#cyber-and-careers

1 messages ยท Page 97 of 1

warm hinge
#

For someone with 5 years of cyber security experience?

#

Because I am thinking of going for it

stoic cave
#

In relation to other certs its not that hard

warm hinge
#

It's good to have a cert

stoic cave
#

Take a look at the Exam Material on Comptia's website. With 5 years of experience it shouldn't be hard

warm hinge
#

Is it practical like OSCP ?

#

Or ask questions ?

stoic cave
#

No

#

It has multiple choice and then some longer form questions called PBQ, or performance based questions

warm hinge
#

Questions like what's the OSI model?

stoic cave
#

All of the material on the exam is available on Comptia's website. Exam specifics aren't supposed to be discussed I believe, so you'll have to go there

warm hinge
#

Oh yes my bad

quasi hatch
#

I'll probably do Sec+ myself in the next month or so

static tide
warm hinge
#

Oh I see

#

I want something that can give me the cyber investigator title

#

That's what I have been working on for the past 5 years

stoic cave
#

I mean every company is different

#

But I suggest looking on LinkedIn or Indeed for Cyber Investigation roles and then seeing what certs they require

remote gale
#

After graduation does a post graduate specializing in cybersecurity helps you in getting a job or starting from a startup with an entry level position ?

flat sedge
#

No

#

A postgrad degree will price you out of most entry level positions - if you go for a postgrad right away, be sure you have a pretty in-depth personal projects section for practical implementations

#

If you don't have a work history or someone in your network willing to vouch for you, it can be difficult to break into mid or senior level positions that the M.Sc would otherwise qualify you for

remote gale
#

In my college, the job prospects for cybersec and ethical hacking are not available. Any suggestions? Even the teachers teaching us ethical hacking and forensics dont teach us the important stuff rather than just theory and no practical. Any suggestion?

remote gale
#

is it a good approach?

flat sedge
#

My advice is don't get a postgrad unless you can convince someone else to pay for it

#

Either a stipend from the university to be a teaching assistant or get a company to pay for it as part of a training program

remote gale
#

Hmm well I wanted to go abroad for getting good job prospects becoz the financial condition of the country is too unstable to depend upon

old crater
#

though of getting a master degree in it

#

but ppl said it would be bad

#

to get it if you still in entry level

stoic cave
#

That is correct

old crater
#

then how do i get a degree

#

and btw why is it bad ?

stoic cave
#

Getting a Masters before any relevant work experience is going to price you out of entry level positions

old crater
#

and if am priced out of entry level

#

i wont get expreince

#

for the higher level potions

stoic cave
#

Companies are less likely to hire you

old crater
#

positions*

#

well what degree should i get

stoic cave
#

A Bachelors if you want to get a degree

old crater
#

that's

#

a 4 years degree

stoic cave
#

BS in CompSci is common

old crater
#

am 22 atm

stoic cave
#

BS in Computer Security is also an option, you just have to be aware of the program you're entering

old crater
#

i decided to go into cyber defense

stoic cave
#

As I mentioned before Cyber isn't Entry level. You may have to start somewhere else if you don't want to go through the degree process

old crater
#

but am sure cyber defense is a generalized concept

stoic cave
#

And getting a degree also doesn't guarantee entry level cyber positions

old crater
#

a degree in MIS

#

it's not relevant to cyber security tho

stoic cave
#

A degree is a degree

#

It checks a box

old crater
#

ya but doesnt companies want it

stoic cave
#

So you have a bachelors of science in MIS?

old crater
#

in a specific area

#

not exactly

#

Bachelor of Commerce in Management Information Systems

#

this is my 4th and last year

#

atm

stoic cave
#

So a business degree?

old crater
#

am hoping to get good grades this year also

stoic cave
#

Never heard of Bachelor of Commerce before

old crater
#

but i realized good grades aint everything

#

it's sort of busniess analyst

stoic cave
#

So, I would start looking for jobs in the computer field. You may not start in Cyber Security right away but there are avenues to it

#

IT, helpdesk, etc

old crater
#

i dont think i get you

#

you mean look for a job in computer field

#

once i get experience

#

i try to switch jobs ?

#

or

stoic cave
#

No

#

You get experience in other areas of the computer field and then transition to a Cyber Security role once you have relevant experience

old crater
#

sorry for the stupid question

stoic cave
#

There are no stupid questions

old crater
#

but how do i know i am in a relevant job experience

stoic cave
#

IT, as an example, is a common starting point for Security professionals

old crater
#

working in anit department you mean

stoic cave
#

Yes

#

If you look on your local jobs board I am sure there are some entry level IT positions that you could apply for

#

Even with your degree, just send out applications to entry level computer and Cyber Security positions. You don't know unless you try

old crater
#

well a degree alone

#

won't work

#

am i right ?

stoic cave
#

How do you know? Send out applications

old crater
#

need certifications

#

and other skills

stoic cave
#

Some companies may be willing to take a chance. You just have to put in the work

old crater
#

well the question

#

of how do i get experience for a job if i need the job to get experience

fallow prism
#

Certifications, practical things like tryhackme.

It really depends on the company, I've seen a lot willing to take someone with entry level It experience to train up

old crater
#

they need bunch of shit i never heared about

stoic cave
#

A lot of job postings are written by HR

fallow prism
old crater
stoic cave
#

My current job was asking for 3 years of experience. I applied with 0 and got the job

fallow prism
#

^^

old crater
#

that's awesome

#

but what skills you had then ?

stoic cave
#

I had a Bachelors of Science in Computer Security and Information Assurance

#

And a Security Clearance

#

That's it

#

I got Sec+ after I was hired

old crater
#

wait am ask a question like atm in college we took databases and a tiny tiny tiny part of sql

#

i saw a job needs the degree i have and a good understanding of sql with someother stuff ofcourse

#

is my degree enough like that?

stoic cave
#

Degrees are just a checkbox, most of your learning will happen on the job

old crater
#

or should i try to improve my self ?

#

but going with 0 knowledge about sql will be bad right ?

#

am talking like an example

#

since ya we took a tiny but it was litterly nothing

#

so you can say we didnt take anything

stoic cave
#

Applying for a database administrator position without experience in SQL would probably be bad

#

But database administrator isn't entry level

old crater
#

no no like

#

an mis specialist

stoic cave
#

Something with specialist in the title likely isn't entry level

#

If you don't mind me asking, what's your home country?

old crater
#

egypt

#

i really fked my self up

#

cuz i didnt pay attention to what i was doing

#

untill this year ( my final year in college )

#

ya i got good grades

#

but my memory my knowledge of the stuff i took is

#

close to 0

#

unless i revise on the stuff i took to remember them

#

oh ya and when i really explored my goals i found that i liked cyber security

#

it peaked my interest

stoic cave
#

At this point, I kind of feel we're going in circles. All I can suggest is to go on your local job board and start looking for entry level jobs in the computer field. IT, Cyber, Analyst, Engineer, etc and start applying. You won't know until you try and the worst they can say is no. You're completing a degree, which is mainly a checkbox in most cases and used as a baseline of education not necessarily job experience. Make sure you have a presentable resume and show you are learning outside of school in a projects section with things like a Homelab, HTB, THM, etc.

old crater
#

okay so basically i keep working on thm i finish my college try to do other projects for my resume while applying to entry level jobs when i get enough experience and certain certifications to help me transition from my spot to a cyber security position

#

and i try to make sure that the entry level jobs that am applying for is relevant to the cyber security filed

old crater
#

did i get it right ?

paper grove
short pike
#

Awesome, thanks for the advice. Yeah that's fair, I'm also not sure I'd be completely prepared for something in cyber by that point because my classes are going in a different direction next semester, but I've been going through and marking things to apply for, so I'll start applying and try to talk to an advisor in the meantime

serene umbraBOT
#

Gave +1 Rep to @stoic cave

static heron
#

Speaking of degrees, how likely is it that you can get a job without a degree (but with relevant experience), when the job posting says:

  1. "Requirements: (or 'Qualifications:') Bachelor's degree in $field or related area"
  2. "Bachelor's degree in $field or related area required"
  3. "Bachelor's degree in $field or related area."
  4. "Bachelor's degree in $field preferred"
warm hinge
stoic cave
static heron
stoic cave
static heron
#

I was worried they'd be after some kind of background/foundational knowledge gained from the core classes or something

warm hinge
stoic cave
static heron
#

Which I'm sure is sometimes the case, but I'm also sure some of those can be compensated for by passing one of those cognitive tests they like using now

#

or otherwise demonstrating ability/aptitude

#

What I really need is to pin down the technique for selling the concept that I may have gaps in my knowledge but that I'm very aware of them and they can be filled quickly as needed with minimal wasting of TL/SME time ๐Ÿ˜›

warm hinge
static heron
#

Ooh, yes

#

At this point I have years worth of blog I should have written just of routine stuff I keep having to look up again because I never think to make notes in the heat of the moment ๐Ÿ˜„

#

(Even at work I would end up writing all the ticket notes at the end half the time, lol)

warm hinge
#

lol I do the same, I find having my own archive of publically available notes helps tremendously because I not only have to write it down, but I have to explain it well, so it sticks in my head a lot more

#

You could start with a static site using github for hosting for free too!

static heron
#

I'll have to make a concerted effort not to over-engineer it lol
I'll totally go to make a simple blog and end up creating a bunch of self-imposed prerequisites because at some point I decided I need to set up a comprehensive note-taking system involving org-mode or vim plugins that auto-publishes to the web and shines your shoes

warm hinge
static heron
#

Arbitrary constraints enable the best creativity :V

spare kernel
#

How likely is it to get a job that isn't Help Desk with a degree in CyberSec, certifications & an internship? I see people saying that they have these things but the only thing they can get is Help Desk jobs ??

burnt perch
#

Overview:
Iโ€™m currently studying in a degree for Cyber Security and Forensic Computing in the UK, this year (Level 4 BTEC) is solely Computing, but next year weโ€™re going more into both offensive and defensive security (from what Iโ€™ve been told).

