pushing yourself as soon as possible and increase the difficulty. It may mean that you might need a write-up for almost every step, but it also means you learn something new with every box. Free certifications: This one is a must-have. It is just the right mix between great course content and realistic and challenging exercises. APISec University: This one is not really about pen-testing but covers a lot of the basics of cybersecurity. But these topics are important for pen-testers as well because they always have to see the bigger picture of cybersecurity. The course and exam are free, but it requires an annual maintenance fee. ISC2 Certified in Cybersecurity (CC): : Another one that is not directly about pen-testing. It explains one of the essential policies of cybersecurity, and employers would like knowledge about this one. Skillfront ISO/IEC 27001 Information Security Associate™ If you love certifications as I do and want some more for free, please check out my GitHub Repo over here: https://github.com/her0marodeur/awesome-free-cybersecurity Getting the experience By now, you already hacked some machines and websites, but all of them were in a simulated environment and left vulnerable by design. While this provides valuable experience and gives you the ability to learn how to exploit vulnerabilities, it is not necessarily the experience employers are looking for. Therefore, I recommend you try your skills against some real-world targets (in a legal way). Luckily, Bug Bounty platforms allow you to do this and maybe earn some money. Bug Bounty Platforms You can check out the following platforms: https://www.bugcrowd.com/ https://www.hackerone.com/ https://www.intigriti.com/ https://yeswehack.com/ Look at their programs and get familiar with the general topic of Bug Bounty (try to avoid the Twitter and Medium hustler bubble; there is some really bad stuff out there). I suggest you start by looking at Katie Paxton-Fear’s stuff ( ). She has some great videos that are really for beginners. But don’t stress too much about all of it; sign up for a platform, pick a program, and hunt. This is what life as a pentester is going to be like. Also, be careful and don’t bother too much about all of the tools, oneliners, and scanners. Learn about the recon fundamentals ( ) and start hunting. https://insiderphd.dev/ https://www.youtube.com/watch?v=krCsMZfbuB4 If you get one or the other bug, it is great for your CV because it shows you know how to apply your pen-testing knowledge to real-world targets. Synack Red Team https://www.synack.com/red-team/ This one really depends on how much time you want to spend before getting a job as a pentester. I am not part of it, but I heard really good stuff about it. It basically is a closed Bug Bounty platform, but they additionally offer some fixed pay jobs like checking default credentials or OWASP Top 10. However, you have to apply to them, and this process can take a while. But it gives you the chance to have some experience with a real-world job application. It offers great hands-on experience and looks good on your CV. So check it out and see if it is for you. Getting the job If you are following this blog (btw. please read more resources than just this one; there is a lot of great career advice out there), I hope you don’t think of it as something that has to be done in chronological order. You can skip things and do them in parallel, or however it feels right for you. Writing a CV Before you go out and look for a job, you should write a CV. This really should focus on showcasing skills that you can apply to your pen-testing job. So if you have worked in another job, think about how you can translate the skills you gained to pen-testing. If you are a programmer, tell them you have a deep understanding of technology and for sure you had to implement security measures in your code, and probably you know how developers think and fail. If you have worked as an executive assistant, you have probably done a lot of writing and have clear communication skills, which is also really beneficial for pen-testing. By now, you have done at least some certifications and courses, but be careful what you include in your CV. I think, if you have done the three free certs I mentioned, you should include all of them, as they really showcase skills and knowledge needed for your job. But you want to be careful not to include every little thing. Rather than including the certificate of completion for every TryHackMe track you did, you should just include your TryHackMe profile. And for bug bounty profiles, you only want to mention the sites where you have at least one accepted submission. If you put too much basic stuff in there, it probably seems desperate. For writing the actual CV, you should not get too creative. It is best to either download a Word template and fill it in with your experience and skills or use one of the online generators (consider privacy implications). Be aware that your CV is often times read by machines, so make it “machine-readable.” Getting yourself out there Being visible can be really helpful if you want to get a job. I think having a is crucial. So create one, put a nice photo and some experience on it, and maybe include “aspiring pentester” in your bio to make yourself visible when recruiters search for possible candidates in this