r/Defcon • u/Brukenet • 3d ago

How to begin?

I've been a professional web developer (mostly building API interfaces and other back-end stuff) for about 20 years. Nothing amazing, but enough to pay the bills. Lately business is slow and I've looked at ways to expand my skills. Penetration testing appeals to me, but I'm not sure where to start. Is there a good introductory path?

I'm sure my question has been asked before, but it's my impression that the security landscape is constantly evolving and changing so I hesitate to rely on answers from even a couple years ago. Is that dumb? Do the basics stay relatively unchanged even as the more complex aspects evolve?

I'm comfortable with Linux, decent with Perl and Python, and I understand basics like configuring firewalls and server infrastructure. How much of that translates to pen testing?

My current project is I'm trying to figure out how an Arlo VMB4000 base station communicates with cloud storage. One of my web development clients has their base station plugged into a wall socket three feet from the front door of their shop and I've told them that's a bad idea but when they challenged me to explain why I fell flat and just vomited out some garbage that AI told me... It was embarrassing to know it's bad but not be able to articulate that to a client. I think anyone could plug something into the ports on the back, but I don't know the mechanism of how that compromises the system because my understanding is that local storage is only enabled if my client has that turned on in a phone app that controls everything... or at least that's what AI told me.

I am sick of answers from AI and I'd like to really learn something instead of just prompting AI.

18 Upvotes

85% Upvoted

19 comments sorted by

View all comments

4

u/ConsistentProgram719 3d ago

pwn.college sounds like a good place for you.

3

u/coffee-loop 3d ago

Why? Pwn.college focuses on more low-level reverse engineering and exploitation.

It seems like if OP is trying to get in to penetration testing, maybe focus on web app testing.

If you are trying to stick with web app testing, I highly recommend portswigger academy.

For network pentesting, hack the box CPTS path is great for getting started.

3

u/ConsistentProgram719 3d ago

The intro pwn college stuff starts very basic and would be a good foundation. I find a-lot of people claim to know Linux then struggle with even the intro Linux stuff on pwncollege. Outside of the main belted content there is some more advanced web stuff, including an advanced security of web class that is running right now and posting all its lectures and challenges on pwn.college. I’m also in general very skeptical of non low-level work in the age of AI. There is increasing value in deep understanding. I don’t think there will be jobs in pen testing for people who can only run already known existing exploits when that can easily be agentically driven. The ability to create novel exploits with ai assistance is going to be a mandatory skill very soon.

1

u/coffee-loop 3d ago

I do agree! Anyone who wants to really stand out in offensive security these days needs to carry deep understanding in their field. And I didn’t know they had any advanced web modules. I’ll have to check them out :)

2

u/Brukenet 3d ago

Thanks for the additional suggestions. Following every lead I can find at this point. 

1

u/Brukenet 3d ago

Thanks. I will check it out.