I might have the opportunity to go into a Level 6 degree apprenticeship next year, but of course I would have not completed level 5 by that time.

Iโ€™ve previously applied for a similar option last year, and a bursary scheme from the same organisation this year with no luck, I wasnโ€™t able to get any personal feedback but put it down to being the excessive number of applicants and perhaps due to me only currently having 5 A Levels under my belt as opposed to higher education grades. Sadge

That being said, a person who works for the company where Iโ€™d be getting this degree apprenticeship opportunity from did say himself he never had the exact qualification that the company he was at were after and instead kind of just social engineered his way in. I have shown keen interest both when he has come to talk to our class as well as my lecturers, so Iโ€™m hoping I may have the chance even without completing level 5, especially as my lecturers have seem that I am excelling in this current year and trying to push myself further where possible.

My questions:
Would you say taking this route is wiser if I have the opportunity?

Has anyone taken a similar route and how did skipping level 5 work out for you? Were you able to complete both level 5 and 6 in your degree apprenticeship (mine is lasting 3 years, so I anticipate Iโ€™d have the time and resources to do so) or was it not even necessary to do so? Should I seek work experience and perhaps regular apprenticeships while Iโ€™m currently studying my Level 4 or focus primarily on the degree apprenticeship route?

Considering my current position, are certs worth going towards? Where should I look to begin with certs and/or other similar things?

vivid flume
# burnt perch **Overview:** Iโ€™m currently studying in a degree for Cyber Security and Forensic...

I think it will greatly depend on the circumstances surrounding you applying for a job and that will show whether it was wise to skip a level. I live in the UK (not studied here), my understanding of BTEC levels are that they're extended levels, am I right in saying that?
I only went as far as college in my country and I only have a diploma. I do not hold any kind of IT certification, yet I have been successful at several roles within IT and am now in management trying to branch out into cyber.

I've always felt that if you know what you're talking about, prospective employers will see that and if they need to take a chance with you, they might take you on. I'd highly recommend you watch this clip from The Cyber Mentor on how he transitioned from being an accountant to cyber: https://www.youtube.com/watch?v=GuAYRYCDdq4

I can't speak from experience yet on how it is like when you land a job in Cyber but am confident in that I will be able to get hired at some point hopefully this year

YouTube
The Cyber Mentor
My Journey to Cybersecurity (CIA Keynote)

โ“Infoโ“

Need a Pentest?: https://tcm-sec.com
Learn to Hack: https://academy.tcm-sec.com

๐Ÿ”นThe Cyber Mentor Merch๐Ÿ”น

https://teespring.com/stores/the-cyber-mentor

๐Ÿ“ฑSocial Media๐Ÿ“ฑ

Website: https://thecybermentor.com
Twit...

โ–ถ Play video
#

As for certs, I am looking to get Sec+ as I do not feel ready for OSCP

#

but then again, a lot of people say that certs may get you an interview but not necessarily a job (I am living proof of that for other roles in my IT career)

spare kernel
burnt perch
serene umbraBOT
#

Gave +1 Rep to @vivid flume

burnt perch
knotty oasis
#

Hey yโ€™all career question for you. Would it be better to do an undergrad in cyber sec or an joint undergrad masters program with undergrad being in IT with a focus in security and a masters in security?

Assuming that the universities are of similar prestige.

stoic cave
knotty oasis
#

The undergrad is from a NSA center of excellence. The joint program also is.

quick forum
#

Be very very wary of getting a masters.

stoic cave
stoic cave
knotty oasis
#

Thank you!

stoic cave
#

You're welcome

coral lava
#

Hi everyone. I am new here and I wanted to see if anyone have some advice or guidance to how to move my career from a network admin / jr dev into a Cyber Security career. I been looking online, found Cybrary had a career path goal that seems promising for $299 a year. Now I am not sure if that is the best option but maybe you guys can advise something. A little about my background I been doing IT work since 2008. I have held positions at Computer Support Specialist, Network Engineer, Cellular Field Engineer, and Network Administrator with some Jr Developer training at my current job. The place I am at is super limited if not the worse for Cyber Security positions, so I am looking to move this year away from here. I been working hard this past month to get my stuff together and hopefully start focusing on a Career path in CyberSecurity. I am torn on whether I should go first for my Sec+ or Net+ or CCNA. I have a degree AAS in Network Systems Administration and hold an expired A+ cert. Done a few courses here and there but nothing major. What you guys recommend I should focus and start with?

stoic cave
coral lava
serene umbraBOT
#

Gave +1 Rep to @stoic cave

stoic cave
coral lava
stoic cave
coral lava
surreal marsh
native elm
surreal marsh
# native elm yes

thank you, I noticed you did your pentest+ as well. what was your experience getting it?

serene umbraBOT
#

Gave +1 Rep to @native elm

native elm
serene umbraBOT
#

Gave +1 Rep to @surreal marsh

surreal marsh
#

okay that's very helpful. I'm definitely going to go for the sec+ cert but i'm not entirely sure which cert I plan to pursue afterwards

edgy tiger
#

It is 0 hands on, a big part is remembering flags of nmap๐Ÿ’€

quick forum
edgy tiger
surreal marsh
quick forum
#

US department of defense

edgy tiger
#

Ah fair enough, I am not from the US ๐Ÿ˜›

surreal marsh
edgy tiger
#

Assuming you would like to become a pentester, probably ejpt

quick forum
#

eJPT doesn't hold much weight with recruiters yet

quick forum
edgy tiger
#

It does help getting your feets wet with hands on experience

surreal marsh
quick forum
#

Certs and HR requirements vary so much, especially between countries

surreal marsh
#

Yeah I've noticed, sec+ is well regarded here, then most companies want CEH after that.

stuck rover
surreal marsh
stuck rover
surreal marsh
stuck rover
surreal marsh
#

thnx

lime bronze
#

Hi guys, Please, help me.
I wanna be ethical-hacker, pentester.

Education:

  • High school - knowledge about networking and hardware, and little bit about electricity
    Experiences:
  • 1 year Front-end Web Developer (React + Typescript)
    Sometimes I code in python scripts for my Raspberry Pi
  • 4 years using linux Ubuntu and Kali, I thing I have anought knowledge about kernel and system.
    I training on HTB academy and THM,
    I have experience with SQLi without sqlmap, BurpSuite, metasploit, nmap and other common tools,

I passed wargames by overthewire, (bandit, Leviathan, krypton),
and some machines on HTB and THM,

Now I dont have money for certificates like OSCP (Pen200), and others,

If you are pentester or you work in cybersec, Can you please give me some info what is important for juniors?
I wanna know what knowledge and skillset I need for this job on junior level.

Thank you so much ๐Ÿ™‚ and sorry for my english ๐Ÿ˜„

static tide
lime bronze
#

Slovakia,

rugged delta
# lime bronze Slovakia,

Slovakia is an EU country and afaik you have access to free education. You should look at whether there are applicable Degree programs in cybersecurity.

Pentester positions are highly competitive and most require you to be able to demonstrate an understanding of the kinds of skills they teach you in OSCP and above as well as other skills you'll have to pick up elsewhere. Having some low level THM/HTB Academy/Overthewire probably won't be enough and you'll have to demonstrate your skills in an advanced environment.

Take a look on recruitment sites like linkedin, indeed or some local sites and see what kind of roless are available in the region and what specifically they're looking for. I'm currently seeing a lot of junior pentester jobs looking for OSCP+ level skills

sonic sandal
#

Can someone give me a brief explanation of what a security architect does? I've read some pretty mixed answers online. Are there many practical components to a job in that area?

restive plinth
inner elm
sonic sandal
#

Oh wow I didn't know you could do that. Thanks ๐Ÿ˜Š

#

@inner elm thanks

serene umbraBOT
#

Gave +1 Rep to @inner elm

sonic sandal
#

Thanks! This answered a question for me too

pseudo creek
warm hinge
#

hi all, just wondering if there's anyone here mixing geopolitical analysis and cyber? I ask because the former is my strength and though I'm working on my cyber skills, I wonder what kind of job one could do with that mixture

#

also assuming it will take a while before I can claim I am competent at any level in the cyber field

distant pier
inner elm
warm hinge
static heron
sonic sandal
serene umbraBOT
#

Gave +1 Rep to @pseudo creek

merry matrix
#

I can't speak to it as much as I'd like to because I've only ever done it competitively as part of the Atlantic Council's Cyber 9/12 competitions, but maybe you can find something here:
https://www.atlanticcouncil.org/programs/scowcroft-center-for-strategy-and-security/cyber-statecraft-initiative/

Atlantic Council
Nancy Messieh
Cyber Statecraft Initiative

Cybersecurity impacts everyone through systems we interact with everyday, from the most innocuous ATM to the latest iPhone. The Cyber Statecraft Initiative, housed within the Scowcroft Center for Strategy and Security, matches exceptional academic insight and practitioner experience with practical policy solutions to move the levers of contempor...

#

If you're a student (graduate or undergraduate), I recommend trying a competition out if you have the resources to. If not, then that's as far as my experience goes.

fierce light
#

Is dice a good place to attempt to find an entry level help desk IT job in my area?

stoic cave
fierce light
stoic cave
#

In the US, LinkedIn and Indeed have a fairly dominant hold. There are some boards that are more tech centric

fierce light
#

Indeed is a really good source, I found out about dice through google jobs tho, it's a nice layout of a site

stoic cave
#

But entry is more than likely to be on the main boards

fierce light
serene umbraBOT
#

Gave +1 Rep to @stoic cave

fierce light
#

there ya go!! +1

stoic cave
#

You're welcome

shut violet
#

what are some infosec careers that have a pretty heavy hand in helping others? I know tracelabs exists, but I'm curious if anyone has an opinion/ view on different areas of infosec that are really involved in this aspect

inner elm
# shut violet what are some infosec careers that have a pretty heavy hand in helping others? I...

