51

Free options are few, but there are tons of videos and tutorials on specific attack vectors or products/tools. They will NOT make you a Penetration Tester, but they are free learning resources. Some decent options to start you off: MetaSploit Unleashed: Learn an exploitation framework SecurityTube: various videos covering a multitude of topics NMap: The ...


49

I don't know a good reference to point to for further reading. Thus I will try to list a few time-wasters that I personally enjoy. In the following I will allow myself to differentiate between various styles of hacking competitions. I don't know if this is a canonical approach, but it will probably help explaining the differences between the ones I know: ...


42

IT in general, IT security in particular, is an area where you should always learn. When you do not want to learn any further, then it is time to retire. Therefore, you should already be eager to learn TCP/IP, and your question should be: "do I learn TCP/IP first, or is there something more urgent ?" Knowing the internals of TCP/IP is an invaluable tool for ...


42

I actually did a presentation similar to this a little over a year ago, and spent quite a bit of time deciding how to structure it. My target audience did include developers and other people quite knowledgeable in IT, but also managers and other non-programmers, so I tried to keep it fairly general, and not to technically complicated. As someone else pointed ...


36

The question could also be asked: "how long should an employee have access to data before they are trained in how to use and protect that data?" For most organizations, the answer is "0 minutes". You wouldn't place an employee in front of machinery without training them, and you shouldn't place employees in front of a computer without training either. Each ...


36

The canonical resource for the concept of secure-by-design is "The Protection of Information in Computer Systems" by Saltzer and Schroeder. The essence is distilled into their 8 principles of secure design: Economy of mechanism Fail-safe defaults Complete mediation Open design Separation of privilege Least privilege Least common mechanism Psychological ...


35

There is quite a lot of them: Metasploitable: Currently there are 2 versions. Kioptrix: Currently 4 challenges. Hackademic: Apparently 2 VM, check 1 and 2. pWnOS: Currently 2 challenges. Standalone which you can install directly without VM, this is to hone your Webattack-Fu: OWASP WebGoat Damn Vulnerable Web Application Mutillidae


29

Code is written in English-based languages, and coders from any country generally know enough English not to need their native language even in comments. The most accurate way of identifying a writer's country of origin in such a scenario is based on counting the frequency of various types of mistakes they make in English. This calls for scientific ...


26

There is no defined blueprint on what is the best language to learn. Therefor I would like to mention two good alternatives that I (and many otheres) think is a good languages to learn in computer security. LUA Explanation of Lua from wikipedia: Lua is a lightweight multi-paradigm programming language designed as a scripting language with "extensible ...


25

Consider the usual risk management statement: Don't spend 1000$ to protect 100$ Now, it might just be a situation that the execs are not aware that what they want will cost 1000$; more likely that they just don't realize that they're only protecting 100$ worth. If that is the case, you could consider trying to implement methodology that will ...


23

This is great that you are doing so much learning on your own. You are on the right track. Your enthusiasm to learn on your own will put you a step above a lot of your competition. Kudos. My main advice would be: don't worry too much about planning out a path through all the material you want to learn. You don't need a carefully thought-out plan. ...


23

Edit: I'm an OSCP now, and you can read my review here, but to briefly answer your question. OSCP is nothing like C|EH, SSCP or any of the other courses I know that are out there. It is extremely practical and leaves tons of opportunities for further research and development on your own. If you're looking to learn something new or establish ground in I.T. ...


22

Vulnhub is a collection of vulnerable distributions along with walkthroughs contributed by the community. exploit-exercises.com provides a variety of virtual machines, documentation and challenges that can be used to learn about a variety of computer security issues such as privilege escalation, vulnerability analysis, exploit development, debugging, ...


22

Depending on what you call "online", a simple Google search on "damn vulnerable" will reveal the existence of freely downloadable applications of even full OS, meant for, indeed, learning all the ways software can be horribly vulnerable. One of them is Damn Vulnerable Web App, which is, you guessed it, a damn vulnerable Web app. There also used to be a full ...


21

I'd suggest in additiona to HamZa DzCyberDeV's answer: Pentester Labs exercises which are full VMs as well as full detailed walkthroughs etc. These are great for all skill levels and i've found them most useful.


20

It will be hard to teach design principles in 30 minutes. I agree with others who say that you have to get them excited in some fashion. I developed the "Elevation of Privilege" card game to get people excited about threat modeling, it might be helpful. (https://blogs.microsoft.com/cybertrust/2010/03/02/announcing-elevation-of-privilege-the-threat-...


