Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm a web programmer, using the Linux environment for 2 years.(I have experience with Web app hacks +Web app security techniques)

I want to start studying security in-depth, but I have limited time as I am working full time. I want to save time by taking a course rather than studying from a book and setting up a lab for penetration testing.

I am considering taking either the online course from eCPPT Certification ($600) or OSCP Certification Penetration Testing With BackTrack (PWB) ($950). SANS or Cisco are not in my budget.

So please help me to decide between eLearnSecurity vs. Offensive-Security

Edit::Please answer about also eLearnSecurity final exam - he should show the level of the course vs 24 hours exam (I can't find details about eLearnSecurity exam because this new course that people haven't take yet and eLearnSecurity have no interest in publishing more details about exam)

Edit::I asking about them because i can take only online courses+online exam that not expensive, If you have other good online possibilities please write.

Edit::Do I have a chance to do course if i have full work Job in month? or also 2 month not anough time?

(I am not professional sysadmin only basic knowledge in web servers + linux as programmer use of smpt/http/https/ftp - I never analyze network or security of Operating System)


migration rejected from May 18 '15 at 17:43

This question came from our site for system and network administrators. Votes, comments, and answers are locked due to the question being closed here, but it may be eligible for editing and reopening on the site where it originated.

closed as primarily opinion-based by Jens Erat, Stephane, Xander, AviD May 18 '15 at 17:43

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise.If this question can be reworded to fit the rules in the help center, please edit the question.

up vote 13 down vote accepted

The Offensive Security course is exactly that, training one to become a penetration tester. I found the class to be very informative, and a lot of fun. The PWB course states that a basic understanding of Linux command line is a plus, but not required. While it's true that the first few videos do a good job of making that statement true, having an understanding (if not actual experience) with some of the other tools in the kit would be a definite plus.

Since it is very much a hands-on course, you will be breaking into systems, often using web-app vulnerabilities. While I did enjoy it immensely, I don't think I would recommend it unless you were actually planning on performing penetration tests or vulnerability analysis professionally.

If you just want to get your feet wet, then I would recommend looking into the De-ICE Project. They provide live-cds that will constitute a lab environment similar to what the Offensive Security guys provide for the PWB course.

Unfortunately, this isn't really a field that you can short-cut into by taking a cram course. I believe you would get significantly more out of whatever course you do decide to take if you go into it with some experience, even if it's limited to a lab environment.

What do you think about course? De-ICE Project - also have courses are they better then courses? (at least they much more expensive) – Yosef Mar 6 '11 at 10:49
@Yosef: I have no experience with eLearnSecurity or the De-ICE courses, sorry. – Scott Pack Mar 6 '11 at 13:48
meh, get a 500 Server error at De-ICE. Hopefully they will go back up sometime – LamonteCristo Feb 16 '13 at 20:43

Before you jump into a course and commit to anything, try to get a taste for some security stuff using web "hackme" courses, such as webgoat (owasp) , hackmebank (foundstone), etc. As you are a web programmer, this might also ease your introduction to the field.

Use google to look for reviews for both courses, and try to see what other say. Irrelevant of which course you will take, you will probably end up needing to build a lab - it's pretty much unavoidable. I believe the OSCP labs come with a huge pre-configured network you need to hack, and from what i hear, getting everything done in 30 days is tough unless you can dedicate your time to it during that month.

The bottom line is that no course will turn you into a security specialist - it will only introduce you to the field. The real work has to be done by you, as you learn the field deeper and gain experience.

+1 for the hackme references. Good resources. – Scott Pack Mar 10 '11 at 4:44

I'm the Lead author of eLearnSecurity courses. In the attempt to shed some light and avoiding any (biased) comparison between these two great courses, I will just tell you what I think we do best.

We give great attention to the why/how of each technique/vulnerability. We want the reader to deeply understand every topic in our course before introducing tools or real world examples. That's why our course, in its version 1.1, is more tailored to Basic to Intermediate level pentesters.

From what our students tell me, and as you can read in many forums, they find the following certification path eLearnSecurity eCPPT > OSCP natural.

I hope I have brought some more information on the table so that you can decide what works best for you.

By the way, we also include a 7 days money back guarantee in case our course is not for you.

really good example of how a supplier should answer one of these questions! Informative, and you stated your connection up front. Nice one! – Rory Alsop Mar 10 '11 at 10:37

I do not know you level/background but OSCP is kind of a hardcore course for penetration testers. It is not a security course for web developers/web administrators. You will be doing a lot of metasploit, nmap, etc. and searching for vulnerabilities in existing software using fuzzing techniques, debugging in ollydbg and developing exploits.

They do cover some web related attacks, but less intense in my opinion.

You have to have some initial skills, then it is a very interesting course.

Be ready to spend all evening/some working time and even take few days off for final challenge.

