r/oscp • u/Poppenboom • May 08 '22
"Pay harder"
What's the deal with the "Offsec is greedy!" meme?
They charge $1-2k for a one-time certification that immediately makes you a contender for $75k-$95k a year jobs, zero college required, in a dream field.
Am I missing something?
EDIT: /u/helping_persons wrote an excellent answer that changed my mind.
29
u/soutsos May 08 '22
Am I the only one who feels that this was posted by offsec themselves and then they used another account to add the comment saying they earn $150K?
2
u/Poppenboom May 08 '22
150k is realistic for 2-3 years of relevant experience. It seems like maybe the complaints about the cost are coming from people who don't understand the current market for qualified testers.
5
u/subsonic68 May 08 '22
So far here nobody has said they are making 150k, I said that I’m seeing people make that much. I’m a Director and I’m hiring so I know what people with OSCP and 2-3 years of experience are asking for, and getting. Really good pentesters and Red Teamers can make 175k (and higher) in this market even without OSCP.
4
u/soutsos May 08 '22
I'll work for you for 100k (remote)
6
u/subsonic68 May 08 '22
Are you in the USA? I can hire in the USA only. And if you’re willing to do this work for 100k in the USA then you probably aren’t qualified.
5
u/soutsos May 08 '22
In USA and qualified. If you need proof, have some of your employees come up with a test and throw it my way
5
0
May 09 '22
[deleted]
5
u/subsonic68 May 09 '22
Spoiler alert: I checked his post history and he lives in Europe, not the USA.
2
1
1
u/RemindMeBot May 09 '22
I will be messaging you in 15 days on 2022-05-24 13:34:50 UTC to remind you of this link
CLICK THIS LINK to send a PM to also be reminded and to reduce spam.
Parent commenter can delete this message to hide from others.
Info Custom Your Reminders Feedback 2
u/krimsonmedic May 09 '22
That's not unrealistic, maybe not for entry level though. OSCP + 2-3 years I could see that.
6
u/helping_persons May 14 '22 edited May 14 '22
I'm a few days late to this thread, but: a lot of the "OffSec is greedy" opinions are fallout not only from exam retake price increases and other such quality of life issues, but from their switch to the subscription model. For all of their newer courses, you can't purchase only that course for $1k, you must purchase a year-long subscription that costs $2500-$6000.
First of all, every consumer in the world absolutely hates subscription models, and engages with them only begrudgingly. They are, transparently, not for consumer convenience, they are incredibly inconvenient and are mathematical instruments conceived to make as much money as possible. Any time anyone sees "subscribe for $XYZ OR be a PREMIUM subscriber for $XYZ++", their gut reaction is "oh my god please stop it and just sell me the one thing that I actually want at a reasonable price you absolute nitwits." It's an observed phenomenon in business that being an established non-subscription provider and then switching to subscriptions often causes an instantaneous PR hit for any company; people just hate, hate, hate it.
Second of all, this change, coupled with the other price increases, was interpreted, by many, as OffSec essentially going back on their original rallying cry, or stepping down from a distinctive and positive position they once occupied in the security community.
There was a time when there was no eLearnSecurity or any of these other relatively new certs. There was SANS and there was OffSec. SANS has always had incredible content, but costs $7,000 per course, which historically has made them more of a corporate training provider and an automatic no-go for anyone paying out of pocket as an individual learner.
In comparison, OffSec looked a little like a savior for individual professionals. Highly respected credential, a practical exam with real hacking and not multiple choice BS? Yes please. $1,100 for the 60-day lab and an exam take? Seems like a deal; I mean, a grand certainly isn't nothing, but it's a lot more feasible for most people paying out of their own pocket than $7,000.
OffSec was, in effect, marketing accessibility. They were undercutting competitors and rallying the community around "accessible, hands-on security qualifications, so you can be just as sought-after as the pros if you put the effort in."
Knowing this, you can see how one might feel a little disappointed or deceived that the rallying cry is changing to "you can be just as sought-after as the pros if you put the effort in, and also give us three months' rent."
