Your opinion about online courses

[Alex Fiuvertiz]

EHLO,

What are your opinions about the online/on demand courses that are
offered by Offensive Security, SANS, etc?
I realize that it demands some kind of self-discipline when it comes
to dedicate time and so on, but besides that, is it just a waste of
money?
Is it better to spend the money on books and the time on reading and nmap -iR ?

I also realize that a course led by an instructor gives you much more,
but this question is about the online courses.

Thank you for your reply

/ A.F

------------------------------------------------------------------------
This list is sponsored by: Information Assurance Certification Review Board

Prove to peers and potential employers without a doubt that you can actually do a proper penetration test. IACRB CPT and CEPT certs require a full practical examination in order to become certified.

http://www.iacertification.org
------------------------------------------------------------------------

[Eric Milam]

The overall answer is you get out of them what you put into them.  But  
that goes for anything.

I can speak to the Offensive Security Course.  I love them, they teach  
you a lot and you are truly challenged.  One thing to remember is they  
are self study.  So you may not always get the help you are looking for.

Instructor courses are over rated sometimes.  I took a C|EH course and  
I felt I had waste $3k that I could've done on my own.  But I wanted  
the certification ASAP.

If you spend 1-2 hours per day for 3-4 months, you will not only know  
enough to pass a certification exam, but you will honestly know your  
topic.  Which of course is way better than a piece of paper.

Best of luck

Quoting Alex Fiuvertiz <fiuvertiz@...>:

> EHLO,
>
> What are your opinions about the online/on demand courses that are
> offered by Offensive Security, SANS, etc?
> I realize that it demands some kind of self-discipline when it comes
> to dedicate time and so on, but besides that, is it just a waste of
> money?
> Is it better to spend the money on books and the time on reading and  
>  nmap -iR ?
>
> I also realize that a course led by an instructor gives you much more,
> but this question is about the online courses.
>
> Thank you for your reply
>
> / A.F
>
> ------------------------------------------------------------------------
> This list is sponsored by: Information Assurance Certification Review Board
>
> Prove to peers and potential employers without a doubt that you can  
> actually do a proper penetration test. IACRB CPT and CEPT certs  
> require a full practical examination in order to become certified.
>
> http://www.iacertification.org
> ------------------------------------------------------------------------
>
>

------------------------------------------------------------------------
This list is sponsored by: Information Assurance Certification Review Board

Prove to peers and potential employers without a doubt that you can actually do a proper penetration test. IACRB CPT and CEPT certs require a full practical examination in order to become certified.

http://www.iacertification.org
------------------------------------------------------------------------

[Jon Kibler-2]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Alex Fiuvertiz wrote:

> EHLO,
>
> What are your opinions about the online/on demand courses that are
> offered by Offensive Security, SANS, etc?
> I realize that it demands some kind of self-discipline when it comes
> to dedicate time and so on, but besides that, is it just a waste of
> money?
> Is it better to spend the money on books and the time on reading and nmap -iR ?
>
> I also realize that a course led by an instructor gives you much more,
> but this question is about the online courses.
>
> Thank you for your reply

No experience with SANS online. Instructor lead courses are generally great.

Offensive Security's online courses are fantastic, especially if you have basic
knowledge in the course area. I am currently working through the "beggarware /
donate to HFC" version of the Metasploit Unleashed course.
        http://www.offensive-security.com/metasploit-unleashed/

I have been using metasploit for several years, and I am amazed at how much I
did not know that I am picking up in the course. The instructions are excellent,
and even if you are not a metasploit user, there is little that you cannot
figure out on your own from the instructions.

THAT SAID, this is the "free" version of the course. Once MSF 3.3 goes from dev
to released, the course will be updated and will only be available for $250
(last price I heard), and that version will include PDF documentation and
videos, plus some online support through IRC.

Once I finish with the metasploit course, I plan to work on the OSCP
certification through the online course. I have no hesitation about recommending
the OffSec courses. Also, I will add that this year at BlackHat, I took the
OffSec "Pen Testing w/ BT4" course, and it was awesome.

