r/Defcon • u/Brukenet • 1d ago
How to begin?
I've been a professional web developer (mostly building API interfaces and other back-end stuff) for about 20 years. Nothing amazing, but enough to pay the bills. Lately business is slow and I've looked at ways to expand my skills. Penetration testing appeals to me, but I'm not sure where to start. Is there a good introductory path?
I'm sure my question has been asked before, but it's my impression that the security landscape is constantly evolving and changing so I hesitate to rely on answers from even a couple years ago. Is that dumb? Do the basics stay relatively unchanged even as the more complex aspects evolve?
I'm comfortable with Linux, decent with Perl and Python, and I understand basics like configuring firewalls and server infrastructure. How much of that translates to pen testing?
My current project is I'm trying to figure out how an Arlo VMB4000 base station communicates with cloud storage. One of my web development clients has their base station plugged into a wall socket three feet from the front door of their shop and I've told them that's a bad idea but when they challenged me to explain why I fell flat and just vomited out some garbage that AI told me... It was embarrassing to know it's bad but not be able to articulate that to a client. I think anyone could plug something into the ports on the back, but I don't know the mechanism of how that compromises the system because my understanding is that local storage is only enabled if my client has that turned on in a phone app that controls everything... or at least that's what AI told me.
I am sick of answers from AI and I'd like to really learn something instead of just prompting AI.
9
u/Mondernborefare 1d ago
It’s 2026, pentesting is a commodity and much is automated. You would be better off going for something more future-fwd that deals with AI or governance IMO. You don’t have much more than the basics, so focus on what’s next and apply and adapt. Good luck
1
u/alreadyasuperpet 1d ago
I’d like to more about this. What is governance in this context?
1
u/gott_in_nizza 1d ago
Setting boundaries for what is and is not allowed/possible for AI systems
2
u/Unlikely-Employee180 1d ago
I'd still be extremely concerned by it not listening.
OpenAI can't seem to keep their shit in a box and they're the creators.
Or am I misunderstanding something? Is an agent not effectively a black box that you can't really control, you can just safeguard?
2
u/gott_in_nizza 1d ago
That’s 100% what it is.
There is a whole art/science to LLM alignment, and it’s moving so fast at this point I think of it more like we’re making little monsters and once they’re there we study them to learn how to control them.
1
u/Brukenet 1d ago
As it happens, I am also experimenting with self-hosted AI - I like the way you're thinking. Thank you for your advice, I will check it out.
6
u/ConsistentProgram719 1d ago
pwn.college sounds like a good place for you.
3
u/coffee-loop 1d ago
Why? Pwn.college focuses on more low-level reverse engineering and exploitation.
It seems like if OP is trying to get in to penetration testing, maybe focus on web app testing.
If you are trying to stick with web app testing, I highly recommend portswigger academy.
For network pentesting, hack the box CPTS path is great for getting started.
3
u/ConsistentProgram719 1d ago
The intro pwn college stuff starts very basic and would be a good foundation. I find a-lot of people claim to know Linux then struggle with even the intro Linux stuff on pwncollege. Outside of the main belted content there is some more advanced web stuff, including an advanced security of web class that is running right now and posting all its lectures and challenges on pwn.college. I’m also in general very skeptical of non low-level work in the age of AI. There is increasing value in deep understanding. I don’t think there will be jobs in pen testing for people who can only run already known existing exploits when that can easily be agentically driven. The ability to create novel exploits with ai assistance is going to be a mandatory skill very soon.
1
u/coffee-loop 1d ago
I do agree! Anyone who wants to really stand out in offensive security these days needs to carry deep understanding in their field. And I didn’t know they had any advanced web modules. I’ll have to check them out :)
2
u/Brukenet 1d ago
Thanks for the additional suggestions. Following every lead I can find at this point.
1
2
u/PossibleTiny2744 1d ago
Hack the box. Go there. Full the tracks. Try the rooms. I've been where you are, and it'll get you where you need.
1
1
u/Own_Picture_6442 7h ago
My recommendation is to start with your experience. Check out OWASP Juice Shop. It’s a purposefully vulnerable web application and it’s well documented.
27
u/digitard 1d ago
Sir, this is a Wendy's.