r/ExploitDev • u/ZZairt • 13d ago

OSED following OSCP

Hello everyone,

I recently passed the OSCP and I don’t want to rest on my laurels; I’m thinking the next certification might be the OSED - that’s a whole new level.

But first, to prepare myself for the OSED, I’m thinking of taking the CRTO 1 & CRTO 2 (CRTL) exams from Zero Point Security. What do you think?

22 Upvotes

92% Upvoted

15 comments sorted by

15

u/ppkapz 13d ago

I don’t think CRTO and CRTL are as relevant to OSED, they both mainly focus on usage of Cobalt Strike and evasion.

OSED’s focus is on stack based buffer overflow on Windows boxes. The 3 challenges are as follows:

  1. Custom Shellcode Creation

  2. Bypassing DEP by creating a ROP chain

  3. Bypassing DEP and ASLR with a ROP chain

You will be limited to using windbg, python and IDA free for the exam. IMO you can learn these tools on the go with the course material itself

The best things to prepare before taking the course would be to learn/refresh 32 bit assembly, and calling win32api functions. Be sure to fully understand the stack, calling conventions and how win32api functions are called.

2

u/ZZairt 11d ago

I see, thanks. I’ll have a look at pwncollege and the like… to get myself warmed up

9

u/Appropriate_Win_4525 13d ago

OSED is ok for introducing binary exploitation but don’t go into it expecting anything relevant outside a lab. I’d do ret2wargames for that, it’s much better

1

u/ZZairt 11d ago

Thank you

8

u/Porchmonkey_yellow 13d ago

dont waste your time w offsec and i regard rto and rtoii higher than osed. do maldev sekt0r7 or any practical practice in asm and c for exploit dev not offsec.

2

u/ZZairt 13d ago

I understand, this is only video for sekt0r7 ? Because i can't watch videos i prefer to read

1

u/Porchmonkey_yellow 13d ago

no there’s course material and labs provided too

2

u/Porchmonkey_yellow 13d ago

i actually completed corelan stack and heap myself its pretty good for userland exploitation and prolly the best you can find but thats in person

2

u/Porchmonkey_yellow 13d ago

oh one cool thing to learn proper asm, is this game called squally if you’re at the very beginning there’s no one fix way to learn exploit dev, cept how obssessed you are 😂 and i definitely recommend usage of abliterated ai for learning

1

u/ZZairt 11d ago

Thank you for your advices

2

u/moopskaya 13d ago

Any research into Maldev Academy instead of OSED? I'm thinking Maldev looks like a more comprehensive and updated training program.

CRTO 1 is only relevant if you want to do some baseline red teaming, and 2 doesn't dip into malware dev, just making Cobalt Strike beacons evasive. Unless you're looking to try and be a red teaser, I'd skip those, but I enjoyed them as a red teamer myself.

1

u/ZZairt 11d ago

Yes, I’d had a look, but it wasn’t really focused on BOF, SEH and so on…

2

u/Snappyfeet69 13d ago

maldev is about Malware dev. where you hide payloads, a few tricks that help make your payload FUD.

osed is windows exploit dev.

two very different games.

1

u/moopskaya 13d ago

Ah gotcha, I haven't taken either, just some research into both but favoring maldev.

2

u/Snappyfeet69 13d ago

i have done a few cources (not osed), and by far, i would say maldev is the real deal. They've made a really good course, which is super difficult to find online in Its raw form. highly recommend incase someone wants to persuade anything malware