I'd think anything in these sectors would be important in helping people: https://www.cisa.gov/critical-infrastructure-sectors

Critical Infrastructure Sectors | CISA

There are 16 critical infrastructure sectors whose assets, systems, and networks, whether physical or virtual, are considered so vital that their incapacitation or destruction would have a debilitating effect on security, national economic security, national public health or safety, or any combination thereof.

languid hearth
#

we work with cisa on a semi-regular basis, can confirm. CISA provides awesome services.

inner elm
#

you might even say they are critical to the security, economics, public health or safety, or any combination thereof

shut violet
#

Hm yeah makes sense. Thanks for the link

languid hearth
shut violet
serene umbraBOT
#

Gave +1 Rep to @languid hearth

merry matrix
#

CISA is one of few government agencies that is actually on top of things from what I've seen and studied

#

Established in 2018 I believe

pseudo creek
#

I don't know if any other gov agency was involved but it broke off of DHS, which was doing that previously

warm hinge
# static heron It sounds like it could align with a few CIA intel/threat analysis jobs and mayb...

Thanks for responding. Indeed that is one attractive place to look for a job but, unfortunately for me, I am not a US citizen. I've seen lots of opening that vaguely would need you to have that kind of understanding (politics/sociology) or a PoliSci degree but almost if not all of them need you to have clearance or be eligible for one which in turn...And as to my job's contacts/career opportunities, also unfortunately no. I work at a place where most people can only think of cyberattacks in terms of the US 2016 elections or ransomware, so little opportunity to be got there

serene umbraBOT
#

Gave +1 Rep to @static heron

warm hinge
warm hinge
warm hinge
inner elm
warm hinge
warm hinge
distant pier
mint hound
#

I have no idea what to even apply to anymore. I have A+, Net+, CCNA+ maybe I should get Sec or something else

narrow pendant
#

Hey all, looking for some advice. I graduated with an engineering degree but quickly moved into tech. I worked as a SWE and now as a kind of product manager, but I want to move into more IT/cyber security

#

I just acquired my TS/SCI through the military and was hoping that would make me a solid candidate buuut I have no certs or anything so Iโ€™m not sure where to start

#

My ideal role is likely something DevSecOps

flat sedge
#

@stoic cave @vital laurel What are those jobsites for those with tickets? I can never remember

languid hearth
stoic cave
#

For cleared work?

#

LinkedIn is actually pretty popular, USAJobs as spooks just mentioned, and then Clearancejobs

narrow pendant
#

Yeah Iโ€™ve been using clearancejobs but tbh I donโ€™t feel like Iโ€™m super qualified for stuff outside of the clearance

stoic cave
#

Intelligence Careers is NSA specific afaik

languid hearth
#

nsa best three letter

stoic cave
#

A lot of times the Federal agencies will post the openings on their websites with links on where they want you to apply

#

A few are internal but most are USAJobs

narrow pendant
#

Would it be better following some of the paths with tryhackme or just going for a cert?

stoic cave
#

Then Clearancejobs and LinkedIn are popular with federal contractors

languid hearth
#

certification will likely help more

stoic cave
#

DOD 8570

languid hearth
flat sedge
#

Sorry spooks, I didn't know you were public sector

stoic cave
#

I didn't have any certs when I started though so it's not an absolute must

languid hearth
#

I'm private, want to go into public later down the line

#

we're heavily regulated by the public sector though

stoic cave
#

Certainly helps though

#

Security+ is probably your golden ticket though

#

Degree, TS/SCI, and an 8570 cert would make you a super easy hire

languid hearth
#

if my team lead didn't bail shortly after getting clearance I'd probably have it by now ;-;

stoic cave
#

Are you poly as well?

static heron
#

Man, the people at clearance jobs who called me had to do everything themselves, no remote session, couldn't hardly say anything about the issue half the time, they were pretty much just calling to get the manual and whatever material I could think of that was tangentially related

narrow pendant
inner elm
gloomy temple
#

HI I'm applying to internships with little luck and I was hoping I could get some input on my resume. I'm not yet at the stage where I have anything special or impressive but I'd appreciate any suggestions.

stoic cave
# gloomy temple

I'd put projects at the end under awards personally but other than that it looks good

#

Also don't limit yourself to cyber internships if that's what you're doing. I took an IT internship when I was in college

gloomy temple
#

Yeah I'm applying to IT + software eng too, casting a very wide net hoping that I get something lol

stoic cave
#

You're applying which is what matters. I didn't really start hearing back until March so just keep on applying

gloomy temple
#

gotcha

autumn otter
#

Hi, I need some more advice. Amazon is recruiting me for an IT Support Engineer Internship. Iโ€™m currently an intern for another large organization, but theyโ€™re promoting me to a Jr role and extending my contract. When is a good time to tell Amazon that to try and leverage my way into more pay + a Jr role with them? My final goal is to stay with my current company (I like them a lot) but to try and use this Amazon recruiting thing to get more pay with the promotion

stoic cave
# autumn otter Hi, I need some more advice. Amazon is recruiting me for an IT Support Engineer ...

First, did Amazon provide a signed offer. If they did, you can bring that your current company and say "Another company has extended an offer and I'm considering taking it. I would like to stay with you guys though. Is there a possibility we could renegotiate my contract to match or improve what they are offering?" I would be prepared for some pushback and outright denial to call your bluff. If that's the case, I would heavily consider departing for Amazon

flat sedge
#

I would tell them you currently have a better offer than theirs, and you'd like to work for them - but your requirements have changed

stoic cave
#

Juun will more than likely know what to say better than I

flat sedge
#

Be careful about playing these money games, its very easy to hurt yourself and the trust you have with your company. I have known managers that will cut people loose the moment they play the game

stoic cave
#

Yeah, that's an unfortunate reality

flat sedge
#

"So another company has made me an offer, and I am finding it very hard to say no because of the pay. I would love to stay here, but I can't with the offer they have made. If you can get close, I would prefer to stay"

#

But be prepared to walk out the door when you do that

autumn otter
#

No they havenโ€™t given me an offer yet, Iโ€™m about to schedule an interview. Should I try to leverage my promotion to try and have the interview be for a Jr role instead of an internship? Does the distinction matter? Or should I just try and get the offer for the internship first and then go from there?

#

And okay that makes sense, Iโ€™ll be careful. I donโ€™t want my current place to wanna boot me for that lol

stoic cave
#

I think you're getting ahead of yourself, personally

autumn otter
#

Okay, Iโ€™ll just get the offer and then go from there

#

Thank you guys

#

I appreciate the insight

ebon mica
#

Yeah. Do not rush into asking for more when just interviewing.

stoic cave
#

You don't have an offer, which means you have zero leverage and nothing to fall back on. On top of that, I don't think it would be smart to try and get more out of Amazon because their internship programs are super competitive

autumn otter
#

Really?

stoic cave
#

They'll just drop you from the pile

autumn otter
#

Damn yea then Iโ€™ll just focus on landing the internship lol

#

Yea wont even try and get more from them then

flat sedge
autumn otter
#

I mean I am, itโ€™s Amazon. My company is great and in a very profitable sector, but itโ€™s not Amazon lol

ebon mica
#

Amazon or other big tech company interview processes can be stressing.

flat sedge
#

Amzon leverages that respect you have to treat you bad

#

Look up their hiring/firing practices before going there

#

I wouldn't work for amazon or google, regardless of the prestige

stoic cave
#

They could offer me a really good 6 figure salary tomorrow and I would turn it down

ebon mica
autumn otter
#

Jeez itโ€™s that bad???

stoic cave
#

Ethics for me

flat sedge
ebon mica
#

I turned down a facebook interview request for that reason. The job would probably have been interesting.

flat sedge
#

Malicious compliance would be the very least of my efforts working for those companies, I know I wouldn't be able to help myself

stoic cave
#

Lol

autumn otter
#

Good to know. I know at like lower levels in warehouses itโ€™s complete garbo. Didnโ€™t know it was bad all over

ancient prairie
#

why in the lord's name does CyberArk have an AD auditing tool

#

jesus

stoic cave
#

You can usually judge a company by how they treat their lowest level employees

ancient prairie
#

woops wrong chat

#

we just got a dev from amazon, very nice and knowledgeable guy but def wanna hear the dirt

autumn otter
#

does Amazon pay their interns more than minimum wage?

ancient prairie
#

he talked a bit about they build everything in house which is pretty cool but also somewhat a nightmare

autumn otter
#

Cuz if they donโ€™t then no reason for me to even apply, even for leverage

#

And it sounds like theyโ€™d pay minimum, lol

flat sedge
#

Most tech internships pay above minimum wage. That shouldn't even be a part of the conversation.

autumn otter
#

Oh sweet okay

ebon mica
#

That being said: The interview process can be a good learning experience. And stressing as hell.

autumn otter
#

I do love stress

#

/s

static heron
#

every time she took me off hold she'd be taking a deep breath lol, sounded like me at the call center at the end of a shift that started with a hangover

fierce light
#

**OFF TOPIC: **fellas, is it weird to message a recruiting manager introducing yourself on LinkedIn? I think I found the Tesla Recruiting Manager on LinkedIn and I was watching a video saying it'd be good to call in a say Hi and let them know that I applied but they don't have a public phone number or anything anywhere

stoic cave
#

I wouldn't personally

#

Cold calling is a good way to get blocked even if they are in a "public" position

static heron
#

Recruiting manager = not a recruiter (anymore) = you just get passed off to one of his people and spend some time making yourself look like you might not understand the org chart (or you're going to jump the chain of command a lot)

#

If you find a recruiter and especially if they're the one who's been posting job ads in the past (I'm told you can see this on LI sometimes but I haven't yet) then it would make sense to pitch some ideas about what you can do there

static heron
warm hinge
#

guys, I'm a planner by nature....what would you say is the best environment/company to do offensive security?

