Nice Interactive Cybersecurity Jobs Heat Map

Montana and Wyoming have very few #cybersecurity jobs available.  Who would have guessed?

CyberSeek

OSCP progress report 2

Well, it's Sunday and I promised a report on how the OSCP stuff is going -

So far so good.

I am sticking to the plan I outlined in my last report, mostly; I fell a little behind yesterday because of some family stuff but I will catch up today and tomorrow.  Working through the buffer overflow chapters at the moment.

I am already starting to see a way to tie some of this stuff in with work too (I mean even before I walk in and say hey I am an OSCP give me a raise).  I mentioned a couple weeks ago I am building a VM lab at work for training / testing configurations.  One of the questions has been what vulnerable VMs to put on the "corporate" segment (not real corporate but the segment we are going to attack), well this site has a list of machines, on Vulnhub, that have similar vulnerabilities to the machines in the OSCP labs.  (found via this site).  I knew about vulnhub already of course, and plnned to use some of their images already, this just ties stuff together a little.

OSCP first progress report

Started yesterday after belatedly receiving the email notification that my materials were ready.  I signed up for the 90 day plan and I fully expect to have to extend at least one 30 day period because, honestly, I am not very bright.

Progress so far - 75 pages into the manual (about 20%) and have been working along with the examples.  I know that doesn't sound like much but I have a plan - when I am starting a new course I always like to go thru the materials once before starting any exercises or homework, so that is what I am doing.  I ma going to read the manual and go thru the examples along with the video, then after I have done that I will go back and do the exercise.  I think that will give me the best reinforcement of the learning.  I expect that to eat up the first month.  then I will start the real work - trying to compromise the 10 lab machines.

I know this doesn't sound like an ambitious schedule but I know me and I know that I get bored quickly if all I do is one thing so I am trying to be realistic.

After this I will start posting these updates on Sundays.

(I thought about doing video postings like a bunch of other people but that would probably break youtube)

OSCP begins

There was a little bit of confusion on when I was supposed to start this - initially I thought the 19th, then I got an email saying the 27th, then it was the 19th again but nothing showed up so I was thinking whelp, the 27th it is; but last night at about 11pm a quarantined email message came thru and I scrambled really quick to get stuff set up.  Doesn't seem like a particularly auspicious start but I am optimistic.

The materials look good.  The training manual is a 375 page watermarked .pdf.  Even before I got the packet people have been asking for copies.  Sorry guys not happening.  There are also videos (about 30 hours worth I think) also watermarked.  Again sorry guys but no sharing.

The workload seems fairly daunting - most of the write-ups I have read have recommended 100 - 120 hours lab time, so I went for the 90 day package, but I am a dumbass so I expect I will be extending at least once.  In order to successfully complete the course you have to compromise 10 machines and do a write-up (for CPEs).  They provide a template and it's pretty extensive.

Anyway that it so far I have read the first section of the manual so I will start labbing this evening.  That's my plan, by the way, read the manual and watch the videos on the way to and from work and then lab it in the evenings.  I changed that plan when I realized I would quickly get bored and burn out.  The new plan will take longer but is more in line with my learning style.

3 Books

Over the last week and a half I have read 3 new books

Monster Hunter: Siege by Larry Correia - The latest in the Monster Hunter International series.  This volume finds Owen Pitt (the main protagonist of the series) helping to prepare an invasion of an alternate dimension to recover comrades lost during the events of Monster Hunter: Legion. Management the Dragon and Melvin the Computer Troll are present, but Franks, my overall favorite character in the series is not.

Overall, while I liked this book, I did not like it as much as most of the entries in the main series.  Too much time was spent on the antagonist (Asag / Jason).  On the other hand the on-going world building is good. Correia is building an actual believable world where magic and monsters exist and it's actually pretty cool.  If you haven't read the series, do and of course read this entry in it.

After On: A Novel of Silicon Valley by Rob Reid - One of the best examinations of our technological drift that I have read in a long time (maybe ever).

After On looks at things like Privacy, the Gig Economy, Quantum Computing, AI and the Singularity in a way that is both entertaining and though provoking.  I am a bit of a Luddite - I don't believe in change just for change's sake (I am not opposed to change, I just think there should be an articulatable reason to upend complex systems), I don't believe that most new technology makes things better, maybe just more convenient, which is not the same thing, and I don't think Silicon Valley Technocrats should be running the world - so this book struck home pretty well with me.

Beyond the above though, it's humorous, well written and engaging.  I highly recommend this book.

The Illusion of Due Diligence by Jeffery S. Bardin - I'm just going to say it - Don't read this book.  From what I gather online the author is pretty well-respected in the infosec community, but you wouldn't know it from the writing here.

There are a number of problems:

First - Notes from the CISO Underground makes it sound like he is going to be sharing stories from multiple CISOs as cautionary tales.  Instead it is just the author and none of the stories strike me as particularly remarkable.

Second - The author comes off as a bit of a prude / blowhard.  This may be editing problems (i.e. his "voice" is wrong) but the constant harping on the code of conduct of the CISSP and CISM and his invocation of Federal and State laws (generically, never specifically referenced, just an "I knew they were violating several laws and couldn't be a part of this") makes him sound like some sort of whiny tattletale, not as an identifiable protagonist.  I know ethics and legality are important and I am not criticizing the author for wanting to operate in an ethical and legal manner.  It's just the tone the book takes.  It's horrible.

Finally - This book was apparently self published and it shows.  Bad grammar, bad editing.  It really needed some polishing before release, and that might have helped with point two.

Just stay away unless a new version comes out.

OSCP and Defcon26

First - I was thinking my OSCP course started on the 27th, nope it starts on the 19th.  I would have missed it except i decided to double check this morning.  I have to say these guys are kind of a pain in the ass.  Any link they send you is only open for 72 hours.  It's like screw you I am paying you for access to this stuff you bastards, but given that they are really the only game in town what can you do.

Second - This is freaking crazy

So of course I booked at the Linq.  May have to add days if I end up going to Blackhat too.

OSCP

Signed up for the Pentesting with Kali Linux course from Offensive Security.  Going to try for my OSCP.    If anyone has any hints, not cheats, but actual hints on good sources of info etc.  send them my way.