How to be a better pentester

Security Engineer in a Fortune 500 company, with experiences in penetration testing, ethical hacking, cloud security, devops and product security. In my free time, I write blogs about life and dreams.

Recognize your flow

When you find a promising attack vector, make note of the flow of actions that you'll go through. For example, talk to yourself out loud: "I will run an nmap scan first, and then this, and that". If you're forgetful like me, write them down in your notes. You can even reuse the notes as a personal guideline for your future tests.

Explain the payload to yourself as you go

Try and explain the payload you're going to use to yourself see if it will do exactly what you want it to do. Ask yourself what are the expected results and what alerts it might trigger. Teach yourself as you go; you will remember it better and might find a different way to pivot if the payload fails.

If you're reusing a payload online, make sure to go through it line by line to ensure that it's not actually malicious to your program. Check which remote IP it's using as an example, because you might accidentally cause real-life damage to the application and turn this pentest into an incident response event.

Spell check, y'all

Your reports are the results of your sweat, blood and tears conducting pentests. Pentests are not easy, and you should make sure your report represents you, the meticulous you, and make it easy to understand and follow. Always always spell check. They should be as well-polished as the work you do during the pentest.

Give detailed remediation steps

Give detailed remediations of how to fix the finding, since our job is to make security better, not harder. This is why our job is considered QA on steroids: we find bugs, and we should understand how to fix it. This is why Pentests are not easy, and why we get paid the big bucks.

Thanks for reading!

How to be a better pentester

Comments

More from this blog

Proven Strategies for Success in GIAC Exams

HackTheBox - Vaccine - Writeup

How I pass the AWS Cloud Practitioner Certification

HackTheBox - Knife - writeup

Recognize your flow

Explain the payload to yourself as you go

Write amazing reports

Spell check, y'all

Have an executive summary

Give detailed remediation steps

Command Palette

Comments

More from this blog

Recognize your flow

Explain the payload to yourself as you go

Write amazing reports

Spell check, y'all

Have an executive summary

Give detailed remediation steps