OffSec @offsectraining

OffSec will be at ISTC 2026 in Muscat, on October 20–21 🇴🇲 Tools, policies and frameworks all matter. But when an attack happens, what counts is whether your team has the practical skills to respond. That’s what we help organisations build and prove, through hands-on training, Cyber Range exercises and certifications like OSCP+. Visit our booth to find out how we can support your team’s development. 📍 OCEC, Grand Ballroom, Muscat 📅 20–21 October 2026 🔗 Register: bit.ly/4ioxVAS #TryHarder #ISTC2026 #Oman #Cybersecurity #OffSec

You're entering the final stretch of HackTrack. HackTrack continues with another Active Directory walkthrough featuring AD06. This week's focus: 🎟 Kerberoasting 🔓 UAC Bypass 🔑 Password Reuse 🛠 Public Exploit Validation Learn how attackers move beyond initial access by identifying opportunities throughout an Active Directory environment. 📅 Saturday 🕓 16:00 GMT Register Now: hubs.li/Q04rTkqs0 #TryHarder

Cybersecurity Awareness Month comes with plenty of good advice: 🤔 Think before you click. 💪 Use strong passwords. ➕ Turn on MFA. 📢 Report suspicious activity. And someone’s still going to click it. Awareness helps reduce risk. But when prevention fails, your security team needs the practical skills to investigate what happened, understand the attack path, and respond. Train for what happens next. offsec.com #CybersecurityAwarenessMonth #OffSec #TryHarder

What could you accomplish in 90 days? Build your first AI red teaming methodology. Take your penetration testing skills further. Learn to hunt threats. Get better at finding what others miss in web applications. Choose your cybersecurity goal. The Course + Cert Bundle gives you 90 days of focused course content, hands-on labs, and exam preparation to build your skills and prove what you know. Explore the Course + Cert Bundles: offsec.com/products/90-da…

Security checks can confirm that controls on your AI systems are working as expected. Some attacks can still manipulate trusted prompts, data, and workflows without triggering them. That gap is the AI blind spot. Understanding it is becoming increasingly important as organizations strengthen AI risk oversight for the EU AI Act. See what your security tools may miss in our whitepaper. Grab your free copy here: offsec.com/business/eu-ai…

If you were looking for a challenge this weekend, your queue just got completely restocked. 🚀 We just pushed 30 new hands-on labs to the platform. There is a huge variety in this drop: 🕵️‍♂️ Grimoires Investigations: 8 new deep-dive scenarios, including complex supply-chain investigations (GitNightMare) and Kubernetes cloud-native breaches. 💥 Offensive Cyber Range: 16 new machines and environments! This includes standalone CVE machines (like the CVSS 10.0 GitLab flaw, CVE-2026-85706) and massive multi-host Active Directory and Linux tiered environments. 🛡️ Defensive Cyber Range: 3 new live-fire defense labs to secure vulnerable platforms against SQLi and RCE. 🤖 AI Attack Surfaces: Brand new machines focused on exploiting Model Context Protocol (MCP) bridges and AI runtimes. These are available now for Learn Enterprise users and a few rotating labs in AMP. Which one are you spinning up first? 👇 Log in now to get access: bit.ly/4rJZNCF #OffSecCommunity #HackThePlanet #TryHarder #RedTeam #BlueTeam

OffSec is heading to Warsaw for #Cyber24Days, Oct 7–8 🇵🇱 We’re proud to sponsor a conference that brings government, defence, and industry together on cyber resilience and state readiness. Stop by Booth No. B23 or connect with @leszekszczech Not attending but want to speak with the OffSec team? ▶️ bit.ly/4wd4A0K #TryHarder #OffSec

Don't wait for 2027 to upgrade your career. 🛑💻 You have exactly 90 days left to finish the year strong. Grab an OffSec Course & Cert Bundle today, hit the labs, and you could be holding your OSCP, OSAI, or OSWA before the calendar flips. Start your sprint today: offsec.com/products/90-da… #OffSec #CyberSecurity #TryHarder #InfoSec #PenetrationTesting #TechCareers #osai #oscp #careerupgrade

