Passed GIAC GXPN Exam

Hey guys, I challenged and passed certification exam for SANS 660 - GIAC Exploit Developer and Advanced Penetration Tester (GXPN) recently.

As with most of my previous GIAC exams, I did a self-study for GXPN as well. SANS / GIAC categorizes this exam / course as 'Advanced' so keep that in mind when preparing.

Exam objective break up list is available on GIAC GXPN site and must be the first place to prioritize study plan. As I see it, there are 2 sections to plan for.

First, you got to study, practice hands-on and should have good prior experience primarily in Penetration Testing. An experienced pen tester carries knowledge & skills in a variety of domains - systems, networks, applications, architecture, etc., - & how to break each using tools or manually by hand; and that is what this section demands. At a high level, relate the topics from objective lists of SANS GIAC 401, 504, 505, 506, 542, and 560. Anything and everything except exploit development.

Second, is Exploit Development on Windows & Linux platforms. So, your priority reading ought to be, x86, Assembly, Memory management, Stacks, Heaps, Processes, Threads, SEH, DEP, ASLR, Shellcode, Debugging, Disassembling, and various exploitation techniques on Windows & *nix. Unless you have hands-on experience in these areas, plan to spend at least 6-10 months to learn & practice.

Following are resources that helped me prepare for the SANS 660 GXPN exam:

1. Corelan.be - Peter (corelanc0d3r) has written Excellent articles on exploit development from Basics to Advanced exploitation scenarios. Highly recommended resource. Period.
2. Security Tube - Another excellent resource for learning variety of topics. Vivek has created series of video tutorials on Linux assembly, Windows assembly, Format String vulnerabilities, Buffer Overflows, Exploit research, Metasploit and many more. His way of teaching is pretty good. I highly recommend studying his primers for preparation to GIAC GXPN.
3. Shellcoder's handbook 2nd edition - Thorough coverage of *nix exploitation. Windows and other OS are covered as well. A good resource. Get it here.
4. Microsoft MSDN / Technet - This is required reading for various topics, such as Windows memory management, process, threads, heaps, SEH, DEP, etc.
5. Exploit-db (Papers) - Formerly milw0rm, there are some really good papers that detail various exploitation techniques. This is required reading, folks.

In addition to all the above resources, the essential, final element is hands-on experience. There is no alternative to it. Build a virtual lab, go to exploit-db.com, download vulnerable applications and their corresponding exploit codes and test them out in your virtual machines. Learn to use Immunity Debugger / Ollydbg, IDA pro / gdb disassembler. Spend time, make notes and follow along the topics one by one. Always start it one step at a time and trust me, you'll be sprinting in no time.

My views on exam are mixed. Most questions were pretty straight and some really twisted. Apparently, pretty straight to me, cos I have decent EEE (education, exposure, experience) in pen testing, and work on exploit dev every once in a while. Twisted ones especially on the exploit development domain. I feel exam can be further improved in 2 aspects:

1. More screen cap based questions should be there in exam which will test a candidate's ability to read through registers, memory locations and identify issues, and solutions in making an exploit work.
2. For any incorrect questions, I hope SANS GIAC starts to show a hint for why the chosen answer was not correct. Currently, you answer incorrectly and you get no freaking idea why it was so. The objective of exam needs to be to enforce the learning and not only to get a certificate.

Overall, it has been a long process to prepare and become confident of completing this expensive challenge (~1000$). It took far greater effort than earlier GIAC exams I completed - GPEN, GCIH, GREM, and GWAPT.

For those who are preparing for GIAC GXPN, feel free to comment, and ask questions. I will be glad to help.

Passed GIAC GWAPT Exam

Hi dears,

I just wanted to share first update of this year.

I sat for & passed the SANS GIAC Web Application Penetration Testing - GWAPT - exam on January 14, 2012. I found the exam was pretty tough as compared to the previous GIAC exams I had attempted - GPEN, GCIH, and GREM.

I have been doing web app pentesting for a while. So, most of the tested topics were not new to me. I did a self-study for this exam. I used the following study resources to prepare:

1. SANS GPEN course material

2. OWASP - this site has a lot of good, relevant information on a majority of web app topics.

3. Web Application Hacker's handbook

4. SQL Injection - Attacks & Defense by Justin Clarke - A superb book for injection attacks.

5. Backtrack - Specifically for any or all related tools - load it up & practice various web app testing related tools on this dist.

