HN user

ohm

48 karma
Posts2
Comments60
View on HN

Pentesting for consulting company. It’s either testing web apps, mobile apps, external networks or internal networks. I used to enjoy it but due to health issues I had to take a step back with studying and it has become pretty monotonous. I’m trying to think of where to go next after this.

As a parent I can’t stand Roblox. A while back Bedwars game on it was all the kids would talk about, then it was Grow a garden, now the worst of them all, Steal a brainrot.

Friends turn on friends and steal their items. Lots of crying and yelling. My child starts having tantrum if they can’t play. A friend’s child started hitting them with fists because they weren’t allowed to play.

The problem is that all the kids play this game and it’s their form of communication so I don’t want to completely ban it. Right now I block it on the router during the week and only allow it on weekends or when friends come over.

My other complaint is the currency they use, Robux. After 10, all kids want for their birthday is that. Some kids spend it on the stupidest things. When they run out of currency they go into a game called please donate and beg for more money. They also trade rare items for currency and some make items and sell them in the store to make money.

If the kid is banned by parents they find creative ways to play, they hide the app from Home Screen and play when studying, or wake up really early to play on their device, they play on school laptop using websites that run android emularors, etc.

I guess I’ll mention something positive as well. One child I know actually enjoys building their own games and publishing them. It rare thought and I haven’t seen many kids do that. They usually load up Roblox studio, play around with it for a bit and never ouch it again.

I miss the days of creative fun with Minecraft and wish the kids would have played that instead of Roblox.

Look into computer security. A good portion of our team are former developers. There are many opportunities to code. Either making internal tools, one off tools during projects or tools for public use.

My physics teacher played the whole album in high school class as we were doing our work. The door to the classroom was open and the music was echoing through the whole floor. I was surprised none of the teachers next door said anything.

Gym every other day. Upper body one day, lower body next time. I also do lower back and sit up machines each time I’m at the gym. I start with flex and stretch exercises the one construction workers do. I just remember them school. Then 15 mins elliptical. 5 mins forward stride, 5 backwards and 5 forward again. I put on liquid DnB app, bassdrive DnB or bbc dance station for fast upbeat music. Then do machines.

On off gym days I still do flex and stretch then walk or bike.

I used to do martial arts 3x times a week but after I learned the basics I lost my motivation to push so hard so I stopped going.

Working in pentesting and I like my job because for the majority of the time I’m treated like an adult and left alone to do my job. I’m also surrounded by smart and passionate individuals that make me want to keep learning and enjoy working. The work itself can be exciting when doing internal or external network testing. Finding a new vulnerability, thinking of a new attack vector, chaining multiple attacks and getting privileged access is always a thrill. Web app testing can be fun when testing newly build or older apps but boring if the app was tested multiples times already. Mobile testing is interesting and it can be fun bypassing controls. Wireless testing could be fun as well. Red team and physical tests are a thrill but not good for the heart. Code reviews not many want to do but are helpful when combined with web app testing.

Something else that’s fun is making a tool that helps people save time during engagements.

After a while the job is repetitive though and the thrill fades away. I’m at a point where I want to try something new but not sure where to go. I don’t want to go back to doing tickets or being on call. I also like having flexible working hours.

Usually good consulting companies would hire former SWE that wants to switch to security. During interviews, basic security questions are asked, most are covered under security+ certification. But companies might skip asking them and instead ask SWE code related security questions instead. Such as how to prevent OWASP top 10 vulnerabilities. Most of the major ones are covered here https://cheatsheetseries.owasp.org/Glossary.html

Code review job would involve running commercial tool such as checkmarx or fortify and then reporting on issues that tool finds.

For web application testing these two sites are a good start. https://portswigger.net/training and https://www.pentesterlab.com/pro Most web app testing is performed using this guide https://owasp.org/www-project-web-security-testing-guide/ Hands on is the best way to learn web app testing.

Companies give you 24-48 hours to test vulnerable web app. After you send them report with findings if they like they have final interview round.

Some of the better companies are ncc group, bishop fox, nettitude, google certified security companies and others. You can find them as sponsors on security meetups like bsides.

Some of the more technical ones are https://cure53.de/#publications. You can read their reports. Also https://www.trailofbits.com/

As for pay it’s decent but the ceiling is lower than SWE. Entry level positions usually make below 100, senior low 100, manager mid 100 and more senior positions are around 200. After that it’s harder to move up.

Lastly the job itself can get pretty boring at times. Code review is something most people try to avoid. It’s useful when combined with web app testing to perform greybox testing.

Web app testing can be boring as well, when testing multiple web apps in a row that were tested multiple times and not finding anything decent.

What makes up for all of that is excitement from testing newly developed or older web apps with lots of vulns, performing network pentesting and developing new tools for different projects.

It’s a great feeling when you publish a new tool and lots of people start using it and appreciate your work.

You don't need certifications to get a job if you have knowledge of various security topics. But if you don't, certifications are a great start to gain that knowledge. Also majority of security interviews will ask you questions from various parts of security so it's best to learn those topics. First figure out which part of security you want to work in and then take the shortest path to get a job in that part of security.

For compliance work you need certifications. Security+ as a start. AWS and Azure to stand out from the crowd, then CISSP and CISA and whatever other certs company requires.

For network security. Certifications matter. Network+, Security+, CCNA.

For blue team. Certifications matter. Security+, Microsoft, Linux, Network+, etc.

For pentesting. Skills matter more but certifications will help you with interview questions and getting first job. Web App testing knowledge is the most important, followed by code review and netpen knowledge. Security+ and Network+ certs to answer security related interview questions. OSCP to help you with learning how to use tools, how AD attacks work and getting a boost over other candidates.