Side story: this is even true for pentesting (disclaimer: not a pentester, I was helping a friend to break into the career). The most recognized certification (

Side story: this is even true for pentesting (disclaimer: not a pentester, I was helping a friend to break into the career). The most recognized certification (OSCP) is about killing CVE's and dodging rabbit holes, that's it. What I did on hackthebox.eu recently was: <technobabble> reverse engineering x64 assembly into C (silly, I should've used Ghidra instead). Then I started exploiting the heap by poisoning the t-cache, with that I could overwrite the GOT (getting an arbitrary read/write). Leak libc's base address bypassing ASLR, then using return to libc to exploit the thing (a ROP technique). </technobabble> Most of these things I learned during my CS master and it's apparently overkill for something like OSCP. More importantly, not all skills overlap. Dodging rabbit holes is not something you learn well. Understanding how to reverse engineer a binary has not much merit when it comes to finding a CVE and using metasploit, or some script on Github. Dodging rabbit holes and being fast at finding the right CVE's and using them properly to exploit a target are skills in their own right.