Re: Pen testing for educational purposes

[bgreene () gdn net]

This sounds more like a hack-off than a course test. I'd be interested to know how you are going to handle the "social 
engineering" tests seeing how that works by the person not knowing they are being socially engineered.

Otherwise you could setup challenges that would simulate the mark you are trying to accomplish.

1) Social Engineer stolen encrypted data physically from a machine.

2) Crack the encryption

3) Compromise a website and access the db

You could go one further and add a balance to the system, that would be an opposing team that would be trying to 
counter or mitigate the attackers. Each team would act as both, with both parts of the challenge counting toward points 
or a grade.

Getting in is one thing, keeping people out is entirely different.