Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How did you get started in Network Security/Penetration Testing?

news.ycombinator.com

Post reply on HN
Print view View original

41–50 of 69 posts

Re: Ask HN: How did you get started in Network Security/Penetration Testing?

#41

Post by graystevens »

Txmm wrote: post #40
igolden wrote: post #2

I’ve been a professional software developer for the last 4-5 years, but never took security serious until iot took off. Get some raspberry pis, install kali Linux on a VM or spare computer, and go to work! It’s just so easy and cheap to setup a pen test lab. I’d recommend every dev have a few attack machines for fun. That’s how I got started . It’s also a huge field. Try checking out security in your current discipli…

"It’s also a huge field. Try checking out security in your current discipline." I'm actually 15 at the moment with basically no experience besides messing around with kali tools like a script kiddie. Got any tips for programming languages to learn/where to learn? I appreciate the post!

Take a look at either Ruby or Python - both have huge userbases in general, but are also used regularly within the business.

A lot of quick scripts are written in Python - you may have noticed this in Kali.

Ruby is what metaspoilt in built upon, meaning a lot of the modules are also ruby.

Both are great languages. In regards to where to start with learning them, take a look at https://www.codecademy.com, both are featured there and give you a nice gentle introduction to their syntax and ways of workings.

Also for Python there's https://learnpythonthehardway.org which is awesome, and https://automatetheboringstuff.com which is a little more practical to begin with.

Once you feel comfortable with the language(s), go read the source code for those scripts or modules in Kali and see what else you can pick up.

Re: Ask HN: How did you get started in Network Security/Penetration Testing?

#42

Post by ktta »

dguido wrote: post #8

I had an oppressive computer teacher in high school and I liked to pull pranks. It started out with simple password guessing, then phishing, then trojaned USB autoruns, SAM hash dumping, and password cracking, then some wifi sniffing... I never thought of what I was doing as hacking at the time (2001-2002). I just wanted to use the computer lab to play video games, and show up my jerk of a teacher. In my senior year…

I feel like it is difficult to get hired right out of college into a pentesting/netsec role without a bunch of certs and CTFs (which you do mention in your career guide). Even then it just looks like just another qualifying tick in the checklist. Right now I'm thinking a dev job for a couple years, then move into security (which looks like what some recommend). What do you suggest one can do to show that they have the chops to take up the a good role short of getting a couple high profile CVEs? Write a blog? Write PoCs for past CVEs?

What will get the attention of someone who hires (like you) to think that they will be a good fit?

Re: Ask HN: How did you get started in Network Security/Penetration Testing?

#43

Post by raesene9 »

Txmm wrote: post #40
igolden wrote: post #2

I’ve been a professional software developer for the last 4-5 years, but never took security serious until iot took off. Get some raspberry pis, install kali Linux on a VM or spare computer, and go to work! It’s just so easy and cheap to setup a pen test lab. I’d recommend every dev have a few attack machines for fun. That’s how I got started . It’s also a huge field. Try checking out security in your current discipli…

"It’s also a huge field. Try checking out security in your current discipline." I'm actually 15 at the moment with basically no experience besides messing around with kali tools like a script kiddie. Got any tips for programming languages to learn/where to learn? I appreciate the post!

In terms of languages I'd echo the sibling comment, Ruby or python are likely to be good choices.

If you're looking for things to start getting into security type learning, you could do a lot worse than start with CTFs (https://ctftime.org/ctf-wtf/) Whilst they're not identical to what you'll face as a security tester, they cover a lot of similar skills. Also you'll likely meet people in the industry by doing them.

There's also sites like https://pentesterlab.com/ which have free examples of pentesting challenges.

Re: Ask HN: How did you get started in Network Security/Penetration Testing?

#44

Post by demonshalo »

Txmm wrote: post #40
igolden wrote: post #2

I’ve been a professional software developer for the last 4-5 years, but never took security serious until iot took off. Get some raspberry pis, install kali Linux on a VM or spare computer, and go to work! It’s just so easy and cheap to setup a pen test lab. I’d recommend every dev have a few attack machines for fun. That’s how I got started . It’s also a huge field. Try checking out security in your current discipli…

"It’s also a huge field. Try checking out security in your current discipline." I'm actually 15 at the moment with basically no experience besides messing around with kali tools like a script kiddie. Got any tips for programming languages to learn/where to learn? I appreciate the post!

I remember when I was 15 and asked that same question on hellboundhackers :D #nostalgia!

Jokes aside, go with Python. It was my first language and to this day I can't think of a better language for people to start out with!

Good luck to ya!

Re: Ask HN: How did you get started in Network Security/Penetration Testing?

#45

Post by Txmm »

graystevens wrote: post #41
Txmm wrote: post #40

Earlier quoted context omitted.

"It’s also a huge field. Try checking out security in your current discipline." I'm actually 15 at the moment with basically no experience besides messing around with kali tools like a script kiddie. Got any tips for programming languages to learn/where to learn? I appreciate the post!

Take a look at either Ruby or Python - both have huge userbases in general, but are also used regularly within the business. A lot of quick scripts are written in Python - you may have noticed this in Kali. Ruby is what metaspoilt in built upon, meaning a lot of the modules are also ruby. Both are great languages. In regards to where to start with learning them, take a look at https://www.codecademy.com , both are fe…

Thank You!

Re: Ask HN: How did you get started in Network Security/Penetration Testing?

