Certifications Pro & Con

A lot has been written about certifications and whether you should have them or not. For me it is pretty simple, certifications helped me finding jobs and improving my career.

As a penetration tester I made OSCP and OSCE, for getting a bit more into DFIR I made the CHFI certification. At the beginning of my career I did CompTIA Network+ and Security+ for learning and prooving my skills. At some companies it is simply a door opener. I know enough people who never certified and are great at their jobs and also don’t have problems making a good career.

But of course there are other ways to show your motivation:

  • have projects or a blog that are showing your skills
  • have you found vulnerabilites? write them down in your CV
  • found something great? consider to give a talk at a conference
  • maybe you are a great CTF player?
  • don’t forget your personal network

Besides that, what certification you want to do strongly depends on your career path and the budget. SANS courses & certs cost a ton if you have to pay for yourself and are mainly useful if you want to go into DFIR.

On the other end there are certifications from EDX or coursera that are cheap but of course not that recognized. Certifications from securitytube are also worth a look.

After all it is the mix of certifiations, courses, experience, personality, connections and so on that enables your career.

Review Wargames Over the Wire

URL: http://overthewire.org/wargames/
Career Path: Pentesters, Beginners in Security
Level: All, good for beginners

The wargames are free & fun, I tested two games so far, Bandit and Natas, but there are much more that include also crypto and explotation wargames.

Bandit

From the website:

  • aimed to absolute beginners
  • connection over ssh with given credentials, no registration needed
  • for learning linux commands/hacking
  • in each level you have to find the password for the next level
  • exercides are for example search for the password in hidden files, files with special characters, learning commands
  • Reading the exercise makes absolute sense here 😉

Example:
The password for the next level is stored somewhere on the server and has all of the following properties:* owned by user bandit7* owned by group bandit6* 33 bytes in size

For starting you get your first credentials and then hack on:

http://overthewire.org/wargames/bandit/

Natas
Natas is for learning webserver security. You can just start right away and log into the first exercise:

http://natas0.natas.labs.overthewire.org/
  • Read the source code
  • Use a proxy like Burpsuite might be useful
  • starting simple, but you should read a bit about html and http before starting
  • first find tokens in code, files, change cookies and so on

I hope I will have some time to write about the other wargames too.

Hack on!

Getting started with hackthebox

Career Path, Labs: Penetration Tester
Challenges: Penetration Tester, Forensics, Malware
Level: All

Until now I never realized that hackthebox also offers free accounts, so I decided to test it and write a short post. 

After a challenge here you can create your login. With the connection pack for openvpn it is possible to connect to the labs with a Kali machine (or any other Linux I guess), easy.

With the free account you can solve challenges and active machines.

Active machines
For owning systems and users there are flags that are stored in files on the machines, for example:

The labs remind me about the OSCP labs, and lots of people are using them for training before the OSCP certification (which might be a good idea, though I did not) or to get an impression about the labs and the exam.

For more information and getting an impression about owning boxes look here, lot’s of walkthoughs for retired boxes.

At the time of this writing 20 machines were online, with different OS versions (Linux, Windows, BSD) and different scenarios. I had a closer look at some boxes and solved one so far in a couple of hours. 

The lab looks really fun, and I would recommend it for everyone who wants to train and learn hacking.

Challenges
The challenges also look quite good, i had a look but honestly, I am much more into owning. Here are the categories for the challenges:

For solving for example the Stego challenges, you download a file with a hidden message and have to find it. I was surprised that there are also some Forensics challenges, I will defilnetly have a look into those too.

Conclusion
This is definetly a great playground for everyone who is into solving challenges and pwn boxes. I am not sure if hackthebox is good for total beginners, there are no big explanations or tutorials for the machines or what is to do. There are the official forums with hints and some websites offering more in depth explanations, although the rules say that this should not be done, and somehow as an OSCP taker (“Try harder”) this feels like cheating. With the VIP membership you also have the retired machines with walkthroughs.

For your career hands-on and solving challenges is a very important part, so I recommend: sign up.