6. Google - Yeah, search out specific topics, terms, video tutorials, tool demonstrations. This is significant especially if you choose to take the self-study route.
7. Misc Notes - some random, personal notes on various topics.

I know it's not easy to take out 4000+ usd for official course materials. I hope this info will help someone planning self-study to tame this beast.

As always, let me know if you have any questions. I will be glad to help.

KG

Passed GIAC GREM Exam

Hey guys, I passed GIAC GREM this June 05, 2011. GREM is the Reverse Engineering Malware [ SANS 610 class ]. I find the RE stuff pretty cool. You get to learn how to analyze web, doc, pdf, and flash based malware; plus the fundamentals of exploit dev, vectors and similar sexy dope.

GIAC GREM

If you have any questions, feel free to comment n ask here.

Cheers!

Edit: A lot of people have been emailing me asking the suggestions on self-study resources for GREM. So, I am updating this post with my response info. 

Hope you will find it useful.

Malware Analyst's cookbook is a great resource for GREM exam preparation. Also check out Lenny Zeltser's website for articles, posts, and other information. Go join in Offensive computing website and get your hands dirty with the malware specimens. Apart from these, I would also encourage to go through my blog posts dissecting a bot specimen using the RE methodology and RE tools. 

From the exam perspective, when you purchase the exam, you will also receive 2 practice tests. These tests will give you a fair idea on the type of questions, & depth expected in the exam. For a list of topics that GREM covers, please refer to GREM exam link.

The links are as follows:

1. Lenny Zeltser's website: zeltser.com
2. Offensive Computing website: http://offensivecomputing.net/
3. GREM Topics: http://www.giac.org/certification/reverse-engineering-malware-grem
4. My blog posts covering bot analysis, patching malware, and manually unpacking a malware for analysis:
http://ipositivesecurity.blogspot.in/2011/07/analyzing-malware-begin.html
http://ipositivesecurity.blogspot.in/2011/07/analyzing-malware-slackbot-i.html
http://ipositivesecurity.blogspot.in/2011/07/analyzing-malware-slackbot-ii.html
http://ipositivesecurity.blogspot.in/2011/08/analyzing-malware-patching-in-way.html
http://ipositivesecurity.blogspot.in/2011/08/analyzing-malware-manually-unpacking.html

Passed GIAC GCIH Exam

Hey fellas,

After around a month's preparation post passing GPEN, I sat for and passed  GIAC Incident Handling exam yesterday.

Here is the program detail:

GIAC Certified Incident Handler

This subject teaches about Incident Handling skills, and dives deep into various attack vectors. Also, interesting is to learn how to understand and apply this knowledge to attacks vis-a-vis the 6 Incident Handling phases.

The exam was gripping at all times, and I found a handful of pretty tricky questions in there too. I will not delve any detail on the questions, only that you should have decent experience in most / all the topics mentioned in the syllabii as well as have at least some exposure to handling events / incidents from a high level.

Here is the GCIH certification bulletin:

http://www.giac.org/certbulletin/gcih.php

Day 1 today, and I am already finding this knowledge very helpful. It is comforting to be able to relate methods n thought process of a penetration tester in confirming / exploiting security weaknesses in a customer environment, with the defensive approach of an Incident Handler. This brings out all the worth of GPEN n GCIH cos it is crucial to be able to help customers' infosec / security team understand ways an attacker can get in as well as recommendations pertaining to each of the phases of Incident handling process; i.e.   preparation / identification / containment / eradication / recovery and lessons learned. And lastly and equally importantly, as a consultant, you can show the playground and the game to (non-tech) executives.

What say? Go for it!

Best Regards.

Passed GIAC GPEN Exam today

Hey peeps,


My first post of this year. And what a busy lazy ass I've been since past few months.


So quick update is that I attended SANS 560 class in February 2011. And sat for the exam today March 14, 2011 here at a local kryterion center, that's actually exactly 3 weeks later.


Briefly hissing, I completed the test in around 2:30 hours out of 4 and scored a decent 93%.


Yeah, I passed. I am GIAC GPEN certified now. Yay!


I hope I can use this weekend to try put down my study plan in a new post.


Ping me if you've any questions etc.


Keep learning.!