So You Want to Be a Penetration Tester?
jhalon.github.io
jhalon.github.io
For someone that just want to get a foot in the industry and be useful in some real world scenarios (where knowledge of the most common problems will probably be enough to find real problems) I think this article is a useful resource. But in the long term you will be better and more valuable to skip security resources most of the time and instead go deep in a wide set of areas.
And pen testing isn't a "sexy" job. Not amongst security and software developers anyway. I see on the same level as QA.
There are already many automated pentesting tools, and those are a good first pass, and yes, they could improve much further and take more of the bottom end of the pentesting market.
However, logic vulnerabilities, hardware vulns, research against browsers and operating systems, malware analysis, and even advanced network and web security testing, are all far from being automated.
- You need to have strong technical writing skills. Reporting for each vulnerability should include:
* Title
* Two sentence summary explaining the impact of the finding.
* Explanation of the vulnerability.
* Where the bug is (code if available).
* Proof of concept for exploitation. Clients may want a retest, ensure that the person reading the report can find the vulnerability quickly if need be! A quick explanation of how to navigate the app to the vulnerable page is useful.
* Remediation.
- Report patterns that can lead to exploitation, but are currently not exploitable, as informational findings. Are they copying and pasting security sensitive code throughout application? Recommend a useful abstraction in the remediation! You don't want to play wack-a-mole and try to find all locations to update these scenarios.
- Does the client have sufficient logging and monitoring capabilities to detect an attack? The client may be interested in knowing if the security team can detect an intrusion is or has occurred.
- Recommend automation when possible! A Continuous Integration System should automatically be scanning for out of date dependencies.
- Time management skills are vital. Is a finding really convoluted to exploit, and would take a while to develop a Proof of Concept? Save the proof of concept for the end of the project. Ensure you try and get as much coverage as possible during your available given time.
- Project management skills are important. Test credentials early, and request whatever else you may need as soon as possible (buffer up questions to avoid email spam). Double check to ensure information hasn't been given to you already. You don't want to wait until the last couple days to request additional access if possible.
I disagree. There are people who's entire jobs are just to break web apps (most banks probably have a couple on the payroll) or just to get into and around a network (though the latter is slowly becoming less common as network architecture is changing).
I thought this was mostly the perception from people outside infosec. The vibe I tend to get from people within infosec is that pentesting is a low status specialization.
Depends so much. But yes, the good old "compliance checkers" who run a couple of scripts and call them self pen tester are very low on the lader. These are the majority nowadays.
People who can actually penetrate stuff "by hand" are considered sexy alright.
I put a "by hand" job posting in the "Who Is Hiring?" thread. Here: https://news.ycombinator.com/item?id=19543995 It isn't anything I'd call pentesting. We study software, not specific installations of software.
Pretty free to grow and work on what you like. Amazing work life balance, IMO.
From personal experience, Root-Me is easily one of the best way to get into infosec for someone with no prior knowledge of infosec or even information technologies in general.