My 2 cents on SANS GPEN
Disclaimer: This certification was sponsored for me.
Recently I attempted SANS GPEN and passed with flying colors. Got 92% to be exact. So thought of sharing my experience for common good. This blog will contain
- Details about the cert
- SANS GPEN vs Offsec OSCP
- Who should take a plunge
- How to get qualifying marks
About the Cert
Most important details you should care about is, its costly. It costs around $7k including 6 day virtual online training. Additional certificate attempt will cost you $1999.
GPEN training course is named as SEC560. Once you register for the course which include training you will get a mail link to download the course material which will be password protected. You will also get those material posted to your physical address.
Above pic would tell you how the course is divided. These 6 booklets corresponds to 6 days of virtual training that also include a CTF at the end among the participating folks. Winner will also get an exclusive hacker coin by GIAC. This CTF reminded of me the rush I used to have while solving OSCP boxes.
Overall training is divided into 6 modules
- Pentest planning, scoping , recon
- Scanning
- Exploitation
- Password attack and pivoting
- Domain enumeration and attack
- Web application security and CTF
First day of training ( mostly theoretical ) will be bit boring if you are already into the pentesting. But for the starters this builds a solid background for the coming days of training which has good contents like scanning and exploitation. Content is pretty good, you will find lots of good tricks and tips on powershell, Nmap, Netcat. Bonus is a good coverage of commands using cmd for pivoting across the window domain.
In password attack module you will get to know basic tools like john the ripper, hashcat etc. Content on pivoting and domain enumeration & attack is pretty good. However if you are expecting to learn web pentesting with this course, then forget it. That’s because GIAC has a different course for advance web pentesting. So the content for web pentesting is very basic, only basic details like proxy tools and some basic vulnerabilities like xss, sqlinjection etc. are covered. Again good for starters. More details on the syllabus is here
With training you will get two VMs as well, one windows and one Linux. Along with training you will be given different exercises to practice on the VMs, these will have step by step instructions to complete the exercise. These VMs need to be connected to a separate vpn to do some of the exercises. Details of the vpn can be downloaded again from giac site. Each day recording will be available to view at a later point of time and will be available for viewing for 4 months from the date of training end.
After the end of the training, you will get 4 month to appear for the exam before you exam attempt expire. You will also get two practice attempts, which can be passed on to someone else if you think you don’t need them 😉 Your vpn connection will stop working after your training end. However if you have purchased the on demand training, you can have an active vpn connection to practice all the labs. ( I don’t think its a wise investment, given the pattern of exam, only 5 questions are lab based).
GPEN vs OSCP my perspective
Most of you already know this, but for continuity of the article 😃. I did OSCP in 2019 just to write this comparison.
- Cost : $7K GPEN vs $1.5k OCSP ( These are not exact, cause the keep on changing )
- Effort to pass : Obvious winner is OSCP
- Learning : with honest effort, again OSCP is the winner
- Proctored : both
- Content : Quality of the content is same for both
- Difficulty of exam : OSCP
- Absolute beginner friendly : GPEN. Don’t curse me please
If you guys think this comparison is not complete, then let me know in comment. I will oblige.
Who should attempt the cert
Rich , beginner, or sponsored candidate
How to get qualifying marks
GPEN exam is open book. You can use all the physical books that you want during the exam, however digital materials are not allowed.
- 3 hours exam
- 82 question ( 75 objective & 7 lab based )
- 75% passing score
- Its proctored
More details how to prepare here https://www.giac.org/exams/preparation
GIAC recommends to read https://tisiphone.net/2015/08/18/giac-testing/ for exam preparation. I will do the same. However, if you are an experienced pentesters and specially if you are OSCP then you don’t need to sweat that much. Only caveat is, syllabus is very large and you can be asked about a flag in powershell command. So be careful there.
Only technique required apart from reading whole study material and practicing the labs is proper indexing. Above link ( recommendation by giac ) will also teach you about indexing. Below is the snap of the note I created. If any one requests, I can share it ( My GPEN Notes )individually
With some reading and attempting the practice exam sincerely you will remember where to look for the topic in your notes. Remember to not make you indexing notes more than 10 pages. Sometimes its easier to arrange the whole thing in alphabetical order. Its individual perspective.
Finally
Let me know if you guys need any more information, otherwise you can clap your heart out and follow me for future articles. ( Hopefully!! working on my consistency)
Say hi to me on LinkedIn.
