1
00:00:00,000 --> 00:00:02,540
Good to support the village.

2
00:00:02,540 --> 00:00:06,460
I'm really glad to see that DEF CON continued on this year.

3
00:00:06,460 --> 00:00:08,000
I think it was a great idea.

4
00:00:08,200 --> 00:00:11,480
You know, there's a lot of people that don't always get to make it out to DEF CON.

5
00:00:11,480 --> 00:00:14,440
And so, you know, people get a little taste of what it's like.

6
00:00:14,440 --> 00:00:16,320
They missed the human interaction part.

7
00:00:16,320 --> 00:00:19,740
But I would bet it's going to be back even bigger and stronger next year.

8
00:00:19,740 --> 00:00:26,200
But thanks to Omar and Joseph for continuing this on as well as DEF CON in general.

9
00:00:26,780 --> 00:00:30,200
So I'm happy to present my new talk here today.

10
00:00:30,440 --> 00:00:33,220
I have a talk that I do, the Pentester Blueprint.

11
00:00:33,680 --> 00:00:36,340
And it's basically a talk on becoming a Pentester.

12
00:00:36,680 --> 00:00:40,700
And so I came up with something more Red Team related.

13
00:00:41,640 --> 00:00:47,040
Because there's a lot of confusion between what true Red Team is and Pentesting.

14
00:00:47,080 --> 00:00:47,740
So who am I?

15
00:00:47,740 --> 00:00:48,560
I'm Phillip Wiley.

16
00:00:48,560 --> 00:00:53,400
I have my CISSP, OSCP, and the SANS GWAPT cert.

17
00:00:53,400 --> 00:00:57,320
I'm a senior lead at a global consumer products company.

18
00:00:57,580 --> 00:01:02,240
I'm also an adjunct professor at Dallas College, formerly Richland College.

19
00:01:02,260 --> 00:01:16,400
I'm the founder of the Pwn School Project, which is a monthly, now virtual, meetup that teaches cybersecurity techniques as well as a big focus on stuff offensive security.

20
00:01:16,400 --> 00:01:18,620
So a lot of our talks are geared towards that.

21
00:01:19,180 --> 00:01:22,520
Even some good talks on SOX and other areas of security.

22
00:01:22,520 --> 00:01:27,080
I've been in technology and InfoSec for over 22 years.

23
00:01:27,840 --> 00:01:30,600
2004 is when I got my start into security.

24
00:01:30,880 --> 00:01:33,360
The last eight years I've spent Pentesting.

25
00:01:33,360 --> 00:01:35,780
First five years I was a consultant.

26
00:01:36,060 --> 00:01:40,240
I was featured in the book, The Tribe of Hackers, Red Team book edition.

27
00:01:40,320 --> 00:01:44,280
So those are some really great books by Marcus Carey and Jennifer Jin.

28
00:01:44,640 --> 00:01:47,800
Really good for those getting started out, but I recommend it for anyone else.

29
00:01:47,800 --> 00:01:51,080
It's advice from industry professionals on different topics.

30
00:01:51,080 --> 00:01:52,360
There's The Red Team.

31
00:01:52,360 --> 00:01:53,740
There's The First Tribe of Hackers.

32
00:01:53,740 --> 00:01:56,640
It's across all spectrums of security.

33
00:01:57,000 --> 00:02:00,480
And then there's the leadership book out.

34
00:02:00,820 --> 00:02:06,420
I'm also the co-author of The Pentester Blueprint, Starting a Career in Ethical Hacking.

35
00:02:06,500 --> 00:02:11,940
I took my talk, The Pentester Blueprint, and decided to make a book.

36
00:02:11,940 --> 00:02:16,660
And I teamed up with Kim Crowley to help me make that a reality.

37
00:02:16,660 --> 00:02:20,140
So that should be coming out late fall or so.

38
00:02:20,140 --> 00:02:25,480
And I'm also a co-host of the Uncommon Journey podcast with Chloe Mostogian and Alyssa Miller.

39
00:02:27,840 --> 00:02:28,940
So the agenda.

40
00:02:29,180 --> 00:02:35,200
During this talk, I'm going to describe my path into offensive security.

41
00:02:35,200 --> 00:02:38,460
Because a lot of people that attend these talks are trying to get into it.

42
00:02:38,460 --> 00:02:44,020
There's not a lot of... you have to look out there to find good information on how to get into certain areas of security.

43
00:02:44,020 --> 00:02:46,820
And there's not a lot of stuff on offensive security.

44
00:02:46,820 --> 00:02:59,700
So continuing on in the spirit of the Pentester Blueprint talk, I've kind of extended that on to offensive security in general with this talk being more focused on red teaming.

45
00:02:59,700 --> 00:03:15,040
We're going to discuss what offensive security is, the different domains, a red team intro, red team tools, a red team blueprint, as well as some other educational resources and books out there and blogs.

46
00:03:15,560 --> 00:03:19,120
So my offensive security path is kind of an unusual one.

47
00:03:19,120 --> 00:03:20,960
I started out as a pro wrestler.

48
00:03:20,960 --> 00:03:25,280
I graduated high school and my friends asked me, what are you going to do for a career?

49
00:03:25,280 --> 00:03:27,100
And I did not have a clue.

50
00:03:27,120 --> 00:03:32,240
I mean, really college wasn't in the plans for me and I didn't know what I was going to do.

51
00:03:32,240 --> 00:03:34,900
I was a power lifter and my friends said, hey, you're a big guy.

52
00:03:34,900 --> 00:03:36,260
You should be a pro wrestler.

53
00:03:36,260 --> 00:03:39,420
So I went to wrestling school and I wrestled for a few years.

54
00:03:39,420 --> 00:03:47,540
And I got out in the late 80s due to needing a more stable career since I got married.

55
00:03:47,540 --> 00:03:52,020
So I was married and needed a stable career for my wife and future family.

56
00:03:53,560 --> 00:04:07,000
When I did that, you know, just having, you know, working through other areas of manual labor and retail sales, I saw an ad on TV for a trade school that taught AutoCAD.

57
00:04:07,000 --> 00:04:11,520
So I went to school to be a CAD draftsman and there's where things really started to take off.

58
00:04:12,580 --> 00:04:28,600
I learned about sysadmin work because I was working in offices and we had a network administrator, a system administrator come in one time to work on our systems and found out that, you know, this guy was making more money than I was and what he did looked a lot more interesting.

59
00:04:28,600 --> 00:04:39,640
I taught myself how to build computers, took a Nobel network class that used to be the popular network operating system before Microsoft really took off with their directory services.

60
00:04:40,140 --> 00:04:44,040
So from there I moved into InfoSec and then AppSec.