#

My current job will see me dealing with compliance, risk and everything blue team so I wish my next step to be on the other side (Thinking in 1.5/2 years. Immediate next step is to do the PNPT training and take the exam)

warm hinge
languid hearth
#

in offensive security it's very much take what position is offered to you - don't say you want to work for Intel as a penetration tester

#

do say you want to work as a penetration tester

#

my big chunk of advice is you never know how mature a companies pentest/red team is, they might be just starting out, or might have been around for 10+ years. Try to find that out sooner rather than later.

warm hinge
serene umbraBOT
#

Gave +1 Rep to @languid hearth

cinder hare
#

sorry I have a question, if i finish THM pentesting path, am I ready to entry in world job?

pseudo creek
#

prob not ๐Ÿ™‚

#

but you are on your way, it really depends on a number of things

#

I would look at entry level job listings in your area, see what they are asking for and see if you meet the qualifications, if not, start working towards them

shut violet
#

Anyone have a good template for a cover letter?

stoic cave
shut violet
stoic cave
#

Not a problem. I'll see if I have any on my phone and if not I'll hop over to my computer in a bit

stoic cave
shut violet
oblique vine
#

I hate cover letters because the one I always used had to be specialized for every single place I applied to

static heron
#

Well yeah, that's really the point, it should be a curated tour through the parts of your skills and experience that are relevant to that position, and why you want to work at that company / what you can do/solve for them and what it means for your intended path or sense of purpose or whatever. It can't be the same unless you're just using to say "Hi I want a job and I think I'd be a good fit, I can solve problems, see the big picture outside the box, and function on a team please find resume attached"

#

Which I think can sound redundant since it's kind of what you do with the resume, except you get to be more verbose and qualitative about it

oblique vine
# static heron Well yeah, that's really the point, it should be a curated tour through the part...

That's true. It does give motivation to apply to only the jobs you really want though which I think is a double edged sword. My current job I didn't cater and just had a generic but wasn't really interested in the position. After going through the first interview awhile back and getting to know the company and what I would be doing it changed my perspective. I ultimately ended up spear heading the next 2 interviews and pushed to get in

jovial pond
#

i am looking for cybersecurity job...... basically penetration testing

#

can anyone help or refer

static tide
#

location/experience?

jovial pond
#

current location - India and experience - 6 months as bug bounty hunter and 7-8 months as penetraion tester at craw security , Delhi

#

can relocate

pseudo creek
#

best bet is to use LinkedIn and try to make connections there

jovial pond
#

just did, but no luck

pseudo creek
#

we don't see a lot of requests here for people in India, but you can keep an eye on the #jobs-board

jovial pond
#

no i can relocate even if its outside india

#

but thanx anyways

edgy tiger
jovial pond
#

@edgy tiger no bro

edgy tiger
#

Or you need to have a huge list of bugs you have found and wrote blog posts etc about it.

jovial pond
#

I am not even getting to a point where i can get a interview call...... Maybe i am not being shortlisted or some other issue...... Van use some helping hand

quick forum
#

I think 7-8 months as a pentester sets you up quite well to be a pentester.

#

But international hiring is often messy

jovial pond
jovial pond
edgy tiger
#

Then you should go back to the drawing board and reviewing your CV, motivation letter etc.

jovial pond
spiral creek
#

Hi

spark ore
#

hey what do you people think a good entry level cert be for penetration testing be? (im sure the most common question in this room). i was studying for my pentest+ but when looking at job offers on linked i didn't see it that much..i saw more ceh or oscp but those seem like big dog certs?

quick forum
#

OSCP is entry to the workplace.

spark ore
#

so certs that are entry into the field are just a building block to eventually lead someone to the OSCP to get the job?

quick forum
#

Also IMO avoid CEH outside India.

quick forum
spark ore
#

i understand that but if that's the bottom line..whats the point of the pentest+

quick forum
#

It checks DoD 8570 same as CEH does ยฏ_(ใƒ„)_/ยฏ

spark ore
#

and less than half the price

quick forum
#

Exactly

spark ore
#

but noone is talking about it.

#

as in, it isn't on any job openings

quick forum
#

I ain't in the US

pseudo creek
#

it is still one of the newer certs, give it time

quick forum
flat sedge
#

PT+ offiiclaly released mid-year last year, it'll take a bit of time for word of it to spread and be recognized by industry

pseudo creek
#

basically how certs get on a job listing? Team member gets cert, socializes that out, manager asks for recommendations on what should go on job listing... team member puts cert.... OR Team member gets cert, becomes manager, puts on job listing

spark ore
#

ahh

pseudo creek
#

not always but word of mouth is usually how certs get on job listings

ebon mica
spark ore
#

i also dont assume 'this one thing will get the job'

pseudo creek
#

yeah its not just one thing

spark ore
#

especially for a noob i figured other certifications more specialized in the field..burp,linux,etc

quick forum
#

Eh, I wouldn't say those are so recognised

pseudo creek
#

linux certs are mostly useless unless you are a Linux admin

#

burp isn't recognized, think that is really new? but burp knowledge is good

spark ore
#

yeah i figured it just showed interest or ability

quick forum
#

I'd argue your knowledge and skills are more important than a bit of paper saying you have those. Hopefully you'd get a change to demonstrate them.

spark ore
#

like chess club after school

pseudo creek
#

yeah but I wouldn't spend time on a Linux cert (hardly anyone does...)

#

Network+, Security+, OSCP are generally good if you are in the US if you are looking for a cert path

spark ore
#

sec+ as opposed to pentest+ ?

#

oscp seems more in the trenches, but its twice the price as some others

pseudo creek
#

if you are trying to get your foot in the door, its good, if you have time, you could do pentest+

quick forum
pseudo creek
#

what do you mean "in the trenches"? because... thats pretty basic stuff for pentesting

quick forum
spark ore
#

thats what i mean..more hands on work

pseudo creek
#

and well recognized, its costly but good idea is to get security+, get a cyber job, try to get an employer to pay for OSCP

quick forum
#

Sinking $1200 now, is that going to get you an ROI?

pseudo creek
#

pentesting is hands on though

spark ore
#

yes i'm agreeing with you. it seems more apt at testing your ability than the others

quick forum
# pseudo creek pentesting is hands on though

There is some risk related stuff there, but largely that'll be left to the client.
Understanding business risk and security from a slightly more formal rather than practical perspective is useful IMo

spark ore
#

cisa is having free ics training if anyone is interested in industrial controls

quick forum
latent kettle
#

Hello guys, i have some problem with the factor of CEH and OSCP ๐Ÿ˜ฆ

pseudo creek
#

@latent kettle you could read up this conversation we just had or TLDR; CEH for India, OSCP for everywhere else

#

unless you have a specific question

spark ore
#

speak of the devil and he shall appear

pseudo creek
#

its an OSCP/CEH morning apparently

quick forum
pseudo creek
#

do you think it'd be read? I looked at the pins and didn't see anything but yes, a FAQ say "read this"

latent kettle
spark ore
#

or a mandatory straight up noob rooms with questions about all that

pseudo creek
#

its all fine here but yeah we should / can put together a quick FAQ on it

#

Cyber/IT certs and applicability -
CEH - Cert highly recognized and valued in India, not useful elsewhere. Not good for learning.

OSCP - Cert highly recognized, useful for entry level pentester positions in multiple countries including US, UK, Europe and others. Good for learning.

PNPT - Not highly recognized but those that are aware of it would recognize the value. May not help pass HR filters. Good for learning.

CRTO - One of the few certs to cover "Red Team" vs Penetration Testing and those that take it, have spoken highly of it as a learning resource. May not help pass HR filters.

Pentest+ - Not highly recognized, yet but Comptia is a well recognized company. In the US, meets the DoD 8570 requirement so can be useful working for companies that perform work on behalf of the US government. Possibly useful in passing HR filter in the future.

eJPT - Not highly recognized but good for learning the basics needed for pentesting. Useful for showing interest on resume but may not help pass HR filters.

eCCPT - Not highly recognized but those that are aware of it would the value. Good for learning. May not help pass HR filters.

Security+ - Cert highly recognized, useful for entry level cyber security positions

Network+ - Cert highly recognized, useful for entry level network administrator positions

CCNA - Cert highly recognized, useful for entry level network administrator positions. More valuable than Network+ in many countries.

CISSP - Cert highly recognized, requires years of Cyber experience, useful for mid level positions in the United States, useful for managerial positions elsewhere

pseudo creek
#

might have to make into a blog article or something at some point

quick forum
#

I'd add a line on at the end saying that certs don't only have HR value. Something like PNPT is good for the knowledge. Same with CRTO

pseudo creek
#

ahh

latent kettle
serene umbraBOT
#

Gave +1 Rep to @pseudo creek

spark ore
pseudo creek
#

lots of people download the syllabus and go topic by topic

forest knoll
#

Yeah I do that and I work full time + more

#

Means when u come to going through the PDF you're a lot more clued up and you'll have more time in their labs.

quick forum
#

Also IIRC their Kali course is free? (but the exam isn't)
The first section of the PDF aligns quite closely with the Kali course

pseudo creek
#

yeah their kali course is free but I couldn't find it last time I looked

#

they seem to have hid the link once it became part of learn1/unlimited

quick forum
pseudo creek
spark ore
#

wow that's a great resource!

spark ore
#

ahh but i assume the KLR cert does nothing either haha

quick forum
#

Just the learning

robust frigate
#

Education is always good.

spark ore
#

i agree

#

that's why i was gonna take the linux course from linux..just to get better at linux commands

#

i'm trying to get the grep king

robust frigate
spark ore
#

bookmarking as we speak

quick forum
#

I use regexr for testing

robust frigate
#

Oh, I like that interface more. I'll have to play around with it.

mint hound
#

Can anyone lend me some advice I'm trying to get a remote role more in security or honestly anything outside of help desk. I have the CCNA, A+, Net+ Any advice on what roles or skills I should learn or roles I should apply for?

static tide
#

maybe try as a network admin/engineer

pseudo creek
#

also SOC analyst, but network admin/engineer would be solid

#

and always check with job listings to see what they are asking for or just go to a job site and search for jobs listing CCNA and see what pops up

#

Cyber/IT certs (continued) and other related topics
Anything SANS - SANS is expensive but if you can get your employer to pay for it, go for it. If your employer offers tuition assistance, SANS also has an undergraduate degree, undergraduate certificate, graduate degree and graduate certificate. SANS certs are thought of highly and the courses are overall really good.