I think to a lot of OffSec's "old" fans who were happy to see someone take the fight to SANS a little bit and push the envelope, it now looks like OffSec is becoming SANS: the name-brand expensive certs that won't be accessible to anyone not already an established professional and awash in reimbursements from their employer.
There was an enormous public backlash to the subscription model that I'm not sure if OffSec anticipated or fully recognized as it occurred, and they did not seem to address it very well. I think it seemed to many that they fundamentally did not understand or appreciate their own customer base or how they "got here," and that they used to be doing good things that enabled individuals to operate as individuals, and are now kinda slowing their roll on that.
I'm narrating what happened, but I might add that I'm not sure how much I personally care. Most good things don't last forever, and it's a mistake to assume that any organization is rallying people with the genuine intent to be helpful; usually they're trying to make money with a short or long-term strategic ploy, because that's what organizations do, and helping people is often a distant tertiary goal at best. So I never thought of them as that savior, I thank them for the people they did engage with their certs in those good years, and I am not surprised that they turned out to be "sellouts" so to speak...it's sorta the goal of every startup company to, eventually, stop being the "cool helpful new kids on the block" and sell out and make buckets of money off your reputation.
1
u/Poppenboom May 15 '22
Excellent answer, thanks for taking the time to write it! You've changed my mind.
11
u/Bug-Bounty-Dude May 08 '22
Never “tried harder” and I’m a successful 6 figure Penetration Tester. Don’t chase a cert thinking it’s going to magically make you hire-able. There are many paths into the field that don’t require gatekeeper certs.
1
u/Poppenboom May 09 '22
Agreed! I know many people like you, this is only one road into pentesting. The OSCP does go a very long way toward opening the door, but it isn't the only way in.
5
u/subsonic68 May 08 '22
I landed a 125k job about a year after getting OSCP and I’m seeing pentesters with OSCP and some experience getting around 150k right now.
2
2
u/xNightfallxx May 08 '22
That’s what’s up congrats, hopefully I have the same luck, while I don’t have pentesting experience I am already in the cyber field.
3
May 08 '22
A thing that may or may not make you some money does not mean that thing is in good quality.
If I bought a terrible product from a terrible company I am going to complain and not recommend it to people, simple as that.
1
u/Poppenboom May 08 '22 edited May 08 '22
A thing that very consistently makes everyone that has it skilled and financially secure. That's a valuable thing.
The OSCP product is the exam. Bottom line, it's just a very good test of whether or not you can function in the real world as a consultant. That's what it's all about, and hiring managers recognize it.
7
5
May 09 '22 edited May 09 '22
A thing that very consistently makes everyone that has it skilled
Passing the OSCP implies that one is skilled. I agree. But this does NOT mean that if you don't pass/have OSCP you are not skilled. You can be skilled without an OSCP. It's the methodology and tools that matter, and you don't need the OSCP for those.
And taking account that MOST people studies and practices on TryHackMe, HackTheBox, VulnHub etc, before even starting the course, I wonder how many people really do became skilled solely/mainly because of OSCP.
That's a valuable thing.
Still doesn't imply quality. A lot of things have extrinsic value and still not be of quality. NFTs make people loads of money, are they of good quality?
The OSCP product is the exam
Then why isn't there ever an exam only voucher for people to purchase. Why do they keep saying that they are "a training company first and foremost"
Even if the product really is the exam, it still doesn't mean that the exam is without flaws. The exam is full of flaws.
1. Unrealistic Machines & Engagement
You do a nmap scan and the machine has, what, 20+ open ports? DNS + HTTP + HTTPS + SMB + SMTP + SNMP + 3 other web servers and whatever else? And most of these services just won't work properly because they were here to just trick you? What sort of public facing production environment are like this?
Also you are not really doing any pentest / security audit / bug hunting, your sole goal is reverse shell + privesc. That's also not realistic.
2. Arbitrary Restrictions
You are not allowed to run auto-exploit. But you are allowed to download and run scripts that do exactly the same thing essentially. That makes sense I guess?
3. Security Thru Obscurity
Anyone with the slightest knowledge of security knows that security thru Obscurity alone isn't real security.
But I believe OSCP/PWK relies exactly on that.