61
00:04:44,040 --> 00:04:57,180
And AppSec is really where I kind of found out about pen testing and offensive security, learning how to use web application vulnerability scanners, going to some different vendor talks on their tools and stuff got me interested in pen testing.

62
00:04:57,280 --> 00:05:07,820
So in 2012, I got laid off from my job of 14 years at a mortgage company and then I went to work as a consultant working in pen testing.

63
00:05:07,820 --> 00:05:13,380
I did that for five years and then got out of consulting and moved more into the corporate world.

64
00:05:13,840 --> 00:05:16,880
And then back in November, I moved into red teaming.

65
00:05:18,740 --> 00:05:28,100
So this is a slide I share every semester during all these conference talks because, you know, only hack if you have permission, even better written permission.

66
00:05:28,100 --> 00:05:30,120
Hacking without permission is illegal.

67
00:05:30,120 --> 00:05:34,420
So as long as you have permission, you're good.

68
00:05:34,420 --> 00:05:48,820
But , you know, you don't want to get in any trouble because if you get any kind of criminal record, then it kind of makes it hard to work in any area of IT and especially something like offensive security.

69
00:05:49,220 --> 00:05:50,920
So I like this quote.

70
00:05:50,920 --> 00:05:52,980
I first learned about it from Spider-Man.

71
00:05:52,980 --> 00:05:55,700
With great power comes great responsibility.

72
00:05:56,900 --> 00:05:59,040
So what is offensive security?

73
00:05:59,040 --> 00:06:05,120
So offensive security is kind of a broad generalization of different types of ethical hacking.

74
00:06:05,120 --> 00:06:14,180
So it's assessing security of a target using adversary tactics, techniques, and procedures or TTPs, commonly known as ethical hacking.

75
00:06:15,000 --> 00:06:21,960
So some of the different domains in offensive security, two main categories is pen testing and red teaming.

76
00:06:21,960 --> 00:06:26,940
You can see different areas in pen testing that are covered.

77
00:06:27,100 --> 00:06:37,100
Network, application, network including wireless, cloud, social engineering, physical security, hardware, and vehicle security can be tested through pen testing.

78
00:06:37,380 --> 00:06:39,880
Red teaming is kind of more of a specialized area.

79
00:06:40,240 --> 00:06:43,400
You're getting into more adversarial type simulations.

80
00:06:44,020 --> 00:06:46,320
But there's been a lot of confusion.

81
00:06:46,540 --> 00:06:49,820
So red teaming, red team engagement is not a pen test.

82
00:06:49,820 --> 00:06:51,080
It's not the same thing.

83
00:06:51,080 --> 00:06:54,720
They've been used interchangeably, pen testing and red team for years.

84
00:06:54,720 --> 00:07:00,380
It's a way to generalize, kind of the same way the blue team generalizes the defensive side.

85
00:07:00,380 --> 00:07:04,340
Even on the defensive side, all blue team is not the same.

86
00:07:04,340 --> 00:07:05,440
There's a lot of differences.

87
00:07:05,800 --> 00:07:10,360
But red team, a lot of people have confused and think that red teaming in general, that it's all the same, but it's not.

88
00:07:10,360 --> 00:07:12,920
So there are some distinct differences.

89
00:07:13,960 --> 00:07:19,260
Some of the commonalities, these similarities between the two areas.

90
00:07:19,520 --> 00:07:25,080
They're both forms of pen testing or forms of defensive security.

91
00:07:25,240 --> 00:07:32,920
Exploitation, social engineering, phishing, and physical security exploitation are used on both of these.

92
00:07:32,920 --> 00:07:34,520
Sometimes not everything.

93
00:07:34,520 --> 00:07:42,900
With your pen testing, a lot of times only social engineering, phishing, or physical security exploitation is not part of it.

94
00:07:42,900 --> 00:07:49,380
Unless it's specifically built into the statement of work, the rules of engagement.

95
00:07:51,740 --> 00:07:54,200
There are some differences there too.

96
00:07:54,200 --> 00:08:01,020
With red teaming, you're emulating a threat actor, an APT, an advanced persistent threat.

97
00:08:01,060 --> 00:08:06,420
With pen testing, you're using some of those techniques, but you're not emulating a threat actor.

98
00:08:06,420 --> 00:08:08,400
You're just using some of those techniques.

99
00:08:08,400 --> 00:08:10,740
In red teaming, you're trying to avoid detection.

100
00:08:10,740 --> 00:08:13,820
With pen testing, it's a time box test.

101
00:08:13,820 --> 00:08:16,080
You're limited to the amount of time you have to test.

102
00:08:16,160 --> 00:08:20,240
So you don't have time to go low and slow to try to avoid being detected.

103
00:08:20,580 --> 00:08:27,920
And due to the time constraints, you're using vulnerability scanners and doing a lot of port and service scanning, which makes it more loud.

104
00:08:27,920 --> 00:08:30,860
So you're not really avoiding detection.

105
00:08:30,860 --> 00:08:36,220
Sometimes it can be part of a statement of work, but usually this gets more into your red teaming.

106
00:08:36,440 --> 00:08:38,700
Red teaming is less restrictive.

107
00:08:38,700 --> 00:08:46,220
There's more areas you can, in most cases, social engineering, phishing are part of it, part of the scope.

108
00:08:46,620 --> 00:08:48,640
With the pen testing, it's more limited.

109
00:08:48,640 --> 00:08:56,300
With PCI, when PCI came out, a lot of the pen tests and PCI has drove a lot of pen testing requirements.

110
00:08:56,440 --> 00:09:01,240
To be PCI compliant, you know, it's a requirement to be pen tested.

111
00:09:01,240 --> 00:09:06,880
So a lot of the focus has been on just what is needed to be compliant and not overall security.

112
00:09:06,880 --> 00:09:08,020
So some things get missed.

113
00:09:08,820 --> 00:09:10,960
And that's kind of carried on throughout the pen test.

114
00:09:11,140 --> 00:09:13,980
There's a certain area that they want to be tested.

115
00:09:14,480 --> 00:09:16,800
Sometimes it's not a lot of time to plan it out.

116
00:09:17,960 --> 00:09:20,500
Budget constraints, they just want to get it done quickly.

117
00:09:20,620 --> 00:09:23,660
And with pen testing, vulnerability is the focus.

118
00:09:24,080 --> 00:09:29,740
Whereas with red teaming, you're trying to simulate an actual attacker or cyber criminal.

119
00:09:31,000 --> 00:09:32,820
And there's a lot of tool commonalities.

120
00:09:32,820 --> 00:09:37,200
If you look at the list of tools here, you see everything is pretty much the same.

121
00:09:37,200 --> 00:09:40,540
There are some variants and some things that are not on this list.

122
00:09:40,540 --> 00:09:42,600
But the common tools are listed here.

