5 ms·

I was a professional penetration tester focusing on network security for a couple of years and Impacket was an Essential piece of tooling that I used constantly

I was a professional penetration tester focusing on network security for a couple of years and Impacket was an Essential piece of tooling that I used constantly. The "examples" folder in this repo contains enough utility that you could successfully pwn a bunch of windows environments with no other tools.

boston_clone 4y ago
It’s tangential, but as someone moving toward the offensive & network side of things, would you mind sharing why you changed fields?
- kkirsche 4y ago
  Not OP, but if you work for a big company the goal of penetration testing runs counter to the goals of the other departments. The more bugs you find, the more that means someone else looks “bad”, so it can become hard to move up in seniority if you don’t have a good leader above you to properly align the interests of both parties so it’s collaborative rather than antagonistic
  - InitialBP 4y ago
    Not an issue I experienced at my old company (a consultancy) but this is a huge factor on security teams that I think is often overlooked. "Old" style security teams often have a "you (wrote bad code|bad config|picked bad libraries), now go fix it" attitude that really doesn't do them any favors. A big part of being on any security team is building rapport with other teams and making sure that the security team is seen as a part of the company and not "the assholes who make us do extra work." Anecdotally it seems like the more the other teams have a strong relationship with security - the more likely they are to consult the team early on and get some input on design decisions and recommendations that reduce the overhead of fixing vulns later on.
- InitialBP 4y ago
  At the time I was working for a consulting company. After a few years of grinding through assessments over and over I wanted to take a stab at actually helping improve the security of a company rather than simply telling them what they were doing wrong. I still get to do _SOME_ offensive work, but now I also get to follow up and help design/implement a good solution to the issue.

boston_clone 4y ago

It’s tangential, but as someone moving toward the offensive & network side of things, would you mind sharing why you changed fields?

kkirsche 4y ago
Not OP, but if you work for a big company the goal of penetration testing runs counter to the goals of the other departments. The more bugs you find, the more that means someone else looks “bad”, so it can become hard to move up in seniority if you don’t have a good leader above you to properly align the interests of both parties so it’s collaborative rather than antagonistic
- InitialBP 4y ago
  Not an issue I experienced at my old company (a consultancy) but this is a huge factor on security teams that I think is often overlooked. "Old" style security teams often have a "you (wrote bad code|bad config|picked bad libraries), now go fix it" attitude that really doesn't do them any favors. A big part of being on any security team is building rapport with other teams and making sure that the security team is seen as a part of the company and not "the assholes who make us do extra work." Anecdotally it seems like the more the other teams have a strong relationship with security - the more likely they are to consult the team early on and get some input on design decisions and recommendations that reduce the overhead of fixing vulns later on.
InitialBP 4y ago
At the time I was working for a consulting company. After a few years of grinding through assessments over and over I wanted to take a stab at actually helping improve the security of a company rather than simply telling them what they were doing wrong. I still get to do _SOME_ offensive work, but now I also get to follow up and help design/implement a good solution to the issue.