Black Hat has been an industry leader in providing and facilitating cutting edge security briefings and training for over two decades. Driven by innovation and research, the annual conferences provide attendees various avenues to learn and progress in the different sectors of information security. This year, in partnership with The SecOps Group, Black Hat is pleased to announce its own certification: Black Hat Certified Pentester (BCPen).
What is Black Hat Certified Pentester Certification?
The Black Hat Certified Pentester (BCPen) is an intermediate level exam, intended to be taken by professional pentesters, bug-bounty hunters, red and blue team experts, SOC analysts and anyone wanting to evaluate or appraise their existing knowledge in topics involving hands-on pentesting. This practical, in-person exam covers a wide variety of topics and in order to successfully complete each section, attendees will have to obtain flags associated with every topic.
The pass criteria is as following:
How long is the exam?
The exam will be for 7 hours (9 AM to 5 PM). However, an hour of lunch break can be taken during the exam. The exam can be taken on any one of the following four days:
What topics are covered?
The exam will cover the following topics of pentesting:
The complete list of topics can be found in the exam syllabus section below.
*Note:
The marks allocated for every question also indicates the time that an attendee is expected to spend in solving a question. For e.g. a question worth 30 marks, will require roughly 30 minutes, for it to be solved.
What is the format of the exam?
The exam will be a Capture The Flag (CTF) style Hackathon. It will be a full day event requiring attendees to capture flags as they go on identifying and exploiting various system vulnerabilities and score points, after submitting the flags and answering the associated questions.
What is the experience needed to take the certification and what level of difficulty can be expected from the exam?
We recommend a minimum of 2 years of professional penetration testing/bug bounty experience (both network and application pentesting) before taking this exam.
In terms of difficulty, on the scale of beginner, intermediate and advanced, this exam has been rated as intermediate. The exam tests attendees' practical knowledge in identifying and exploiting vulnerabilities in real life pentesting scenarios.
To explain this a bit more, we expect attendees to be able to identify and exploit vulnerabilities such as SQL Injection and obtain relevant flags, however, we are not testing them on advanced web hacking concepts such as that of Second-order SQL Injection, within this exam. Similarly, to cite another example for infrastructure hacking, attendees are expected to use common hacking tools and techniques to demonstrate how to compromise a Windows Active Directory infrastructure, but they are not expected to write custom exploits, use or create 0-day exploits or perform reverse engineering etc.
Can I participate with my friends and colleagues as a team?
One can only participate in an individual capacity (i.e. teamwork is not allowed).
What tools/laptop do I need to bring?
Attendees must use their own laptop and can use hacking tools of their choice. Internet access will be available during the course of the exam but no assistance will be provided with regards to installation/configuration of any tools. The hacking challenges can be solved using freely available tools and scripts.
What will attendees get?
Each attendee will receive:
A certificate of participation. The certificate will mention pass/fail and merit status. In addition to this, attendees will be able to download a PDF report, which will have detailed scores for each section of the exam, allowing them to identify and focus on areas of improvement for future qualification and training.
Will you provide any training that can be taken prior to the certification?
Being an independent certifying authority, we (The SecOps Group) do not provide any training for the exam. Attendees should carefully go over each topic listed in the syllabus and make sure they have adequate understanding, required experience and practical knowledge of these topics.
What is the exam retake policy?
Candidates who fail the exam must purchase a new exam voucher for every attempt.
How long is the certificate valid for?
The certification does not have an expiration date. However, the passing certificate will mention the details of the exam such as the exam version and the date. As the exam is updated over time, candidates should retake the newer version as per their convenience.
What is the exam syllabus?
The exam syllabus is listed below:
Web Hacking
Infrastructure Hacking
About: The SecOps Group
The SecOps Group is a globally recognized IT security company having extensive and varied experience of providing cyber security consultancy and education services. At The SecOps Group, we believe that security is a continuous process, which has to progress with time and in accordance with the customer needs and constantly evolving threats. Our core business comprises of two units:
Consultancy:
Pentesting and Advisory
The SecOps Group are cybersecurity experts offering CREST accredited security consultancy services.
Education:
Cyber Security Certifications
Through our exams, we provide an authentic and credible certification program that is modern, relevant and represents real life business risks.
Vulnmachines (A Pentest Learning Platform)
The SecOps Group runs a free pentest learning platform called “Vulnmachines”.