Links:
https://www.secjuice.com/hack-the-box-starter-pack-edit/
https://veteransec.com/category/hack-the-box-write-ups/
https://resources.infosecinstitute.com/hack-the-box-htb-machines-walkthrough-series-jerry/#gref

Working at a CERT and shifting to Technical Lead

This article is part of an article series about my personal experience and career in the penetration testing and security field.
Part 1: Start a Penetration Tester Career
Part 2: From Beginner to Expert as Penetration Tester
Part 3: Working at a CERT and shifting to Technical Lead (this part)

A new job
Because I was interested in Incident Response and wanted to specialize more in the field of penetration testing I applied at a CERT in one of the 30 biggest DAX enlisted companies in Germany. The environment was of course completely different to consulting companies:

  • more long-term thinking
  • not much overtime
  • more administrative work
  • more time for in-depth work

As in every job there are some advantages but also some disadvantages, but the advantages predominate for me.


More specialization
I was lucky that it was possible for me to attend lot of training and learning on the job. At this time my plan was to specialize in the field of exploitation. Among the training I did was:

  • “Tactical Exploitation and Response“ by Attack Research
  • Internal Incident Response Training
  • SANS Sec 660 with GXPN certification
  • “Windows Kernel Exploitation” by Hacksys (higly recommended)
  • Corelan Bootcamp & Corelan Advanced (higly recommended)

Also I was able to go to conferences like Brucon, Blackhat, Defcon and others and I could present Avet now three times at the Blackhat Arsenal, which is by the way one of the most fun events I presented.

But it became different
… than it was planned by me, which is not a bad thing. I did a lot of Incident Handling and later I was involved ramping up a vulnerability management system. While the latter is not that interesting for most people working in penetration testing, I learned a lot about companies politics and also management, which helped me a lot within my personal development. Because I traveled mainly to Asia I could also get Chinese lessons at work, which is a great thing. 

Promotion
After about three years I was promoted to a technical lead position in the Red Team of the CERT with some new duties:

  • Ensure that all provided services (Pentesting, Vulnerability Management and so on) work properly
  • Adjusting with the other CERT teams and management
  • Conducting job interviews
  • Organizational tasks (yes, writing excel sheets)

About the new position I sometimes have discussions with other professionals. One thing is that I definitely shifted away from technical stuff. On the other hand it is possible to influence the direction for the future, for example what should be in focus for the next time. By job descriptions and job interviews you can find suitable people for your team and so on. 
Important for me is not to loose the connection to the hands on work, so I like to be involved here too. But being also involved in some management tasks also gives the opportunity to self improvement and training on a non technical level.
If you do not like these tasks you better continue you technical career, which also gives you opportunities for improving and developing.

Conclusion
Besides all things I learned from a technical point of view (Incident Response, Trainings etc.), the more important lesson for me was and still is what I can learn from a management point of view and the personal development. Sometimes the attitude and the political thinking is more important than the technical knowledge for improving things in a big company, I try to find a way where I can combine both.

Two important take aways:

  • The exploitation trainings in that depth were not necessary when I look back at this time. It was no total waste of resources, but choosing more careful and adjusting your learning goals is always a great idea.
  • After staying for 18 and then 17 months at the two jobs before it is a good idea to stay a bit longer at the new job. Changing jobs too often might look bad on your CV. Also staying for a longer time is also opening new perspective (when you are on the right company).


That concludes the career article series from my personal point of view (so far) and I hope you enjoyed reading and that my experience is also helpful to other people and especially to beginners in the field.

Links

Some Online courses I did during that time:

Books:

For more links and book recommendations please have a look at the recommendations list.

