4 ms·

This is something of a dream job of mine. As a college student - does anyone have suggestions of what steps to take to be able to do something like this for a l

by yathern 12y ago

This is something of a dream job of mine. As a college student - does anyone have suggestions of what steps to take to be able to do something like this for a living? I have a small amount of experience with hacking (pen testing my own sites for fun and learning) and I have a decent understanding of a wide range of network security and vulnerabilities. But I don't have very much knowledge on the physical side of pentesting. How would I gain this knowledge, or is it something that you're expected to learn simply from experiences in the field?

theoh 12y ago
Caving is very technical and can involve a lot of rigging ropes for abseil and prusiking (going up). It's not really a career, though, and you need to have access to an area with the right geology for caves. Yorkshire is excellent. Judging from the "professional" section of the Petzl website, being a steeplejack, rescue crew or arborist (tree surgeon?) is the best way to get to use this equipment and get paid for it.
- yathern 12y ago
  Thanks for the response - but I think you misunderstood - sorry if I wasn't clear. I'll update my first comment to reflect this. What I mean is, how to I get into pentesting in a way that combines both digital and physical attacks. Though thanks for the tips.
  - dmix 12y ago
    The linked website was a guide on getting started with Red Teaming: http://redteams.net/starthere http://redteams.net/starthere Also a surprisingly good reading list: http://redteams.net/bookshelf http://redteams.net/bookshelf
- hanley 12y ago
  I get the feeling that you didn't read the original post.
  - theoh 12y ago
    I did. I interpreted the parent as saying he was interested in doing technical rope stuff, which was a reasonable interpretation, given the content of the article. I don't think most penetration testing guys have those skills, which is why I discussed fields where you can acquire/use them. Any clearer?
    - ZoF 12y ago
      I think your interpretation is flawed; I thought you were trolling to be honest.(or are you still?) If you're describing your dream-job as 'repelling off of buildings' why would you mention your pen-testing experience?
- brianmwaters_hn 12y ago
  I just got done with a three year "mini career" in industrial rope access, where I got to work on-rope on wind turbine blades, in oil refineries, on the sides of high-rise buildings, and even one job up in the rafters above a professional football (American football) stadium. I'm now working towards a first job in IT or app dev, so this article is right up my alley. Nice work ;) If you're interested in a job working on-rope, and, uh, learning the ropes, I suggest you take a look at rope access. It's a small niche industry, but pay is very good, technicians are treated well, and many companies offer an "alternative" work schedule/lifestyle where weeks of travel work are interspersed with weeks of total off-time - and good technicians can sometimes choose how much they want to work (or not work). If anyone's interested, run a Google search for SPRAT and IRATA (those are our professional certifying bodies), and look on those sites for companies in your country. You'll have to take a week-long course (it's hard) and pass an exam before you're allowed on a job site, but if you have the stuff you'll pass, and most companies are hiring.
  - doorhammer 12y ago
    Interesting; I wish I'd known about this a few years back. Might have been a better option than moving companies and gas stations. But really, my friends and I used to do a lot of building climbing for kicks when I was younger (probably four to five stories usually) and there was a long period where that kind of job would have been way better while I learned to code than the random crap jobs I ended up doing. Looks really interesting though. Probably going to do some research into this. Is the course integral to the job or is it the kind of thing where you pay for the course/licensing/certification then go look for a job? Seems like it might be interesting to look into just for the certification. Of course... I have no idea what all this is like, so I might research for five seconds and realize that's lal stupid to ask
    - brianmwaters_hn 12y ago
      There are a lot of companies that claim to do industrial rope access outside the scope of the certification programs, but be skeptical of them at first. (That doesn't include companies in other rope disciplines that are different from rope access, like tree climbing and entertainment rigging. Those are different trades. RA takes most of its methods from caving, and some from rock climbing.) If you want to learn to do it right and have a good experience on the job, "go legit." But that means you'll have to get certified. Unless you have specific, in-demand skills (electrician, fiberglass technician, weld inspector), few companies will pay for your first course - you'll just have to pony up $1000+ on your own. However, once you get a job, they'll pay for your re-certifications, as well as follow-up courses that you take as you get more experience and climb up through the certification ranks.
fleitz 12y ago
Lock your doors, try to get into your house, fix the security issues, try to get in again. Buy a safe, try to unlock it without the key, buy a better safe, try to get in. If you're especially lazy, put an ad on craigslist looking to hire janitors, take the resumes, put your name on it, and apply for real janitorial jobs.
- yathern 12y ago
  Thanks for the suggestions. I've already dabbled into lockpicking as a hobby. I honestly have no idea what you are talking about with the last sentence though. Are you making a joke about the likeliness of making a career in pentesting? Or is this a way of describing how to infiltrate a building by running a long-con as one of their janitorial staff...
  - clarkmoody 12y ago
    I think the janitor bit is for real: go for the long-con.
  - rob_b 12y ago
    That last route threw me off at first as well. But it does provide excellent cover and who would suspect a simple janitor of anything. An added benefit is you get a key to almost anywhere.

