In August 2020, we announced our intention to retire our Cracking the Perimeter (CTP) course and revamp the OSCE certification.
As we announced previously, one of the new replacement courses, Evasion Techniques and Breaching Defenses (PEN-300), is now available. This advanced pentest course is for information security professionals who already have considerable skill in offensive techniques and penetration testing.
We’ve gathered answers to key questions about the course in this blog post. Keep reading for more information, or jump to the section of interest below. If you purchased CTP and still have questions, check out our CTP Sunset FAQ post here.
Jump to: The Course | Pricing | Preparing for PEN-300 | The OSEP Exam | Verifying Certification | Networking and Community
The Course
Evasion Techniques and Breaching Defenses covers more advanced topics of breaching network internal defenses through client-side attacks as well as evading antivirus and defeating application allow-listing technologies.
Specifically, we focus on how to customize those attacks and chain them together; for example, in an advanced Active Directory exploitation such as the compromise of an Active Directory Forest. PEN-300 does even more to prepare you for what happens in the field than PWK / PEN-200.
As a general rule, it will not specifically deal with the act of evading a blue team but rather focus on bypassing security mechanisms that are designed to block attacks.
How/where can I take PEN-300?
We offer the course online at this time. The official Evasion Techniques and Breaching Defenses course is only available from OffSec.
How to register
New students
Individuals and those with voucher codes can register for PEN-300 online. Students who are considering registering as part of a group, business, or organization, as well as managers purchasing for a team, should contact our training consultants.
If your purchase falls into one of the following categories please reach out to your assigned account executive directly (if applicable) or contact us at sales(at)offensive-security(dot)com:
- You are purchasing on someone else’s behalf
- You are being sponsored by your company
- You wish to make a bulk purchase
- You wish to purchase the course in advance (our course vouchers are valid for 12 months from the payment date)
- You wish to submit payment via wire transfer or would like to use net terms
Past and current students
If you are already a student and you would like to purchase another course or more lab time, please use the purchase link you received when you made your first purchase with OffSec. Can’t find your purchase link? Recover it here using the same email address you originally purchased with.
To register for the OSEP exam, use the link we provide in your welcome pack after purchasing PEN-300.
How does this new course differ from CTP?
CTP offered a broad survey to advanced topics in web application testing, penetration testing, and exploit development. Evasion Techniques and Breaching Defenses is a more thorough course focused strictly on penetration testing, and especially avoiding defenses.
The web application security aspect of CTP has been taken over by Advanced Web Attacks and Exploitation (WEB-300). The forthcoming Windows Usermode Exploit Development (EXP-301) course will cover the exploit development portion of CTP.
Of the new courses, Windows Usermode Exploit Development is about exploit development, reverse engineering, and working directly with a debugger. Evasion Techniques and Breaching Defenses focuses on advanced pentesting techniques, largely around bypassing various layers of security.
Requirements
In addition to the recommended knowledge prerequisites listed below, students must be at least 18 years old and have a valid ID to take a course. There are limited exceptions, with rigorous application checks for younger students who wish to apply.
There is no pre-purchase registration test for this course.
For hardware, we recommend a minimum of 4 GB of RAM installed with at least a dual-core CPU and 20 GB of free hard drive space.
The lab connection is done with OpenVPN using Kali Linux. You should use a stable, high-speed Internet connection to access the labs, not mobile internet (3G/4G/5G data connection).
What dates are available to take PEN-300?
Available dates can be seen when you register. They typically open for the next few months. If you would like to register for a future course date that isn’t listed, simply complete your purchase with the latest available date and reschedule by contacting our team. Please include your OSID when you contact us.
Please note that while sales for PEN-300 opened October 27, 2020, course start dates will be offered from mid-November onwards.
Pricing
Evasion Techniques and Breaching Defenses starts at $1,599 (all prices in USD). This base price includes 60 days of lab access plus the OSEP exam fee. Increasing lab time to 90 days increases the cost. There is no 30-day lab option due to the difficulty level of the course material.
You may add lab time later if you find you would like more practice before starting the OSEP exam. Lab access extensions start at $359 for 30 days. The OSEP certification exam retake fee is $249.
Please note that as of February 11, 2020, lab extensions no longer come with a free exam take.
See “Course Pricing” for more information, including lab extensions and upgrades to the new course material.
Preparing for PEN-300
Since the end goal is to learn how to compromise client organizations that contain hardened systems, it’s expected that you have either taken the Penetration Testing with Kali Linux (PWK) course and passed the OSCP exam or have equivalent knowledge and skills.
The best way to prepare for the OSEP exam is to take Evasion Techniques and Breaching Defenses, with time in the labs to tackle as many of the challenges as possible.
Course prerequisites
The recommended skills include:
- Working familiarity with Kali Linux and the Linux command line
- Solid ability in enumeration of targets to identify vulnerabilities
- Basic scripting abilities in Bash, Python, and PowerShell
- Foundational understanding of Active Directory and knowledge of basic AD attacks
Familiarity with C# programming is a plus for this course. The full syllabus may be viewed here.
Labs
You may safely and legally practice your skills within the individual labs for the course. You should use a fully updated Kali Linux installation.
Lab time begins on your course starting date, at the same time you receive your course materials. Lab time is counted in consecutive days and is measured by the number of days you have purchased.
The OSEP Exam
The PEN-300 course prepares you to take the Offensive Security Experienced Penetration Tester certification exam. This is a 48-hour exam.
Earning all three of the following certifications automatically grants you the new OSCE³ certification:
- Offensive Security Experienced Penetration Tester (OSEP), granted after completing PEN-300 and passing the exam
- Offensive Security Web Expert (OSWE), granted after completing Advanced Web Attacks and Exploitation (WEB-300) and passing the exam
- Offensive Security Exploit Developer (OSED), granted after completing Windows Usermode Exploitation Development (EXP-301, coming early 2021) and passing the exam
Can I start the exam immediately after purchase? What if I still have lab time, but feel ready?
The OSEP exam will be available from February 1, 2021.
You must register for Evasion Techniques and Breaching Defenses at least 10 days prior to your desired course start date. Once your course starts, you may schedule your OSEP exam from February 1, 2021 onward.
If you feel ready early, you may schedule your exam when it becomes available. However, please be advised that there is a cool-off period before any exam retakes may be attempted. We strongly recommend students take full advantage of their lab time.
The OSEP exam is a hands-on penetration test, which focuses on the skills you would need to conduct a successful penetration test in the real world.
The OSEP exam is proctored. To learn more about proctoring, review the FAQs prior to registering for the course.
How long is the OSEP certification good for?
As with all OffSec certifications, once you’ve earned your OSEP certification, it’s yours. And as always, there are no subscriptions, renewals, membership fees, or other requirements to requalify your certification with OffSec.
Verifying Certification
We use Acclaim digital badges to make it easier for students to share their credentials with potential employers, and for employers to verify certification.
Professional development
Evasion Techniques and Breaching Defenses is not associated with any professional development credentials at this time.
Networking and Community
There are a number of ways you can connect with others who are either already OS certification holders, or on their journey:
You can also keep up to date with OffSec by signing up to be an OffSec Insider, or on social media:
More questions?
If you have more questions about PEN-300 or the OSEP exam, you can:
- Visit the course help section on our FAQ page
- Contact us (if you have an OSID, please include this with your message)
We look forward to seeing you!
