5 ms·

This may be slightly off-topic, but how do you get started in pen-testing? I read a book about it and the book, with focus on white-hat hacking, was very clear

This may be slightly off-topic, but how do you get started in pen-testing? I read a book about it and the book, with focus on white-hat hacking, was very clear about making sure you have a green-lit target to test on, but even the company I work for isn't going to let me randomly hack away and test security without an agreement in place (they would want to know I was doing it so as to filter false positive attacks, for example). So without doing anything either illegal or unethical, things that could lose me my current job, how does one build up the skills and experience?

raesene4 11y ago
There's quite a few ways to get started with the skills you need for pen. testing and the good news is that a lot of them are free or low cost. You should probably start by picking an area that you're interested in (e.g. web, infrastructure, mobile) as whilst there's some commonalities each area has it's own toolset and specific areas of focus. For learning there's things like https://pentesterlab.com/ https://pentesterlab.com/ , https://www.offensive-security.com/metasploit-unleashed/ https://www.offensive-security.com/metasploit-unleashed/ For practicing legally , a lot of CTF competitions make use of skills which are useful for penetration testers, also places like vulnhub https://www.vulnhub.com/ https://www.vulnhub.com/ have downloadable challenge machines that you can run in a VM. In terms of meeting up with people in the industry, look out for local Defcon chapters or B-Sides conferences, both of which tend to be free or low cost and have some good content.
- kenbaylor 11y ago
  The answer from raesene4 is the right way to go. For baby steps I would advise starting with nessus, and metasploit then targeting virtual machines that you build on your own home network.
- kagamine 11y ago
  Thanks, that should help. all I need now is time... edit: the metasploit site asks for payment in the form of a donation to charity, so I'll take closer look at that one first. Now that's a link worth sharing.

raesene4 11y ago

There's quite a few ways to get started with the skills you need for pen. testing and the good news is that a lot of them are free or low cost. You should probably start by picking an area that you're interested in (e.g. web, infrastructure, mobile) as whilst there's some commonalities each area has it's own toolset and specific areas of focus. For learning there's things like https://pentesterlab.com/ https://pentesterlab.com/ , https://www.offensive-security.com/metasploit-unleashed/ https://www.offensive-security.com/metasploit-unleashed/ For practicing legally , a lot of CTF competitions make use of skills which are useful for penetration testers, also places like vulnhub https://www.vulnhub.com/ https://www.vulnhub.com/ have downloadable challenge machines that you can run in a VM. In terms of meeting up with people in the industry, look out for local Defcon chapters or B-Sides conferences, both of which tend to be free or low cost and have some good content.

kenbaylor 11y ago
The answer from raesene4 is the right way to go. For baby steps I would advise starting with nessus, and metasploit then targeting virtual machines that you build on your own home network.
kagamine 11y ago
Thanks, that should help. all I need now is time... edit: the metasploit site asks for payment in the form of a donation to charity, so I'll take closer look at that one first. Now that's a link worth sharing.