Do you suggest not take course, and to take if I have background+ time? (how much time should I spent every day for this course if a taking a month? - I know well C /C++ linux ) – Yosef Mar 6 '11 at 10:39

My big question is - why penetration testing? I see that you want:

  • An online course
  • An online exam
  • A reasonable cost

Is getting certification a a bonus or a requirement?

Usually my personal strategy is to start with something I know and move into something tangential to it. Or I keep working to get to the bigger picture. So as someone who started in web development, a lot of first steps would be:

  • Web app hacks - cross site scripting, SQL injection, etc.
  • Web app security techniques - SSL, client auth with SSL, password protection, access control techniques
  • web services and web service security - XMLDSIG, SAML, WS-Policy, etc.

From there I might move into lower network layers - IP stack, firewalls, DOS attacks, etc.

My thought is to for a ripple effect outward from a topic you're familiar with rather than specifically penetration testing.

If you've decided penetration testing is absolutely the direction you want to go, then I defer to others who work in that particular field and have taken one or both of these courses.

If not, here's a few hooks to the kind of topics I'm thinking of: - CSSLP - Certified Secure Software Lifecycle Professional - both security topics and generally good SW process topics, so there's a leg up with some stuff you're probably already familiar with. The Downside - it's been out for 2 years, and I haven't seen much of a buzz about it. Not online, but probably there is a center local to you. May be possible to study from CIB without a course (for free) or with a bootcamp (not online). - GSSP - I wish I could tell you more, but it's not one I'm familiar with.

Sorry if this is too off-topic - none of these are precisely the same as your requirements. But I figured I'd throw out that there's a lot of other courses beyond pen testing...

I have experience with Web app hacks +Web app security techniques – Yosef Mar 8 '11 at 22:45

I can't speak for Elearningsecurity but I can for Offensive-Security, which I'm currently taking. Honestly, I think most people don't like Offensive Security because it's brutally hard IF you are doing the self study method, don't have pros in the field you can turn to, work a job 9-5 or don't have much time in the day to play, don't have a solid background in networking, basic linux, or are not good at reading/modifying code in various languages. If you suffer from any of that, or combination of that, you'll be bitter about the course, because you did not get far.

You won't have to be an expert programmer, but you surely better know something from various languages, or you can't use public exploits if you can't read and understand the code you're taking and trying to apply. You must do this, to be successful, because you can't rely on Metasploit to save you, if there is no canned exploit for what you need, then you're stuck. I hit that wall, HARD, and changed up my mentality. You're not going to be taught to code, it's not a programming course, but they give a good foundation to start, with regards to python and perl- neither of which I used previously, but currently use, thanks to OS. If you don't do this, you won't get far, because a lot of what you want to exploit, involves taking public exploits and modifying them for a different environment. If you inherently trust the code you're taking and reusing, you'll not get far.

If you have to be spoon-fed, and can't research on your own, you're dead in the water with Offensive Security. No one is going to help you, in the way you want (babied and spoon-fed that is), not at OS, which does NOT make that an ideal course for an absolute beginner. If you've never installed web servers, ftp servers, smtp servers, etc, on various platforms, why are you trying to exploit something you don't know anything about the structure of? You don't know what to target, you have no idea what might be the holes. This is not necessarily taught, in OS, you have to come to the table with these skills already. You learn a little sql injection, some xss, but they don't teach you how to become a system administrator. You're at a huge disadvantage if you're not done any installations, you'll not get far.

Ultimately, it's a brutal course if you're a newbie and you WILL tap out if you have no time to dedicate to this, plus no sys admin and/or programming interest or background. With OS, you're on your own, but you have a good direction, is what I can say. I think the elearningsecurity's business model might be better, where you have a newbie program, and a separate Pro program. I think a graduation of skills is a better approach. This stuff should be approached in levels, like that. OS just puts all the talent (good and bad) in 1 course, so how can the really good hackers, or the really bad ones, not have someone feel shortchanged if they're all in the same course?

welcome to the site, and thanks for sharing your experience and perspective! – AviD Jun 17 '11 at 7:42

Honestly, no reason to take backtrack courses unless you don't know how to read( <3 @packs :P ). Basically all the stuff they teach is material you can find/learn in pen testing books, and it would be much more economical to setup your own lab and set aside some time for reading than it would be to take a course that teaches stuff that is pretty basic in the world of pentesting. I use the backtrack distro for the breadth of tools, in order to find out what I like the best and then apply those to my own distro (arch linux, gentoo, or nsa secured kernel I would recommend).

If you want a good course and you already understand pen testing/web attacks to some degree, I would ALWAYS recommend a theory course over a practicuum course, and thus I think the eLearnSec would be the best bet.


Not the answer you're looking for? Browse other questions tagged or ask your own question.