Cloud Certs - A number of useful certs can show interest and knowledge in cloud. Azure Fundamentals (Az-900) and AWS Cloud practitioner are good, quick exams to get your feet wet. AWS Solution Architect Associate and Azure Administrator (Az-104) take more time but are useful for jobs that require more cloud knowledge. Overall, cloud is good to learn.

Linux certs - Generic because there are a few including Red Hat. Useful primarily for Linux admins. Mostly a waste of time for those with focus on jobs in Cyber security. Good to learn Linux, not necessary to get cert.

Master degrees - Master degrees are generally used to advance in an already career and are a poor way to break into Cyber. They can also sometimes provide a disadvantage. If you are having trouble getting an entry level job and have a Masters, take the Masters off your resume. In the US, Master degrees are mostly similar across the board (except for SANS and maybe a few others) and are Cyber management focused.

pseudo creek
warm hinge
#

zojja what a great list! Thanks for the info.

Do you guys know of any masters for cyber sec focused on the technical aspect? So far I've got:

-Tal Tech (You can choose operations or crypto focus instead of management/risk)
-Ben-Gurion
-ITMO
-University of Helsinki
-Carnegie Mellon
-USNA (Only US nationals and looks to have some cool stuff)

warm hinge
# mint hound Can anyone lend me some advice I'm trying to get a remote role more in security ...

Start looking for Cloud Analyst/Engineering JR positions. The companies looking to fill in these positions should already be working remote.
If you already have the networking experience and CCNA knowledge, getting into cloud networking should be trivial for you.
You could start off by doing Cantrill's SAA course to get a good grasp on how cloud works. If you complete it 100% and do all labs, you should already have a good AWS security base (Given that many topics seen in the AWS sec specialization are taught in his SAA course)

pseudo creek
#

but with SANS you also get technical certs

warm hinge
#

looks like a good deal

novel cobalt
#

Emphasis*

pseudo creek
novel cobalt
#

I did the info systems route because my undergrad wasnโ€™t comp sci.

pseudo creek
#

I mean looking at the courses I see a lot "discussion about..."

novel cobalt
#

But there were a lot of labs

#

Iโ€™m not sure what you mean by technical

#

The only business class I took was project management. Which I did not like lol

pseudo creek
#

technical meaning lots of hands on stuff, projects, vs writing papers

#

like if you look at the CMU degree, you'll see the courses mention lab work, hands on

novel cobalt
#

Yeah not many papers and no thesis

pseudo creek
#

so what type of projects did you have?

novel cobalt
#

We had labs almost weekly (hands on) in most classes

pseudo creek
#

what were you graded on though?

novel cobalt
#

Graded on successful execution of lab, discussion posts and sometimes quizzes and finals

pseudo creek
#

like my MS in Cyber Security was a 'non-technical' masters, mostly managerial, we had labs but they were to explore various topics, Cryptography was really our only true technical, technical class

novel cobalt
#

What is your undergrad in?

pseudo creek
#

Comp Sci

#

I'd expect technical projects as part of a more technical masters,

novel cobalt
#

What are your concerns?

pseudo creek
#

none, just that in the US, lots of the cyber degrees are more focused on those going into management, think 4d4143 is trying to collect the more technical masters programs, which are rarer

#

partly because the NSA partnered with a lot of universities to design Cyber Masters in the US and they went for more of a managerial slant and even those universities not partnered with them, went the same way... it basically makes a Cyber Masters good for those that want to get into management, not so good for those that are entry level

novel cobalt
#

Management usually touches on everything in cyber security anyways.

#

Thatโ€™s not true..

pseudo creek
#

but it is

novel cobalt
#

You can def get into entry level with masters

pseudo creek
#

In the US, it can be very, very difficult without experience

#

I used to work with a lot of entry level cyber folks, basically we had them take their Masters off their resumes and they started getting interviews and jobs

#

I mean if you did, kudos, but that doesn't seem to be the overall experience

novel cobalt
#

Thereโ€™s a difference in masters of art and science as well

#

I feel like you are over generalizing. Sounds like the masters you got wasnโ€™t helpful.

pseudo creek
#

and there is the overall discussion of whether a masters as all is worth it.. technology is changing quickly and generally degree programs are teaching classes built 5 years ago... sometimes certs in various technologies do better than a masters

novel cobalt
#

Masters is higher tier than bachelors

pseudo creek
#

nah my masters was fine, but I got my masters after I was already in cyber and I have 0 plans to go into management

novel cobalt
#

I donโ€™t understand your logic tbh

pseudo creek
#

I'm talking about MS in Cyber...

#

but I really didn't know better overall at the time, it was many years ago

novel cobalt
#

I wouldnโ€™t think a bachelors in comp sci is the same as bachelors in cyber either

fading edge
#

Hey guys, Im starting school on Monday for Cyber Security. Ive been thinking for about two years now about making this move, and im really excited to start. My ideal job is to eventually manage a team, making sure goals and deadlines are met, while taking care of the paperwork and upper management. Is there a specific job title for this?

I have a natural sense of leadership, and im very good at communicating.

pseudo creek
pseudo creek
#

there are also things like Manager, Senior manager (manager of many managers), Director (has multiple Senior managers under them), CISO (has multiple directors under them)

fading edge
#

Definitely Cyber Security Manager.

I think im asking the question, knowing the answer, hoping to find a gem of information that im not aware of.

#

Will look further into the other roles though! Thanks

pseudo creek
#

remember, Cyber is huge, you can be a manager of various areas, if you want to go into management, you might want to look at Governance, Risk and Compliance (GRC for short), look at certs like CISA

#

but if you decide you like application security for example... you could be a Cyber security manager for a group that does application security

fading edge
#

That was my next question, about pathways and things I need to focus on while im in school.

#

You are awesome.

pseudo creek
#

good luck

stable walrus
#

I have a question if my goal is to become a Sys-Admin will anything on THM help with that? If so what pathways will help or is there anything like THM that will help with that?

stoic cave
#

THM does have some "Blue Team" Content. You're more than likely going to need to use other resources though as well as learning on the job @stable walrus

stable walrus
stoic cave
#

Getting Systems Administration experience starts with getting a job on a help desk

#

and working your way up

#

Homelabs are another way of self-learning but dont count as professional experience

#

If you're in college, see what clubs may be available as well

stable walrus
serene umbraBOT
#

Gave +1 Rep to @stoic cave

stoic cave
#

not a problem

#

if there isnt a club, see if you can start it yourself

#

Talk to an advisor to sponsor and also IT to see if they would mind shadows and students learning from them

#

Most of the IT at my University was student led

teal lion
#
  1. Is this a weird thing to request
  2. Normally they send an automatic reply within a minute but I haven't received one and it's been over 15 minutes, is it safe to assume they didn't receive it and I should resend at a later time?
Screenshot_20220109-014817_Gmail.jpg
stoic cave
#

I wouldn't send them multiple emails rapidly

#

comes off as not having everything together I feel

teal lion
#

I'll wait a few days then

#

Problem is they said they'd invite for an on-site assessment, and I'd rather have it changed before then

#

Not sure when I'd get the invite tho

static heron
#

I'd give people 24 hours minimum to respond to a non-emergency mail (so like all of it I guess lol), if you're replying to an existing thread maybe that's why? Or maybe it sends the canned reply when they acknowledge it in whatever kind of overwrought candidate management system they're using these days ๐Ÿ˜›

#

If you have anyone's [anyone appropriate/relevant/involved] number or direct email I don't think it would be unreasonable to follow up in a day if there's not a lot of time, but if you can wait 2-3 that sounds fine to me for sure

rose quartz
#

@teal lion I hope you don't mind but, I wouldn't send that email at all, IMO. You don't want to be seen as having 'lack of forethought' or however it might come across.

stable walrus
#

Also if I have zero experience but have certs such as (CCNA,NET+,A...etc) should I just start with helpdesk

smoky slate
#

helpdesk is for people like me who skipped school and certs to get a foot in the door and work their way up

#

you should be good to go for whatever you want

static heron
#

@teal lion wait tho is this directly with an employer or are you talking to a gov. employed advisor for the apprenticeship thing? I'm not very familiar with it but unless you've been talking about this most people are probably assuming you're talking to HR at a private employer

#

"Founded <university> LUG" is an item I'd jump at the chance to take for my resume lol

modern hawk
#

still looking to get some new certs and move after a year here

smoky slate
#

I don't even know if I want a job in security lol

#

McSkidy went through hell this xmas

modern hawk
#

log4j had my team in cahoots

teal lion
teal lion
stable walrus
serene umbraBOT
#

Gave +1 Rep to @smoky slate

iron forge
#

Iโ€™m looking for a Junior Cybersecurity Analyst position in DMV on-site or remote. I have less than 1 year experience using SIEM solutions and EDR tools e.g IBM Qradar, Crowdstrike, Proofpoint, SentinelOne, Splunk ES, Tenable io. Jira and Resilient ticketing as well. Iโ€™m CompTIA Security+ Certified. I will be happy if a recruiter will give me a shot. Iโ€™m open to learn as well. Thank you all

stable walrus
#

just wondering but what position are you currently at Flex

frozen halo
#

Hey guys im looking at a position as a Junior pentester at a uk firm, they mention demonstrating the ability to obtain SC (security clearance) or higher. I'm a bit worried about this since i have a history of mental health difficulties. Does anyone have any experience with this sort of thing?

quick forum
quick forum
#

You're quite unlikely to even get interviewed

frozen halo
#

oh nice!

