Passed GIAC GXPN Exam

Hey guys, I challenged and passed certification exam for SANS 660 - GIAC Exploit Developer and Advanced Penetration Tester (GXPN) recently.

As with most of my previous GIAC exams, I did a self-study for GXPN as well. SANS / GIAC categorizes this exam / course as 'Advanced' so keep that in mind when preparing.

Exam objective break up list is available on GIAC GXPN site and must be the first place to prioritize study plan. As I see it, there are 2 sections to plan for.

First, you got to study, practice hands-on and should have good prior experience primarily in Penetration Testing. An experienced pen tester carries knowledge & skills in a variety of domains - systems, networks, applications, architecture, etc., - & how to break each using tools or manually by hand; and that is what this section demands. At a high level, relate the topics from objective lists of SANS GIAC 401, 504, 505, 506, 542, and 560. Anything and everything except exploit development.

Second, is Exploit Development on Windows & Linux platforms. So, your priority reading ought to be, x86, Assembly, Memory management, Stacks, Heaps, Processes, Threads, SEH, DEP, ASLR, Shellcode, Debugging, Disassembling, and various exploitation techniques on Windows & *nix. Unless you have hands-on experience in these areas, plan to spend at least 6-10 months to learn & practice.

Following are resources that helped me prepare for the SANS 660 GXPN exam:

1. Corelan.be - Peter (corelanc0d3r) has written Excellent articles on exploit development from Basics to Advanced exploitation scenarios. Highly recommended resource. Period.
2. Security Tube - Another excellent resource for learning variety of topics. Vivek has created series of video tutorials on Linux assembly, Windows assembly, Format String vulnerabilities, Buffer Overflows, Exploit research, Metasploit and many more. His way of teaching is pretty good. I highly recommend studying his primers for preparation to GIAC GXPN.
3. Shellcoder's handbook 2nd edition - Thorough coverage of *nix exploitation. Windows and other OS are covered as well. A good resource. Get it here.
4. Microsoft MSDN / Technet - This is required reading for various topics, such as Windows memory management, process, threads, heaps, SEH, DEP, etc.
5. Exploit-db (Papers) - Formerly milw0rm, there are some really good papers that detail various exploitation techniques. This is required reading, folks.

In addition to all the above resources, the essential, final element is hands-on experience. There is no alternative to it. Build a virtual lab, go to exploit-db.com, download vulnerable applications and their corresponding exploit codes and test them out in your virtual machines. Learn to use Immunity Debugger / Ollydbg, IDA pro / gdb disassembler. Spend time, make notes and follow along the topics one by one. Always start it one step at a time and trust me, you'll be sprinting in no time.

My views on exam are mixed. Most questions were pretty straight and some really twisted. Apparently, pretty straight to me, cos I have decent EEE (education, exposure, experience) in pen testing, and work on exploit dev every once in a while. Twisted ones especially on the exploit development domain. I feel exam can be further improved in 2 aspects:

1. More screen cap based questions should be there in exam which will test a candidate's ability to read through registers, memory locations and identify issues, and solutions in making an exploit work.
2. For any incorrect questions, I hope SANS GIAC starts to show a hint for why the chosen answer was not correct. Currently, you answer incorrectly and you get no freaking idea why it was so. The objective of exam needs to be to enforce the learning and not only to get a certificate.

Overall, it has been a long process to prepare and become confident of completing this expensive challenge (~1000$). It took far greater effort than earlier GIAC exams I completed - GPEN, GCIH, GREM, and GWAPT.

For those who are preparing for GIAC GXPN, feel free to comment, and ask questions. I will be glad to help.