123
00:09:42,700 --> 00:09:45,660
With pen testing, you're using vulnerability scanners.

124
00:09:45,860 --> 00:09:50,420
Red teaming, you know, if you're using a vulnerability scanner, you're going to cause noise.

125
00:09:50,420 --> 00:09:51,960
You know, you want to be quiet.

126
00:09:52,620 --> 00:09:54,860
Metasploit can be used across both of those.

127
00:09:55,300 --> 00:10:00,620
And also you see malware and exploits used across both.

128
00:10:00,620 --> 00:10:07,540
But red teaming, it's more heavily depended on to get the footholds using malware, do phishing campaigns.

129
00:10:07,540 --> 00:10:14,960
Command and control is done both, and useful in both, but a lot more heavily relied on for red teaming.

130
00:10:17,850 --> 00:10:23,350
And so here's kind of a little red introduction on red teaming.

131
00:10:23,350 --> 00:10:29,710
Red teaming is scenario-based assessment, emulating threat actors, and even simulating specific APTs.

132
00:10:29,710 --> 00:10:34,930
You can go through like the MITRE ATT&CK framework and pick out specific APTs to mimic.

133
00:10:35,050 --> 00:10:38,610
The goal of red team operation is to simulate real-world breaches.

134
00:10:38,670 --> 00:10:44,590
Not only is this operator testing the security of technology, they're testing the people in the process.

135
00:10:45,150 --> 00:10:51,530
A great quote from Dwyer Fald, the founder of Dallas Hackers Association, is the red team tests the blue team.

136
00:10:51,530 --> 00:10:54,070
And this is a good way to describe that.

137
00:10:54,150 --> 00:10:57,110
When you're doing a pen test, you're really not testing the people.

138
00:10:57,110 --> 00:11:00,910
You're testing the security controls and the technology.

139
00:11:01,170 --> 00:11:08,510
With red teaming, you're testing the reactions of the defenders, as well as any of the systems being detected.

140
00:11:08,830 --> 00:11:14,550
During a pen test, things can be detected, and usually, unless it's built in to block it, you're not going to get blocked.

141
00:11:14,550 --> 00:11:16,470
They're going to let you complete the pen test.

142
00:11:19,460 --> 00:11:23,420
And red team operations take a lot of time to plan and perform.

143
00:11:23,420 --> 00:11:29,280
So you're trying to go and plan a specific scenario, a certain type of APT.

144
00:11:29,280 --> 00:11:31,260
You're trying to imitate.

145
00:11:31,260 --> 00:11:33,980
So you're taking the time to plan this out, to perform it.

146
00:11:33,980 --> 00:11:36,100
And usually, you've got more time.

147
00:11:36,400 --> 00:11:42,080
A pen test, not to say it's a thorough pen test, but a lot of times, a pen test may be a week.

148
00:11:42,640 --> 00:11:46,800
Like a red team engagement could be four weeks or it could be months.

149
00:11:46,800 --> 00:11:51,060
So it depends on the scenario you're trying to imitate.

150
00:11:51,060 --> 00:11:57,700
And so red team operations rely heavily on OSINT to enumerate information on target technologies and employees.

151
00:11:57,960 --> 00:12:03,840
This is leveraged through social engineering and phishing to gain initial foothold in the target environment.

152
00:12:04,120 --> 00:12:10,160
You can also do like an assumed breach and use accounts.

153
00:12:10,160 --> 00:12:31,100
But this is a good way to see how easy it is to get past people, the process and technology by using phishing campaigns, sending malicious payloads to end users or compromising a site and putting payloads in there to gain access to the systems.

154
00:12:31,220 --> 00:12:35,480
Detection avoidance is very important for red team to be successful.

155
00:12:35,480 --> 00:12:37,680
Because part of this is they're trying to stop you.

156
00:12:37,680 --> 00:12:42,200
They may see something going on and they're going to let you finish the pen test.

157
00:12:42,200 --> 00:12:49,040
During a red team engagement, usually the people you're testing, they don't know about the pen test.

158
00:12:49,040 --> 00:12:50,180
It's not announced.

159
00:12:50,180 --> 00:12:53,560
Usually management and a few key people know what's going on.

160
00:12:53,560 --> 00:13:06,060
So in case the defenders detect this, they can report it and it can be treated internally to look like a normal breach to see how everyone reacts to it during the exercise.

161
00:13:06,060 --> 00:13:10,280
So that's important to stay undetected.

162
00:13:12,920 --> 00:13:19,360
Red team TTPs, red team operations a lot of malware payloads to gain initial footholds.

163
00:13:19,560 --> 00:13:25,920
So being able to evade and obfuscate your code for your malware and exploits is very important.

164
00:13:26,000 --> 00:13:34,560
A lot of times to get it to work in a pen testing role, you have to work on obfuscating your code because PowerShell is getting more detected.

165
00:13:34,560 --> 00:13:36,740
Although some environments it's not.

166
00:13:36,740 --> 00:13:40,400
So as a practitioner, keep trying.

167
00:13:40,620 --> 00:13:42,920
People will say this is not environments anymore.

168
00:13:42,920 --> 00:13:44,100
It still will be.

169
00:13:44,100 --> 00:13:53,040
I mean, I've performed pen tests as recent as the end of 2018 where Windows XP was in a company, a Fortune 100 company.

170
00:13:53,040 --> 00:13:59,140
So that stuff's still out there and not everyone's blocking PowerShell, but it's becoming more often blocked.

171
00:13:59,140 --> 00:14:03,840
So some of the skills that you'll need to work on is really working on the evasion and obfuscation.

172
00:14:03,840 --> 00:14:13,860
Command and Control or C2 is a very important tool used to compromise systems, deliver payloads, elevate privileges, lateral movement, and use for persistence.

173
00:14:13,900 --> 00:14:20,580
Cobalt Strike is a very popular command and control as well as there's some other ones out there, Silent Trinity, Covenant.

174
00:14:23,180 --> 00:14:32,020
And actually Team Ares from Critical Start came out with Domidios, which is a new C2 that's built on Go.

175
00:14:32,020 --> 00:14:40,060
So it looks really promising, a new one out there and recently was added to the C2 matrix.

176
00:14:42,400 --> 00:14:46,780
And Red Team Ops Planning, so as we mentioned, there's more planning that goes into this.

177
00:14:46,780 --> 00:14:52,920
It can be more detailed, so you can map the APTs from the MITRE ATT&CK framework and use tools like Vector.

178
00:14:53,320 --> 00:14:58,660
Vector is a pretty cool tool I learned about from George Ochia's talks.

179
00:14:58,660 --> 00:15:01,740
He does a lot of great talks on red teaming and purple teaming.

180
00:15:01,760 --> 00:15:05,160
He currently works for Scythe, so he's a SANS instructor.

