OffSec

Empowering the world to fight cyber threats with indispensable cybersecurity skills and resources.

Support queries:

[OffSec @offsectraining]

#OSAI is officially here! 📣🐺

OffSec’s newest certification for hands-on offensive operations against AI-enabled systems is now available for purchase with Learn One, Course & Cert Bundle, and Learn Enterprise.

Built for practitioners who want to apply an adversary mindset to modern AI systems and stay ahead as the attack surface evolves.

🔗 https://t.co/SRN3DaGaNi

[OffSec @offsectraining]

🚨 Actively Exploited: CVE-2026-85706 (CVSS 10.0).

An unauthenticated path traversal in GitLab CE/EE allows attackers to read arbitrary files off your server. All it takes is one HTTP request to expose CI/CD secrets, deploy tokens, and SSH keys.

Patch self-managed instances immediately (19.1.8 / 19.2.6 / 19.3.2).

Want to see how this access-control failure works under the hood? Practice exploiting it safely in our new Offensive Cyber Range lab on Learn Enterprise.

Try it here: https://t.co/80vYjSH2Ss

[OffSec @offsectraining]

The EU AI Act has put AI literacy, oversight, and workforce capability on the agenda. The next step is proving what your security team can do.

Can your teams test AI systems under realistic conditions and uncover attacks that exploit legitimate behavior and may escape traditional controls?

These hard-to-detect attack paths create an AI blind spot. Our whitepaper explores what it takes to move from awareness to proven capability.

Download your free copy: https://t.co/7wa4N1OUox

[OffSec @offsectraining]

New labs are here! 💻

Ready to put your skills to the test? Check out the latest hands-on labs from OffSec and keep building your practical cybersecurity skills.

We're releasing new labs every week, so there's always something new to explore and another challenge to tackle.

See what's new this week: https://t.co/0zvaJGSMmd

#OffSec #CybersecurityTraining #HandsOnLearning

[OffSec @offsectraining]

Certified? Still working toward it? Just getting started?

The OffSec Annual Membership Program meets you where you are with year-round access to hands-on training and regularly updated content.

🏅 Already certified? Earn CPE credits and keep an eligible certification active.
💻 Still learning? Get more opportunities to practice and strengthen your approach.
💾 New to the OffSec Community? Start working in realistic environments and see where your skills can take you.

Wherever you’re starting from, AMP gives you a way to keep progressing.

Explore AMP: https://t.co/k4i4IUVWIw

[OffSec @offsectraining]

🏛️ Public sector cybersecurity missions depend on a workforce that's prepared to meet evolving threats.

But how do you know your training strategy is building the skills your teams actually need?

From identifying skill gaps to validating technical proficiency, workforce development requires more than completing training requirements.

OffSec's Public Sector Cyber Workforce Training Blueprint offers a practical framework for evaluating your approach and strengthening mission readiness.

Download the blueprint: https://t.co/OXTbHGU35O

#Cybersecurity #PublicSector #CyberWorkforceDevelopment

[OffSec @offsectraining]

⏰ 24 hours. Vulnerable machines. An Active Directory set. And no answer key hiding somewhere in the back.

The OSCP exam is designed to test more than what you know. It tests how you approach a problem, adapt when your first idea fails, and keep going when the obvious path leads nowhere.

PEN-200 helps you build those skills. The OSCP exam asks you to prove them.

Think you're ready for the challenge? See what the exam demands: https://t.co/OUXz59VsqR

[OffSec @offsectraining]

😱 Someone will eventually click. The question is: Is your security team ready for what happens next?

Cybersecurity awareness helps employees recognize and report threats. Awareness alone can't prevent every attack.

When something gets through, your security team's ability to investigate, contain, and respond makes all the difference.

For Cybersecurity Awareness Month, we spoke with members of OffSec's internal IT and security teams about why effective security preparation requires more than awareness training.

Train for the click that gets through.

Read the blog: https://t.co/K9Wrt27XIe

#CybersecurityAwarenessMonth #Cybersecurity #SecurityTraining

[OffSec @offsectraining]

OffSec will be at ISTC 2026 in Muscat, on October 20–21 🇴🇲

Tools, policies and frameworks all matter.
But when an attack happens, what counts is whether your team has the practical skills to respond.

That’s what we help organisations build and prove, through hands-on training, Cyber Range exercises and certifications like OSCP+.

Visit our booth to find out how we can support your team’s development.

📍 OCEC, Grand Ballroom, Muscat
📅 20–21 October 2026
🔗 Register: https://t.co/9hDNoSRL2r

#TryHarder #ISTC2026 #Oman #Cybersecurity #OffSec

[OffSec @offsectraining]

You're entering the final stretch of HackTrack.

HackTrack continues with another Active Directory walkthrough featuring AD06.

This week's focus:
🎟 Kerberoasting
🔓 UAC Bypass
🔑 Password Reuse
🛠 Public Exploit Validation

Learn how attackers move beyond initial access by identifying opportunities throughout an Active Directory environment.

📅 Saturday
🕓 16:00 GMT

Register Now: https://t.co/LWbShoGyGl

#TryHarder

[OffSec @offsectraining]

Cybersecurity Awareness Month comes with plenty of good advice:

🤔 Think before you click.
💪 Use strong passwords.
➕ Turn on MFA.
📢 Report suspicious activity.

And someone’s still going to click it.

Awareness helps reduce risk. But when prevention fails, your security team needs the practical skills to investigate what happened, understand the attack path, and respond.

Train for what happens next. https://t.co/59bZmxhzXf

#CybersecurityAwarenessMonth #OffSec #TryHarder

[OffSec @offsectraining]

What could you accomplish in 90 days?

