Understanding the Digital World, and Staying Safe on Cyberspace!
I think the Pentester Academy site has covered the syllabus of the Certified Red Team Professional (CRTP) which is somewhat of a misnomer because today’s definition of red-teaming goes far beyond what this course covers: Active Directory penetration testing and defence techniques. Note that the attack methodology and tips given by the instructor, Nikhil Mittal,…
Students who are familiar with the PWK/OSCP understand that the field of penetration testing is broad, and at times, overwhelming because there is a lot to learn. Does the AWAE/OSWE come across as significantly less broad? Well, not exactly, because web applications are extremely diverse. Let us take the white box/black box approach to examine…
Dear Offsec, I’ve never quite felt such a magnitude of ph33r in any examination so far, but the thought of facing a L100 behemoth for 48 hours in a week’s time is frightening indeed. I was a L10 servant in infosec before the AWAE course, and now I’m barely a L30 archer. Spending countless days…
(Warning: A slightly long read. I have wanted to write about doctrine for the longest of times, but I decided to weave in some of my personal musings about other areas of cybersecurity as well, that are related to doctrine. The result is a long story.) Introduction: The Thought on Business A number of friends…
“Minimum 8 characters, minimum 1 upper case, 1 lower case, 1 number and 1 special character.” Sounds familiar? Yes, this is a fairly common password policy. Users found the shortest password that could meet these requirements, “P@ssw0rd” and used it so widely that one of the biggest data breaches in Singapore documented how the use…
Recently, I finished reading a book at the intersection of behavioural economics and psychology, and will be embarking on yet another book on behavioural economics. For someone who graduated from a hard science degree, I think this qualifies as “reading some fluff” to pass time. They make for interesting reads to suggest that humans are…
Is cybersecurity merely only for technically gifted people? Well, not quite. With the advent of the digital world (think Smart Nation), there has been an increasing need for cyber literacy and awareness. Yet, there exists a gap between cyber professionals and laypeople in terms of cyber awareness and literacy. Hence, one short way of addressing…
(If you have not read Part 2, please click here.) Let us now extend what we did in Parts 1 and 2 to more than one machine. After all, one machine teaches one set of skills; multiple machines can cover a range of skills. This, in effect, is building a cyber range. Before we jump…
While preparing for a cybersecurity 101 community talk that I would give in the next month as part of a volunteer community outreach programme, I felt somewhat concerned about how far behind the layperson is in catching up with the digital world. I never expecting doing cybersecurity half a decade ago. Then, I was an…
(If you have not read Part 1, you should have a look at it here.) DISCLAIMER: If you would like to try the TORMENT machine and root it (this is currently pending Vulnhub publication), please download a copy of the machine here. Do NOT read beyond this disclaimer because this will be a full post…