I have a new course available on Pluralsight. It’s a new type of course for me. My previous courses have been long-form courses. This one is shorter, tool-focused course on Shodan. It is part of the Pluralsight Red Team Tools learning path.
While my other courses are a couple hours of content, the Reconnaissance with Shodan course is 27 minutes. It is designed to be a quick introduction and heavily focused on demonstrating how to use Shodan for recon in red team engagements. (Course overview video)
I have a new course available at Pluralsight. It’s an introduction to the Metasploit Framework. In it, I focus on getting started quickly with using the framework. It’s a relatively short course (for me) at approximately two hours of content, including demonstrations. The course is called Metasploit: Getting Started. (Course Overview video)
I completed and published another course with Pluralsight. This time I was asked to create an introductory course for information security. It had to be high level. It had to be accessible to beginners that have little to no background in information security.
The objective of this course is to assist learners in understanding the foundational principles and the key concepts in security. I describe most of the program and management approaches from an organizational perspective. I used this method specifically so that learners can apply this knowledge to their current job and their organization.
I have another Pluralsight course published. Still focusing on penetration testing, I was asked to create a high level overview course on the subject. Penetration Testing: The Big Picture was published on October 6, 2017 and looks at a wide variety of topics on penetration testing.
The focus in this course is to present information about pen testing that would be useful to those interested in learning more about it as a career option or training direction. It can also be useful for individuals and organizations interested in hiring pen testers or organizations seeking pen testing services.
I developed the Pluralsight course Introduction to Penetration Testing Using Metasploit using Kali Linux, which is a project from Offensive Security. Kali is a Linux distribution with most of the tools an information security professional would need. It is also a great platform for designing courses around because most, if not all, of the tools needed are installed by default.
The challenge is that Kali changes over time. Most of the times those changes are good and necessary to stay current and relevant. Of course, those changes often negatively impact ancillary products and information resources, including instructional courses. My Metasploit course is no exception. Revising an existing course that is already in use has its own challenges. Instead, I offer this blog post as a “living document” highlighting changes in Kali Linux that impact my Metasploit course. My hope is that if you run into issues with the course due to changes in Kali, you can find the answers here.
Joe is a fellow Pluralsight Author and host of the Test Talks Podcast, which is a weekly podcast all about software test automation.
We discussed concepts in penetration testing, Metasploit and its auxiliary modules and OpenVAS for vulnerability scanning, Meterpreter for post-exploitation activities, ethics in the use of tools like Metasploit, and Kali Linux.
Check out this episode and other episodes from Joe Colantonio and the Test Talks Podcast.
Metasploit is one of the most widely used tools for penetration testing, providing powerful attack simulations, security assessment management, and more. In this course, Introduction to Penetration Testing Using Metasploit, you’ll learn to use Metasploit to enumerate available services, identify potential weaknesses, test vulnerabilities through exploitation, and gather evidence for reporting. First, you’ll see how to install and configure the Metasploit Framework and several supporting tools on Kali Linux. Next, you’ll explore how exploits and payloads work together to gain access to systems. Finally, you’ll look at how Metasploit Framework releases are made available and how to maintain the latest version of the Framework. By the end of this course, you’ll have a better understanding of how to use Metasploit to quickly assess the security posture of systems and networks to reduce risk.
I received terrific support from the Pluralsight team in creating this course. They are very active in communicating, listening, and work with their authors. They have tools and a process for getting courses out the door. I was surprised by this attention to authors and to the details most of all.
I just switched my personal web site (this one) over to HTTPS using Let’s Encrypt. My long-time hosting provider, Dreamhost, added support for it recently (January 20, 2016). Both Let’s Encrypt and Dreamhost’s support for it are still considered Beta, but no issues here so far.
I have always wanted to have encrypted transmissions for my web site but did not want to spend the money to get the certificate and and possibly pay for the static IP. Thanks to Let’s Encrypt and Dreamhost’s support for it, it’s now possible.
I am an information security guy with a computer science degree. A good portion of my knowledge lies in operating system security and the interactions between systems. In college I took a computer science course in networking in which we delved into network fundamentals (packets, headers, protocols, etc.). However, most of it was focused on building network-enabled applications at the system call library level in the C programming language. We did not get to play with routers and switches, even though we knew how they worked, at least in theory. We assumed those components were there, were properly configured, and worked perfectly.
In my information security work, I have worked with small firewalls, software VPNs, IPS/IDS devices, VLANs and switches, and some other network components. I was able to figure out and configure most of that stuff out based on my fundamental knowledge of networking. However, I still didn’t have any exposure to enterprise-level switching and routing. Now I am a security architect and that is essential knowledge.
I got a free copy of the second edition of Network Warrior by Gary A. Donahue in early January 2016 through my membership to several O’Reilly Media mailing lists. This was a great opportunity to grow my knowledge of an area that I needed. It’s just over 1000 pages and packed full of useful information. It’s mostly about Cisco gear, but there are many chapters that focus on concepts that apply no matter what the vendor.
Here is a mini-review of what I found to be most helpful from an information security perspective.