area. well-maintained LinkedIn profile You can also do a little bit more to increase visibility. A nice thing to do is to start a blog. Like this one, you are just reading. Even tho you might not have a lot of expert knowledge; you can talk about your journey and experiences or write a tutorial for a tool or a writeup for a box you did. But please don’t go down 1337 Hacker Road. I don’t think that blogs like “Hack a webcam with only three steps,” “Hacking Instagram password,” and other clickbait help find employment. Other things you can do are contribute to GitHub projects (for example, Nuclei and Spiderfoot allow you to contribute new rules and templates), create your own tools, or speak at a conference. All of these things will increase your network and look great on a CV. Applying for jobs Go for quality over quantity. The job has to be a match for you as much as you have to be a match for the job. So, really try to find jobs that match your expectations. While I say that, it is also true that it is probably easier to pivot from one pen-testing job to another than getting into the industry, but I feel bad advising anyone to take a job they don’t enjoy. I highly recommend you reach out to recruiters/headhunters. You can easily find them on LinkedIn, add them to your network, and ask if they have a role that fits your profile. It will not cost you a penny because the employers are paying them. They will also be a big help with streamlining a lot of the process. They know their clients and where you have a good chance of getting hired and, most of the time, allow you to skip steps like writing a cover letter. Even if they are not able to offer you something right away, they will add you to their contact list and reach out in the future. Interviews There are just better resources than I am, so I will link to them: The Cyber Mentor- Mock Job Interview: https://www.youtube.com/watch?v=IDpjaS6OYPU The Cyber Mentor — What to Expect in an Ethical Hacking Job Interview: https://www.youtube.com/watch?v=nrewE1mLlaU Security Interview Questions: https://github.com/justinltodd/security-interview-questions Conclusion While it should be entirely possible to get a pen-testing job without spending a dollar, it will still require a lot of work. Spending at least some money can make the process if you spend it right. I also have to mention that all of this is just my personal experience and perspective. Your mileage may vary. If you liked this blog post, you can follow me on Twitter @Secbyaccident or read my other stuff over at . https://security-by-accident.com/ And if you have read this far, I want to offer you a little Thank You. My DMs on Twitter are open, and you can reach out to me if you want me to review your CV, help you with some studying, or set you up with some recruiters. I will do all of this for free, but expect a little delay in response time. Also published here.

Cybersecurity Job Hunting, Pen-Testing Study Plans, and Certifications on a Budget

I remember seeing a post on LinkedIn talking about how “Encryption is overrated.” The post was taken down by the author just a day later because people sent him a lot of angry messages. Even though it was not well articulated, his post had a valid point. So please hear me out; I feel this post has a valid message as well. I will try to articulate it well. If I fail, this blog post might disappear as well. The idea for this post was stolen from a friend. He has much more experience in this industry than I do. That might be why he put this thought into words before I did. I Love Pentesting Yes, I do. It is my daily job, and there is nothing in the world I would rather do. The complexity amazes me, and I admire all of my peers with their deep understanding of technology which allows them to uncover insane vulnerabilities. And to be clear: pentesting itself is not easy. Doing the OSCP, for example, was one of the hardest challenges of my life, and that one is just the “beginner” certification. This job requires so much knowledge and dedication, but it is one of the most interesting things you can do, also the challenge is part of what makes it interesting. Nevertheless, pentesting can not exist in isolation, it is always only part of an organization's approach to cybersecurity. If you have no other ways to check for vulnerabilities, like scanning code and infrastructure, pentesters will just drown in findings and will never be able to catch the really complex ones. There need to be policies in place, which define your approach to security and people catching attacks when they happen. There have to be people fixing the vulnerabilities as well, and this is where we should have a closer look. Different Types of Vulnerabilities You can distinguish vulnerabilities in a lot of different ways. They can be classified according to severity, hardware or software, underlying principles, and much more. For this article, I want to look at them from the perspective of “straightforward way to fix” versus “no straightforward way to fix” (wow, that is what you call a lack of better terms). Let’s look at an example: When your pentest uncovers an SQL injection, you know how to handle it. You should sanitize your user input. There are many ways to do it the wrong way, but in general, you know exactly what to do. However, it might be the case that your