#

thanks a lot man

native elm
frozen halo
#

good to hear thanks man ๐Ÿ™‚

warm hinge
# stable walrus Do you know of anything else besides THM for this purpose?

Everything Alces said are excellent points. You should also consider trying to specialize from the go in one OS. There are jobs out there demanding knowledge of only everything Microsoft while others want you to focus on Linux (RedHat, SUSE, Ubuntu, etc.). In my personal experience, playing and learning Linux is far easier. For some reason it's more friendly to learn and experiment with (For me)

stable walrus
serene umbraBOT
#

Gave +1 Rep to @twilit arrow

undone shore
ripe basalt
#

This probably a very loaded question. But I'm not sure if I'm interested in Networking or Security. Anywhere I can look that goes into this? The different roles in security and networking? I know the two intermingle a lot

worn spire
#

There are lots of specific roles for firewall security, AWS Security, Azure security. Networking is becoming more and more cloud centric.
You can even look for IT network engineer or security network engineer positions sometimes have that mix of skills.

sharp rain
#

Ok so I'm in high school and I wanted to get a pentesting job without going to college. I'm on tryhackme and is there a way I could add online certifications and courses to my resume and get the same job as someone with CEH?

#

Because if I completed tryhackme and hackthebox plus I did python would employers be willing to give me a try?

stoic cave
# sharp rain Ok so I'm in high school and I wanted to get a pentesting job without going to c...

Not to burst your bubble, but Pentesting is not an entry level position. It's a very niche occupation within the Cyber Security field which itself is also not an entry level area typically. With a degree you may be able to break into Cyber off the bat but it's not guaranteed. Furthermore, I'm not sure what you're asking about the THM on the resume but in this case I'm going to assume that you're asking if you can put it on the resume as experience. In short, no. To expand, THM and other cites like it are extracurricular activities to expand your knowledge. They do not qualify as professional experience and with that should be put in an Extracurricular category or a projects category on the resume. Things like CEH, Security+, OSCP, would go into a Certifications category as industry vendors can verify that you are knowledgeable on the material as you have taken a proctored exam.

#

All of the above being said, it does not mean there is no path to pentesting. It may just take a little longer. There are a number of paths where you could start out and get base experience and work your way up the ladder so to say. Helpdesk, Junior Administrator, Telco, etc

sacred canopy
#

Yeah, I was applying for a Junior pentesting position and they are mainly interested in certs and whether you've done stuff like HackTheBox or TryHackMe in your spare time. Stuff to prove you have an interest or knowledge of pentesting. A degree gets you noticed, but you'll need more to through the door.

sharp rain
#

So like I should also get CEH but could I put THM and stuff on my resume as extra or something?

#

Also is THM good for learning bug bounty?

stoic cave
sharp rain
#

America

stoic cave
#

Outside of India, CEH isn't exactly wanted except to check boxes

#

So you'd be better off with OSCP

sacred canopy
#

I know in the UK they are interested in CHECK and CREST

stoic cave
#

Yeah i updated it

inner elm
# sharp rain America

hit up the website, go to the search bar, type bug bounty and you'll see NahamStore, a medium room labeled with the basics of bug bounty hunting and web application hacking

unknown.png
sacred canopy
#

This current associate's thing I've applied for asked me to do a bunch of tasks on their pre-configured system and to produce a writeup

#

I think once you get the hang of pentesting, It wouldn't hurt to make your own writeups, detailing how found the vulnerabilities and how you would go about fixing them on like a public blog

#

Shows you can apply the skills you've learnt and that you can document the process, which is a big part of any testing

undone shore
#

Yeaaaaaah, considering CEH is a literal meme, avoid it unless HR insist in your area

#

Then work from within to change that policy, because by all accounts it is utter crap

sharp rain
#

Some companies want you to have CEH tho

#

Like DoD

#

Although I'm not sure what other companies require

#

OSCP?

undone shore
# sharp rain Some companies want you to have CEH tho

Exactly. Get it if HR insist, but from a learning perspective it's crap. Effectively a case of: read the material, pass the exam, get the bit of paper, then promptly forget it all because it's mostly outdated or incorrect anyway ๐Ÿคทโ€โ™‚๏ธ

#

OSCP is much more widely recognised anywhere that isn't US Government or India. It also has the advantage of actually being useful for learning at an entry level.

sharp rain
#

Exactly. Right now I got a few years till I'm 18 and on my own so right now I'm focusing on actually learning stuff rather then getting a certifications

#

Like I wanna try bug bounties and get paid in Bitcoin

undone shore
#

Evaluate what you need from the cert. If you already have the information and jobs in your area need a certain cert, go for that cert. If you just want to learn, prioritise the useful certs

#

Oh Lord

sharp rain
#

And learn python

#

High level programming languages are fun but I feel like they don't let you interact with the machine

#

But u spoke with a bunch of hacker guys at this event and they all said to learn python because companies love to see that

#

Since you can code shocker scripts in python

undone shore
#

Scripting is more useful for most simple pentesting things than programming is, so, yes

#

I still jump to Python for most quick scripts ๐Ÿคทโ€โ™‚๏ธ

sharp rain
#

Yeah

flat sedge
sharp rain
#

I like pythons capibilities for wifi and socket programming

#

Yeah ik

#

Arduino

undone shore
#

Good for GPIO programming on embedded devices too for that matter

#

Yeah, and microcontrollers

sharp rain
#

Although I just learned about bug bounties so I want to learn JavaScript since most bounties are wep applications I think

flat sedge
#

IMO mBed is more popular than python for MCUs, but academia and learning is a very different world than 'real' mechatronics engineering

sharp rain
#

Web

undone shore
#

Web and mobile, generally, aye

#

academia and learning is a very different world than 'real' mechatronics engineering
True that ๐Ÿ˜ฆ

sharp rain
#

I don't know any java tho so I'm not any good in Android applications

#

I know python and I've had experience with the C programming language

#

As well as html

undone shore
#

Don't get caught up on the languages you know -- they're all just a means to an end anyway

#

The important thing is programmatical thought constructs -- the ability to follow a flow of logic and "think like a computer"

#

Once you have that, languages are just syntax

sharp rain
#

Exactly!!! I found it very alarming how similar different languages were other then syntax

#

Like c and python both have the same socket functions and stuff

undone shore
#

I mean, the concept of a socket is the same regardless of language -- it's a construct in its own right, just with different implementations in different languages

#

Different things to connect to as well, for that matter -- they don't just do the TCP/IP stack

sharp rain
#

Yeah

#

I like learning python but it's hard to find python tutorials specifically for hacking

#

Like I get you can learn regular python but it's harder for me to learn the math stuff

undone shore
#

Because why would they exist?

#

What is "hacking" anyway?

sharp rain
#

Well there is black hat python

#

And people write python scripts all the time for hacking

undone shore
#

Programming languages exist to solve problems. When you understand the language you can apply it to problems to find solutions -- including for hacking

sharp rain
#

Yeah but idk for me python is becoming really hard

#

Like complex arrays and stuff

#

And I'm bad at math so

undone shore
#

i.e. don't get caught up on "hacking". It's not some mythical thing to strive for.
"Hacking" is just the curiosity mindset. The thought process of: "Oh, this looks fun, what happens if I do this...". Poking things to see how they react.

sharp rain
#

I love playing with conouters

#

Computers

#

I think that's why I got into hacking

#

Just making computers do things they aren't supposed ti

#

To

undone shore
#

Focus on foundations. Focus on understanding how tech works. Focus on figuring out how things fit together. Then see about getting it to break.
A hacker is just a master of all trades ๐Ÿคทโ€โ™‚๏ธ

undone shore
sharp rain
#

Do you think I should learn hacking directly like tutorials and courses or go for programming and learning machines first

undone shore
#

Go for what interests you ๐Ÿคทโ€โ™‚๏ธ
A lot of people jump straight to exploiting stuff (i.e. "hacking" courses and tutorials) but without the foundations they'll never be as strong as they otherwise could be. Hence why things like the THM Pre-Security pathway exist.

sharp rain
#

Yeah I went to tryhackme but took the cyber course first

#

It's good stuff

#

And I need to learn networking better

#

Although I learned that s lit

#

TCP/IP OSI etc etc

#

I just dream of doing and learning stuff and getting my dream job without a long time in college

#

I just got excited

#

To learn fast

undone shore
#

Put it this way though. My first year of university (on a degree that is literally a BSc (Hons) Ethical hacking degree) was two C++ programming modules, a computer architecture module, an introduction to security concepts (non technically) module, an introductory networking module, and one elective

sharp rain
#

C++ ?

#

Hmmm

undone shore
#

Note that, despite the degree emphasis on offensive security, all of that is foundational stuff -- the kind of thing you'd see on a general computer science degree

#

It's important, and pays dividends to know

sharp rain
#

I guess they wanted you to learn low level languages first

#

Well I gtg for tonight I'll see you guys tomorrow

#

Also I got a raapberri pi

#

Model 4

#

Raspberry

undone shore
undone shore
#

Networking does mean a lot in this industry, that's for sure

#

kekw You're telling me -- I've got a fricken' conference to organise around it

#

Stick around communities like this and meet people. Hackers thrive online -- it's genuinely one of the best ways to meet people, especially during COVID

#

Everyone here is here because they're passionate about it, and there are plenty of recruiters / high-fliers to boot

#

Infosec Prep is a good one.
Offsec seems to developing into a really well-rounded infosec base now as well, although it is largely run by the same Infosec Prep folks
John Hammond's community is always lovely.

#

Laptop Hacking Coffee is another of the traditional ones, but I've not spent much time there personally.

#

The Many Hats Club is dead now unfortunately, or that would have been good as well

#

Np ๐Ÿ™‚

sharp rain
#

Well I just popped back on for a sec but in order to learn networking I recommend you start at the physical level

#

Look at it router and understand how your computer and devices are connected

#

To the internet

#

And then go from there

#

Learn the OSI model

#

And methods of device communication like TCP/IP

#

And learn about packet

#

Packets

#

So you know how data is sent

#

The science elf made great videos on the internet and networking

undone shore
#

The social kind of networking

#

i.e. meeting new people. Building contacts

forest adder
#

hi

#

gm

native elm
#

No offense, but what if you are just bad at interviews?

