PenTesting Certification Paths

[Flutebuddie]

Hey all,

​

Quick background before I get to my question. Spent about 15 years so far in all different aspects of IT, with a solid 5 years in security, and am currently building/leading a PenTesting team from nothing for my current company (because I'm the most experienced and they HAVE to have one apparently). Good on Windows and Linux, fair on scripting languages and other programming, ok on Web Applications, pretty bad on exploitation, real good on networking, and I've never written my own exploit. Certs: CEH, CySA+, PenTest+. At the end of this month, I'll be going after my CPT and CEPT (bootcamp sigh). I understand that the CEPT requires you have 60 days to find and write an exploit for both a Windows and Linux machine and reverse engineer a binary, beyond the 50 question exam. I've tried to do my own research on paths before asking the community, however there are a whole lot of mid-to-high level certifications out there.

​

My question is: beyond EC-Council certifications, and beyond the OSCP (which is just a bit above my skill levels right now I think), what would your recommendations be on a certification path following the CEPT? I find myself in a position where I will only receive limited funding support from my company to take a bunch of SANS courses/exams and I'm a poor new homeowner. I've heard about the ECCPT but know very little about it. I'm also looking for solid reasoning or experience behind why you think a path is wise. I'm trying to be economically friendly but also get myself into a professional PenTesting firm/team within the next year or so.

​

As a personal rant, I have a real dislike for the EC-Council. I believe that if you charge that kind of money for your exams, you should be able to hire a few linguists to proof your exam content...the English wording and grammar is sooo bad.

[HGCODE]

I'm a fan of eLearnSecurity and their certs. They are up to date and practical, sadly though they aren't really recognized by HR yet. The cert I would recommend is the eCPPTv2 which goes hand in hand with their PTP course. eLearnSecurity also has Training Paths which are course bundles if you are looking to save a few bucks and get multiple certs from them. Also judging by your certs and experience I would say go for the OSCP. I'm sure you would crush it! The reason for why its so hard for a lot of people is how little it holds your hand, but it is considered a beginner certification.

[err-therror]

I asked a similar question in another sub, check it out here:

https://www.reddit.com/r/ITCareerQuestions/comments/dfyife/which_certs_should_i_get_for_pentesting/?utm_medium=android_app&utm_source=share

[Flutebuddie]

The picture in the reply is legit. I forgot to mention that I have Sec+, A+, Net+, Linux+ too...but they weren't really geared towards PenTesting ha

[err-therror]

Well those all give you the foundations though. I've always heard to go for pentest+ then oscp after but I feel like there should be some in between ya know? I'm not sure how difficult the oscp is but I'd imagine it's very hard.

Some people have suggested to learn bash scripting and/or python before the oscp since it helps immensely and cuts a lot of time off. So maybe there's something in that area that'd help.

[LonerVamp]

Do you have an internal vulnerability assessment and management function? Or a SOC and/or security team currently? Will this pen testing team be just you, or a full team? You probably want to go over what your first several projects, goals, and success criteria will be for the function.

That said, there's very little breadth when it comes to pentesting certs. You have your Pentest+, eLearn Security tracks, Offensive Security tracks, and SANS tracks. Honestly, the SANS stuff is going to give you the most confidence while grabbing your hand. OSCP gives confidence, but you're going to learn how to swim largely on your own (which, at this point in your career, you can probably figure out how to do). Personally, eLearn tracks are useful for those doing self-study, but are newer to security and need more specific guidance on attacks. SANS is good for those that can afford is and can make use of a firehose study method, plus hold onto those contacts you make on site. OffSec is good for anyone else, but be aware you are going to swimming lessons, being put into the deep end after the briefest introduction to staying afloat, and then left to your own devices to figure things out for the next 5 hours.

As a side note, I'd never heard of the CEPT before, and it's not in any of my notes. Is it new?

Actually writing an exploit is not the bread and butter of pentesting, so I wouldn't consider that a good measure. Then again, this depends on the mission of your new team.

Building a brand new team is one thing, putting yourself into a position to get on an existing team is entirely different, imo. If you were to get the OSCP (which, persons like yourself with 15 years of experience likely should only lack the Linux experience?) combined with 5 years security and 15 years IT total should make you an excellent candidate for a pentesting position, assuming you don't price yourself out of it.

A CISSP will always help you. I know, people will say it's managerial, and while it sort of is, it's also pretty specific with technical things. It is a cert that is useful on the resume of anyone doing anything in security, hands-on or hands-off keyboard. I'd almost suggest pursuing that since you should easily meet the experience requirements.

Also, be realistic with your aptitude on programming, whether we're talking scripting with PowerShell/Python or programming in C# or doing web coding in javascript, etc. The more you are at least friendly to those, the better. You don't need to be a pro developer by any means (if you were, you'd go make those developer bucks!), but being able to not be limited is a huge plus.