16

I am partial to the appsec side of penetration-testing. Hunting Security Bugs The Art of Software Security Assessment Secure Programming with Static Analysis Open-Source Fuzzing Tools Fuzzing for Software Security Testing and Quality Assurance Gray Hat Hacking, 3rd Edition Advanced Windows Debugging How to Break Software Seven Deadliest Web Application ...


16

Yes, math is a tool and it can be useful in the realm of computer security. A fair amount of math is required to obtain a degree in Computer Science, and hackers prey on software developed by computer scientists. Algebra can be used to fool GPS, and detect doctored photographs. Computer Science theory is a branch of math and has applications to security....


16

Do it as part of new employee orientation and follow up with more training at regular intervals. Security policy is part of our new employee orientation. We also require a short online "securing the human" training to be completed once every other year. Introduction of this regular training has had noticable positive results.


16

These are all that i recommend. Web Vulnerability 1. Webgoat(Recommend) - https://www.owasp.org/index.php/Category:OWASP_WebGoat_Project 2. EnigmaGroup(WarGame) - http://www.enigmagroup.org 3. Mutillidae(Good) http://sourceforge.net/projects/mutillidae/ 4. DVWA (not so good) http://www.dvwa.co.uk/ OS Vulnerability 5. Metasploitable(Recommend) - http:/...


15

None of the existing answers mention this and its too long for a comment even if its not a thorough answer. One thing you will absolutely need to avoid engendering in your audience is nihilism (i.e. I will get hacked no matter what I do). Its quite easy to scare people s@#$less (and temptingly entertaining depending on circumstances). But big part of ...


14

While it may not be the hardcore technical pentesting you are used to, it will definitely aid you in understanding processes and security controls within a company. This may help you to bring your findings in an understandable way to the business and IT management. Obviously it also means you could do more than just pentesting as you could also write a ...


12

Sans has a Web Penetration Testing and Ethical Hacking: Capture the Flag class you might be interested at https://www.sans.org/security-training/web-penetration-testing-ethical-hacking-capture-flag-day-6-13632-cid There are some capture the flag sites that you might learn from using http://hax.tor.hu/ https://pwn0.com/ http://www.smashthestack.org/ http://...


12

A typcial example of non-trivial buffer handling is the parsing of binary files (or network packets) that can contain arbitrary-length strings. (Is there any ASN.1 parser that didn't have buffer overflows bugs at some time?) For example, consider the format of textual data chunks in PNG files: The keyword and text string are separated by a zero byte (...


11

I've been really enjoying: http://exploit-exercises.com/ From their site: Nebula - Nebula covers a variety of simple and intermediate challenges that cover Linux privilege escalation, common scripting language issues, and file system race conditions. Protostar - Protostar introduces basic memory corruption issues such as buffer overflows, format strings ...


11

I can identify with your situation :-) I've been buzzing around the infosec community for a while now, basically trying to get going with the things you want to do as well. These are some of the pointers I've picked up on how to get your hands dirty. eLearnSecurity For me personally, I've decided to go ahead with the course at eLearnSecurity. http://www....


11

Get a job in the IT industry - any job. Work a help desk if you have to because that still counts as experience and experience is what employers really want to see on a resume. Get your foot in the door. I know a lot of people (myself included) who got to where they are because of entry level jobs and working hard to prove their worth. Get involved in the ...


11

If you're looking for non-language/framework specific stuff, you could start with a pair of books on security engineering Security Engineering by Ross Anderson Engineering Security by Peter Gutmann Usefully both are available for free online. If you're looking for more platform specific stuff, if you haven't already I'd recommend looking through ...


11

The objective of penetration testing is not to find vulnerabilities, and so it hasn't failed if it doesn't find any. It's to check whether or not vulnerabilities are present. It doesn't get harder if systems get more secure, it just comes up with fewer vulnerabilities. In fact, it will get easier if the list of known vulnerabilities to check gets smaller.


10

In general, the three most valuable layers of penetration test reporting are: Technical - What the problem is, how to repeat it, and how to fix: this is what the IT/Dev team will require and should be in technical language Business - What does each vulnerability mean to the organisation in terms of business risk, impact, loss etc. - this needs to be in ...


Only top voted, non community-wiki answers of a minimum length are eligible