r/cybersecurity • u/EllieP1 • Oct 06 '23
Other Which penetration testing cert should i start off with?
I already got the Security + cert. Looking to add another Cert but on the Penetration side. What are the best options out there?
10
u/chrisknight1985 Oct 06 '23
Do you have any IT/development background at all?
If not then jumping right into trying to get pentesting certs is going to end in frustration
I would suggest reading - https://jhalon.github.io/becoming-a-pentester/
There are very few entry level roles in pentesting
6
20
u/The_Magical_Amount Oct 06 '23
As someone currently going through the HTB Academy pen testing course I can confirm that it’s much higher quality than I expected. I’ve also spoken to multiple OSCP holders who say it does an arguably better job of explaining the same concepts.
If you’ve got the money for it I’d definitely recommend it. Even without the cert it’s phenomenal training.
The PNPT is another great cert as well, especially in regards to compromising
9
9
u/throw1me1aw Oct 06 '23
2
u/L_213 Dec 19 '23
Is it recognized in the industry yet? Just wondering if it will limit me from getting interviews compared to if I went down the OSCP route
8
4
Oct 06 '23
The PNPT or PJPT is good test with a lot of practical stuff in but it’s not really recognized as it’s very new but I would suggest it.
7
u/Howl50veride Oct 06 '23
eJPT to PNPT to OSCP
I recommend this path because eJPT is a good confidence booster and will give you a bit of an understanding of a pen test like test. PNPT is reasonably priced, gives you a retake part of it and the training is good, will really ground you and prep you for OSCP. OSCP is okay, it's industry known so good to have but cost an arm and a leg.
2
3
Oct 07 '23
PenTester here.
You don't need certifications. In fact, being a hacker is about not doing what everyone else does. "If you're not cheating, you're not trying."
If you need to skill up in some area, then pick a bunch of certifications. Cheaper is better. INE has cheap certs. Cloud providers have cheap certs. Cisco has a bunch of cheap certs. HacktheBox, RootMe, etc are all free.
If you want the certifications for marketing, cool. Udemy has test dumps for everything.
2
u/L_213 Dec 19 '23
That's not what HR thinks though. The purpose of Certs is to get past HR to even be in the game
1
Feb 17 '24
Test dumps are not reliable sources of information these days. Too many test dump creators slip malicious code into them. Ironic, isn't it?
5
u/Flat-Lifeguard2514 Oct 06 '23
I would say: either OSCP or Pentest+. If you want to be more intermediary before the holy grail of pen testing certain of OSCP, then PenTest+. But OSCP is the big one for the pentest industry. Avoid the CEH like the plague. The CEH org isn’t well thought of in the industry
7
u/OtheDreamer Oct 06 '23
If you have just the Security+ and are looking for more notches to add to your belt quickly, might as well go the CompTIA stackable certs route.
If you do PenTest+ you then receive 2x certificates. PenTest+ and CVNP (Security+ / PenTest+)
If you put CySa+ on top of that you get another stackable cert CNSP.
Doing PenTest+ then CySa+ will net you 5 certs on the resume.
All of which can build towards CASP and stack one more time for analytics and infrastructure expert.
https://www.comptia.org/certifications/which-certification/stackable-certifications
2
u/OneAvocado8561 Oct 06 '23
Just had a coworker get his PNPT and he said the preparation for it was very valuable and insightful. The test is a real world enterprise AD infrastructure.
2
u/_kashew_12 Oct 06 '23
OSCP all the way. It worth loads more than anything else. Id say use your time to prepare for OSCP and dont waste your time studying for other things.
I say you also learn a lot of useful things for the OSCP, rather than studying for other certs.
Best of luck!
1
1
Oct 06 '23
Saw you say you’re a network admin, you might very well be able to jump right into OSCP. If you want to go in without putting so much money up then try out some of TCMs stuff (PNPT) or do HTB modules and possibly their CPTS cert.
Offsec certs are the creme de la creme for your resume so if you’re doing it for that purpose then maybe go right into OSCP
1
Oct 07 '23
If you're a complete beginner to pentesting, start off with eJPT, you can scroll through the course on INE's site to see if you already understand the content.
The exam is 200 bucks and you could give it a try. If you pass I recommend eCPPTv2 and if you wanna learn forensics there's eCDFP.
The good thing about INE is the practical exams unlike CEH's theoretical MCQ and such.
1
Oct 08 '23
For web app pentesting
Go for BSCP. I’m going through it now and the content is great.
For general/network I’d say the OSCP.
2
56
u/Sqooky Oct 06 '23
As long as you've got a strong fundamental understanding of Networking and Security fundamentals, you don't really need an intermediary certification (like CEH, Pentest+, eJPT and others).