The Prequel to PWK Course and OSCP Certification
During my many times of research on how to best prepare for the OSCP exam, I came across someone mentioning about how great VHL was for properly preparing them to take the PWK course and OSCP exam. After reading multiple reviews of success, I then decided that I was going to add the VHL training course to my path of becoming OSCP certified. I eventually ended up finding their Discord server and joined there, while I was still going through my PTS course for my eJPT. Once I obtained my eJPT, I was ready for my next step which I had my sights set on the PTP course in order to achieve my eCPPT and then I would proceed to VHL, and finally the PWK/OSCP path.
VHL Discord
However, I soon changed my mind one day after talking with some of the people from the VHL Discord group chat. I had finally decided that I would proceed to sign up for VHL, to better prepare for my OSCP and eCPPT exams, while continuing with my eCPPT studies during my free time. At this point I've become more and more eager to dive into studying and further advance my skills in penetration testing.
If you would like to join the VHL Discord Server, please click on the link.
Why sign up for the VHL Discord Server? Well, if you are stuck on a box and unsure of how to move forward, then you can go to the VHL Discord and ask for an additional nudge in the right direction. Or you can compare notes with another member on a box that you’ve completed but still have some questions on. It’s also a good place to go and hang out in the General section for some fun discussions and memes. Please do take note that this is not an official VHL Discord Server and it is provided only as additional community assistance to aid in the learning process for those that would benefit from such.
A few things to keep in mind while using the VHL Discord. Please read the rules channel and abide by them. Try your best not to drop spoilers into the chat rooms for the boxes, as these spoilers ruin the effort of other students that are trying their best to learn and only need a nudge from time to time in the right direction to continue. Please keep spoilers limited to DMs in your private chat with other members.
Also, do not join the VHL Discord just to ask for donations so that you can purchase the newest gadgets, this is best left for your Facebook posting and other social media venues; plus, it is the fastest way to get you banned from the VHL Discord Server. Remember to be courteous and respectful towards other members, because we’re all there to learn and not everyone is an Elite hacker, as this is a mixture of different skill sets.
Don't forget to check out the Resources channel as it also contains some good learning content and tools. Other than that, enjoy your time there; as it is a great community to learn from one another and make some friends with like minded people.
Signing Up
When signing up you can choose from the following packages: 7 days (Week Pass), 31 days (Month Pass), 93 days (3 Month Pass), 186 days (6 Month Pass), or 365 days (1 Year Pass).
Please do note that anything under than a Month Pass will not qualify for the following: Certificate of Completion, Downloadable Course-ware, or the E-book. If something states that it’s out of stock, you can contact the VHL Team and inquire about the next availability. Choose the package that is best for you and your schedule, generally if you have plenty of time quite a few students were able to complete majority of the boxes within a month’s time.
I proceeded to VHL's website to sign up for a 3 month subscription to VHL, due to my busy schedule, but quickly noticed that I couldn't sign up as my network at work was being blocked from signing up due to the company's VPN. During the initial signup you can't use a VPN. Also, the course has to be available in your country, or else you will get an error as such...
In no time at all, with assistance I was able to sign up using my payment details. After a few hours of impatiently waiting I had finally received my confirmation email of account creation and access to my student panel, where I quickly proceeded to download the PDF for the course.
Penetration Testing Course-ware
The course-ware can be viewed on their website and you can track your progress by marking the section complete. Or as an alternative, you can download their PDF from the Lab’s Dashboard, this is also available by visiting the downloads section within your account, where VHL has also provided some alternate downloads for their VMs.
I suggest try reading through the material first, before starting your hacking journey within the labs, because there is a lot of good information in there – which seems to get updated quite frequently on a monthly basis. You can also use the practice box while going through the materials as some of the explanations are conducted on that box.
Also, there are some helpful explanations from the boxes that you will be working on, as well. If you’re relatively new to the hacking scene then this will be like a treasure chest that will help you ingrain and form your own methodology, that works the best for you.