#

It's really not. Networking just helps.

inner elm
#

I don't know you from Adam, but one possibility is that you might need to develop your soft skills.

Screenshot_20220109-161414_LinkedIn.png
sharp rain
#

Wow

#

Is assembly language good to learn?

#

Because I heard people code Trojans with assembly language and it's really good for that stuff

quick forum
meager notch
#

Is there any point in getting AWS if I have zero experience?

oblique vine
#

AWS account or one of the AWS certs?

meager notch
#

One of the certs

#

AWS Certified Cloud Practitioner
AWS Certified Developer Associate
AWS Certified Solutions Architect - Associate

oblique vine
#

Look at job postings you plan to apply to and see if they require any?
I'd also recommend making an aws account as a playground. You get a bunch of services free for 12 months but be careful when adding services. Some add ons will not be free.
I initially learned by just creating a free account and playing around.

meager notch
#

Ok thanks

winged tapir
#

What are some remote roles to apply for with the Net+ A+ CCNA? I've been applying to random things but haven't really gotten anywhere

edgy tiger
distant pier
fierce light
#

does anyone have any knowledge of what this little additional information means? are they saying, based on how hard you will work will determine how much you get paid

unknown.png
warm hinge
oblique vine
#

Sounds like it's just a "pay per customer" model instead of a straight salary or per hour.
To me it sounds like you would get paid $22/hour during your training period then after you're training period you may get a low flat rate + $x/customer you work with or just a straight $y/customer?

native elm
#

I read it as it will be based on your ratings from the customer.

warm hinge
#

And here we have why you should def ask the recruiter/HR guy for extra clarification

oblique vine
#

Think of a waitress. Some make only $2/hour and then could potentially make another $10/hour off of tips

warm hinge
#

+1$ an hour for bilingual Spanish lmao

oblique vine
#

lol I seen that.. oof xD

fierce light
#

wow yeah i haven't applied yet, that 22 looks good but that's insane how they won't even put how much you'd make after training lmaooo

#

thank you guys for the input ๐Ÿ™‚

warm hinge
#

in case you go ahead, always ask to get everything in the job offer before you sign

oblique vine
#

You will definitely want to clarify the pay after training. If you get a base salary + per customer compensation or no base salary at all. Meaning if you didn't work with any customers you wouldn't have a paycheck

warm hinge
#

don't ever think for a second you are being "dense" or bothersome if you ask every single thing of a job to be clearly spelled out

fierce light
fierce light
oblique vine
#

To me, the job environment is more important that the pay/how get paid but you definitely want to get clarification to make sure you'll be comfortable with it as well.

#

For example this job I started last month salary is about $15k less per year than another offer I got but it's a local government job with better benefits and I get my own office with 40 employees total versus thousands all being crammed in cubicles ๐Ÿคฃ

fierce light
flat sedge
fierce light
#

those ones i don't hesitate on applying for because I just know they'd treat you well

fierce light
#

I got an interview for a cannabis company this Wednesday , definitely going to make up a word document full of questions i'd be interested about, mainly benefits and just average day to day tasks about being in help desk there and what programs i'd be working with the most

oblique vine
#

Local family owned company ๐Ÿ˜‰ I started dec 20 and got a sign-on/christmas bonus on my first week xD Extra week paycheck. Ton of cookies to take home, bottle of wine for new years and he takes groups of people out for lunch and just relax a couple times a week. Much better work environment than someone standing over my shoulder criticizing why I'm not donig the same work as the guy besides me that has 10+ more years experience than I do ๐Ÿคฃ

#

I'm happy with my not $100k/year job over cubicles ๐Ÿ˜‚

fierce light
oblique vine
#

I'm not in the cyber career path yet. Something I'm working towards. I have an Associate in Software Development (currently working on finishing up my Associate in Cyber Security), 2 years work experience as a Windows Application Developer with some full stack web stuff. Work is paying for my cybsec schooling and various certifications as I was brought on as an Application developer to be moved into a more jr. cyber security analyst position later this year.

#

I'm not saying exactly how much I current make as an Application Developer but it's somewhere between $60k-80k plus work incentive bonuses + profit sharing

fierce light
#

holy shit yeah you do got some ambition for developing for sure, i tried to develop some websites using 3D models for about a year or two and it was extremely stressful ๐Ÿ˜… but i do see that if someone were to put in more drive towards it it can be second nature; i just think that web development and even just freelancing just wasn't for me and i'd just like something a little bit more strict? cybersec just seems amazing and i just believe now it's just something anyone in this day and age should just learn, even for just a little bit!!

oblique vine
#

To note, I am making about $10k more than the original job offer because I was able to bring up personal projects or stuff I've done for friends (websites, servers I host at home and through AWS) to negotiate a higher pay rate

#

I also hold a few optional certifications with c#, javascript, html, aws, etc to bump the salary as well

fierce light
#

yeah i need some more experience in the field, hopefully i can take this job on wednesday and just hold that down for a year while i get my a+ and learn more about pentesting

oblique vine
#

Yup, agreed. The first job I took in the field I hated but it was experience. I don't suggest doing the same though. Try to get that first bit of experience where you'll be happy or you'll eventually be miserable and change your views on the field itself

#

My first job was an IT technical analyst where the job description was completely different than what I actually did everyday xD I was basically a glorified help desk tech. I ended up leaving for somewhere else because they were forcing me to get the A+ certification out of my own pocket. (I had 0 intentions of getting my A+ lol I passed it up my first time in college)

fierce light
#

i'm going in the industry with little to no real experience on me, i mean i've been working with computer since i was 7, i went to a high school where they thought me engineer and computer science all 4 years, passed the AP comp science exam, did a bunch of stuff, graduated in 2019, didn't really want to go to college, mom died, covid happened, yada yada yada, eventually i thought that i'd be better off going into life RAW, it's a little intimidating not gonna lie but it's communities like this that help me push through so I can be a better person each day, i am 21 so it's going to be a hell of a journey for sure

oblique vine
#

Exactly, it gave me a good foundational knowledge going into the industry with some insight on things like AD, AWS, linux env, etc.
The moral of the story is be picky but not to picky about that first job. Be happy with what you do and enjoy what you do. I've always looked at a job and thought "hmm will it feel like work if I'll be doing this or that for 8 hours per day?"

#

Also pluralsight has been my life line since I graduated college the first time! Some topics it may not have the best amount of resources but overall I spend probably 8 hrs/week on pluralsight learning something new or learning how to change something I'm already doing to make it better

#

Unfortunately it's a paid service but the handful of jobs I've had were all willing to pay for the subscription for me

sharp rain
#

Is it hard to become a junior pentester?

#

Because I was thinking if I got junior pentester and earned reasonable pay like $70k per year I could then become a full pentester with the previous experience I had

fierce light
# oblique vine Exactly, it gave me a good foundational knowledge going into the industry with s...

yeah! surprisingly a lot of companies didn't reply back to me when I applied for them but oddly enough I chuckled about this Cannabis company I applied for LOL, it's definitely something I'd be happy going into work everyday about! pluralsight looks like an amazing tool! i'll definitely look into this, do you know if they have any courses that would help with A+ certs? I'm doing the subscription of THM obviously but I am curious if this tool can expand me where I want to go!

#

also sorry for the late replies, currently working from home LOL

#

eventually i'll meet a company/agency that will pay for all my cert stuff or at least reimburse me with it! i'm okay with out of pocket pay for now!!

oblique vine
#

All good, same lol
Definitely ask any questions you have during the interview process. An interview isn't just for the company to see if you're a good fit, it's also for you to see if the company is a good fit.

fierce light
sharp rain
#

Wait if I pay for the tryhackme subscription would that help me get a job in the future? Like if I got the tryhackme pentesting certifications could I apply for jobs on the tryhackme jobs section?

fierce light
#

some would possibly say that the 70k-100k per year trades off very nicely. it depends on person to person, but i think it trades of nice

sharp rain
#

Because they have well paying cyber careers there

#

Like $80k a year

fierce light
#

i think cyber seek is good

sharp rain
#

Ceh

fierce light
sharp rain
#

Pentest+

#

OSCP

#

I k

fierce light
sharp rain
#

Yeah ik good average salary

#

And rn I'm looking at bounty hunting for bugs

#

Bug bounties

fierce light
sharp rain
#

Bug bounties are kinda like thay

#

That

#

Fund a bug report it get money

#

It's like mining gold you don't know if you will get lucky and find a lot of it

#

And also maybe I can get paid in Bitcoin

oblique vine
#

Someone in here told me once the certification path will depend on where you live as well. The best way to find out what employers are looking for in your area is look up the job descriptions of where you want to work. I seen someone mentioned CEH cert but was advised in my area it's not really worth it etc

#

I haven't really looked up jobs for this so I don't really have input xD
I'm going to be moving from within my company to a cybsec position so work is approving/paying for the certifications that they want me to have

meager notch
#

Any other thing else like THM that would prepare me for something like a Jr Sys admin role/ Sys Admin?

pseudo creek
#

Linux or Windows?

sharp rain
#

are there any free certifications I can get that might help me on a resume

pseudo creek
#

az-900

sharp rain
#

other then thins like CEH or pentest bcs they cost a lot of money

#

and I will have to g et those later

#

az900?