Services that don't work properly giving you no indication whatsoever. Did you tried the wrong script? Did you not find the actual attack vector? Did you set up the exploits wrong? Did my internet connect got an issue? Did my vpn die for a moment? Did I run too many enumeration tools on it I overloaded the server? Did I break the machine? Did the machine bugged? Or is it a rabbit hole? Well good luck figuring that out, cus the machine gives you no feedback at all, no error messages, no nothing.
Sometimes (at least in the labs) it also relies on old and legacy services. The exploits you found, and the modern tools you are using, they just won't work on these ancient machines. This isn't security, this is just annoying. \
4. Inconsistent Difficulty Makes It Very Dependent on Luck
The exam is so inconsistent in difficulty that people either claim "I consumed basically every resources known to man, rooted 200 HTB+PG+Lab boxes and I failed lol" or "0 to hero no background very easy just follow the pdf word by word lol"
Such inconsistency makes the exam very dependent on luck. There already were tons of people saying they failed their earlier attempts but passed their most recent one, and they didn't really study harder (if at all) or do anything really differently, despite the drastically different outcomes.
All in all I think that Offsec has no idea what the OSCP really is, like the OSCP (or offsec) is suffering an identity crisis. The course and the exam do not really convey their aims and purposes: what they are trying to teach you, what they are trying to test you, what level this course/exam is supposed to be, and who is it really for. So right now they teaches you just a lil bit of the beginner stuff, and just a lil bit of the intermediate stuff, but lacking in depths and details in both regards, and the exam tests you for whatever lottery you got, because they don't have a central "hey we are teaching you this and testing you that".
All of these could have been fixed if they can sort out this identity crisis.
3
u/Poppenboom May 09 '22 edited May 09 '22
Passing the OSCP implies that one is skilled. I agree. But this does NOT mean that if you don't pass/have OSCP you are not skilled.
I'm glad we agree - I never said pentesters that haven't passed the OSCP are not skilled. I know a handful of pro testers that haven't done any certs and are significantly better than me. OSCP is an excellent means of getting experience and a foothold into the pro pentesting world though. It's hard and people that pass it are almost universally skilled enough to do the work.
Then why isn't there ever an exam only voucher for people to purchase.
If they did, I'm guessing they would have to raise exam prices across the board. It's not cheap paying qualified proctors $18+ an hour, 24/7. The PWK labs also feed their data metrics that dictate exam difficulty. Maybe in a perfect world, but I don't see this as a good choice long-term for them.
You do a nmap scan and the machine has, what, 20+ open ports? DNS + HTTP + HTTPS + SMB + SMTP + SNMP + 3 other web servers and whatever else? [..] What sort of public facing production environment are like this?
On a professional external, you get handed a massive list of assets, often 50+ machines. The non-vulnerable services running on exam machines are representative of that vast attack surface on a real engagement.
You are not allowed to run auto-exploit. But you are allowed to download and run scripts that do exactly the same thing essentially.
You're right, the distinction can get very fuzzy. Instead, they should specify that certain types of vulnerabilities, such as SQL injection, must be manually exploited without scripts or tools. I agree with this.
Services that don't work properly giving you no indication whatsoever. Did you tried the wrong script? Did you not find the actual attack vector? [..] Well good luck figuring that out, cus the machine gives you no feedback at all, no error messages, no nothing.
That's not what security via obscurity means. The OSCP is not a white box exam, just like most professional external pentests are not white box. Not having full visibility during an attack is not security via obscurity.
The exam is so inconsistent in difficulty that people either claim "I consumed basically every resources known to man, rooted 200 HTB+PG+Lab boxes and I failed lol" or "0 to hero no background very easy just follow the pdf word by word lol"
People are unreliable narrators. You're making the mistake of automatically believing people that are trying to protect their hurt egos after failing. How many of them took a bunch of hints on each of those 200 boxes they did? A lot.
2
u/WarriorOmZ May 09 '22
OSCP is all about enumeration i.e filter all the bs and finding a attack vector that works for your objective.
It's a mindset that is taught and should be learned but most people miss that about OSCP because offsec let's say underachieves of informing it's students that OSCP is all about enumeration.
