Virtual Hacking Labs Advanced and Advanced + Certification
I recently signed up for Virtual Hacking Labs training found here: https://www.virtualhackinglabs.com/. I signed up for one month and it took around 24 hours to recieve my VPN access and instructions. The subscription comes with a very well written PDF that will keep your attention and teach you some new things.
When you first login you will see a dashboard which has beginner, advanced and advanced + machines spread throughout it. Each machines rating does go along with the machine, the beginner machines do not feel like they should be advanced + and vice versa. The VPN access is extremely fast, one of the fastest I have ever used for any of my courses that I have gone through.
To reset the machines the student is able to go to their lab reset IP, which will be 10.1x.10.10. The x is for what lab number you are such as if you are lab one you would do 10.11.10.10. The lab network you are on is within the welcome email that is sent to the student.
Get Ryan Yager’s stories in your inbox
Join Medium for free to get updates from this writer.
Now that we are done with the admin portion, lets talk about obtaining the certifications. A student needs to do 20 beginner / advanced machines to obtain the Penetration Testing Course certification, shown below. The student must also have a report for each machine, my report was not too hardcore. If you read the FAQs an look at reporting procedures you will see that they do have sample report for one of the machines. My report showed the main information in the beginning of the report, then from there showed the steps and a quick guide if the steps were not straight forward. For this certification my report was only 75 pages, which for 20 machines is not very big. The thing that I like about this is that the student gets to pick the machines they are doing, if you do not understand something, move onto a different machine and then move back to orginal machine you were stuck on.
Moving onto the advanced + machines, I felt that the advanced + machines were challenging. They had a lot of different aspects to them and different ways to be able to Priv Esc. Quick side not, Priv Esc, many of the Priv Esc’s that I did throughout this course I have not seen before. Each machine you can do a Kernel Exploit, however, there are other ways. I highly encourage you to find another way and not utilize the KE. Each Priv Esc was different and challenged the student to know what different scripts were doing, how they worked and if it fails, did it fail at a point that you could still utilize that script and obtain higher privileges. Also, it is not get in and get to root, on many of the machines you move horizontally to another user, this user may have different privileges, or different SUDO privileges that can be used to obtain root. Lastly, with priv esc, each lab contains a root.txt file within the root directory that can be used to show that you have rooted the machine. The student must also utilize 2 exploits that they have developed themselves or get in without utilizing a script / priv esc without utilizing a public script / metasploit. This part I liked a lot, I wrote a few different scripts throughout this course that I showed on the lab report to show that I did not use a public script / exploit. You do not need to go super hardcore here and create your own Kernel Exploit, something like a MySQL brute force tool that you create will suffice. Also to obtain the Advanced + certification you need to gain root on 10 machines.
Ultimately, I felt that the training received, the machines, lab access and everything else was very good and worth the price. It is a higher price; with that you are getting what I feel some really good training. I do not think you should hop right into VHL as you first hacking experience, it is more for someone that is working towards a junior to mid-level tester and already has a good understanding of exploits and different types of web applications.
Something of note is that when reaching out over e-mail VHL was extremely quick to respond and take care of any issues. They also read the e-mails that you send, it seemed more personal to me than other platforms, they seemed to genuinely care about your learning experience and wanted to make it the best experience possible. I am currently going through the ProLab machines and will do another writeup about those once finished. If you are wanting to do the machines and want to learn with others there is a Discord for VHL found here: Discord
Thanks for reading.