pseudo creek
#

azure cloud fundamentals

#

not sure if you have to attend a free webinar to get a voucher, but they hand out free vouchers like candy

meager notch
sharp rain
#

well for hakcing use kali

#

kali linux

pseudo creek
sharp rain
#

and for cyber I say use red hat

#

it has a lot of admin capabilities

meager notch
serene umbraBOT
#

Gave +1 Rep to @pseudo creek

pseudo creek
#

For Linux, there are a few different options for learning, THM has some, Acloud guru has quite a bit, Pluralsight also has stuff for Windows but not sure if they have stuff related to the new Microsoft certificate yet

meager notch
#

I know its better to know both though

pseudo creek
#

Sysadmin for Linux = most likely Redhat

meager notch
#

I didn't know it was redhat

#

thanks

pseudo creek
#

Redhat is a corporate offering and used in many environments

#

generally a company looking for a sys admin will be looking for either Linux or Windows, if you know both, that'd be awesome

meager notch
#

Would you say either one takes years to fully know

pseudo creek
#

you can learn the basics of either in a few months, enough for a jr sys admin

#

and if you get a related cert... all the better

meager notch
#

Thanks a lot

sharp rain
#

are google career certificates good

#

Im looking for something I can take in 3-12 months and doesnt cost a human kidney to get. Plus google career certificates are well looked at

pseudo creek
#

I've not heard anything good about google career certificates, maybe google values them

#

A+, Network+, Security+ are pretty inexpensive I think and are valued

sharp rain
#

this coursera course

#

is python development

#

and it is made and offered by the university of michigan

#

could I use a course like that?

pseudo creek
#

having python on your resume is good, but better is to have a portfolio with python coding vs a course

sharp rain
#

So basically a bunch of courses to make a portfolio?

meager notch
#

Use what you learn from the courses to create your own projects then put it on your portfolio/resume

sharp rain
#

I do write projects in github

#

Would a project like that be good or is it too simple?

#

I coded it as my first python hacking project as I code entirely in python

pseudo creek
#

if you are trying to avoid certs, then a portfolio is a good way

#

sure any projects, writeups are also good

sharp rain
#

Yea

#

But I'd it ok if I don't know all the python commands?

#

Like a lot of times I'll have to look up a tutorial or something to see what to do

#

But I understand the purpose of what I'm writing

#

I just have trouble remembering certain python syntax and stuff

#

Is*

meager notch
#

I feel like you're over thinking this

merry matrix
#

Itโ€™s about knowing whatโ€™s available for you to use, and using those things appropriately

pseudo creek
#

anytime I take a break from python for more than a month, I'm looking up commands

sharp rain
#

So like it's fine if I look up a tutorial on his to write a port scanner or something bcs the ppl in those videos look like zombies writing it from memory

pseudo creek
#

sure

#

but it'd probably be more like looking up components

sharp rain
#

Yea u do that

#

Like I know many commands

#

But I watch the tutorials to see specific parts

#

Like I want to build a MITM attack project but I need to see videos in how to build parts of the script

#

Also what's the bug deal about frameworks?

#

Can't you just make a normal attack script in python

#

Like why does metasploit build a framework

#

Instead of a normal ruby script

quick forum
sharp rain
#

Yes

quick forum
#

It's all consistent, and it does a lot more than just exploits

sharp rain
#

I'm a hacker but I'm learning python since a bunch of fellow hackers told me to learn it

#

Since it would get me a much higher chance of getting a job

#

But can't you program a python script to send exploits?

pseudo creek
#

sure

#

and you'll find some exploits on exploitdb in python

sharp rain
#

What would you say is the best place to learn python skills for building hakcing scripts

#

I heard the book black hat python was good

pseudo creek
#

it is good

sharp rain
#

Yea but I can't find too many tutorials for things like that

warm hinge
#

any sales engineers in here ?

stoic cave
meager notch
#

I'm lost on where to take my career. I want to have a remote role with good pay. I have the CCNA, A+, Net, Sec+ and I think a few other certs from school. But I'm at Help-desk. Should I look into Cloud Computing? That seems interesting and I'm really interested in Infosec obviously.

pseudo creek
#

We need security people desperately

meager notch
pseudo creek
#

Started working in cloud computing by studying AWS and applied for a job

sharp rain
#

is i smart to learn cloud hacking since the cloud is expanding?

stable walrus
#

I would imagine

merry jacinth
#

Is it possible to get a degree in cybersecurity or are they only certifications

sharp phoenix
#

I am going for my BS in Cybersecurity and Information Assurance right now

#

I think they have quite a few degrees in cybersecurity nowadays

merry jacinth
#

Thank you

sharp phoenix
#

๐Ÿ‘

sharp rain
#

its interesting NSA doesnt require a cybersecurity degree

#

only the CEH exam I think

sharp rain
#

I started bug bounties for the first time on bugcrows.com is this a good starting place or should I start somewhere else?

pseudo creek
#

Bug bounty doesnโ€™t count as experience but itโ€™d be a extracurricular activity

#

Just donโ€™t sacrifice time you could be learning with doing bug bounties

sharp rain
#

what do you think is a good path for someone like me to get more into hacking

#

bcs Ive gone trhough the beginner stages

#

and Im kinda in beginning intermediate

#

like I can hack windows 7 computers and so computer scans

#

but what would be a good path to get a job

warm hinge
#

How r u hacking windows 7?

sharp rain
#

I used eternalblue

#

exploit

#

on a vm

undone shore
sharp rain
#

what do you guys think of online courses like freecodecamp.org and programiz to learn python? I know the certifications you get from these course alonewont help you get a job but if you build a portfolio it will help greatly. Also, Im mainly trying to learn the python programming language rather than get certifications in it as of right now

#

since my goal is to build hacking scripts in python

merry matrix
#

Just. learn.

#

Talking about what's best doesn't get you anywhere. Learn the language to aid you in your hacking. That's all.

#

You've asked this like 3 different times now lmao

undone shore
#

Quit overthinking it, basically ๐Ÿ˜†

sharp rain
#

I get that but Im scared that Im gonna be learning the wrong stuff

#

like if I learn python programming just regular then Im learning a bunch of data science and stuff like API and machine learning which doesnt really seem to apply to python

#

for hacking

#

sorry if Im coming off as a little annoying

#

sometimes I get anxiety over the dumbest stuff and spend more time worrying about something then just trying it๐Ÿ˜†

warm hinge
#

u can learn python the โ€œregularโ€ way, how u apply it is up to you. Just gotta explore and experiment as u keep learning

undone shore
#

Learn machine learning in python and who knows? You might end up hacking a robot one day

#

Hacking is just the flip side of development. You literally cannot go wrong by teaching yourself development and computing fundamentals

#

Don't think of "hacking" as being its own separate thing: it isn't. Learn how computers work, then apply that to the "What happens if..." mindset

iron forge
#

There are connection between python machine learning and cybersecurity, so not completely "time wasted"

undone shore
#

Not time wasted at all ๐Ÿ˜†

iron forge
#

It just not hacking

undone shore
#

Sure it is, if you apply it in the right way ๐Ÿคทโ€โ™‚๏ธ

#

Hacking is literally just mastery to an extent that you can take something to bits and figure out how to abuse it

#

The first hackers were literally programmers who enjoyed pulling code to bits to find flaws

#

That's all hacking is, all it's ever been. Learning how to develop things, how to build, how to put things together, just makes you better at taking them to bits.

#

Master how something works and you're in a significantly better place to take it apart again

#

It's not using "hacking tools", or scanning a network, or any of the "exciting" adrenaline rush stuff that you get from doing a CTF, but that's not the ethos of hacking anyway

#

It's all just a mindset. The idea of "If I do this, how will it affect that?". The curiosity to go and explore things, pull them apart and try to put them back together again. See what works and what breaks.
If you have that mindset then you're hacking

iron forge
#

Ah, i see

sharp rain
#

I do do CTF events

#

picoCTF

#

and hackerone

#

so if I learn computer sicence in python and machine learning thats also good?

#

since hacking is just applied programming

undone shore
#

Sure ๐Ÿคทโ€โ™‚๏ธ
Learn what interests you

#

You can't really go wrong as long as it's in computer science

#

Heck, go pick up a psychology textbook -- that'll be really helpful

#

Most hackers also seem to have independently picked up lock picking as a hobby (myself included) -- not entirely sure how, but it's useful nonetheless

sharp rain
#

Yea

#

I'm really interested in learning more python

#

Because I know beginner python and stuff

#

But not enough to code my own tools

#

Just enough to maybe make a multiple choice quiz

#

Or something

undone shore
#

Then go learn and enjoy

sharp rain
#

Also interesting thing a few months ago I attacked a drone using my computer

undone shore
#

A drone you owned, I trust chceyes

sharp rain
#

Scanned wifi networks and deauthenticated the drone

#

Thing dropped from the sky

#

Yes I do own it

#

So I'm not a criminal :F

#

Wtf

#

Why did it do F

#

Nvm

#

But yeah only problem is even after learning python it's hard to learn to apply iy

#

It

#

But I have a great python book I got

undone shore
#

Conventional advice is "find a project"

sharp rain
#

Ye

#

Like build a script or something

#

I was thinking on a drone exploiting script

#

I also learned how to hack a car

#

Although I used a virtual car

#

Since my families car is from like 2008

#

@undone shore you seem like a very experienced hacker which language did you learn?

undone shore
#

kekw I'm a 20 year old student -- got a long way to go before I'm experienced ๐Ÿ˜†

sharp rain
#

Dude you got some certifications I could only dream if getting

#

Of

undone shore
#

I started with Python myself, then got taught C++. I've picked up a bunch more along the way ๐Ÿคทโ€โ™‚๏ธ

sharp rain
#

Also you are not TOO much older then me.

#

Yeah I know html

#

And some very basic c++

undone shore
#

Do a fair bit of web dev, so lots of HTML/CSS/JS/PHP/Python there ๐Ÿคทโ€โ™‚๏ธ

sharp rain
#

I couldn't code much in c but I know it's structure

#

It's sql and pho good languages to learn because of web vulnerabilities?

#

Most of the website hacking like OWASP is with SQL

undone shore
#

PHP is going out of fashion but it's still a very good one to know because a lot of the internet is powered off it

#

It's also extremely easy to write bad (i.e. vulnerable) PHP code