Pentesting : The Poor Man Guide.
What is pentesting ?
Pentesting or penetration testing is the action of penetrating into an application to seek for vulnerabilities and exploit them before the bad guys do under the permission of the application author, it is also known as Ethical Hacking which may sound awkward at first but it’s the method of "hacking" in legal way.
Getting involved is for everyone:
Considering a career as a pentester is cool especially if you’re coming from a computer science background or a related one , but what about me , newbie switching career or just getting started with information security, is there any chance for that ? Well , yes there’s and this is what we’ll be discussing down below for you to get started as an Ethical Hacker.
The Poor man Guide :
To begin with, you might want to start with a knowledge grasping about Searching skills && Google Dorking , to be able to beat the hacker you need to think like one, this would be handy too later when searching for Research papers about specific topics that you didn’t understand. Upnext you’ll get your hands on the wheel of Operating system (Linux/Windows) and Networks (Net+ can be helpful && u don’t need to be certified unless you’re applying for a job) , then you can move to some scripting using Python or Go , Until now you have the basics under your belt so it’s up to you what to seek after : (Web, binary exploitation, reverse engineering,forensics,Cloud,cryptography..)
Just pick the subject that you like and deep dive into that sea until you feel comfortable about your skills so you can move to the next one But if you want to be more specific then u can just choose one subject and keep your high learning hopes about it .
1- Practice :
For practice you have :
1- hackthebox.eu
2- tryhackme.com
3- vulnhub.com
4- portwigger.net/web-security/learning-path
5- root-me.org
6- overthewire.org(to learn about linux)
7- underthewire.org(to learn about windows)
Amd other resources , the internet is full you just need to search carefully .
Those are great plateforms when it comes to just getting started, HackTheBox also provides an Academy to learn more about different subjects :
https://academy.hackthebox.com
2- CTFs : The hacker playground
CTFs or Capture The Flag are the suitable choice in your early phases of learning As they’re a set of challenges varies from Web to Networks in order to find vulnerabilities and Exploit them to get a small line of text called Flag to prove that you’ve successfully hacked into the machine.To get Started, just keep an eye on https://ctftime.org and play some CTFs or you can just visit PicoCTF and Roll those dices.
3- Bug bounty : Hunters Arena
If you are confident enough of your skills and disagree with the idea of having a pre-vulnerable software/app then you can do Real World application pentesting AKA Bug bounty on platforms like :
https://Hackerone.com
https://bugcrowd.com
4- Books:
For Books, you can go with the already known ones like :
1- Web application security .
2- Web security for developers .
3- Hacking : The art of exploitation .
4- The Web Application Hacker’s Handbook.
5- The hacker playbook .
6- Web security testing Guide.
5- YouTube & Blogs : Insights storage
For YouTube && Blogs , Keep yourself up to date with the latest news, techniques and vulnerabilities :
- Blackhat (YouTube && website).
- DefCon (YouTube && website).
- RSA conferences .
- Infosec writeups (Medium).
- Reddit (Asknetsec && Cybersecurity subreddits....).
- Liveoverflow .
- John Hammond .
- InsiderPhd .
- Ippsec .
- Hackerone && bugcrowd .
- Bug bounty reports explained ( This is handy to understand how a vulnerability was discovered ).
And much more , the more you Learn the better you pick .
6- Podcasts
Postcasts are a helpful way too like the Darknet diaries , TED speaks about Cybersecurity ...etc
7- Traditional Assets
If you’re opt for some academic courses to see things both ways , then you may consider taking a look at :
8- Success is Work
Remember , being a pentester requires a lot of efforts and passion and perseverance , it’s okay to ask / search for solutions whenever you get stuck on a subject , you’ll be stressed when things go unintended and that’s totally fine;you’re learning and that’s what learning is all about: failing alot then winning. The expert is just a person who’s patient enough to try again && humble to keep learning through years , just assume that you’re an ignorant and don’t know whole alot , this shall create a constant path of learning and Growth. Good luck in your journey.
Make sure to follow for more write-ups, reports and posts of the Infosec.