181
00:15:05,160 --> 00:15:11,200
He teaches the SANS Red Team course, so keep an eye out for his videos.

182
00:15:11,200 --> 00:15:21,160
This Vector tool is a framework that you can plan out your scenarios for your Red Team engagements.

183
00:15:21,160 --> 00:15:26,120
So you can go through and map out the APTs that it's pulling from the MITRE ATT&CK framework.

184
00:15:26,600 --> 00:15:33,960
And so Red Team Ops can also be less complicated and not map to specific APTs, just using common TTPs.

185
00:15:33,960 --> 00:15:41,060
And as your program starts out, it may not take really advanced attacks to be able to compromise systems.

186
00:15:41,500 --> 00:15:44,200
You know, it's kind of like offensive security in general.

187
00:15:44,220 --> 00:15:50,200
You want to make sure that you've got your vulnerability scanning program, your vulnerability management solid in place.

188
00:15:50,560 --> 00:15:57,260
You know, before you include it with pen testing, but you really want to get that in place and working on that.

189
00:15:57,260 --> 00:16:13,140
As you get to more open scope pen tests and Red Team engagements where more things are in scope and can be exploited, then, you know, as you become more mature, then you'll need to emulate more advanced attacks.

190
00:16:13,140 --> 00:16:23,000
So starting out, you may not have to be as complicated, but as you're going along, you can become more complicated and detailed in your attacks.

191
00:16:23,000 --> 00:16:30,400
And using the tools like the MITRE ATT&CK framework and Vector to map those out are great options.

192
00:16:33,150 --> 00:16:35,630
There are some additional Red Team benefits here.

193
00:16:35,630 --> 00:16:39,510
So a major benefit of Red Team is testing the people process and technology.

194
00:16:39,710 --> 00:16:50,070
So during the operation, if activities are not detected, then the Red Team can work with the security team to tune the security defenses to be able to detect malicious activity.

195
00:16:50,070 --> 00:17:01,450
This can be extended to Purple Teaming engagements or activities where you just work with the Blue Team to tune their systems to detect different types of exploits.

196
00:17:01,450 --> 00:17:16,730
So during your testing, if PowerShell is not being detected, if Mimikatz is not being detected, then you can, you know, kind of do a Purple Team activity, just kind of working with your Blue Team as you launch specific attacks.

197
00:17:16,790 --> 00:17:25,170
See if they detect it and help them to work on detecting those systems where you can build signatures to detect those vulnerabilities.

198
00:17:29,010 --> 00:17:38,270
And so in the spirit of the Pentester Blueprint, I'm kind of going to go into some details on here on how to become a Red Team operator.

199
00:17:38,270 --> 00:17:44,270
So, you know, basically Red Team operator is a Pentester.

200
00:17:44,270 --> 00:17:49,450
You're getting more specialized, going more into adversarial simulation.

201
00:17:49,450 --> 00:17:52,810
But you have to start, you need a base, the base starting out.

202
00:17:52,810 --> 00:17:56,490
So your base, you need to understand technology.

203
00:17:56,490 --> 00:18:02,810
So if you're jumping in this from nothing, then you're going to have to build these technologies.

204
00:18:02,810 --> 00:18:10,810
You have to understand networking and operating systems and Active Directory that you're performing Pentest against some of these networks and Red Team engagements.

205
00:18:10,850 --> 00:18:21,050
Because Active Directory is Microsoft's directory services where all the users and different computer objects and security settings are set in Active Directory.

206
00:18:21,050 --> 00:18:25,470
You get access to that, you can breach a lot of things, compromise on a large scale.

207
00:18:25,470 --> 00:18:30,830
I mean, the way to look at it is kind of like a single sign-on type of solution using LDAP.

208
00:18:30,830 --> 00:18:37,230
So you're able to, if you're able to compromise Active Directory, then you can get access to anything in the environment.

209
00:18:37,690 --> 00:18:40,530
So understand, you have to understand this technology.

210
00:18:40,610 --> 00:18:47,710
So understanding networking, understanding operations, operating systems from a, you know, a system administrator perspective.

211
00:18:47,710 --> 00:18:56,430
You need to be able to start and stop services, you know, disable firewalls, enable services, and that sort of thing during a Pentest.

212
00:18:56,430 --> 00:19:04,610
So if you gain a shelter system or command line access, then the more you understand the command line, the more things you can do, the more effective you can be.

213
00:19:04,610 --> 00:19:06,430
And you've got to understand networking.

214
00:19:07,310 --> 00:19:16,010
And Pentesting hacking, so you have to understand the different tools and techniques that penetration testers and hackers use.

215
00:19:16,170 --> 00:19:20,990
So you have to have those because, you know, hacking is part of being a Red Teamer.

216
00:19:20,990 --> 00:19:24,290
That's part of the job.

217
00:19:24,290 --> 00:19:28,890
It's kind of an extension or more advanced form of Pentesting.

218
00:19:28,930 --> 00:19:31,830
And so programming and scripting can be very important.

219
00:19:32,070 --> 00:19:35,750
Some of the best hackers I know can program.

220
00:19:35,750 --> 00:19:38,730
They can write their own code or they can write their own scripts.

221
00:19:39,450 --> 00:19:43,690
So popular ones out there are Python and PowerShell.

222
00:19:43,690 --> 00:19:58,470
From a Red Teamer or Pentester perspective, you know, knowing how to use PowerShell using some of the tools like PowerShell, Empire, and some of the different exploitation tools out there in command and control is very important.

223
00:19:58,470 --> 00:20:02,670
So you don't necessarily have to know how to write PowerShell, although it's good.

224
00:20:03,050 --> 00:20:08,370
Tools like Python and Golang can be used across multiple platforms.

225
00:20:08,450 --> 00:20:10,690
Python has been very popular for years.

226
00:20:10,690 --> 00:20:14,570
It allows you to write tools pretty quickly, modify tools.

227
00:20:14,690 --> 00:20:25,950
And from programming scripting perspective, at first you need to really be able to, you know, modify exploit code, be able to look at Python code and be able to alter that to fit.

228
00:20:25,950 --> 00:20:31,190
Maybe you find some exploit code and there's something different about that system that you need to modify.

229
00:20:31,190 --> 00:20:34,490
So just understanding how to modify exploits is important.

230
00:20:34,490 --> 00:20:36,290
It's a good starting step.

231
00:20:36,290 --> 00:20:38,130
But be able to write Python scripts.

232
00:20:38,230 --> 00:20:41,430
Golang is a very new popular one.

233
00:20:41,910 --> 00:20:45,890
I guess it's been out five or six years or so, maybe longer, eight years.

234
00:20:45,890 --> 00:20:48,830
But it's a really good one because it's also a compiled language.

235
00:20:48,830 --> 00:20:51,810
It can run across multiple platforms.

