An Interview With A Hacker [Shahin Ramezany]

Shahin Ramezany is a computer security researcher with over 7 years of experience in computer security, where he specializes in web application penetration, reverse-engineering/exploit-development and network penetration. Over the years he has disclosed many security vulnerabilities and authored several exploits for popular web/desktop applications.

Shahin is best known for his work on month of Abysssec undisclosed bugs (with Abysssec team), publishing 0day/1day reliable exploit codes for popular softwares, as well as finding and reporting issues in popular web sites such as Yahoo! , Microsoft, OWNcloud , Adobe , Mozilla, and so on. Shahin is also an expert Python developer and likes to automate hacking tasks via programming. His current interests are new web hacking methods, rapid code auditing techniques and security mitigation bypasses

Now a days, we have seen bug bounty hunting at the peak and XSS being low hanging fruit is found any where and lots of people i have seen is they are just injecting random payloads in POST/GET Input without knowing how XSS actually works. What do you think about them, also what according to you is the future of bug bounty hunting? 

Well , from my point of view the idea of bug bounty is cool but in most bounty programs payment is cheap for experts and in most cases credit is first motivation for those (who know what they are doing) . and about those who are doing brute force (using scanners , sending random payloads and checking reflection) they can find vulnerabilities too, because big companies have a lot of not talented (in security) developers but bounty programs will kill these kind of bounty hunters and vulnerabilities soon and about future of bounty programs i just can say if they pay well they can except to kill some serious 0days otherwise it won't work as it title. 

Why do you think that your courses stand out from the rest of the training and certification programs? 

Most of the courses in the field are though by security experts (aka defenders), who have spent a lifetime fixing and patching stuff and have only had minimal hacking experience (because its mostly illegal), but our courses are fundamentally offensive, even the theories we provide are biased towards offense and not defense.

On top of that, we have the collective experience of some of the world's most famous security researchers and the training are backed up by a company which has a lot of people actually doing penetrations and researching vulnerabilities.
To sum it up, its not a sit-get-certified program, its a tough thing with a lot of labs that makes you much more confident as a hacker.

Do you think are certifications really worth the knowledge/money? 

From the creators perspective, they are actually very cheap. The amount of labs that are virtually served and thoroughly prepared for these courses, is tremendous. The money is not even paying for that, and we're using a considerable open source community to push the thing forward.
From the students perspective, the material you learn in a course is directly correlated with the people who teach them.

Everybody can take a peek at OWASP Top 10, and then go ahead teaching how to use and defend them, but people who have spent years creating the Top 10 list, and have had millions of discussions on what to put where, definitely know all the roots to those.

How you will support your students? 

We have staff who will read all questions and feedbacks, classify them and forward them to the instructors for answers. In case some questions are out of the scope, the staff will do a brief research and guide the student in the right direction.

But the most important step is real-life scenario-based labs, which mimic actual hacking scenarios and are not classroom labs. These boost students confidence and have considerable details embedded in them.

How about your certification ? 

We are a new firm, but we are of the highest quality (check some of our sample reports), and the people we have gathered here working together are the best in their respective fields. Our certificates will soon be of very high standings. On top of that we are willing to hire most of the students that successfully pass our courses!

What are your main courses ? 

Our focus is on application security. It can be divided into web application security - which is much more unpredictable and vast - and binary application security. For web application security, we have our advanced web hacking (flagship) course, and our penetration testing course covers some of the aspects. For binary application security, we have reverse engineering courses focuses on hacking and security, and exploit development which is a tad bit more advanced.
If our audience requires it, we will provide defensive courses as well as more focused courses such as cryptography.

What about your prices?

Because this is our initial run, our prices are not too high. Our plans are to double them by the next run. To make the courses more affordable to students, we are providing discounts for early registrations. The prices are carefully prepared, for example a price of one thousand dollars for a course with more than 1000 pages of lectures, many hours of video and more than 20 full labs available on separate machines for each student, is pretty economical.

What is your material delivery? 

We are proud to say that we have prepared our material delivery for every taste! We have a survey as part of the registration that asks students to rank their experiences. Currently we support live classes (instructors teaching directly), online classes (video and lectures recorded and playable online), and downloadable classes (download watermarked lectures and videos per student), and we can provide a mixture of them.


Our labs are primarily online on a cloud and each student has his/her own separate system to meddle with, and reset to factory setting if necessary.

Last but not least, What do you think about RHA? 

About RHA i think you have great resources for beginners and you can think about some expert sections in future.

To see a complete list of trainings by Zdresearch team, Please visit the following URL:

http://training.zdresearch.com