The GIAC Penetration Tester certification validates a practitioner’s ability to properly conduct a penetration test, using best practice techniques and methodologies. GPEN certification holders have the knowledge and skills to conduct exploits and engage in detailed reconnaissance, as well as utilize a process-oriented approach to penetration testing projects.

• Comprehensive Pen Test Planning, Scoping, and Recon

• In-Depth Scanning and Exploitation, Post-Exploitation, and Pivoting

• In-Depth Password Attacks and Web App Pen Testing

SEC560 is the flagship penetration test course offered by the SANS Institute. Attendees are expected to have a working knowledge of TCP/IP, understand the differences between cryptographic routines such as DES, AES, and MD5, and have a basic knowledge of the Windows and Linux command lines before they come to class. While SEC560 is technically in-depth, it is important to note that programming knowledge is NOT required for the course. For more information on the differences between SEC560 and SEC504, see the SEC560 and SEC504 FAQS.

Important! Bring your own system configured according to these instructions!

A properly configured system is required to fully participate in this course. If you do not carefully read and follow these instructions, you will likely leave the class unsatisfied because you will not be able to participate in hands-on exercises that are essential to this course. Therefore, we strongly urge you to arrive with a system meeting all the requirements specified for the course.

It is critical that you back-up your system before class. it is also strongly advised that you do not bring a system storing any sensitive data.

Baseline Hardware Requirements

• CPU

  • 64-bit Intel i5/i7 2.0+ GHz processor

• BIOS

  • Enabled "Intel-VT"

• USB

  • USB 3.0 Type-A port

• RAM

  • 16 GB RAM

• Hard Drive Free Space

  • 100 GB Free space

• Operating System

  • Latest version of Windows 10, macOS 10.15.x or later, or Linux that also can install and run VMware virtualization products described below.

Additional Hardware Requirements

The requirements below are in addition to baseline requirements provided above. Prior to the start of class, you must install virtualization software and meet additional hardware and software requirements as described below. If you do not carefully read and follow these instructions, you will leave the class unsatisfied because you will not be able to participate in hands-on exercises that are essential to this course.

Network, Wired Connection

A wired connection is required in class. A wired network adapter is one that you plug a cable into. They are typically on the back or the side of your system. If your system supports only wireless, you can purchase a USB wired Ethernet adapter. This will allow you to plug the adapter into a USB Laptop Requirements for SEC560 port on your system and plug the network cable into the adapter.

VMware Player

Install VMware Player 15, VMware Fusion 11, or VMware Workstation 15. Older Versions will not work for this course. Choose the version compatible with your host OS. If you do not own a licensed copy of VMware Workstation or Fusion, you can download a free 30-day trial copy from VMware. VMware will send you a time-limited serial number if you register for the trial at their Web site. VMware Workstation Player is a free download that does not need a commercial license but has fewer features than Workstation. THIS IS CRITICAL: Other virtualization products, such as Hyper-V and VirtualBox, are not supported and will not work with the course material.

Credential Guard

If your host computer is running Windows, Credential Guard may interfere with the ability to run VMs. It is important that you start up VMWare prior to class and confirm that virtual machines can run. It is required that Credential Guard is turned off prior to coming to class.

System Configuration Settings

Disable VPN

Enterprise VPN clients may interfere with the network configuration required to participate in the class. To avoid any frustration in class, uninstall or disable your enterprise VPN client for the duration of the class. If you keep it installed, make sure that you have the access to disable or uninstall it at class.

Your course media will now be delivered via download. The media files for class can be large, some in the 40 - 50 GB range. You need to allow plenty of time for the download to complete. Internet connections and speed vary greatly and are dependent on many different factors. Therefore, it is not possible to give an estimate of the length of time it will take to download your materials. Please start your course media downloads as you get the link. You will need your course media immediately on the first day of class. Waiting until the night before the class starts to begin your download has a high probability of failure.

SANS has begun providing printed materials in PDF form. Additionally, certain classes are using an electronic workbook in addition to the PDFs. The number of classes using eWorkbooks will grow quickly. In this new environment, we have found that a second monitor and/or a tablet device can be useful by keeping the class materials visible while the instructor is presenting or while you are working on lab exercises.

"A key requirement for top security people is to understand the mind of the attacker. Both offense (red) and defense (blue) need to understand the tools and techniques used by real world attackers. A defender needs to understand attacks and how they work to properly design defenses and, just as importantly, configure detections. Offense needs to understand the tools, as well as the process, to deliver a high-value penetration test, focusing on the risks of the target. This course walks you through the process of a penetration test which is invaluable for penetration testers, those working with penetration testers, and those designing, implementing, and monitoring the defenses. This is a unique course, focusing holistically on penetration testing, not just the tools. I love sharing my passion for offense and sharing my experiences in this field. I hope to see you in class!"

- Tim Medin

"A thorough understanding of security assessment / penetration testing techniques is a key asset for any cyber security professional. In order to become a better defender, you must understand offense. Likewise, the course provides fundamental skills for people who want to establish themselves as penetration testers. Throughout my 10+ years of penetration testing experience, I am very proud to further develop and maintain SANS SEC560 as SANS' flagship penetration testing course. The class provides a balanced mix between lecture and hands-on activities, to make sure students go home, equipped to immediately put their skills to use. I personally enjoy modeling the lecture and labs towards real-life scenarios that I have encountered, and I look forward sharing my stories with you!"

- Erik Van Buggenhout