OffSec @offsectraining

🧪🤖 WEEKLY LAB DROP! Are you up to the challenge? ⤵️ Did you know that OffSec loads new labs every week into our platform? Depending on your subscription, you have access to rotating and permanent labs that will help you keep your skills fresh. Here are a few of the NEW labs in your inbox: Learn Enterprise ➡️ bit.ly/4f2eCft 🛑 CVE-2025-64507 (level 200, 20 points, about 1 hour): A multi-stage Linux machine built on CVE-2025-64507, combining exposed internal tooling, binary reverse engineering, and memory corruption to reach privileged application access. ☁️ Sutekh (level 200, 3 hosts): A hybrid environment that combines Kubernetes, RabbitMQ, and Active Directory, including an exposed Kubelet and gMSA authentication. A new hybrid cloud and Active Directory surface. 🔷 Defend CVE-2026-68771 (level 200, about 2 hours): Secure a vulnerable version of ComfyUI, an open-source AI media-creation engine, against a command-execution vulnerability (CVE-2026-68771). A new AI-infrastructure defensive scenario. AMP ➡️ bit.ly/4ulvdjb 🔴 CVE-2026-25887 (level 200): Exploit an authenticated remote code execution vulnerability (CVE-2026-25887). 🔷 Defend Wp2shell (level 200): Defensive lab covering two WordPress Core vulnerabilities (Wp2shell). 🐉 Privy (level 200): Exploit CVE-2024-1991, a privilege-escalation flaw in a WordPress plugin. Sign up or register now to get access to the newest labs on scene! #oscp #tryharder #labdrop #cybersecurity #osai

🔺 🐉 Missed the first few weeks? There's still plenty of time to join HackTrack and prepare for OSCP! Join fellow PEN-200 learners as you continue building the skills and confidence needed for OSCP success. (Not registered for the training and certification yet? Check out options here! offsec.com/courses/pen-20…) This Saturday join our mentors for a walkthrough of #BitForge. Sometimes the path forward is hidden in the details. This week, OffSec Student Mentors will demonstrate how to uncover overlooked attack paths, troubleshoot web exploits, and identify opportunities for privilege escalation. This week’s focus: 🔍 Enumerating .git 🌐 Discovering VHosts 🛠 Troubleshooting Web App Exploits ⬆️ Analyzing sudo Privileges Build a stronger methodology for finding the opportunities others might miss. 📅 Saturday, September 19, 2026 🕓 16:00 GMT Register Now: hubs.li/Q04rTkqs0 #TryHarder

👏 25 OffSec certifications. ✅ One fully certified cybersecurity team. In one year, 🛡️ Titan Shield built recognized capability across penetration testing, SOC operations, incident response, threat hunting, and secure web application development. The result is bigger than the certification count. Titan Shield can show prospective clients that expertise extends across the team, strengthening its credibility as it grows in Palestine and across the region. Read the full case study: offsec.com/resources/case…

You got the badge. You proved you can hack it. So... what's next? 🎯 The "Try Harder" ethos isn't a one-time event; it's a lifelong mindset. Whether you want to master Advanced Web Attacks (WEB-300), AI Red Teaming (AI-300), or Threat Hunting (TH-200), we've mapped out the exact path to get you there. Find your next challenge and keep climbing: 🔗 bit.ly/4ungymX #OffSec #TryHarder #CyberSecurity #PenetrationTesting #RedTeam #BlueTeam

🛠️🧠 Theory is great, but execution is what matters. The AI Blind Spot breaks down why traditional security fails against modern AI systems. But how do you actually attack and defend these pipelines in the real world? 🔴 Enter AI-300: Advanced AI Red Teaming and OSAI. Take the concepts from the whitepaper (like manipulating embeddings and exploiting multi-agent workflows) and drop into live, hands-on labs to practice them. Understand the threat: bit.ly/4v3owTh Hack the threat: bit.ly/4a2t5oo #OSAI #OffSec #AISecurity #RedTeam #Infosec #TryHarder

keyboard_arrow_left Previous keyboard_arrow_right Next

📈 More than 100 technology and cybersecurity companies are calling for urgent action as AI accelerates cyber threats. AI can compress parts of the attack and defense workflow, but speed alone does not create capable operators. Security professionals still need to understand attack paths, validate AI output, and adapt when an approach fails. That makes practical expertise more valuable than ever. Read more on this: offsec.com/blog/are-secur…

🛠️📝 Struggling to make your Nmap outputs look good for your OSCP report? During OffSec's Hack Track: Moonwalk (Week 4 for OSCP learners), our experts talk about how documentation is just as important as exploitation. Check out this quick tip from our latest session on using xsltproc to effortlessly convert messy XML scan outputs into clean, readable HTML files. Your future self (and your grader) will thank you. Register for the next Hack Track ➡️ hubs.li/Q04rTkqs0 #HackTrack #OffSec #TryHarder #Moonwalk #PenetrationTesting

Ready to move past automated scanners and master white-box web testing? 🛑💻 WEB-300: Advanced Web Attacks and Exploitation teaches you how to perform deep analysis and exploitation of modern web app vulnerabilities, from deserialization RCE to advanced SSRF. Pass the grueling 48-hour exam, earn your OSWE certification, and prove you can craft custom exploits in real-world environments. Level up your web security skills: offsec.com/courses/web-30… #OSWE #OffSec #AppSec #BugBounty #CyberSecurity

🛑📊 Ransomware doesn't operate on an annual compliance schedule. Your team's training shouldn't either. A point-in-time training seminar isn't enough to stop modern Advanced Persistent Threats (APTs) or ransomware syndicates. 🔄 Protecting financial assets requires Continuous Readiness. With OffSec Learn Enterprise, your security teams get always-on access to the constantly updated OffSec Learning Library and live Cyber Ranges. Keep your team's skills as dynamic and adaptable as the adversaries targeting your perimeter. Stay ready. Stay secure: bit.ly/4h6hjMp #Fintech #CyberDefense #Ransomware #ContinuousLearning #OffSec #RiskManagement

