• 0 Posts
  • 9 Comments
Joined 1 year ago
cake
Cake day: June 14th, 2023

help-circle

  • Pentesting skills are built upon skills in Linux and Windows system administration from the command line, networking, some coding usually in Python, knowledge of web applications and web servers, and more. When starting out it can feel bad because you want to learn out pentesting topic X, but then you figure out that you need to go learn at least the basics of fundamental topic A and B first. It’s normal so don’t worry about. Just dig in and enjoy the knowledge journey.



  • Not a question but I’d like to provide some career guidance. If you’re interested in a career in penetration testing, please, please put some time in your training plan for technical writing. So many folks think the job is all hacking, but it’s really about a third project planning with meetings and such, a third hacking and a third writing. Writing rules of engagement, test plans, reports, presentations on results, etc. So business and writing is just as important as the technical stuff. A well rounded applicant will have better luck finding a role.

    Thanks for listening to my Ted talk.



  • IMO penetration testing is a skill that is built upon knowledge of the fundamentals in a pretty long list of topics. System admin using the command line only for Linux and Windows, network administration like switches, routers and firewalls, web applications, databases, and programming. Again, the fundamentals. No need to be an expert. Knowing command line is key because usually you won’t have GUI access to targets.

    So what I tell folks is to look at where they have gaps and do some introduction courses on those topics.

    For example if databases are a weak area learn the basics on some SQL and no-SQL databases. That will help lay a foundation for later learning database attacks like SQL Injection.

    Same applies to many penetration testing concepts. One needs to understand the underlying fundamentals that support the attack to really get it.

    Then it’s a matter of building skill in identifying weaknesses and matching those up with a technique that can exploit the weakness. That is a continuous learning process because tech never sits still. It’s perfect for the perpetual student type.




  • Something I don’t think is talked about enough in offensive cybersecurity training / skill development are communication skills. Too often we are seeing folks try to enter these roles without the ability to write reports and give presentations to audiences with a mix of technical and business attendees. My recommendation to folks considering these roles is to put in the time to get communication skills to a very professional level. Train it just like report writing or public speaking was a new shiny hacking certification. It will improve your chances of landing the job.