9 ms·
My advice is to ignore everything about Kali Linux. It’s a pen-drive distribution loaded with every “hacking” tool imaginable. As far as learning goes, you won’
by snazz 8y ago
My advice is to ignore everything about Kali Linux. It’s a pen-drive distribution loaded with every “hacking” tool imaginable. As far as learning goes, you won’t gain anything from installing it and clicking randomly through the options in Zenmap or other tools. The best you could learn from this kind of “education” is how to be a script kiddie who presses buttons and gets in lots of trouble for causing damage. Penetration testing requires more skill than simply using Kali Linux and most penetration testers don’t use it.
Instead, focus on something that you have an interest in. Do you want to find bugs in data file handling libraries (like libpng or libxml2)? Do you want to reverse engineer software and hardware to find previously-unexplored attack vectors, that could be sold to bug bounties for lots of money? Do you want to help companies find errors in their software configurations that could lead to security breaches? Do you want to hack hardware?
My point is not that Kali Linux is useless. It’s a convenient hodgepodge of most every penetration testing tool in existence. My point is, however, that you should find an interesting niche and get experience finding real bugs and solving real security problems. You’ll build up a portfolio this way that could help you get hired in a more senior position. It sounds like you’ll want to focus on defensive protections and mitigating attacks, if you currently work for a regular company as a cyber security analyst.
Good luck!
- snazz 8y agoAddendum: Real experience (presentations, papers, blog posts with real issues and real solutions) as described above is likely more valuable to a future employer than completing certifications and courses.
- who-knows95 8y agohello, thank you for this reply. the only reason i mentioned Kali Linux is it's a requirement for the oscp? and i guess kali would be used for basic pen testing. i'm not sure exactly where i fall, id like to be a jack of trades for a few things; defensive protections, pen testing, social engineering. thank you for your advice, that's what i really want, to put myself into the position where i can solve real problems and be a part of the sec community. thank you snazz.
- world32 8y agoThere are not many jobs out there for jacks of all trades. Pen testing and social engineering are not necessarily separate roles but you will not likely find a job that lets you both be a pen tester and work from a defensive standpoint.
- who-knows95 8y agoi understand what you mean, i guess it's more my curious/autistic nature to want to learn as much as i can.