VHL Certificates of Completion
The Penetration Testing Course Certificate of Completion can be obtained by completing 20 boxes within the lab and writing a report for each box. I recommend using only the Beginner and Advanced Boxes for this purpose. Also, conduct the write up during your pentest or after completing the box as this will save you a lot of time at the end where you can just review your report for any missing information before submitting it to the VHL Team for review and approval. Try to prepare your report before your lab time runs out so that you can go back and capture a missing screenshot if needed.
The Penetration Testing Course Advanced+ Certificate of Completion can be obtained by completing 10 of the Advanced+ boxes, plus including 2 additional boxes that have proven public exploits available that work to PWN the boxes, but were done manually without using Metasploit or any publicly available scripts to PWN the boxes. For this purpose, look through the list of boxes that you have PWND to see if any two boxes match these criteria and save them for this report write up. The two boxes can be from any category of difficulty.
If you don’t already have a template that you like using for reporting then I would suggest using this VHL template that was made by one of the students and VHL Discord members, it’s very good layout that only requires a little bit of tweaking for the 20 box report.
The Labs
The Lab’s Dashboard can be accessed via your browser where you can view hints only on Beginner and Advanced boxes and be able to mark the box as complete to further track your progress. To access the labs read the chapter on Accessing the Labs in the supplied course-ware after connecting via the supplied VPN which will bring up the lab listing for your assigned lab environment. From there you can view the names and IP Addresses for all the machines with the ability to reset a lab once every 5 mins. The environment is similar to Hack the Box, with the caveat of not having to start the machines each time you want to begin, as they are constantly running.
One of the problems is that multiple people could be working on the same box at the same time, or the box had been completed but the last user never bothered to reset the box. Because of this, I like to verify the last reset time and also, check the Discord channel before clicking the reset button. If the box has been reset within the past couple of hours, then chances are someone is actively working on that box, so it might be better to choose another box to work off of and come back to that one at a later time.
The available difficulty categories for the boxes consist of 1 Practice box, 9 Beginner boxes, 17 Advanced boxes, and 15 Advanced+ boxes for a total of 42 boxes. The VHL Team does seem to launch new boxes every so often, to which they announce it on their news feed.
PrivEsc and Other Resources
If you are struggling with the concept of privilege escalation then I would recommend looking into some Udemy courses from Tib3rius and The Cyber Mentor. Both of these instructors go over their methodology of privesc to PWN Linux and Windows boxes and even have free labs over on TryHackMe to go with their course so you can practice what you have been taught.
A good tool to use and speed up the enumeration process is from Tib3rius called AutoRecon which exam takers have used this tool on the OSCP exam without any issues as there are no auto PWNing tools involved, it just gathers all the information in one location locally so that you can go through it as you like. I find that the Nmap, Nikto, GoBuster, and robots.txt scans that it does is very handy.
Final Thoughts
You might still be wondering is the course worth it, when I could just as easily spend my time elsewhere, in someone else’s course? Well, you could; however, it is one of the few available options that are more affordable and of quality for the price. Of course, there are room for improvements, but you will definitely feel that you have gotten your money’s worth by the end. There have been many people that have used VHL as their first stop before continuing on to their PWK course and others that failed their OSCP exam and then learned about the VHL course, took the course and went back to their OSCP exam and ended up passing right after completing the VHL course.
Personally, I can attest that my skills have increased tremendously when compared to before I started, and it’s all because of going through this course. Before I wasn’t very confident with hacking at medium level or hard level boxes, but now, I’m willing to run straight at them until I’ve completed it. I believe that this course has pushed my skills to the point where I can confidently start my PWK and take the OSCP afterwards to pass the first time, which is one of my goals. At the time of this review, I have completed 32/42 of the boxes and obtained my Certification of Completion. I may come back at a later date to finish up the remaining boxes, but for now I feel comfortable with what I was able to achieve.
Comments