Pentester Academy Container Security Professional (PACOSP) – Review

by | Mar 28, 2021 | Blog, Cloud

I just passed the Pentester Academy Container Security Professional (PACOSP) certification 🙂

Course

It is all part of the Container security learning path. I took it as a bootcamp of 4 weeks with one live class per week of approximately 2.5 hours. During the week there was interesting labs/homework. Each class had a topic:

  1. Module I: Introduction to Linux Containers
  2. Module II: Attacking Docker Containers
  3. Module III: Docker Host Security and Docker Forensics
  4. Module IV: Securing Docker Infrastructure

Exam

The exam was 48 hours and the objective was to gather flags from the containers. There were 5 different environments and to pass you needed to compromise at least 4 of 5.

In my exam I got 4 and knew how to the 5th in around 15 hours of real testing during the two days. I think that the two were easy and relatively straightforward. The other 3 were harder. I don’t think that just doing the labs/taking the classes is not enough to pass. This is definitly not an entry course. TBH i struggled and i’m a full time pentester and i have certificates such as OSCP. You should know at least a little bit of proxies, web hacking, shells, confortable viewing/modifying code, really confortable in command line and have a really good undestanding of hacking and enumerating linux.

PROS

  1. I learned a lot, in general I was aware of the concepts but having a full explanation was amazing.
  2. They are really innovating, in the field. The courses and the exams were cutting edge. This is refreshing and amazing. Kudos to them.
  3. The labs were really interesting. They were (really well) explained with PDFs and videos.
  4. After the class a recording of the session was sent. This recordings were available for later. In my case that was amazing because i was not doing the courses live. I was seeing the videos during the weekend with 2x speed.
  5. And i returned to the videos and the labs during the exam.
  6. You are able to start the exam whenever you want.
  7. 48 hours is a good time for 4/5 containers.
  8. I love that there was no reporting and the flags were verified live. (No need to wait x ammounts of days for results). If you have the 4 flags you passed :).

CONS

  1. They make the exams difficult by doing some shady things that make you lose a lot of time. For example not all the flags are in “roo/flag”. I understand that in some cases that make sense. But in some others they just hide stuff that should not be hidden and make you lose a lot of time.  Another example is not naming a flag “flag”…  or having fake flags called flags…. is like WTF… that should be avoided. I was angry half of my exam because of this… I even contact support because one of the flags was not working…  If you want decoy flag either dont name it flag or inside put something that is clear that is not a flag.
  2. Related to the point 1, tell me which are the targets, this is not an nmap exam… And the network was not fast. I also lose (a lot of) time with this.
  3. If you want me to bruteforce make the dictionaries smaller… If not i spend more time bruteforcing than testing…
  4. The labs are amazing and in general stable, but that is not the case of the exam. During the exam, the networking was slow and some programs were crashing . Same that in the point one, i spend a lot of time debugging and redoing stuff that made everything harder.
  5. You can not work in 2 exam machines at the same time. I was used to run nmap in one and test in another, in this case i was running an nmap and wating for results… Maybe increase the maximun number of machines to two?
  6. Make the scripts for the courses downloadable please. People cant copy from pdfs.

As a conclusion, I learned a lot and Ill recomend the course and the exam but i honestly believe that the exam should be focus more in Container Security and less on trying to hide things in random folders with random names and/or random IPs.