pentesters (maybe during a Red Team) report some other findings like too many permissions granted to user X, lack of user awareness, users exposing sensitive information (well awareness again), or core processes are set up in an insecure way. Those findings might be harder to fix, and I would argue that there is no standard way to do so. You might be shouting at your screen now: “Zero trust and security by design and awareness campaigns.” Well, you are right, but they still require a lot of work, and there is no one size fits all approach. (If you have the solution, don’t tell me in the comments, sell it and enjoy life as a billionaire.) These fixes often require architectural changes, system re-engineering, or even changes in organizational processes and behavior. The Point of This Rant Why am I writing this whole thing? Because there are some points and ideas I wanted to put into writing. None of them are groundbreaking, but they still might be important for some people in cybersecurity: If your IT admin is talking about the security holes he or she has known about for a long time now, don’t spend money on a pentester, spend it on empowering this guy or gal to improve your security. Pentesting does not equal security: Oh boy, this could be a whole other blog post. Sure, if you want them to just manually scan thousands of assets, they will happily bill you for it. Scanning can’t replace pentesting, and pentesting can’t replace scanning: Why should I buy a pentest, I spent thousands of dollars on this shiny security scanner? We have a pentest every year, why should we implement a security scan? This will take up all your budget and won’t allow them to look at complex vulnerabilities, a scanner could never find. Now, finding the balance between these two and all the other security measures might be pretty hard. (One might even say pentesting is the easy part. ) wink I know the feeling of reporting a glaring security vulnerability and not getting the response I hoped for. Sometimes it is the right decision to apply more pressure to the affected organization unit so they understand the urgency. (This Remote Code Execution is not a bug, it is a feature.) The whole security organization has to work together: But you might have just told them about an issue with a process that is central to their revenue generation. The controllers and salespeople will scream at them if their numbers are bad, and the CISO will scream at them about the open security ticket with a high priority. How about working together with them to find a way to protect everyone's interests? Try to understand the issue. Try to help them with the extensive security knowledge you have. Get the Incident Response Team involved to see if they can implement a detection while the vulnerability isn’t fixed. There are a lot of operational tasks related to security that keep an organization running. Fixing this, implementing that, and collecting evidence for compliance. But you have to have a vision because zero trust and security by design will not be announced today and implemented next week. Security has to be strategic: It is a whole transformation, and somebody has to think about how to do it. Else, there will be just endless operational work keeping your organizations security somewhat alive. Conclusion None of this might be new, and some of it might not be very well articulated or even make sense, but I hope it still added something to the conversation about pentesting and security. Writing and talking about it has at least helped me to see the bigger picture, but I am happy to hear your opinion. If you enjoyed this article, you can read my other stuff over at (add it to your RSS feed), and you can follow me on Twitter @secbyaccident. https://security-by-accident.com/

Pentesting Might Be the “Easy” Part: Here's Why

It feels like everybody who passes the OSCP has written a blog post about it. And, for a long time I thought I wouldn’t write one, because there is already a long list of excellent resources talking about passing the OSCP out there. I will provide a list of them down at the bottom of this post. But whenever I stumbled across an OSCP guide, I feel like there are some things missing. After I passed my OSCP exam at the end of 2022, some of my coworkers have asked me for advice. Most of the time I pointed them to already available guides on the internet or shared my notes with them, but I always added some personal recommendations about Methodology and Mindset that I rarely see being talked about in other OSCP guides. So this blog post is going to summarize these tips. General considerations Before talking about how to approach the OSCP, I want to talk about some general stuff. I know it is written everywhere, but when I started out with the OSCP, I underestimated this part a little: ”Taking this certification will require an EXTENSIVE amount of work and time!”