Certified Pentester (CPen) at c0c0n 2023

c0c0n is a 15 year old platform that is aimed at providing opportunities to showcase, educate, understand and spread awareness on information security, data protection, and privacy. Various technical, non-technical and legal communities participate in the conferences. This year, in partnership with The SecOps Group, c0c0n is pleased to announce a certification to allow participants to validate their skills and progress in their careers.

What is Certified Pentester (CPen) Exam?

The Certified Pentester (CPen) is an intermediate level exam, intended to be taken by professional pentesters, bug-bounty hunters, red and blue team experts, SOC analysts and anyone wanting to evaluate or appraise their existing knowledge in topics involving hands-on pentesting. This practical exam covers a wide variety of topics and in order to successfully complete each section, attendees will have to obtain flags associated with every topic.

The pass criteria is as following:

Attendees scoring over 60% marks will be deemed to have successfully passed the exam.
Attendees scoring over 75% marks will be deemed to have passed with merit.

How long is the exam?

The exam will be for 7 hours (9 am to 5pm). However, an hour of lunch break can be taken during the exam. The exam can be taken on:

DATE: Oct 5th, 2023
TIME: 8am to 5pm IST
VENUE: Grand Hyatt Bolgatty, Kochi, Kerala, India
Note: 2 coffee breaks are provided per day. Food / Lunch is not included

What topics are covered?

The exam will cover the following topics of pentesting:

Web Hacking (50%) – 3.5 hours (210 mins); 210 Marks*
Infrastructure Hacking (50%) – 3.5 hours (210 mins); 210 Marks*

The complete list of topics can be found in the exam syllabus section below.

*Note:

The marks allocated for every question also indicates the time that an attendee is expected to spend in solving a question. For e.g. a question worth 30 marks, will require roughly 30 minutes, for it to be solved.

What is the format of the exam?

The exam will be a Capture The Flag (CTF) style Hackathon. It will be a full day event requiring attendees to capture flags as they go on identifying and exploiting various system vulnerabilities and score points, after submitting the flags and answering the associated questions.

What is the experience needed to take the certification and what level of difficulty can be expected from the exam?

We recommend a minimum of 2 years of professional penetration testing/bug bounty experience before taking this exam.

In terms of difficulty, on the scale of beginner, intermediate and advanced, this exam has been rated as intermediate. The exam tests attendees' practical knowledge in identifying and exploiting vulnerabilities in real life pentesting scenarios.

To explain this a bit more, we expect attendees to be able to identify and exploit vulnerabilities such as SQL Injection and obtain relevant flags, however, we are not testing them on advanced web hacking concepts such as that of Second-order SQL Injection, within this exam. Similarly, to cite another example for infrastructure hacking, attendees are expected to use common hacking tools and techniques to demonstrate how to compromise a Windows Active Directory infrastructure, but they are not expected to write custom exploits, use or create 0-day exploits or perform reverse engineering etc.

Can I participate with my friends and colleagues as a team?

One can only participate in an individual capacity (i.e. teamwork is not allowed).

What tools/laptop do I need to bring?

Attendees must use their own laptop and can use hacking tools of their choice. Internet access will be available during the course of the exam but no assistance will be provided with regards to installation/configuration of any tools. The hacking challenges can be solved using freely available tools and scripts.

What will attendees get?

Each attendee will receive:

A certificate of participation. The certificate will mention pass/fail and merit status. In addition to this, attendees will be able to download a PDF report, which will have detailed scores for each section of the exam, allowing them to identify and focus on areas of improvement for future qualification and training.

Will you provide any training that can be taken prior to the certification?

Being an independent certifying authority, we (The SecOps Group) do not provide any training for the exam. Attendees should carefully go over each topic listed in the syllabus and make sure they have adequate understanding, required experience and practical knowledge of these topics.

What is the exam retake policy?

Candidates who fail the exam must purchase a new exam voucher for every attempt.

How long is the certificate valid for?

The certification does not have an expiration date. However, the passing certificate will mention the details of the exam such as the exam version and the date. As the exam is updated over time, candidates should retake the newer version as per their convenience.

What is the exam syllabus?

The exam syllabus is listed below:

Web Hacking

Google Hacking, Dorking and OSINT Techniques.
Identification and Exploitation of OWASP Top 10 Vulnerabilities
Cross-Site Scripting
SQL Injection
XML External Entity attack
Cross-Site Request Forgery
Practical Cryptographic Attacks
Authentication related Vulnerabilities
- Brute force Attacks
- Username Enumeration
TLS Security
- Identification of TLS security Misconfigurations.
Server-Side Request Forgery
Authorization and Session Management related Flaws
Insecure File Uploads
Code Injection Vulnerabilities
Business Logic Flaws
Directory Traversal Vulnerabilities
Common Security Misconfigurations.
Information Disclosure.
Vulnerable and Outdated Components.
Common Security Weaknesses affecting Cloud Services such as a S3 Bucket.
Security Best Practices and Hardening Mechanisms.

Infrastructure Hacking

Common OSINT Techniques
Network Mapping and Target Identification
Brute-force Attacks.
Vulnerability Identification and Exploitation using Common Hacking Tools.
Application Server Flaws.
Insecure Protocols
*nix Vulnerabilities.
Insecure File permissions.
Security Misconfigurations Leading to Privilege Escalation Attacks.
Windows Active Directory Attacks.
OS Credential Dumping and Replay.
Kerberoasting; golden and silver tickets.
Password Attacks and Password Cracking.
Administrative Shares Exploitation
Persistence Techniques
Lateral Movements
Cloud Enumeration
Abusing Serverless Services
Abusing API Token and Cloud Credentials
Vulnerability chaining
Common security misconfigurations allowing docker escape

About: The SecOps Group

The SecOps Group is a globally recognized IT security company having vast experience of providing cyber security consultancy and education services. At The SecOps Group, we believe that security is a continuous process, which has to progress with time and in accordance with the customer needs and constantly evolving threats. Our core business comprises of two units:

1. Consultancy:

Pentesting and Advisory

The SecOps Group are cybersecurity experts offering CREST accredited security consultancy services.

2. Education:

Cyber Security Certifications

Through our exams, we provide an authentic and credible certification program that is modern, relevant and represents real life business risks.

Vulnmachines (A Pentest Learning Platform)

The SecOps Group The SecOps Group runs a free pentest learning platform called Vulnmachines.

Registration terms and conditions:

Registration fees are non-refundable.
Certification tickets may be transferred. Please email us for specifics.
Failure to attend the Certification without prior written notification, will be considered a No-Show. No refund will be given.
By purchasing this ticket you agree to abide by the Code of Conduct and the registration terms and conditions listed above.

CPen Exam

INR 41000

The Certified Pentester (CPen) is an intermediate level exam, intended to be taken by professional pentesters, bug-bounty hunters, red and blue team experts, SOC analysts and anyone wanting to evaluate or appraise their existing knowledge in topics involving hands-on pentesting. This practical exam covers a wide variety of topics and in order to successfully complete each section, attendees will have to obtain flags associated with every topic.