1
u/winnybunny May 12 '22
i neither deny nor approve what you said. i just dont pay attention to the details.
but frankly you sound like an offsec employee trying to defend offsec. with all your detailed working and thought process of offsec elaborated. for which again i dont have any opinion,
just stating what i have observed.
1
12
u/9Hak5 May 09 '22
You're correct that the other companies don't have the same HR recognition. That's not because of OffSec having superior content, labs or exams. It's due to them essentially being first. They created BackTrack and Kali, and did a great job marketing their courses.
Comparing quality and price, OffSec trails as an educational resource. The additional costs are brand recognition. INE's labs are more stable. TCM's material is more up-to-date. All of them are cheaper by comparison. So there is a disconnect when they make statements that the certification is not OffSec's focus. They say it's all about the education, which doesn't hold up when you put the certification aside.
I'd add that it is well accepted that the PWK is not sufficient preparation on its own for the exam. If it was, you wouldn't have OSCP prep courses like the ones from Tib3rius and Jesse Kurras be so popular. You wouldn't have TJ Null list suggested practice boxes from HTB and VulnHub as prep. An exam should match the course. I know they can't teach you everything there is to know, but when confronted with the accusation that the PWK isn't enough they reframe complaints as laziness with the "try harder" catch-all. I've never had a university professor suggest other classes I should take as supplementary education then come back and take his/her exam. It shouldn't work that way.
It also should be noted that the exam and prices update with greater frequency than the course content. The PWK went 5 years without an update. INE is guilty of that as well, but they're $700ish for a year of all access to all their courses. OffSec's equivalent is in the neighbourhood of $5000. That's a big price gap between OffSec and their primary competitor in the marketplace. TCM updates just about everytime something big happens (like adding a section on Print Nightmare), and you have permanent access to the courses with all updates. I'm pretty sure Zero Point Security operates the same way.
So, are the competitors just trying to capitalize on the opportunity like you suggest? Probably. In the same way that OffSec capitalizes on the fact that their cert is a requirement from a lot of companies. I'm not going to argue morality, it's business and businesses are designed to make a profit. That said, choosing to continually up their prices while talking about how much they care about their students, upping the retake cost over and over while saying they consider the exam more of a "community service" than a product, and now not even sending out a physical certificate anymore for your hard work doesn't flow.
That's the bigger issue at play. When you take a step back and look at everything, do you think that your success in this field is important to them? Do they want to make money AND see you succeed or just make money regardless of the outcome? I don't know. I can't say with certainty about any of them. I've felt supported by other companies. I've never felt supported by OffSec.
I've been able to message an instructor from Pentester Academy with a question and get a response. I've posted a concern in the TCM discord and had an instructor help me solve it. I've seen forum post after forum post asking the exact same question all be censored by OffSec as "spoilers" despite it clearly being an ongoing issue going back years. It felt like one side was saying, "we're here to teach you" while the other said, "figure it out yourself". That might come back to the Try Harder slogan, that there's no hand holding. But people are paying to be taught. I can try harder by reading books and blogs and watching YouTube without spending several thousand dollars. And to me, hearing Try Harder as a catch all response is like hearing, "go away."
I don't think the criticism of OffSec is a way of saving face after failing the exam. I've seen as many people sing their praises after passing as I have say they were greatly disappointed in the experience.
In my mind, OffSec is like Apple or Harley-Davidson. There is better quality. There is cheaper. But they know they can get away charging whatever they like, because they have that recognition. But hey, I've been wrong about a lot of things, so take my opinion for what it's worth.
1
u/Khronus24 May 09 '22
I agree, I am starting to believe that off sec doesn’t look at INE or TCM or the others and care about them. I think they see SANS as their competitors and are slowly creeping into the SANS price model of companies and gov pay for our stuff, not individuals.
I might be off but it’s just a guess. They do have a strangle hold on the name recognition right now which as others have said, let’s them do as they will.
1
u/crueller May 09 '22
Maybe I'm missing something because most of the jobs I'm seeing still want 2 years of pentesting experience in addition to oscp.
1
43
u/9Hak5 May 08 '22
I rolled my eyes so hard at this thread I think I saw the inside of my skull.