236
00:20:51,810 --> 00:21:00,090
The thing I really like about it too is you can compile code on a Linux or Mac system to run on Windows.

237
00:21:00,090 --> 00:21:02,130
So this is kind of nice.

238
00:21:02,130 --> 00:21:11,390
Some of your exploits, if you're doing a pen test, then you need a similar system with Linux to be able to compile your exploit code.

239
00:21:11,490 --> 00:21:14,210
A similar system or compile it on that system.

240
00:21:14,210 --> 00:21:18,590
With this, you can easily compile it on your own system.

241
00:21:18,730 --> 00:21:24,490
And this C Sharp is a very popular one for pen testing.

242
00:21:24,610 --> 00:21:29,530
Some of the PowerShell started getting detected and people moved on to C Sharp.

243
00:21:29,530 --> 00:21:32,750
There's a lot of good tools out there with C Sharp.

244
00:21:32,750 --> 00:21:37,290
A lot of the tools are kind of going away from PowerShell more towards C Sharp.

245
00:21:37,290 --> 00:21:38,610
So understand these tools.

246
00:21:38,690 --> 00:21:41,230
You'll write your own tools and it'll make you a lot better hacker.

247
00:21:42,870 --> 00:21:50,290
So yeah, just be able to do that makes, like I said, some of the best hackers I know and red teamers know how to write their own code.

248
00:21:50,290 --> 00:21:52,630
I mean, you stop and look at some of the tools out there.

249
00:21:52,750 --> 00:21:58,710
Harmjoy, for instance, from Spectrops, he's a prime example of someone that writes tools and he's a red teamer.

250
00:21:58,710 --> 00:22:04,930
So I mean, this goes to show you, you look at a lot of these high level pen testers and red teamers.

251
00:22:04,930 --> 00:22:07,010
They're writing exploits and they're writing tools.

252
00:22:07,010 --> 00:22:11,670
So if you really want to do well, then that's an area to focus on.

253
00:22:15,210 --> 00:22:17,670
So red team focus skills.

254
00:22:17,670 --> 00:22:21,730
So malware and exploit development, where these are also important in pen testing.

255
00:22:21,850 --> 00:22:27,010
Really working on obfuscating and be able to evade systems.

256
00:22:27,010 --> 00:22:31,810
With your PowerShell code or C sharp or any language you're writing and be able to obfuscate.

257
00:22:31,810 --> 00:22:37,370
Sometimes there's written tools out there and you can use different tools to obfuscate.

258
00:22:37,550 --> 00:22:41,450
Or going to manually modify yourself to try to take some of the headers out and signatures.

259
00:22:41,450 --> 00:22:43,490
So it's not as easily detectable.

260
00:22:43,490 --> 00:22:49,970
Sometimes it could just be the name of the developer of the tool that the system's picking up or the name of the tool in the system.

261
00:22:49,970 --> 00:22:53,590
So just be able to modify your code where it's not being detected.

262
00:22:54,390 --> 00:22:56,210
Active directory exploitation.

263
00:22:56,210 --> 00:23:04,810
Understanding active directory is not enough, but understanding active directory and knowing how to exploit it is very important in red teaming.

264
00:23:04,810 --> 00:23:05,870
And command and control.

265
00:23:05,870 --> 00:23:08,350
So command and control is a very important tool.

266
00:23:08,910 --> 00:23:12,990
It allows you to send payloads to your systems.

267
00:23:12,990 --> 00:23:16,050
Once you get a system compromised, you get access to it.

268
00:23:16,050 --> 00:23:22,230
Then you can do lateral movements, going to other computers, other accounts, try to escalate privileges.

269
00:23:22,230 --> 00:23:28,250
And help you maintain persistence, maintain control over the systems that you exploit.

270
00:23:28,410 --> 00:23:33,370
In phishing and social engineering, these are two very helpful tools.

271
00:23:33,370 --> 00:23:40,150
Because in a lot of cases, maybe their systems are pretty secure as far as trying to crack passwords.

272
00:23:40,150 --> 00:23:47,170
Or if you're doing a Zoom breach and you're on that network and maybe you're not able to crack hashes.

273
00:23:47,170 --> 00:23:54,970
So if you can send malware through email, through phishing campaigns, then that's a way to get initial foothold.

274
00:23:55,150 --> 00:23:58,850
Social engineering to get people to execute that code.

275
00:23:59,050 --> 00:24:00,610
Physical security exploits.

276
00:24:00,610 --> 00:24:02,410
Gaining access to the buildings.

277
00:24:02,610 --> 00:24:08,330
Getting past security into the server rooms or different areas to be able to pull off your exploits.

278
00:24:13,260 --> 00:24:18,040
And here's kind of a learning path to follow for gaining these skills.

279
00:24:18,040 --> 00:24:22,520
Kind of a good baseline or a good place to start.

280
00:24:22,520 --> 00:24:26,040
And this is assuming that you've got an IT background.

281
00:24:26,660 --> 00:24:28,900
You've got to learn the hacking skills.

282
00:24:29,780 --> 00:24:38,300
Certification courses like the OSCP, Hack the Box are really good to build those skills.

283
00:24:38,300 --> 00:24:40,260
Learning social engineering.

284
00:24:40,260 --> 00:24:46,860
But the OSCP is a really good one because you've got to get those hacking skills before you really get into the red teaming.

285
00:24:47,140 --> 00:24:49,580
So you need to be a good hacker.

286
00:24:49,580 --> 00:24:57,400
So there's other courses out there like eLearn Security where a lot of those other courses really focus on pen testing.

287
00:24:57,400 --> 00:24:59,420
Which pen testing and hacking is similar.

288
00:24:59,440 --> 00:25:03,940
With the OSCP there is a big focus on hacking skills.

289
00:25:03,940 --> 00:25:13,620
And with some of the newer content of the OSCP, they've kind of went more in the direction of adding more pen testing content.

290
00:25:13,620 --> 00:25:19,860
Whereas before it was mainly just a really great hacking course.

291
00:25:19,860 --> 00:25:24,180
And kind of teaching kind of the way pen testing used to be.

292
00:25:24,200 --> 00:25:32,680
But a good path is once you get the skill set of someone with OSCP, then you can start working on the red teaming skills.

293
00:25:32,680 --> 00:25:34,300
And this is something you can work on hand in hand.

294
00:25:34,300 --> 00:25:37,600
Because your red teaming skills, you're going to be working on Active Directory.

295
00:25:37,740 --> 00:25:41,700
So there's some courses out there that are really good for red teaming.

296
00:25:41,860 --> 00:25:45,920
And Pentester Academy's Red Team Labs is a good resource.

297
00:25:45,920 --> 00:25:48,180
They have Active Directory in their labs.