🤖 With our Annual Membership Program, you gain access to four types of labs. All built to push you past the checklist. 1️⃣ Shiny Labs: Complex, interconnected networks for advanced research and multi-stage attacks. 2️⃣ Grimoires: Forensics, malware analysis, incident response, and threat hunting. New scenarios every month. 3️⃣ Cyber Range Scenarios: Drawn from real-world CVEs. 4️⃣ Proving Grounds Practice Labs: 200+ dedicated machines across Linux and Windows, with no time limits and no shared environments. Start today. bit.ly/4ulvdjb

keyboard_arrow_left Previous keyboard_arrow_right Next

🔍💻 When a critical vulnerability like CVE-2026-85706 (GitLab Unauthenticated Arbitrary File Read) drops, it's not just an alert for defenders—it’s a masterclass in application security. Learn how manipulating the file.path parameter in the Repository Commits API triggers a path traversal flaw, and (BLUE TEAM) discover why validating data exfiltration from this exploit requires cross-referencing specific access logs. Read the full technical breakdown here: 🔗 bit.ly/4yqqKOe #VulnerabilityResearch #CVE #OffSec #AppSec #CyberSecurity #InfoSec

Ready to master web exploitation with Kali Linux? 🛑👾 WEB-200 teaches you to manually find and exploit XSS, SQLi, SSRF, and more using the industry's top tools. No multiple-choice tests—just a grueling 24-hour practical exam to earn your OSWA certification. Embrace the Try Harder mindset. Prove you have what it takes. 🔗 offsec.com/courses/web-20… #OffSec #KaliLinux #OSWA #WebSecurity #TryHarder #AppSec #BugBounty

Recon is everything. Don't rush the exploit. 🛑🐉 HackTrack for OSCP prep continues this Saturday with a deep dive into Gallery. Learn how to uncover hidden attack surfaces through disciplined enumeration. This week's focus: 🌐 SNMP Enum 🔍 vHost Discovery 💉 SQLi 📤 File Upload Attacks 📅 Saturday, September 26, 2026 @ 16:00 GMT Claim your spot: hubs.li/Q04rTkqs0 #OffSec #OSCP #PenTesting #CyberSecurity #TryHarder #TryHarder

As cyber pressure and cybersecurity budgets rise, what should that investment deliver? 🕗 Earlier detection. ⚡ Faster containment. 🤝 Teams ready to protect financial operations under pressure. OffSec helps financial institutions build and validate the hands-on capabilities behind those outcomes, before a real incident puts them to the test. Prepare your cyber workforce with OffSec: bit.ly/4h6hjMp

Some people just need a deadline. ⏳🎯 If you are the type of learner who thrives under pressure and wants to fast-track your next career milestone, the OffSec 90-Day Course & Cert Bundle is designed for you. Instead of a year-long subscription, you get exactly what you need for a focused, intensive sprint: ✅ 90 days of access to a single 200 or 300-level course. ✅ Hands-on lab access. ✅ One exam attempt. ✅ 50+ bonus Proving Grounds Play labs. Whether you are looking to earn the industry-standard OSCP, master web exploitation with the OSWE, pivot to defense with the OSDA, or tackle the new AI attack surface with OSAI, your path is ready. Lock in your next goal and start the clock. Explore the bundle options here: bit.ly/4bkUXER #OffSec #CyberSecurityTraining #OSCP #OSWE #OSAI #CareerGrowth #PenetrationTesting

Automated tools are great, but chaining them with manual enumeration is how you get root. 🔍🛠️ If you are currently studying for your OSCP (ahem, now is the time to register for Hack Track) or just want to level up your Linux Privilege Escalation skills, check out our newest video walkthrough. We demonstrate exactly what to do after you get that initial www-data shell. Key takeaways from this session: 🔊 Managing Noisy Tools: How to use the timeout command to run pspy efficiently without locking up your terminal. ⛰️ Leaving No Stone Unturned: Why reviewing processes reveals credentials (like a rogue MySQL dump) that standard checks might miss. 🛑 Exploiting Misconfigurations: How finding a writable app .py script with sudo execution rights allows for a simple OS module injection to spawn a root shell. Stop guessing and start enumerating. Watch the full breakdown here: bit.ly/4xFQzZq #Linux #PrivilegeEscalation #OffSec #RedTeam #OSCP #CyberSecurityTraining #TryHarder