Want to fast-track your team's skills? Bring OffSec instructors directly to your teams. Get expert, hands-on instruction for our most in-demand certifications: ✅ PEN-200 (OSCP) ✅ AI-300 (OSAI Build a stronger team, faster. Learn more and book your private cohort: bit.ly/43HITJD #OffSec #CyberSecurity #LiveTraining #OSCP #OSAI #EnterpriseTech

keyboard_arrow_left Previous keyboard_arrow_right Next

🛑💻 Tired of missing out on the latest CVEs and new lab drops? Or not receiving info on programs like Hack Track? We are constantly pushing fresh, hands-on scenarios to the OffSec platform. If you want to be the first to know when new challenge labs and exploits drop, make sure you are on our list. Sign up ➡️ offsec.com/community/#join ⚡ Already registered? Check your preference center and ensure marketing emails are turned ON so you don't miss the next drop! #OffSec #CyberSecurity #CVE #PenetrationTesting #InfoSec

🛑🔍 Stop waiting for the SIEM to alert you. Start hunting the threats that slipped past it. TH-200/OSTH: Foundational Threat Hunting teaches you to proactively track adversaries using industry tools and behavioral analysis. Here is what you will master: 🕵️‍♂️ Identifying behaviors and profiling advanced threat actors (including ransomware groups like LockBit and ALPHV). 💻 Leveraging enterprise tools like CrowdStrike Falcon and Splunk to correlate data and track anomalies. 🦠 Analyzing network and endpoint Indicators of Compromise (IoCs) to uncover stealthy intrusions. Pass the 8-hour practical exam, earn your OSTH certification, and prove you can find the hidden threats before they execute. Are you ready to #TryHarder on the defensive line? Start hunting: offsec.com/courses/th-200/ #OSTH #OffSec #BlueTeam #ThreatHunting #CyberSecurity

You're halfway through HackTrack! HackTrack returns this Saturday with a walkthrough of 🔍 Snoops. Enhance your skills in identifying misconfigurations, credential exploitation, and privilege escalation through script manipulation. 🔢 SNMP Enumeration 🔑 SSH Key Access 🚪 Backdoor the Cron 📅 Saturday, September 12, 2026 🕓 16:00 GMT Register Now: hubs.li/Q04rTkqs0

Let's be honest: AI is being deployed faster than we can secure it. 🚨 💤 If you're tired of theoretical AI security discussions and want to actually learn how to break these systems, you need AI-300/ OSAI. This course skips the hype and focuses on the technical reality of attacking LLMs, RAG pipelines, and model orchestration frameworks. 🏁 The exam is a classic OffSec 24-hour practical engagement—you have to actually compromise a realistic enterprise AI environment to earn the cert. Who is planning to tackle AI security this year? Check out the full syllabus here: bit.ly/4a2t5oo #OSAI #AI300 #OffSec #RedTeam #TryHarder #InfoSec

🔵 Build a Blue Team equipped to monitor, detect, respond to, and hunt adversaries across the full defensive lifecycle. 🔊 INTRODUCING: The Blue Team Upskill Program - giving organizations a structured way to develop the talent behind these critical capabilities. Learners start at the stage that matches their current skills, then advance through hands-on, role-based development with their progress validated along the way. Explore the Blue Team Upskill Programs: offsec.com/products/learn…

"I built an autonomous security agent" is a demo. "I built an eval that shows where it breaks" is engineering. 🛠️🧠 OffSec Community Member Ali Abdollahi just published a brilliant piece on why building powerful offensive AI is easy, but teaching it "what not to attack" is incredibly hard. If you are following the AI agent hype, read this reality check: offsec.com/blog/knowing-w… #AISecurity #OffSec #RedTeam #MachineLearning #InfoSec

What could you accomplish in 90 days? ✅ Build your first AI red teaming methodology. 🔴 Take your penetration testing skills further. 🔍 Learn to hunt threats. ➕ Get better at finding what others miss in web applications. You choose your cybersecurity goal. The Course + Cert Bundle gives you 90 days of focused course content, hands-on labs, and exam preparation to build your skills and prove what you know. Explore the Course + Cert Bundles: bit.ly/4bkUXER

🚨 ICYMI: CVE-2026-72898: Critical Metabase SQL injection, CVSS 10.0, no authentication required — and active exploitation has been confirmed. See how it works, what to look for, how to mitigate it, and how to safely test it in OffSec's Offensive Cyber Range. Explore the lab: portal.offsec.com/machine/cve-20… #CVE #Cybersecurity #Metabase #VulnerabilityResearch #OffSec

📈 Instead of dividing the remaining FY26 budget across individual training requests, step back and look at the bigger picture. Where does your organization need stronger cyber capability a year from now? The answer might not be "just" another cybersecurity course but building a workforce development strategy with OffSec. See how OffSec helps federal organizations invest in long-term cybersecurity capability before budgets reset. bit.ly/4gZ2NGk

Sirens going off? Blue Team, it's time to step up. 🚨🛡️ 🔵 SOC-200 teaches you to triage alerts, analyze logs, and hunt threats using industry tools like ELK and Splunk. No multiple-choice tests. Just a 24-hour, hands-on exam to earn your OSDA certification. Prove you can defend a live corporate network against active attackers under pressure. Ready to hold the line? Explore SOC-200: bit.ly/4gxeftS #BlueTeam #OffSec #OSDA #CyberSecurity #SOCAnalyst #InfoSec