298
00:25:48,180 --> 00:25:49,980
So they've got different levels.

299
00:25:50,100 --> 00:25:54,100
But they even have like a red team certification.

300
00:25:54,100 --> 00:26:04,040
They have labs where you're using Linux to exploit Windows systems as well as Windows systems to perform the same similar labs.

301
00:26:04,040 --> 00:26:09,140
Learning how to use PowerShell exploits during that to compromise systems.

302
00:26:09,140 --> 00:26:18,940
And then eLearn Security, their Pen Testing Extreme course is labeled Pen Testing Extreme, but it's a red team course.

303
00:26:18,940 --> 00:26:21,040
It teaches red teaming techniques.

304
00:26:21,040 --> 00:26:29,840
They teach you exploit development, code obfuscation, and some other techniques that are important for red teaming.

305
00:26:29,940 --> 00:26:35,420
Hack the Box Pro, Rasta Labs, this is a really great, good one to learn.

306
00:26:35,420 --> 00:26:42,200
And it's kind of inspired Rasta Mouse to start the Zero Point Security Red Team Ops course.

307
00:26:42,200 --> 00:26:43,520
I'm actually going through that.

308
00:26:43,520 --> 00:26:48,400
And if they actually have a certification with that, I'm currently going through that at the moment.

309
00:26:48,420 --> 00:26:49,900
And it's a really good course.

310
00:26:49,900 --> 00:26:53,740
I mean, it's even set up to where you can send phishing emails in that environment.

311
00:26:55,040 --> 00:27:00,000
And so some different tools and resources for red teaming.

312
00:27:00,000 --> 00:27:08,680
So your APT planning, as mentioned, the MITRE ATT&CK Framework, Vector, there's the URLs for those resources.

313
00:27:08,880 --> 00:27:10,200
Those are really good to know.

314
00:27:10,200 --> 00:27:15,140
Just getting out there and learning how a threat actor's mind works.

315
00:27:15,140 --> 00:27:19,700
Getting that threat actor mindset through tools like the MITRE ATT&CK Framework.

316
00:27:19,700 --> 00:27:21,680
Learning how those TTPs work.

317
00:27:21,880 --> 00:27:23,720
You get to see some of the common attacks.

318
00:27:23,720 --> 00:27:25,340
And this is a great resource for defenders.

319
00:27:25,340 --> 00:27:27,740
It's being widely used by defenders.

320
00:27:28,060 --> 00:27:30,340
Command and Control, the C2 Matrix.

321
00:27:31,960 --> 00:27:35,280
You can find that at the C2Matrix.com.

322
00:27:35,560 --> 00:27:37,420
Cobalt Strike is one of the more popular ones.

323
00:27:37,420 --> 00:27:39,060
One of the first command and control.

324
00:27:39,060 --> 00:27:42,600
Although Metasploit is also considered command and control.

325
00:27:43,020 --> 00:27:46,560
It's also pretty heavy on the exploit framework.

326
00:27:47,020 --> 00:27:51,400
But Cobalt Strike, Silent Trinity, PowerShell Empire.

327
00:27:51,840 --> 00:27:56,200
BC Security took over support of that and upgraded it to Python 3.

328
00:27:56,520 --> 00:27:59,980
And you can use Starkiller, which is a web front end to it.

329
00:27:59,980 --> 00:28:04,640
It makes it more similar to some of the other C2s that have a web front end.

330
00:28:05,200 --> 00:28:07,240
Or you can use these tools as a team.

331
00:28:07,240 --> 00:28:08,720
You can collaborate together.

332
00:28:08,720 --> 00:28:11,360
So you can collaborate on the same project.

333
00:28:11,360 --> 00:28:14,240
So these really work good for collaboration.

334
00:28:14,580 --> 00:28:21,060
And a shout out to Critical Start Team Ares with their Demios C2 that recently came out.

335
00:28:21,060 --> 00:28:22,660
It's written in Golang.

336
00:28:23,680 --> 00:28:29,380
They're adding new items to it, new features as it goes along.

337
00:28:29,380 --> 00:28:30,720
So it just recently came out.

338
00:28:30,720 --> 00:28:31,960
They're pretty excited about it.

339
00:28:31,960 --> 00:28:33,940
It looks like a really good tool.

340
00:28:34,300 --> 00:28:36,340
So you should check that out.

341
00:28:36,340 --> 00:28:37,560
It's a free tool.

342
00:28:37,560 --> 00:28:38,240
It's open source.

343
00:28:38,240 --> 00:28:40,060
It's like a lot of the other C2s.

344
00:28:40,600 --> 00:28:42,120
And operating systems.

345
00:28:42,120 --> 00:28:44,880
Slingshot OS or Slingshot Linux.

346
00:28:44,880 --> 00:28:46,940
You can find that on SANS.

347
00:28:47,440 --> 00:28:54,220
It's a good operating system for pentesting as well as red teaming.

348
00:28:54,220 --> 00:28:56,840
It has a lot of the C2s already installed.

349
00:28:57,140 --> 00:29:01,980
So actually Vector, I believe Vector is installed as well.

350
00:29:02,220 --> 00:29:07,420
Kali Linux and Parrot OS are good hacking options and Commando VM for Windows.

351
00:29:07,420 --> 00:29:10,280
So in red teaming, you're dealing a lot with Active Directory.

352
00:29:10,280 --> 00:29:13,560
So it's good to have a Windows box to test with.

353
00:29:14,100 --> 00:29:16,140
And resources and courses.

354
00:29:16,300 --> 00:29:20,740
So Hack the Box Pro as mentioned by Roster Labs.

355
00:29:20,740 --> 00:29:22,780
One of Roster Mouse's projects.

356
00:29:22,860 --> 00:29:25,040
Pentester Academy, Red Team Labs.

357
00:29:26,020 --> 00:29:29,380
And institute.sector7.net.

358
00:29:29,380 --> 00:29:30,240
This is a good course.

359
00:29:30,240 --> 00:29:32,980
They have relatively inexpensive.

360
00:29:34,580 --> 00:29:39,900
And I'm kind of listing some of these out based on the expense of the course.

361
00:29:39,900 --> 00:29:43,860
They have a course on malware writing for red teaming.

362
00:29:43,860 --> 00:29:47,580
They have a Privilege Escalation as well as another course.

363
00:29:47,580 --> 00:29:48,520
I can't think of it at the moment.

364
00:29:48,520 --> 00:29:51,100
But these three different courses build red team skills.

365
00:29:51,100 --> 00:29:55,520
And sometimes some courses may deal more on the red team side and less on the malware.

366
00:29:55,800 --> 00:29:58,640
With this course, they have good coverage of malware.

367
00:29:58,800 --> 00:30:01,800
So that's a good skill to develop.