From Beginner to Expert as Penetration Tester

This article is part of an article series about my personal experience and career in the penetration testing and security field.
Part 1: Start a Penetration Tester Career
Part 2: From Beginner to Expert as Penetration Tester (this part)
Part 3: Working at a CERT and shifting to Technical Lead

My first job
The first job as a penetration tester was pretty exciting for me. I was lucky to have many colleagues that engaged very much with the newcomers, and for the beginning everyone got at least three workshops lasting 2-4 days, if I remember correctly. The OSCP prepared me pretty well to the thinking of solving the day to day problems on the job. The job was at a consultancy company that mainly is doing penetration testing engagements in Germany. During that time I also started researching about antivirus evasion (in my free time btw). I most consultant jobs time on the job is short. For me that was a huge advantage, I was able to do web app testing in short time. Besides learning from colleagues I also read some books like The Web Application Hackers Handbook, The Shellcoder’s Handbook and Network Security Assessment.
I had my first presentation (in German at the Backtrack Day 2013) about antivirus evasion, which made me very proud of course. 
During the first job that lasted 18 months I also visited the CCC Congress twice, had several chances to conduct interesting pentests (mostly web and mobile) and did an interesting online course (Malicious Software and its Underground Economy: Two Sides to Every Story). Because I liked the hole exploitation topics I made the SLAE certification, which was a lot of fun and I highly recommend, also for preparing the OSCE. Now there is also a 64 Bit version.

My second job
I learned a lot and had great colleagues, but for me it was time to move on to my second job as a penetration tester, where I had the chance to travel more and to work for clients on site. Further I had the chance to do some Digital Forensics and Indident Response (DFIR) under the condition I do any certification, so I choosed the one the looked easiest for me, that was the CHFI (Certified Hacking Forensics Investigator). I would not necessarily recommend it, but at this time it helped me improving my career and also to do some forensics and incident response work. For the preparations I bought “The Official CHFI Exam Study Guide”. For gaining more in depth knowledge about forensics I attended a course at the University of Applied Sciences Albstadt-Sigmaringen about data storage forensics.
Besides the work I continued my research on antivirus evasion and gave a talk at the Deepsec conference 2014 (“Why Antivirus Software fails“).
Also I had the chance to speak at public and closed events from my employer and started to visit the OWASP chapter Cologne. For education and to get from professional to expert level I decided to make the OSCE certification. That was a blast for me. I never had such a challenging time in my career and I fell through the first test and had to take a second shot. The OSCE is highly recognized especially in the Red Team and Exploitation community. Like the OSCP for me it is not about teaching certain techniques, but training the right attitude you need for breaking stuff (Try harder). I was glad when I got the famous mail from offensive security after the second exam.
After 17 months on that job I took my chance and hired at a CERT, this will be the story for part 3.


Conclusion & some notes

  • be grateful for the knowledge and support of friends and colleagues – sometimes I forget to say this… so to everyone who helped me during my career: thank you!
  • when it is time to move on, move on, after all it is about business and your personal development
  • Giving talks gave me the great opportunity to network in the community and also to improve self esteem and public speaking
  • Be flexible, I moved for each job in the IT security field
  • for more networking I started to use twitter
  • Don’t give up, “Try harder”, the motto by offensive security also applies to searching for jobs and many more lessons in life, this attitude helped me also with my research
  • Working at a consultancy company is helpful, since it teaches you to be effective (time and costs), you learn to deal with pressure

Further reading:
https://danielmiessler.com/study/infosec_interview_questions/
https://netsec.ws/?p=517
https://coffeegist.com/security/my-osce-review/
https://master-digitale-forensik.de/

Short Review: x33fcon

x33fcon is a nice & small conference in Poland, Gdynia near to Gdansk.

“Welcome to x33fcon, a new gathering for IT security professionals and enthusiasts. It’s a new event where blue and red teams meet to exchange views and ideas, share experiences, and discuss the latest security challenges in the industry.”
From: https://www.x33fcon.com/

The ticket price is low (also if you plan to travel there privately), the content was really professional and interesting, a bit more than someone might expect when you see the size of the con. Kudos to the organizers for getting so many interesting speakers and talks. Besides the talks there is also a CTF and workshops, after the conference trainings take place. There is also some great food for lunch, in the breakes there is coffee and small snacks. The breakes are long, so you have some time to talk with speakers and other folks around. Seems to be that ATT&CK is the hot topic currently, at x33fcon alone they had three talks about that. 

From my point of view as a Red Teamer some more talks about breaking stuff on exploitation level would have been great. x33fcon is a great conference, the only critics from my side is that the attendees are being filmed in every talk from any perspective possible. At other conferences they ask when making photos or filming, maybe that might be an idea when not filming the whole audience.