#46

Post by Txmm »

demonshalo wrote: post #44
Txmm wrote: post #40

Earlier quoted context omitted.

"It’s also a huge field. Try checking out security in your current discipline." I'm actually 15 at the moment with basically no experience besides messing around with kali tools like a script kiddie. Got any tips for programming languages to learn/where to learn? I appreciate the post!

I remember when I was 15 and asked that same question on hellboundhackers :D #nostalgia! Jokes aside, go with Python. It was my first language and to this day I can't think of a better language for people to start out with! Good luck to ya!

Thanks!

Re: Ask HN: How did you get started in Network Security/Penetration Testing?

#47

Post by Txmm »

raesene9 wrote: post #43
Txmm wrote: post #40

Earlier quoted context omitted.

"It’s also a huge field. Try checking out security in your current discipline." I'm actually 15 at the moment with basically no experience besides messing around with kali tools like a script kiddie. Got any tips for programming languages to learn/where to learn? I appreciate the post!

In terms of languages I'd echo the sibling comment, Ruby or python are likely to be good choices. If you're looking for things to start getting into security type learning, you could do a lot worse than start with CTFs ( https://ctftime.org/ctf-wtf/ ) Whilst they're not identical to what you'll face as a security tester, they cover a lot of similar skills. Also you'll likely meet people in the industry by doing them.…

Hmm those look very interesting. Thanks!

Re: Ask HN: How did you get started in Network Security/Penetration Testing?

#48

Post by mkhpalm »

I got started for personal entertainment in darker corners of the internet. That ultimately evolved into me writing some of the tools people used in the industry. Eventually that developed into some SaaS products and 2 companies that we ended up selling.

My advice to you if you are just getting started in the infosec world is... don't do it! Short of the increased attention to encryption and various better authz/authn standards... the newer crowd doesn't want to hear anything about the vulnerabilities in their code. 9 times out of 10 the only reason they'll resort to testing anything is to cross off a corp checkbox somewhere. Keep in mind that nobody likes policy and you'll be associated with their hatred for it.

Re: Ask HN: How did you get started in Network Security/Penetration Testing?

#49

Post by HakureiSec »

Txmm wrote: post #40
igolden wrote: post #2

I’ve been a professional software developer for the last 4-5 years, but never took security serious until iot took off. Get some raspberry pis, install kali Linux on a VM or spare computer, and go to work! It’s just so easy and cheap to setup a pen test lab. I’d recommend every dev have a few attack machines for fun. That’s how I got started . It’s also a huge field. Try checking out security in your current discipli…

"It’s also a huge field. Try checking out security in your current discipline." I'm actually 15 at the moment with basically no experience besides messing around with kali tools like a script kiddie. Got any tips for programming languages to learn/where to learn? I appreciate the post!

You have a long but very interesting road before you. Infosec is huge. Lesley “hacks4pancakes” Carhart has a great series which provides an overview of what you can choose from: https://tisiphone.net/2015/10/12/starting-an-infosec-career-...

If you're serious about infosec and not just want to run tools and call it a day, I suggest covering the basics first:

- programming: would be cool if you learn not only some language but programming “as art and mindset” in general. This includes your typical Computer Science courses, algorithms etc. Great if your school or university teaches those but you can always fall back to online education platforms.

When it comes to language, I'd recommend Python over Ruby. Granted, the latter powers Metasploit, but a lot more tools and wrappers around tools are written in Python. Once you know Python, creating Metasploit modules won't be a problem because a lot of things are handled by the Metasploit Framework.

Also, this comes from a highly subjective Python developer but suggest to learn Python 3, despite a lot of infosec tutorials and tools still using Python 2 (e.g. socket programming). It's easy to fall back to Py2 if you need but you'll have the power of latest and greatest if you go Py3 because not everything is backported. Most books contain a lot of useless material and are pretty slow-paced and I'm not a fan of “Learn Python The Hard Way” either. I personally started with “Learning Python” by Mark Lutz; after about a third into the book I ditched it and just went practicing and googling for answers. Cannot vouch for “Automate the boring stuff…”. You do you but in the end it all comes to practicing.

- networks: almost as important, if not more important than programming. Web pentesting, internal network pentesting, malware reversing, DFIR, even some part of exploit writing constantly interact with networks and analyze traffic.

- OS: for starters, tinkering will be enough. Familiarize yourself with Windows (console, registry) and some flavour of Linux (shell, permissions, important files etc.), preferably Debian-based because they are popular in CTFs and tutorials. Install and configure some software like web servers, databases, development environments to get the hang of it.

Where to learn:

Google, obviously.

https://pentesterlab.com/ is great for web pentesting. They have free tier with pretty okayish explanations and exercises. They also have “Bootcamp” section which covers some network, programming and Linux stuff.

LiveOverflow's Youtube channel has a playlist called “LiveOverflow Binary Hacking” which is a great primer into exploit development on Linux. For Windows, you should probably check Corelan series: https://www.corelan.be/index.php/articles/

https://www.vulnhub.com/ has machines for practice. Not all of them are great but you may learn a lot by reading writeups.

When it comes to certifications, they all serve their purpose, even CISSP and CEH. I did OSCP and while I won't call it “10 out of 10”, it's decent and probably the best one when it comes to skill practice and cost. It targets internal network pentesting, though, which might not be that useful if you choose other field.

Did I mention Google?

Post reply on HN