368
00:30:01,800 --> 00:30:03,440
And they cover that in that course.

369
00:30:03,500 --> 00:30:07,880
And Zero Point Security of the Red Team Ops course by Roster Mouse.

370
00:30:07,880 --> 00:30:10,000
Which they actually have a certification for.

371
00:30:10,020 --> 00:30:12,140
This is a pretty cool environment.

372
00:30:12,360 --> 00:30:14,420
You have VPN access to it.

373
00:30:14,460 --> 00:30:16,420
They have Windows boxes in there.

374
00:30:16,700 --> 00:30:22,840
You're separated through a firewall so you're connecting in.

375
00:30:23,720 --> 00:30:26,900
So you have to send a phishing email to get on that system.

376
00:30:26,900 --> 00:30:28,200
So it's really cool.

377
00:30:28,320 --> 00:30:31,480
If you have the OSCP, you can just take the exam.

378
00:30:31,480 --> 00:30:36,820
But I didn't really want to miss out on the educational opportunity of going through the course fully.

379
00:30:36,960 --> 00:30:38,740
So that's currently what I'm working on.

380
00:30:38,740 --> 00:30:41,000
It's been a lot of fun so far.

381
00:30:41,100 --> 00:30:42,380
eLearn Security, as we mentioned.

382
00:30:42,380 --> 00:30:44,740
The Pentesting Extreme course.

383
00:30:45,040 --> 00:30:46,580
That one's a red team course.

384
00:30:46,580 --> 00:30:47,620
And they cover malware.

385
00:30:47,620 --> 00:30:50,240
So it's a really good, well-rounded course.

386
00:30:50,240 --> 00:30:51,880
Covers a lot of good materials.

387
00:30:52,000 --> 00:30:54,180
I haven't personally taken this course myself.

388
00:30:54,180 --> 00:30:57,740
But I've taken the eLearn Security Web App Pentesting course.

389
00:30:57,740 --> 00:30:59,280
And the Mobile Pentesting course.

390
00:30:59,280 --> 00:31:00,780
And the good quality courses.

391
00:31:00,780 --> 00:31:04,540
And they don't expect you to be an expert to be able to take these courses and learn from it.

392
00:31:04,540 --> 00:31:10,720
They start in enough detail that someone with technical experience can pick these up.

393
00:31:10,800 --> 00:31:14,480
And then the Spectre Ops, Adversary Tactics and Red Team Operations.

394
00:31:14,720 --> 00:31:21,120
I fortunately got to take a couple courses before COVID really started ramping up.

395
00:31:21,200 --> 00:31:23,780
And it caused us all to have to social isolate.

396
00:31:23,780 --> 00:31:25,680
But I got to attend this talk.

397
00:31:26,140 --> 00:31:27,840
Harmjoy was one of the presenters there.

398
00:31:27,840 --> 00:31:30,900
As well as some of the other gurus from Spectre Ops.

399
00:31:30,900 --> 00:31:36,720
But this course, if you've got Cobalt Strike, this is a really good way to learn Cobalt Strike.

400
00:31:37,140 --> 00:31:39,240
And use it as a Red Team Operator.

401
00:31:39,760 --> 00:31:42,720
Forty North has a couple good classes.

402
00:31:43,100 --> 00:31:46,860
Their initial access operations and intrusion operations.

403
00:31:46,860 --> 00:31:50,060
So they cover some malware in their course.

404
00:31:50,060 --> 00:31:52,420
As well as silent break security.

405
00:31:52,420 --> 00:31:57,860
They have a malware development course and the adversary simulation.

406
00:31:58,300 --> 00:32:00,100
So these are really great courses.

407
00:32:00,400 --> 00:32:04,840
And SANS Red Team Exercise and Adversary Emulation.

408
00:32:04,840 --> 00:32:06,900
This is a two-day course.

409
00:32:07,080 --> 00:32:09,240
And George Rochias teaches this.

410
00:32:09,240 --> 00:32:11,560
And it looks like a really good course.

411
00:32:11,560 --> 00:32:18,400
They get into the Red Team from building a team type perspective.

412
00:32:18,400 --> 00:32:21,380
As well as doing the technology piece.

413
00:32:21,380 --> 00:32:24,580
And then Cobalt Strike offers some free videos on their site.

414
00:32:24,580 --> 00:32:28,880
If you go to the training and support tab on the Cobalt Strike website.

415
00:32:29,180 --> 00:32:31,220
There's links to their YouTube page as well.

416
00:32:31,220 --> 00:32:35,880
So they've got all sorts of tools in Cobalt Strike that they teach you how to use.

417
00:32:35,940 --> 00:32:39,660
A lot of the tools are pretty easy to pick up on.

418
00:32:39,660 --> 00:32:44,340
But if you haven't had experience with C2s, then I highly recommend these videos.

419
00:32:44,340 --> 00:32:47,440
Because there's things that are done a little bit different with a C2.

420
00:32:47,440 --> 00:32:52,920
But they do a good job of covering the different tools that you can use within Cobalt Strike.

421
00:32:52,920 --> 00:32:56,780
And Cobalt Strike uses PowerShell and C Sharp tools pretty heavily.

422
00:32:56,780 --> 00:33:02,560
As well as other scripting languages and executable files.

423
00:33:02,600 --> 00:33:04,440
So that's a good resource out there.

424
00:33:04,440 --> 00:33:10,940
You get a good idea of how Red Teaming works from the Cobalt Strike video series as well.

425
00:33:13,680 --> 00:33:15,500
And resources and blogs.

426
00:33:15,500 --> 00:33:20,820
So here's a list of some blogs and resources that I've come across.

427
00:33:20,820 --> 00:33:24,520
I started dedicated Red Teaming back in November.

428
00:33:24,520 --> 00:33:30,480
So I've been doing a lot of research and studying to learn the Red Team side of things.

429
00:33:30,700 --> 00:33:33,980
So here's some good... the Red Team Journal is kind of an older blog.

430
00:33:35,300 --> 00:33:37,800
I don't think it's been updated lately.

431
00:33:37,800 --> 00:33:39,760
But there's a lot of good information on there.

432
00:33:39,900 --> 00:33:44,120
The Red Team Guide is based on the Red Team Guide book.

433
00:33:44,120 --> 00:33:47,300
But there's a lot of good documents on there on starting pen tests.

434
00:33:47,300 --> 00:33:49,180
And some of the different techniques.

435
00:33:49,240 --> 00:33:51,620
I mean Red Teaming techniques.

436
00:33:52,000 --> 00:33:57,820
And Thread Express is kind of a site related to the Red Team Guide.

437
00:33:57,820 --> 00:33:58,560
Same people.

438
00:33:58,560 --> 00:34:01,400
It was kind of their blog before they came out with the Red Team Guide.