Besides the conference Gdynia, Gdansk and the beaches around are really nice:

Conclusion: Highly recommended.

Coursera courses for free

Like for EDX, it is possible to take coursera courses for free. Here is a short example.

Login (or register if you have no account). Go to the course you want to attend to, in this example I take “Programming Languages, Part A”. Please note that the option described here are not possible for all courses.

On the course page select “Enroll”:

In the pop-up choose “Full course. No certificate” and continue.

And you can start:

Have fun!

EDX courses for free

EDX courses can be taken for free. Of course then you will miss the certificate, but the content is the same. Also you have a time limit for viewing the content, but in my experience it is more than enough.

Here is a short example:
After logging in with your account (register if you do not have one) search for the course you want attend to.

For the example I choosed “Introduction to Cybersecurity”.

Choose “Enroll now” on the course page:

Scroll down a bit and choose “Audit this course”:

One the next page you can just start the course. A dialog might be shown that you can earn the certificate, you can just ignore that or choose “Explore the course” here:

Enjoy and keep learning!

Start a Penetration Tester Career

This article is part of an article series about my personal experience and career in the penetration testing and security field.
Part 1: Start a Penetration Tester Career (this part)
Part 2: From Beginner to Expert as Penetration Tester
Part 3: Working at a CERT and shifting to Technical Lead

From Administrator to the first Penetration Tester Job

I am sharing this because people ask me often about how to get into information security and how to improve a career. In this post, I describe my personal career and learning path including recommendations for books and more learning material. This may not be perfect to other people, for me it just worked. In later posts, I will give some recommendations for a more idealized learning path for different careers, for example as a penetration tester or a forensics specialist.

When I was working as an administrator back in 2011, I began starting to think about how I might change my career. My job back then included some Windows and Linux administration as well as some PHP and VBA coding. Further, I had coding skills in C and Java. In October 2012 I started my first job as penetration tester.

At this time, it was not clear to me whether to go more into depth as a network admin or to security. Since it seemed to be a good idea to have some networking skills, I started to work out a plan for getting the CCNA. 

Network skills
I started with the Mikrotik MCNA, since there was a training possibility in the town where I lived, I only used the training material offered by this course, but if you want more information have a look at the official Mikrotik page: https://mikrotik.com/

Then CompTIA Network+ followed. For the test preparation, I relied on two sources. The first is the free video series from professor Messer, these are excellent and I used to make notes about the content and reviewed them before a new training session. After the videos, I bought the book
Mike Meyers’ CompTIA Security+ Certification Passport” that included some example questions for training.

The CCNA was my first “bigger” certification and I remember that I put a lot effort in it, for example I bought a bunch of old switches and routers for a home lab. This was not necessary, but of course, it added some fun at this time. Much easier is to use simulation software for doing some labs.

Besides my own experiments, I worked through the book CCNA Routing and Switching Complete Study Guide. The certification at this time included not only the multiple choice tests, but also lab exercises.

Security skills
Because it became clear to me that I wanted to go into Security in my career, I started the CompTIA Security+ certification. As like for Network+ I used the Professor Messer tutorials and the book Mike Meyers’ CompTIA Security+ Certification Passport. 

I wanted to work as a penetration tester; I decided to do the OSCP certification and I am happy I did choose it over the CEH. Here is my review in German, more reviews in English here.

I made the certification in 2012, and nowadays I do not think that you must have an OSCP necessarily, although I strongly recommend it. It is a great certification and it surely helped me especially when it comes to attitude, endurance and patience. However, it can be a frustrating experience and if you do not have enough time or motivation, it will be hard. For me it was fun!

During the OSCP preparation, I bought two books:
–      The German book “Hacking mit Metasploit” (Hacking with Metasploit) by Michael Messner, which helped me a lot because it also introduced some Exploit Development and Client Side Attacks.
–      Hacking: The Art of Exploitation by Jon Erickson 

After the OSCP, I was lucky to find my first Job as a penetration tester.

Besides the certifications I also did a course at coursera “Webapplication Engineering” which I liked but it seems it was not continued.