The only "complaint" that I have every heard anyone say about any OffSec course
is that they make you THINK HARD and SWEAT THE DETAILS! This is consistent with
their two mottoes:
        http://www.offensive-security.com/images/zone.jpg
        http://www.offensive-security.com/tryharder.php

I hope this helps!

Jon Kibler
- --
Jon R. Kibler
Chief Technical Officer
Advanced Systems Engineering Technology, Inc.
Charleston, SC  USA
o: 843-849-8214
c: 843-813-2924
s: 843-564-4224
s: JonRKibler
e: Jon.Kibler@...
e: Jon.R.Kibler@...
http://www.linkedin.com/in/jonrkibler

My PGP Fingerprint is:
BAA2 1F2C 5543 5D25 4636 A392 515C 5045 CF39 4253


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.8 (Darwin)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAkrnXm8ACgkQUVxQRc85QlN4tgCgirOSIq8na0WRBA69GKABNxrD
mCwAoI0m43qds9yax0m3QkZGsnU23PgW
=Kfip
-----END PGP SIGNATURE-----




==================================================
Filtered by: TRUSTEM.COM's Email Filtering Service
http://www.trustem.com/
No Spam. No Viruses. Just Good Clean Email.



------------------------------------------------------------------------
This list is sponsored by: Information Assurance Certification Review Board

Prove to peers and potential employers without a doubt that you can actually do a proper penetration test. IACRB CPT and CEPT certs require a full practical examination in order to become certified.

http://www.iacertification.org
------------------------------------------------------------------------

[Shenk, Jerry A]

Any course is gonna give you what you give it - I've been to some SANS
courses where people have obviously spent a fair amount of money to get
there but there are always a few people who get there late (very late)
and leave early...sometimes the same people.  I guess it takes a bit
more discipline to dedicate the time when you aren't in a class but it's
gonna take some time, one way or another.  You can't just put the books
under your pillow and get it through osmosis....but, you already said
all that;)

For the SANS courses, the on-line course and the in-class course is all
the same stuff.  Personally, I kindof like to be able to "go away" and
dedicate a week to it but, on the other hand, doing a couple hours at a
time gives me more time to spend in the lab.  When I do a week-long
course, I typically go back through the whole thing myself anyway.

I think the advantage of a "course" as opposed to on-line reading is
that the course is laid out to teach things in an order, building from
day to day or book to book.  I think it's fair to say that there is
nothing in any of these courses that can't be found on the internet
someplace but the problem is figuring it all out.  I know that I have
spent HOURS doing things that seemed like they should be so
simple....the course will help work you through that initial step
enabling you to get something working so that you can branch out from
that to do your own testing and experimentation.

BTW, I've alluded to the use of a lab - I think that's a big deal...just
reading a book doesn't really cover it...you need some hardware.
Virtual machines are great but you need some real hardware too...old
junk that somebody threw out will probably do just fine.

-----Original Message-----
From: listbounce@... [mailto:listbounce@...]
On Behalf Of Alex Fiuvertiz
Sent: Tuesday, October 27, 2009 12:09 PM
To: pen-test@...
Subject: Your opinion about online courses

EHLO,

What are your opinions about the online/on demand courses that are
offered by Offensive Security, SANS, etc?
I realize that it demands some kind of self-discipline when it comes
to dedicate time and so on, but besides that, is it just a waste of
money?
Is it better to spend the money on books and the time on reading and
nmap -iR ?

I also realize that a course led by an instructor gives you much more,
but this question is about the online courses.

Thank you for your reply

/ A.F

------------------------------------------------------------------------
This list is sponsored by: Information Assurance Certification Review
Board

Prove to peers and potential employers without a doubt that you can
actually do a proper penetration test. IACRB CPT and CEPT certs require
a full practical examination in order to become certified.

http://www.iacertification.org
------------------------------------------------------------------------


**DISCLAIMER
This e-mail message and any files transmitted with it are intended for the use of the individual or entity to which they are addressed and may contain information that is privileged, proprietary and confidential. If you are not the intended recipient, you may not use, copy or disclose to anyone the message or any information contained in the message. If you have received this communication in error, please notify the sender and delete this e-mail message. The contents do not represent the opinion of D&E except to the extent that it relates to their official business.