439
00:34:01,400 --> 00:34:02,720
Good information there.

440
00:34:03,780 --> 00:34:07,000
Mike Bleeder's website along with his awesome tools.

441
00:34:08,120 --> 00:34:10,940
There's a lot of great information on his blog.

442
00:34:10,960 --> 00:34:12,200
Harmjoy's blog is great.

443
00:34:12,200 --> 00:34:12,600
B.C.

444
00:34:12,600 --> 00:34:13,720
Security.

445
00:34:14,200 --> 00:34:15,840
Spectra Ops.

446
00:34:15,840 --> 00:34:16,860
Rastamouse.

447
00:34:16,860 --> 00:34:20,220
Howsec is actually part of Spectra Ops.

448
00:34:20,220 --> 00:34:21,780
Silent Security's blog.

449
00:34:21,780 --> 00:34:23,440
Forty Moore's blog.

450
00:34:23,560 --> 00:34:27,820
And IRED.Team and Vincent Yu's blogs.

451
00:34:27,820 --> 00:34:31,680
These are some really good places to learn.

452
00:34:31,680 --> 00:34:42,140
And I've been using a lot of these resources as I'm going through the Rastamouse's Zero Security Red Team Ops course.

453
00:34:43,300 --> 00:34:44,800
There's some other books out there.

454
00:34:44,800 --> 00:34:48,900
So this is one of the books out here that recently came out.

455
00:34:48,900 --> 00:34:50,140
The Hacker's Playbook.

456
00:34:50,140 --> 00:34:55,340
If you've seen version 1 and 2, it's more pen testing related.

457
00:34:55,340 --> 00:34:58,760
But version 3 gets into Red Teaming.

458
00:34:58,760 --> 00:35:01,520
I highly recommend if you don't have version 2, get version 2.

459
00:35:01,520 --> 00:35:06,360
It's got a lot of good real world pen testing attack scenarios.

460
00:35:06,580 --> 00:35:09,560
So also the Red Team Development and Operations.

461
00:35:09,560 --> 00:35:13,300
This kind of shows you how to build a Red Team.

462
00:35:13,320 --> 00:35:15,560
And one of the authors is Joe Vest.

463
00:35:15,560 --> 00:35:17,940
He formerly worked with Spectra Ops.

464
00:35:17,940 --> 00:35:24,360
I got to meet him back during my Red Team training through Spectra Ops earlier this year.

465
00:35:24,480 --> 00:35:25,720
So it's a really good book.

466
00:35:25,720 --> 00:35:32,620
And they go through and show you some different checklists and stuff on how to perform Red Team operations.

467
00:35:32,720 --> 00:35:36,940
So it's a really good book even for management or people who manage Red Teams.

468
00:35:36,940 --> 00:35:41,140
I recommend this book because it kind of shows you how Red Team operations work.

469
00:35:41,500 --> 00:35:45,180
And then Hands-On Red Team Tactics, A Practical Guide to Mastering Red Team.

470
00:35:45,200 --> 00:35:50,660
This book actually covers some Cobalt Strike information.

471
00:35:50,780 --> 00:35:57,360
And this was recently recommended yesterday or actually Friday during one of the talks in Red Team Village.

472
00:35:57,360 --> 00:36:01,620
So it's a little more indicator that it's a good resource.

473
00:36:01,760 --> 00:36:06,380
But these are some good books out there as well as just pen testing books in general.

474
00:36:06,380 --> 00:36:10,720
Learning pen testing and certifications.

475
00:36:10,720 --> 00:36:12,920
There's not like a lot of certifications out there yet.

476
00:36:13,000 --> 00:36:14,840
And there may be more than this.

477
00:36:14,840 --> 00:36:22,160
I saw another Red Team cert that is more physically and more lock picking and more physical security related.

478
00:36:22,160 --> 00:36:37,920
But what you're going to need from, in most cases, what you would gain from Zero Point Securities cert, the skills that you would need for performing Red Teaming operations.

479
00:36:37,920 --> 00:36:44,720
While some of the physical stuff is important, you can take lock picking courses and learn physical security to kind of really get started.

480
00:36:44,720 --> 00:36:47,000
Especially if you have a pen testing background.

481
00:36:47,000 --> 00:36:52,760
And these three cert courses or the certs would be good to have.

482
00:36:52,860 --> 00:36:59,140
And some of these pen test focused certs from Offensive Security, SANS, and E-Learning Security.

483
00:36:59,140 --> 00:37:04,660
Offensive Security and the SANS certs are really good for getting your foot in the door as a pen tester.

484
00:37:04,820 --> 00:37:06,560
And good for getting pen testing jobs.

485
00:37:06,560 --> 00:37:08,960
The E-Learning Security is starting to gain more notoriety.

486
00:37:08,960 --> 00:37:13,760
They're really good courses and really well written and really well priced.

487
00:37:13,760 --> 00:37:17,400
If you don't have the money to, you know, your company won't put you through SANS training.

488
00:37:17,400 --> 00:37:22,580
Then Offensive Security and E-Learning Security, those certification courses are really good ones.

489
00:37:22,600 --> 00:37:25,140
As well as the Pen Tester Academy courses.

490
00:37:26,860 --> 00:37:28,980
And here's my contact information.

491
00:37:29,640 --> 00:37:34,960
I kind of got into teaching and presenting at conferences as a way to share.

492
00:37:34,960 --> 00:37:38,320
I used to mentor and still do mentor a lot of people.

493
00:37:38,660 --> 00:37:41,640
A lot of times just answering questions and sharing resources.

494
00:37:41,880 --> 00:37:43,300
So this stuff is my hobby.

495
00:37:43,300 --> 00:37:44,740
I live and breathe this stuff.

496
00:37:44,880 --> 00:37:50,900
So I'm always up to talk about this stuff, give career advice, and help out if you're having questions.

497
00:37:51,020 --> 00:37:52,920
There's my contact information.

498
00:37:53,320 --> 00:37:55,700
Feel free to contact me.

499
00:37:57,840 --> 00:38:01,500
And so that concludes my presentation.

500
00:38:02,000 --> 00:38:02,740
Awesome.

501
00:38:02,840 --> 00:38:04,420
Thank you so much, Phillip.

502
00:38:04,420 --> 00:38:06,500
As always, you have been amazing.

503
00:38:06,500 --> 00:38:10,700
And thank you so much for supporting the community and the Red Team Village as well.

504
00:38:10,820 --> 00:38:16,300
And for those of you that are online, please join the conversation in Discord.

505
00:38:16,700 --> 00:38:19,240
We have the link in the bottom of the screen.

506
00:38:19,240 --> 00:38:24,780
So in the description, whether you're in YouTube, in Periscope, or in Twitch.

507
00:38:24,780 --> 00:38:25,880
Please join us.