Yesterday, I passed the GPEN (GIAC Penetration Tester) certification exam, and I wanted to share my experience. If you follow me on social media, especially on Instagram, then you might have noticed that I have been on hiatus from taking certification. The last certification exam I took was the GMON (GIAC Continuous Monitoring). Exam information The exam has the following format: SEC560 class I attended SEC560 (Enterprise Penetration Testing) class during SANS Security West 2026, …
Penetration Testing
Command shell to Meterpreter
As I started learning more about CTF and pentesting, I started to wonder how I can turn a command shell into Meterpreter. Most of my experience almost always ended with just using a command shell to view something. Recently, I learned how to elevate from a command shell to a Meterpreter shell. Today, I'm going to demonstrate how to do that. Environment The environment is set up kinda like a CTF. That said, I am going to walk through steps from start to finish. That way, it also helps the …
Passed eJPTv2
Today, I received an email from INE that I passed my eJPTv2 beta exam. It means that I obtained the eJPT certification again, but this time it is for version 2. I discussed my beta exam experience here. I suggest you read it and come back to this. There might be some information that you would want to know before reading the rest of this post. Preparation I received an email from INE on August 8th that they selected me to participate in the eJPTv2 beta program. I started going …
eJPTv2 Beta Exam
Today, I submitted my eJPTv2 beta exam for review. Per INE, it will take about two to three months to review everyone's exam submission. During this time, they will also decide if they want to tweak the exam based on the feedback. Related: Passed eJPTv2 Exam format For obvious reasons, I cannot disclose any of the questions I saw on the exam. I can, however, discuss whatever is public knowledge. Without further ado, here is some information about the exam: Course …
Attacking Cisco IOS device
Cisco IOS-related CVEs get announced consistently, but we will not be exploring any of those in this article. I will, however, demonstrate that attacking a Cisco IOS device is possible with SNMP misconfiguration. If interested, I covered another attack on a Cisco IOS device running HSRP here. I included this exercise on our Paradise Lost: Red Team versus Blue Team event during our CyberFest 2021. Unfortunately, only the blue team members touched this node. The red team focused on …