------------------------------------------------------------------------
This list is sponsored by: Information Assurance Certification Review Board

Prove to peers and potential employers without a doubt that you can actually do a proper penetration test. IACRB CPT and CEPT certs require a full practical examination in order to become certified.

http://www.iacertification.org
------------------------------------------------------------------------

[Robert Portvliet]

The Offensive Security course is an excellent value for the money and
very challenging.

They cover some tools (Nmap, Metasploit, Ettercap, Netcat, etc), but
the focus of the course is getting down to the nitty gritty of doing
it yourself without the aid of tools.

I can't yet speak on SANS as I am just about to start one of their
courses for the first time, but I've heard very good things & they
also have a live instructor led course over the web that takes place
one night a week over a series of weeks.

Do a search of the archives of this list and the Full Disclosure &
Pauldotcom lists, there's been a lot of good discussion of these
courses recently.



On Tue, Oct 27, 2009 at 12:08 PM, Alex Fiuvertiz <fiuvertiz@...> wrote:

> EHLO,
>
> What are your opinions about the online/on demand courses that are
> offered by Offensive Security, SANS, etc?
> I realize that it demands some kind of self-discipline when it comes
> to dedicate time and so on, but besides that, is it just a waste of
> money?
> Is it better to spend the money on books and the time on reading and nmap -iR ?
>
> I also realize that a course led by an instructor gives you much more,
> but this question is about the online courses.
>
> Thank you for your reply
>
> / A.F
>
> ------------------------------------------------------------------------
> This list is sponsored by: Information Assurance Certification Review Board
>
> Prove to peers and potential employers without a doubt that you can actually do a proper penetration test. IACRB CPT and CEPT certs require a full practical examination in order to become certified.
>
> http://www.iacertification.org
> ------------------------------------------------------------------------
>
>

------------------------------------------------------------------------
This list is sponsored by: Information Assurance Certification Review Board

Prove to peers and potential employers without a doubt that you can actually do a proper penetration test. IACRB CPT and CEPT certs require a full practical examination in order to become certified.

http://www.iacertification.org
------------------------------------------------------------------------

[Alex Fiuvertiz]

Thank you all for replying. I'll try one of the online courses this
year and follow up with an instructor led course next year and compare
if it was worth the money with traveling/hotel/fee.

Cheers, Alex



2009/10/28 Robert Portvliet <robert.portvliet@...>:

> The Offensive Security course is an excellent value for the money and
> very challenging.
>
> They cover some tools (Nmap, Metasploit, Ettercap, Netcat, etc), but
> the focus of the course is getting down to the nitty gritty of doing
> it yourself without the aid of tools.
>
> I can't yet speak on SANS as I am just about to start one of their
> courses for the first time, but I've heard very good things & they
> also have a live instructor led course over the web that takes place
> one night a week over a series of weeks.
>
> Do a search of the archives of this list and the Full Disclosure &
> Pauldotcom lists, there's been a lot of good discussion of these
> courses recently.
>
>
>
> On Tue, Oct 27, 2009 at 12:08 PM, Alex Fiuvertiz <fiuvertiz@...> wrote:
>> EHLO,
>>
>> What are your opinions about the online/on demand courses that are
>> offered by Offensive Security, SANS, etc?
>> I realize that it demands some kind of self-discipline when it comes
>> to dedicate time and so on, but besides that, is it just a waste of
>> money?
>> Is it better to spend the money on books and the time on reading and nmap -iR ?
>>
>> I also realize that a course led by an instructor gives you much more,
>> but this question is about the online courses.
>>
>> Thank you for your reply
>>
>> / A.F
>>
>> ------------------------------------------------------------------------
>> This list is sponsored by: Information Assurance Certification Review Board
>>
>> Prove to peers and potential employers without a doubt that you can actually do a proper penetration test. IACRB CPT and CEPT certs require a full practical examination in order to become certified.
>>
>> http://www.iacertification.org
>> ------------------------------------------------------------------------
>>
>>
>

------------------------------------------------------------------------
This list is sponsored by: Information Assurance Certification Review Board

Prove to peers and potential employers without a doubt that you can actually do a proper penetration test. IACRB CPT and CEPT certs require a full practical examination in order to become certified.

http://www.iacertification.org
------------------------------------------------------------------------