by yathern 12y ago

theoh 12y ago

Caving is very technical and can involve a lot of rigging ropes for abseil and prusiking (going up). It's not really a career, though, and you need to have access to an area with the right geology for caves. Yorkshire is excellent. Judging from the "professional" section of the Petzl website, being a steeplejack, rescue crew or arborist (tree surgeon?) is the best way to get to use this equipment and get paid for it.

yathern 12y ago
Thanks for the response - but I think you misunderstood - sorry if I wasn't clear. I'll update my first comment to reflect this. What I mean is, how to I get into pentesting in a way that combines both digital and physical attacks. Though thanks for the tips.
- dmix 12y ago
  The linked website was a guide on getting started with Red Teaming: http://redteams.net/starthere http://redteams.net/starthere Also a surprisingly good reading list: http://redteams.net/bookshelf http://redteams.net/bookshelf
hanley 12y ago
I get the feeling that you didn't read the original post.
- theoh 12y ago
  I did. I interpreted the parent as saying he was interested in doing technical rope stuff, which was a reasonable interpretation, given the content of the article. I don't think most penetration testing guys have those skills, which is why I discussed fields where you can acquire/use them. Any clearer?
  - ZoF 12y ago
    I think your interpretation is flawed; I thought you were trolling to be honest.(or are you still?) If you're describing your dream-job as 'repelling off of buildings' why would you mention your pen-testing experience?
brianmwaters_hn 12y ago
I just got done with a three year "mini career" in industrial rope access, where I got to work on-rope on wind turbine blades, in oil refineries, on the sides of high-rise buildings, and even one job up in the rafters above a professional football (American football) stadium. I'm now working towards a first job in IT or app dev, so this article is right up my alley. Nice work ;) If you're interested in a job working on-rope, and, uh, learning the ropes, I suggest you take a look at rope access. It's a small niche industry, but pay is very good, technicians are treated well, and many companies offer an "alternative" work schedule/lifestyle where weeks of travel work are interspersed with weeks of total off-time - and good technicians can sometimes choose how much they want to work (or not work). If anyone's interested, run a Google search for SPRAT and IRATA (those are our professional certifying bodies), and look on those sites for companies in your country. You'll have to take a week-long course (it's hard) and pass an exam before you're allowed on a job site, but if you have the stuff you'll pass, and most companies are hiring.
- doorhammer 12y ago
  Interesting; I wish I'd known about this a few years back. Might have been a better option than moving companies and gas stations. But really, my friends and I used to do a lot of building climbing for kicks when I was younger (probably four to five stories usually) and there was a long period where that kind of job would have been way better while I learned to code than the random crap jobs I ended up doing. Looks really interesting though. Probably going to do some research into this. Is the course integral to the job or is it the kind of thing where you pay for the course/licensing/certification then go look for a job? Seems like it might be interesting to look into just for the certification. Of course... I have no idea what all this is like, so I might research for five seconds and realize that's lal stupid to ask
  - brianmwaters_hn 12y ago
    There are a lot of companies that claim to do industrial rope access outside the scope of the certification programs, but be skeptical of them at first. (That doesn't include companies in other rope disciplines that are different from rope access, like tree climbing and entertainment rigging. Those are different trades. RA takes most of its methods from caving, and some from rock climbing.) If you want to learn to do it right and have a good experience on the job, "go legit." But that means you'll have to get certified. Unless you have specific, in-demand skills (electrician, fiberglass technician, weld inspector), few companies will pay for your first course - you'll just have to pony up $1000+ on your own. However, once you get a job, they'll pay for your re-certifications, as well as follow-up courses that you take as you get more experience and climb up through the certification ranks.

fleitz 12y ago

Lock your doors, try to get into your house, fix the security issues, try to get in again. Buy a safe, try to unlock it without the key, buy a better safe, try to get in. If you're especially lazy, put an ad on craigslist looking to hire janitors, take the resumes, put your name on it, and apply for real janitorial jobs.

yathern 12y ago
Thanks for the suggestions. I've already dabbled into lockpicking as a hobby. I honestly have no idea what you are talking about with the last sentence though. Are you making a joke about the likeliness of making a career in pentesting? Or is this a way of describing how to infiltrate a building by running a long-con as one of their janitorial staff...
- clarkmoody 12y ago
  I think the janitor bit is for real: go for the long-con.
- rob_b 12y ago
  That last route threw me off at first as well. But it does provide excellent cover and who would suspect a simple janitor of anything. An added benefit is you get a key to almost anywhere.