Certified Ethical Hacker
The EC-Council’s Certificate Ethical Hacker (CEH) is easily the oldest and most popular penetration course and certification. The official course, which can be taken online or with a live in-person instructor, contains 18 different subject domains including traditional hacking subjects, plus modules on malware, wireless, cloud and mobile platforms. The full remote course includes six months of access to the online Cyber Range iLab, which will allow students to practice over 100 hacking skills.
Sitting for the CEH certification requires taking an official course or, if self-study, proof of two years of relevant experience or education. It contains 125 multiple-choice questions with a four-hour time limit. Taking the exam requires accepting the EC-Council’s Code of Ethics, which was one of the first required codes of ethics required of computer security test takers. The courseware and testing is routinely updated.
SysAdmin, Networking, and Security (SANS) Institute is a highly respected training organization, and anything they teach along with their certifications are greatly respected by IT security practitioners. SANS offers multiple pen testing courses and certifications, but its base GIAC Penetration Tester (GPEN) is one of the most popular.
The official course for the GPEN, SEC560: Network Penetration Testing and Ethical Hacking, can be taken online or live in-person. The GPEN exam has 115 questions, a three-hour time limit, and requires a 74 percent score to pass. No specific training is required for any GIAC exam. The GPEN is covered on GIAC’s general code of ethics, which they take very seriously as attested to by a running count of exam passers who have been disqualified for violating the code.
“I like how [the GPEN exam] ties to practical skills that penetration testers need to have to do their jobs every day,” says Skoudis. “It covers everything from detailed technical approaches to testing all the way up through scoping, rules of engagement, and reporting. The exam is very scenario focused, so it will present a given penetration test scenario and ask which is the best way forward. Or, it’ll show you the output from a tool, and ask what the tool is telling you and what you should do next. I appreciate that so much, as it measures real-world skills better. The exam doesn’t have a lot of questions that are merely definitional, where they have a sentence that is missing one word and ask you which of the following words best fill in the sentence. That’s not a particularly good way of measuring skills.”
Offensive Security Certified Professional
The Offensive Security Certified Professional (OSCP) course and certification has gained a well-earned reputation for toughness with a very hands-on learning structure and exam. The official online, self-paced training course is called Penetration Testing with Kali Linux and includes 30 days of lab access. Because it relies on Kali Linux (the successor to pen testers’ previous favorite Linux distro, BackTrack), participants need to have a basic understanding of how to use Linux, bash shells and scripts.
The OSCP is known for pushing its students and exam takers harder than other pen testing paths. For example, the OSCP course teaches, and the exam requires, the ability to obtain, modify and use publicly obtained exploit code. For the “exam”, the participant is given instructions to remotely attach to a virtual environment where they are expected to compromise multiple operating systems and devices within 24-hours, and thoroughly document how they did it. Offensive Security also offers even more advanced pen testing courses and exams (e.g., including involving web, wireless, and advanced Windows exploitation). Readers may want to take advantage of their free, online basic Metasploit tool course.
Foundstone Ultimate Hacking
McAfee’s Foundstone business unit (which I worked for over 10 years ago) was one of the first hands-on penetration testing courses available. Its series of Ultimate Hacking courses and books led the field for a long time. They covered Windows, Linux, Solaris, web, SQL, and a host of advanced hacker techniques (such as tunneling). Unfortunately, Ultimate Hacking courses don’t have formal exams and certifications.
Today, Foundstone offers a host of training options well beyond just pen testing, including forensics and incident response (as do many of the other players in this article). Additionally, Foundstone offers training in hacking internet of things (IoT), firmware, industrial control security systems, Bluetooth and RFID. Foundstone instructors are often real-life pen testers and security consultants, although many, if not most, of the training courses are handled by partners.
Internationally, the not-for-profit CREST information assurance accreditation and certification body’s pen test courses and exams are commonly accepted in many countries, including the United Kingdom, Australia, Europe, and Asia. CREST’s mission is to educate and certify quality pen testers. All CREST-approved exams have been reviewed and approved by the UK’s Government Communication Headquarters (GCHQ), which is analogous to the United States’ NSA.
CREST’s basic pen testing exam is known as the CREST Registered Tester (or CRT), and there are exams for web and infrastructure pen testers. Exams and costs vary by country. CREST test takers must review and acknowledge the CREST Code of Conduct. The Offensive Security OSCP certification can be used to obtain the CRT.
All the instructors I spoke to believed that the courses they taught were just a beginning. Barker of CBT Nuggets said, “[Certification exams] are a great entry point and exposure to all the foundations that you can then go onto more.”
“Each [of our classes] is not just a standalone class someone takes for six days and then disappears,” says Skoudis. “Instead, our classes are more like an ecosystem, centered around that 6 days of training, but with webcasts and follow up blogs for continued learning going forward. Also, we’ve been super fortunate to have our previous students contributing to this ecosystem through their own blogs and tool development, giving back to the community. It’s really a beautiful virtuous cycle, and I’m so thankful to be a little part of it.”
Ethical hacking tools
Ethical hackers usually have a standard set of hacking tools that they use all the time, but they might have to look for and stock up on different tools depending on the particular job. For example, if the penetration tester is asked to attack SQL servers and has no relevant experience, they might want to start researching and testing different SQL attack tools.
Most penetration testers start with a Linux OS “distro” that is specialized for penetration testing. Linux distros for hacking come and go over the years, but right now the Kali distro is the one most professional ethical hackers prefer. There are thousands of hacking tools, including a bunch of stalwartsthat nearly every pen tester uses.
The most important point of any hacking tool, beyond its quality and fit for the job at hand, is to make sure it does not contain malware or other code designed to hack the hacker. The vast majority of hacking tools that you can get on internet, especially for free, contain malware and undocumented backdoors. You can usually trust the most common and popular hacking tools, like Nmap, but the best ethical hackers write and use their own tools because they don’t trust anything written by someone else.