4 ms·
Love this: http://www.metasploit.com/about/penetration-testing-basics/ http://www.metasploit.com/about/penetration-testing-basics/ "You can become a penetrati
by larrys 14y ago
Love this:
http://www.metasploit.com/about/penetration-testing-basics/ http://www.metasploit.com/about/penetration-testing-basics/
"You can become a penetration tester at home by testing your own server and later make a career out of it."
Sounds like the old style correspondence school ads - a bit hokey.
http://www.thefreedictionary.com/correspondence+school http://www.thefreedictionary.com/correspondence+school
I would have rewritten that as:
"Many people have actually made a career out of being a penetration tester by first testing their own home server"
- tptacek 14y agoYou can absolutely learn to do penetration testing on your own time with your own servers. We have a script we give people to do the same thing. If you feel like you have a knack for systems programming, being a good systems programmer is 1/2 the hard part of appsec; the other 1/2 is literally "taking pleasure in finding creative ways to break things", and you can find out if you have that personality streak in just a couple hours of trying attacks.
- larrys 14y agoAgree. Fully understand the ability to self learn (and have done that with almost everything I've ever made a dollar on despite going to one of those good business schools which is why people think I make money rather than other qualities). My comment strictly related to the style of what they were saying (and how I might rewrite that) I think it's a great idea.
- BanMyAssFag 14y agoI would also like to get in on this circle jerk. You should totally start up a business where you claim to know stuff about security because you port scanned your Linux box. YOu can take their money and then they can get hacked then who cares? You have money. It's great that we can provide so much to the community here!
- porker 14y agoIs this script available? Thanks
- tptacek 14y agoShoot me an email.
- larrys 14y agoWould be interesting to offer this script as "ptaas" penetration testing as a service. That way instead of having the script and having the potential to abuse the script (or temptation) someone would be forced to allow tracking of the IP (presumably their own or their companies) that they are doing the testing on (and you could compile statistics for use elsewhere as a condition if they got the script for free). I know companies already offer this service (we had to go through one of those for PCI) but iirc it was rather expensive. FWIW the bank that required it never followed up after the initial "you have to do this and we suggest this particular company".
- deleted 14y ago[deleted]
- rurounijones 14y agoWhen you say "a script" what do you mean? A script that configures a server incorrectly to let you see the kind of things you can do?
- eru 14y agoI think he refers to a teaching script, as in a series of exercises.
- brightsize 14y agohttp://gogd.tjs-labs.com/show-picture?id=1160663127&size=FULL http://gogd.tjs-labs.com/show-picture?id=1160663127&size... "By and large, Management agrees that there is but one adequate solution to the problem ... a solution that can be applied only by Management itself."
- mpyne 14y agoThere was way less cowbell in that picture than I expected.