We can speak to how great we think our Live Training is, but hear it from the people in the room instead 😌 📞 Ready for your own live training experience? Request a scoping call to chat with our team: lnkd.in/eRJytBZi

keyboard_arrow_left Previous keyboard_arrow_right Next

🎰 Black Hat and DEF CON generate a lot of noise - the good, the weird, and AI. A month later, what actually stuck? 🤔 From cheaper offense and AI agents to attack paths, AppSec, and the changing role of security teams, we pulled out 10 lessons that could shape how defenders work next. 🔟 Read 10 Lessons Reshaping Security After Black Hat and DEF CON 2026: bit.ly/4hDJUtR

🧪🤖 WEEKLY LAB DROP! Are you up to the challenge? ⤵️ Did you know that OffSec loads new labs every week into our platform? Depending on your subscription, you have access to rotating and permanent labs that will help you keep your skills fresh. Here are a few of the NEW labs in your inbox: Learn Enterprise ➡️ bit.ly/4f2eCft 🛑 CVE-2025-64507 (level 200, 20 points, about 1 hour): A multi-stage Linux machine built on CVE-2025-64507, combining exposed internal tooling, binary reverse engineering, and memory corruption to reach privileged application access. ☁️ Sutekh (level 200, 3 hosts): A hybrid environment that combines Kubernetes, RabbitMQ, and Active Directory, including an exposed Kubelet and gMSA authentication. A new hybrid cloud and Active Directory surface. 🔷 Defend CVE-2026-68771 (level 200, about 2 hours): Secure a vulnerable version of ComfyUI, an open-source AI media-creation engine, against a command-execution vulnerability (CVE-2026-68771). A new AI-infrastructure defensive scenario. AMP ➡️ bit.ly/4ulvdjb 🔴 CVE-2026-25887 (level 200): Exploit an authenticated remote code execution vulnerability (CVE-2026-25887). 🔷 Defend Wp2shell (level 200): Defensive lab covering two WordPress Core vulnerabilities (Wp2shell). 🐉 Privy (level 200): Exploit CVE-2024-1991, a privilege-escalation flaw in a WordPress plugin. Sign up or register now to get access to the newest labs on scene! #oscp #tryharder #labdrop #cybersecurity #osai

🔺 🐉 Missed the first few weeks? There's still plenty of time to join HackTrack and prepare for OSCP! Join fellow PEN-200 learners as you continue building the skills and confidence needed for OSCP success. (Not registered for the training and certification yet? Check out options here! offsec.com/courses/pen-20…) This Saturday join our mentors for a walkthrough of #BitForge. Sometimes the path forward is hidden in the details. This week, OffSec Student Mentors will demonstrate how to uncover overlooked attack paths, troubleshoot web exploits, and identify opportunities for privilege escalation. This week’s focus: 🔍 Enumerating .git 🌐 Discovering VHosts 🛠 Troubleshooting Web App Exploits ⬆️ Analyzing sudo Privileges Build a stronger methodology for finding the opportunities others might miss. 📅 Saturday, September 19, 2026 🕓 16:00 GMT Register Now: hubs.li/Q04rTkqs0 #TryHarder

👏 25 OffSec certifications. ✅ One fully certified cybersecurity team. In one year, 🛡️ Titan Shield built recognized capability across penetration testing, SOC operations, incident response, threat hunting, and secure web application development. The result is bigger than the certification count. Titan Shield can show prospective clients that expertise extends across the team, strengthening its credibility as it grows in Palestine and across the region. Read the full case study: offsec.com/resources/case…