Together with a friend we published an article in the German issue of the pentest magazine about pivoting, which was good having it on my CV for the first job in the field.

Conclusion
If you want a job in this field, the most important thing for me is to show that you are motivated. Nowadays I had some job interviews “on the other side” from the perspective of an employer. So besides qualifying with certifications and courses you should consider:

  • Start your own blog
  • Start your own projects on github
  • Contribute to projects
  • Networking (when I looked for my first job as a penetration tester I used Xing and wrote to company owners and asking for a job, which was successful) 
  • Consider publish articles on platforms like Xing, LinkedIn, magazines etc.

In the next part, I will go from starting the first job to going for expert level.

Review EDX Course Security in Office 365 (Microsoft CLD245x)

Recently I took the course Security in Office 365 using the free Audit Access, the final exam and the Certificate are missing here.
The sections of the course are:
  • Threats and data breaches targeting your data
  • Office 365 Advanced Threat Protection
  • Office 365 Threat Intelligence
  • Auditing, alerting and reporting in Office 365
  • Advanced Security Management in Office 365
After each section there is a quiz, as well as an final exam with 20 questions (missing in the free version). I’ll go through each section adding some notes.
Introduction to Security in Office 365
Threats and data breaches targeting your data
  • how threat actors gain access
  • kill chain
  • how the work and threat landscape changed
  • on-premises environment vs “gray area” (cloud etc.) in terms of controll and security
  • phishing
  • malware
  • spoofing
  • escalation of privilege
  • data exfiltration
  • data deletion including ransom ware
  • data spillage (“Data spillage occurs when protected data is transferred to a system that doesn’t provide the same level of protection as the source.”)
  • as well as password cracking
  • malicious insiders
Security solutions in Office 365 
  • Exchange Online Protection (EOP)
  • Office 365 Advanced Threat Protection (Office 365 ATP)
  • Office 365 Threat Intelligence
  • Auditing and alerts
  • Advanced Security Management (ASM)
  • EOP (not End Of Protection 😉 but Exchange Online Protection)
  • Office 365 Threat Intelligence
  • Threat Dashboard
  • Auditing and alerts
  • Advanced Security Management (AMS)
  • Threat detection
  • Enhanced control
  • Discovery and insights
Introduction to Secure Score
  • Overview of Office 365 Secure Score
  • security related measurements
  • Office 365 Secure Score API
  • API & powershell
  • downstream data for other tools and SIEM etc.
  • The Secure Score dashboard
  • The Secure Score analyzer tab
  • Increasing your security posture
  • I liked some of the points:
    • Enabling multi-factor authentication on all admin accounts
    • Designating more than one global admin
    • Enabling auditing across workloads
    • Enabling mailbox auditing
    • Having a weekly review of sign-ins after multiple failures
    • Having a weekly review of sign-ins from unknown sources
    • Having a weekly review of sign-ins from multiple geographies
Implementing and Managing Office 365 ATP
Introduction to Exchange Online Protection
  • The anti-malware pipeline in Office 365
  • Zero-hour auto purge
  • ZAP, detect spam or malware that was undetected by heuristics and delivery patterns
  • Phishing and spoofing protection
  • SFP, DKIM, DMARC
  • Spoof Intelligence
  • Give overview of spoofing attempts, allow spoofing for certain senders for certain addresses
  • Managing spoof intelligence
Overview of Office 365 Advanced Threat Protection
  • How ATP expands protection provided by EOP
  • Safe attachments
  • sandbox/detonation chamber 😀
  • Safe attachment policy options
  • Safe links
  • URL detonation -> mix of safe links and sage attachements
  • Safe links policy options
Managing Safe Attachments
  • Creating safe attachment policies in the Security and Compliance Center
  • Creating safe attachments policies using Windows PowerShell
  • Modifying an existing safe attachments policy in the Security and Compliance Center
  • Creating a transport rule to bypass safe attachments
  • Safe attachments end user experience
Managing Safe Links
  • Creating safe links policies by using the Security and Compliance Center
  • Creating safe links policies using Windows PowerShell
  • Modifying an existing safe links policy
  • Create a transport rule to bypass safe links
  • Safe links user experience in email