. Coupled with the considerable amount of money it costs and the limited time you have to complete it, you really should consider, f your bank account, your mental state, and your friends and family can endure taking the OSCP. It might be the case that for your current situation, there are other learning resources and certifications that are better suited for you. Nevertheless, I have to mention the benefits of taking this course and exam: You will get a lot of new knowledge (If you are a beginner to early intermediate in the field of Pentesting) You can verifiably demonstrate knowledge and dedication With the OSCP, you have a 99% job guarantee How to approach the OSCP course After purchasing the course, you will have access to labs, video and written course content and exercises. Here is some stuff that helped me to succeed: Do the course material and labs in parallel. There is no point in finishing the course material first. You need to gain PRACTICAL, HANDS-ON experience, as much as you can. Join the Discord asap. I was hesitant at first, because by now everybody has a “Discord community”, but this one is insanely helpful. On the Discord server you will find Nearly instant support (trust me, you will need support) Solutions to the exercises and labs (if you know how to look) You will find out, if a machine is broken or if you are just too stupid to use it (skip the broken ones (looking at you: Compile this exploit with one specific version of Linux), sure you will learn some interesting stuff here, but time is running) If you want the bonus points for the exercises (it saved my a**), do not underestimate the time it takes to solve them. Use the Discord server, if you are stuck (remember sometimes 100% is not needed). Spend most of the time in the labs. Here is what I would recommend: Build a methodology to do Recon and Privilege Escalation and refine it over time. In the beginning start without looking up any solutions in the Discord. That is the situation you will face in the exam. The closer you get to your exam, the more you should seek help in the Discord server (Ctrl+F). Many OSCP machines are quite similar and the more you see, the more you are getting a feeling for them. DOCUMENT, DOCUMENT, DOCUMENT. It doesn’t matter where you take notes (I used OneNote, because you can just throw everything everywhere), but from your notes you should be able to solve any machine you have already cracked in a couple of minutes again. Additionally you should have a quick way to know which machine had the Apache Version x.xx exploit, so you can find it in the exam. Try to form a study group, if you can. Try to get all of the Active Directory machines. Active Directory Knowing how to exploit Active Directory (AD) is essential for passing the OSCP. But luckily there are some tricks to help you with doing it. The answer here is checklists. Why? Because for both, Windows Privilege Escalation and Lateral Movement in an AD environment, there is only a limited number of possible ways to do it (at least what they want you to know in the exam). So how do we do it? Easy (well somewhat), you prepare two checklists, one for PrivEsc, one for Lateral Movement. In the exam there will be be three AD machines: One entry, one internal and one Domain Controller. So now you just need to find the initial exploit and afterwards, you take your checklist for PrivEsc and go through each of the methods and try them. After trying each method you mark it as “Successful”, “Definetly not possible” and “Haven’t found a way yet”. Because sometimes you try the entire checklist and everything fails, now you want to know what to try some more and that is when you try the “Haven’t found a way yet”s. After succeeding do the same with the Lateral Movement checklist and so on and so on. Additionally, you have to know Pivoting and you have to do it without Metasploit, so I encourage you to look at tools like chisel and to understand SSH tunneling in depth. https://github.com/jpillora/chisel Recon This one is not a novel and secret tip, but I wanted to include it anyways: Use AutoRecon by Tib3rius . Use it from the first day on, this will allow you to get a feeling for how exploitable and none exploitable recon results may look like. https://github.com/Tib3rius/AutoRecon If you have the time (medium priority for the OSCP, high priority for real job), learn all of the recon tools by themselves. In a real world Red Team engagement there will be no AutoRecon. Privilege Escalation Practice it hard, keep good notes and watch the courses by Tib3rius: https://www.udemy.com/course/linux-privilege-escalation/ https://www.udemy.com/course/windows-privilege-escalation/ While you watch them take note of all the ways shown and compile them into a checklist. The Exam I recommend you do the following preparations: Make a backup of your Kali installation and your notes, have a backup device Prepare meals and sources of caffeine eliminate distractions Get up earlier the day before the exam day, so you will sleep better Read your notes to refresh your memory But to be honest: All of the above might be useful, but the exam will only be passed, if you have studied and prepared really well. Good luck. If you liked this article, or you want to have a chat about preparing for the OSCP with me, you can find me over on Twitter @secbyaccident. You can also check out all my other stuff on . https://security-by-accident.com/ Additional resources https://johnjhacking.com/blog/oscp-reborn-2023/ https://hakluke.medium.com/haklukes-ultimate-oscp-guide-part-1-is-oscp-for-you-b57cbcce7440 https://github.com/0x4D31/awesome-oscp https://help.offsec.com/hc/en-us/articles/360040165632-OSCP-Exam-Guide Also published here .

Stories, News & Mentions about ACCIDENTCOM

Accidentcom’s Stories on HackerNoon