Re: CEH Books

Good luck with the job search, Peter - would love to hear how it turns out for you.

Thanks for the OSCP info -- I'd heard of it, but didn't know what the training was like - good to get the skinny on a course.

I took the CEH course from InfoSec Institute - it was a bootcamp thing. Typical bootcamp mode of learning - quick & dirty.
We did do capture the flag stuff which was lots of fun, but it always came at the end of a 11 hour day of studies geared towards getting us to pass the CEH exam. Now I'm home playing w/ the VMware environment trying to recreate similar capture the flag sessions.


----- Original Message ----- From: "Peter Manis" <manis@xxxxxxxxxxxxx>
To: "Michelle Duff" <mduff@xxxxxxxxxxxxxxx>
Cc: "Jay" <jay.tomas@xxxxxxxxxxxxxxx>; <pen-test@xxxxxxxxxxxxxxxxx>
Sent: Monday, August 27, 2007 1:19 PM
Subject: Re: CEH Books


I agree as well, which is one reason I picked the OSCP before the CEH.
To pass the OSCP I need to actually perform an attack on a machine.
Of course this is not equal to real world experience, but as a start
towards moving to security I felt HR may look at my resume and have
interest in hiring me as an entry level tester because I have proven I
can apply the knowledge I have learned vs just memorizing nmap
switches and port numbers (not that the exam doesn't cover more).

When I watched a few videos of CEH and read through the material on
the exam it seemed the CEH was more like the first few classes at med
school (from what I've heard), you have to memorize a bunch of names,
functions, and instruments, but it isn't until later that you get to
break out the tools and apply that knowledge.

- Pete

On 8/27/07, Michelle Duff <mduff@xxxxxxxxxxxxxxx> wrote:
Excellent point, Jay.

I agree whole-heartedly -- having gotten a number of certs in my career:
CISSP, CCNP, MCSE and not enough hands-on led to my being viewed w/ general
contempt by those who knew their stuff & didn't necessarily have the certs -
I was a 'poser' - it stinks to be viewed that way.

You must have the hands-on -- read, study, test -- all good. But you must do
this stuff - touch it, do it, think it or you'll get the same treatment I
did.



-----Original Message-----
From: Jay [mailto:jay.tomas@xxxxxxxxxxxxxxx]
Sent: Monday, August 27, 2007 11:12 AM
To: mduff@xxxxxxxxxxxxxxx; manis@xxxxxxxxxxxxx; pen-test@xxxxxxxxxxxxxxxxx
Subject: RE: CEH Books

<rant> If you could learn to hack/assess from reading a book everyone would
do it. Does a carpenter go get a book to learn to swing a hammer.?No he goes
out and does it and probably smashes a few knuckles in the process.The most
important part of hacking/assessing is opening your mind see where it leads.
There is a million ways to check for XSS, CSRF etc. You have to be
determined and flexlible. Try things even though it shouldn't work.

e.g I was looking for XSS in a input field. Tried all the normal stale
"><script>alert('XSS')</script> type syntax. - nadda.

Only after I padded it with 20 null characters (%00) on each side it did
pop.

Reading should give you 'ideas' after that its up to you.

CEH is a baseline like most certs. It says I sat through a week of training
and then I took a multiple choice test. May mean I know my stuff and want to
documnt it to an extent. Or I May be good at tests and dont know sh@t about
security.</rant>

Jay


----- Original Message -----
From: Michelle Duff [mailto:mduff@xxxxxxxxxxxxxxx]
To: manis@xxxxxxxxxxxxx,pen-test@xxxxxxxxxxxxxxxxx
Sent: Fri, 24 Aug 2007 01:01:23 -0400
Subject: RE: CEH Books

Peter -

Sorry, I haven't read those books...when I can't find anyone who's read a
study book, I'll check out the reviews on Amazon.com - granted, the
reviewers may not always have a clue, but the more the book is reviewed I
can get an idea if it's what I need & if it's any good... I've had good
results w/ this method.

Amazon readers gave Michael Graves' Exam Prep book a good review:
http://www.amazon.com/Certified-Ethical-Hacker-Exam-Publishing/dp/0789735318
/ref=sr_1_1/102-9254239-5172111?ie=UTF8&s=books&qid=1187930981&sr=1-1

Amazon readers also gave Kimberly Graves' Review Guide good marks:
http://www.amazon.com/CEH-Official-Certified-Ethical-Hacker/dp/0782144373/re
f=sr_1_1/102-9254239-5172111?ie=UTF8&s=books&qid=1187931127&sr=1-1

Hopefully, someone here has read the books and can comment on them.

Good luck!

Michelle



-----Original Message-----
From: listbounce@xxxxxxxxxxxxxxxxx [mailto:listbounce@xxxxxxxxxxxxxxxxx] On
Behalf Of Peter Manis
Sent: Thursday, August 23, 2007 6:09 PM
To: pen-test@xxxxxxxxxxxxxxxxx
Subject: CEH Books

I found two CEH books on Alibris and I was wondering if anyone had
experience with either.

Certified Ethical Hacker: Exam 312-50
by Michael Gregg

CEH: Official Certified Ethical Hacker Review Guide
by Kimbery Graves

Thanks,

- Pete

------------------------------------------------------------------------
This list is sponsored by: Cenzic

Need to secure your web apps NOW?
Cenzic finds more, "real" vulnerabilities fast.
Click to try it, buy it or download a solution FREE today!

http://www.cenzic.com/downloads
------------------------------------------------------------------------


------------------------------------------------------------------------
This list is sponsored by: Cenzic

Need to secure your web apps NOW?
Cenzic finds more, "real" vulnerabilities fast.
Click to try it, buy it or download a solution FREE today!

http://www.cenzic.com/downloads
------------------------------------------------------------------------







------------------------------------------------------------------------
This list is sponsored by: Cenzic

Need to secure your web apps NOW?
Cenzic finds more, "real" vulnerabilities fast.
Click to try it, buy it or download a solution FREE today!

http://www.cenzic.com/downloads
------------------------------------------------------------------------

Relevant Pages

  • Re: CEH Books
    ... Before starting the OSCP course I my ability to perform many of the ... I took the CEH course from InfoSec Institute - it was a bootcamp thing. ... Subject: CEH Books ... Amazon readers also gave Kimberly Graves' Review Guide good marks: ...
    (Pen-Test)
  • Re: CEH Books
    ... which is one reason I picked the OSCP before the CEH. ... switches and port numbers (not that the exam doesn't cover more). ... Subject: CEH Books ... Amazon readers also gave Kimberly Graves' Review Guide good marks: ...
    (Pen-Test)
  • Fwd: CEH Books
    ... I have taken the CEH, ... Subject: CEH Books ... switches and port numbers (not that the exam doesn't cover more). ... Amazon readers also gave Kimberly Graves' Review Guide good marks: ...
    (Pen-Test)
  • Re: CEH Books
    ... I know the things that the security world says I should know to do ... as to why you would use one nmap switch over another like in the CEH ... In the videos I watched for the CEH the exam came across as a book ... Subject: CEH Books ...
    (Pen-Test)
  • Re: Spirit Pond, Maine
    ... This suffices as pure review. ... I don't like reviews or books but that does not mean relatively ... Neither you or Michael, after 2 weeks have chosen to do that. ... In addition it appears that 3 of his references ...
    (sci.archaeology)