  • Safe links user experience in Office 2016
Monitoring and reports
  • Threat protection status report
  • ATP message disposition report
  • ATP file types report
  • Malware detections report
  • Top Malware report
  • Top Senders and Recipients report
  • Spoof Mail report
  • Spam Detections report
  • Sent and received email report
  • Security & Compliance Report Demonstration
Using Office 365 Threat Intelligence
Office 365 Threat Intelligence
“Threat intelligence is evidence-based knowledge, including context, mechanisms, indicators, implications and actionable advice, about an existing or emerging menace or hazard to assets that can be used to inform decisions regarding the subject’s response to that menace or hazard.”
  • Microsoft Intelligent Security Graph
    • Source: Windows, Office 365, Cloud Services, 3rd party
  • Threat dashboard
    • reporting tool for C-level
  • Threat explorer
    • analysts, admins
Using the Threat Detection dashboard
  • Threat detections in your tenant
  • Security and malware trends
  • Alerts
  • More insights
  • Threat Intelligence Demonstration
Using Threat Explorer
  • Viewing options in Threat explorer
  • Filtering capabilities in Threat Explorer
  • Drilling for details
  • Incident reports
Implementing auditing, insights, and alerts
Overview of auditing in the Security & Compliance Center
  • Auditing architecture in Office 365
  • Audited activities
  • Office 365 Management Activity API
Enabling mailbox auditing in Exchange Online
  • Mailbox actions logged by mailbox audit logging
  • Enabling mailbox auditing
  • Specifying owner actions to audit
  • Changing the age limit for entries in the mailbox audit log
Searching the audit log
  • Enabling auditing in your tenant
  • Granting permissions
  • Searching the audit log
  • Viewing the search results
  • Filtering the search results
  • Exporting the search results to a file
  • Searching the audit log by using Windows PowerShell
  • Using a SIEM application to access your auditing data
Enabling sharing auditing for SharePoint and OneDrive
  • The SharePoint sharing schema
  • The SharePoint Sharing model and sharing events
  • How to identify resources shared with external users
Managing insights and alerts in the Security & Compliance Center
  • Introduction to insights and alerts
  • Types of insights that are available
  • Types of alerts that are generated
  • Alerts features in the Security & Compliance Center
  • Alert policy settings
  • Default alert policies
  • Viewing alerts
  • Managing alerts
Advanced Security Management
Overview of Advanced Security Management
  • Lesson introduction
  • Anomaly detection policies
    •     Login authentication failures
    •     Administrator activity
    •     Inactive accounts
    •     Location
    •     Impossible travel
    •     Device and user agent
  • Activity policies
  • Anomaly detection and activity alerts
  • Policy templates
  • Productivity app discovery
  • App permissions
Implementing policies and alerts
  • Enabling and accessing Advanced Security Management
  • Creating anomaly detection policies
  • Creating activity policies
  • Reviewing and taking action on alerts
  • Investigating activities in the Activity log
  • Grouping IP addresses to simplify management
Implementing app discovery
  • Log file requirements
  • Supported vendors and their data attributes
  • Creating app discovery reports
  • Reviewing app discovery findings
  • Troubleshooting errors when log files are uploaded
Implementing app permissions
  • App permissions architecture
  • Managing app permissions
  • Approving or banning an app
Conclusion
Unfortunately I do not have access to an Office 365 environment for testing. So I was thankful that the course gives a broad insight of the posibilites of the security configurations of Office 365. Lots of the topics come withshort  examples (like phishing, spoofing etc.) and a short video clip.

From my side more insight on the security mechanisms and more detail on Threat Intelligence would have been great.  The course goes into logging and how to find strange behaviour, malware and threat intelligence. Which was really nice to see how much effort Microsoft put into securing their cloud products.

A lot of the questions in the module assessements questions are more about configuration the platform itself or how tabs are named, I felt a bit like in a MS exam long time ago. Large parts of the content is text and not videos, most courses are a bit different here.

The course gave a good overview and insights for understanding Security in Office 365 for me, that’s what I was looking for.
Links