Build your first AI red teaming methodology. Take your penetration testing skills further. Learn to hunt threats. Get better at finding what others miss in web applications.

Choose your cybersecurity goal. The Course + Cert Bundle gives you 90 days of focused course content, hands-on labs, and exam preparation to build your skills and prove what you know.

Explore the Course + Cert Bundles: https://t.co/dOpuBmUw89

[OffSec @offsectraining]

Security checks can confirm that controls on your AI systems are working as expected. Some attacks can still manipulate trusted prompts, data, and workflows without triggering them.

That gap is the AI blind spot.

Understanding it is becoming increasingly important as organizations strengthen AI risk oversight for the EU AI Act.

See what your security tools may miss in our whitepaper.

Grab your free copy here: https://t.co/7wa4N1OUox

[OffSec @offsectraining]

If you were looking for a challenge this weekend, your queue just got completely restocked. 🚀 We just pushed 30 new hands-on labs to the platform.

There is a huge variety in this drop:

🕵️‍♂️ Grimoires Investigations: 8 new deep-dive scenarios, including complex supply-chain investigations (GitNightMare) and Kubernetes cloud-native breaches.
💥 Offensive Cyber Range: 16 new machines and environments! This includes standalone CVE machines (like the CVSS 10.0 GitLab flaw, CVE-2026-85706) and massive multi-host Active Directory and Linux tiered environments.
🛡️ Defensive Cyber Range: 3 new live-fire defense labs to secure vulnerable platforms against SQLi and RCE.
🤖 AI Attack Surfaces: Brand new machines focused on exploiting Model Context Protocol (MCP) bridges and AI runtimes.

These are available now for Learn Enterprise users and a few rotating labs in AMP. Which one are you spinning up first? 👇

Log in now to get access: https://t.co/ezA9yXYsya

#OffSecCommunity #HackThePlanet #TryHarder #RedTeam #BlueTeam

[OffSec @offsectraining]

OffSec is heading to Warsaw for #Cyber24Days, Oct 7–8 🇵🇱

We’re proud to sponsor a conference that brings government, defence, and industry together on cyber resilience and state readiness.

Stop by Booth No. B23 or connect with @leszekszczech

Not attending but want to speak with the OffSec team? ▶️ https://t.co/BqT1AT1Unv

#TryHarder #OffSec

[OffSec @offsectraining]

Don't wait for 2027 to upgrade your career. 🛑💻

You have exactly 90 days left to finish the year strong. Grab an OffSec Course & Cert Bundle today, hit the labs, and you could be holding your OSCP, OSAI, or OSWA before the calendar flips.

Start your sprint today: https://t.co/dOpuBmUw89

#OffSec #CyberSecurity #TryHarder #InfoSec #PenetrationTesting #TechCareers #osai #oscp #careerupgrade

[OffSec @offsectraining]

🤖 With our Annual Membership Program, you gain access to four types of labs.
All built to push you past the checklist.

1️⃣ Shiny Labs: Complex, interconnected networks for advanced research and multi-stage attacks.
2️⃣ Grimoires: Forensics, malware analysis, incident response, and threat hunting. New scenarios every month.
3️⃣ Cyber Range Scenarios: Drawn from real-world CVEs.
4️⃣ Proving Grounds Practice Labs: 200+ dedicated machines across Linux and Windows, with no time limits and no shared environments.

Start today. https://t.co/k4i4IUVWIw

[OffSec @offsectraining]

🔍💻 When a critical vulnerability like CVE-2026-85706 (GitLab Unauthenticated Arbitrary File Read) drops, it's not just an alert for defenders—it’s a masterclass in application security.

Learn how manipulating the file.path parameter in the Repository Commits API triggers a path traversal flaw, and (BLUE TEAM) discover why validating data exfiltration from this exploit requires cross-referencing specific access logs.

Read the full technical breakdown here:
🔗 https://t.co/80vYjSH2Ss

#VulnerabilityResearch #CVE #OffSec #AppSec #CyberSecurity #InfoSec

[OffSec @offsectraining]

Ready to master web exploitation with Kali Linux? 🛑👾

WEB-200 teaches you to manually find and exploit XSS, SQLi, SSRF, and more using the industry's top tools. No multiple-choice tests—just a grueling 24-hour practical exam to earn your OSWA certification.

Embrace the Try Harder mindset. Prove you have what it takes.
🔗 https://t.co/Y5urmxP8IL

#OffSec #KaliLinux #OSWA #WebSecurity #TryHarder #AppSec #BugBounty

[OffSec @offsectraining]

Recon is everything. Don't rush the exploit. 🛑🐉

HackTrack for OSCP prep continues this Saturday with a deep dive into Gallery. Learn how to uncover hidden attack surfaces through disciplined enumeration.

This week's focus:
🌐 SNMP Enum
🔍 vHost Discovery
💉 SQLi
📤 File Upload Attacks

📅 Saturday, September 26, 2026 @ 16:00 GMT
Claim your spot: https://t.co/LWbShoGyGl

#OffSec #OSCP #PenTesting #CyberSecurity #TryHarder
#TryHarder

[OffSec @offsectraining]

As cyber pressure and cybersecurity budgets rise, what should that investment deliver?

🕗 Earlier detection.
⚡ Faster containment.
🤝 Teams ready to protect financial operations under pressure.

OffSec helps financial institutions build and validate the hands-on capabilities behind those outcomes, before a real incident puts them to the test.

Prepare your cyber workforce with OffSec: https://t.co/Xk4KJZuYod