The best Hacking Courses & Certs? Your 2024 roadmap to Pentester success.

for me personally doing a podcast writing speaking at conferences really focusing on my network this is really what helped me a lot I had to switch jobs recently I didn't really look that hard for job I reached out to a few people on new but I was my last day was on a Thursday by Friday I had two job offers and a lot of this was because the day my last day I said hey I'm looking for a job and I contact a few people and I had a job that quick you know if you build a name for yourself people see your skills you're being displayed it's going to make you a lot easier finding a job you won't be replaced by AI you'll be replaced by someone that uses AI so like writing has been one of the biggest areas I've seen hell using it to write scripts but the thing about this is when you're using AI as a tool then you have to understand something about it you just can't go throw this in there expect at work if you don't understand how to develop code you're going to have a lot of problems with it yeah I think people are starting to realize that you know just because someone doesn't have much experience so they're new that that they're not talented because there's a lot of young sharp talented people out there and even people that that are or second or third career they're they're doing really well they're putting in the time and effort to do it and when you're passionate about it and you put in the time you can be really good because as I kind of mentioned some people just do it for a job they get bored and they continue they they don't continue to grow and they fall behind but if you jump on something new you can leap frog us yes definitely and one of the things anyone listening that's starting out don't let that intimidate you that someone's got 20 years or even five years because at the end of the day it depends on how good you are how talented you are with that type of whatever you're wanting to learn because there's some people out that have been doing it 20 years they're not that great they just did it the money they're not really passionate about it they're not learning continue to learn they kind of fall behind but then there's a lot of people up and coming you know that are that are really good they got really good work ethics put in so don't let that bother you now there many reasons to use a VPN when I was recently traveling in the United States I couldn't access sites in the UK as an example I went to a financial services website I tried to access it but couldn't because it told me that I wasn't based in the UK here's a very simple example so I'm trying to go to the BBC bbc.co.uk and what you'll notice is it redirects me to bbc.com it's a different website and the content is different on those two websites so basically the BBC is geoca you depending on whether you're in the UK or somewhere else the information that you displayed will be different and you're going to get ads on the bbc.com website but not necessarily on the bbc.co.uk website that's a very basic example I think the example that most people think of is Netflix depending on where you're located in the world the movies that are available to you will be different so apart from all the security reasons for using a VPN you can change your location to for instance get access to websites that you need to get access to I'm not saying that you should do this with Netflix but in my example when I was traveling I couldn't access certain websites because it said I was based in the US rather than the UK now the VPN that I use and have been using for a long long time is protonvpn I originally started using them based on the discussions with hackers and cyber Security Experts as well as information that I read in books such as these how to hack like a ghost Linux basic for hackers and extreme privacy fantastic books if you're interested in privacy topics or cyber security or hacking personally I use a VPN a lot especially when I'm traveling because I don't trust networks that say free Wi-Fi normally I wouldn't connect to them but if I have to connect to them I'd only use them if I've got a VPN enabled and once again the VPN that I use is proton VPN and I really want to thank proton for sponsoring this video he everyone it's David Bumble back with a very special guest philli welcome thanks David thanks for inviting me back it's always an honor to to be on your show Philip it's great to have you back just for everyone who hasn't seen our previous video or doesn't know who Philip is and you should know who he is he's one of the authors of this book The pentester Blueprint fantastic book if you want to get into pentesting Philip it's great to have you back last time we spoke about your book and sort of updates for how people can get into cyber security and become a pentester I'd like to get your feedback now or an update now for 2024 so in 20124 you know what should I do but before we start with that you went to black hat recently um and you I think you told me offline there were questions that people were asking you perhaps you can give us some feedback about that and the kind of common questions that you received or you know people asked you yes uh it it was a fun experience it was black hat Millies in Africa so it was a very fun experience it was kind of nice to to be somewhere else because most of the conferences I speak at are in the US so kind of good to get more of an international audience and kind of getting their questions and stuff pretty similar questions to to what I'm you know what I get here but you know some of the major questions is educational uh platforms where should I learn one of the the advice I've been giving for many years but I've kind of changed within the past year is I used to really tell people to focus on building a home lab and now I've kind of changed that to using more of the cloud-based uh options that are out there because uh unless you need the experience building the home lab I think it's better to to spend your time learning the content that you need to be a penetration tester opposed to spending time troubleshooting a lab you know if this was someone that's wanting to be a network administrator a system administrator is something definitely they want to do but with the options out there try hack me hack the Box off sex Proving Ground all these different options the different ctfs there a lot of good places out there where people can can do learning without having to build home Labs because sometimes that can be kind of uh limited to people's budget to be able to have a beefy enough server to run enough VMS on it and then worrying about things breaking because one of the lessons that that I kind of reflect back on is early in my it career I taught myself how to do web design I had a Red Hat Linux server running my DNS my uh mail sendmail on there for my customers's email and one night I came home from work and the hard drive died I had to rebuild that whole system and instead of spend time building websites for people I was troubleshooting and fixing that I went to web hosting after that but all that time I spent troubleshooting and fixing that I didn't need that experience because I was working as a CIS admin and so that's kind of taught me if you're if you're really needing to learn anything about security that's even Beyond pen testing if you're needing to learn that subject you don't want a environment that's volatile or something you're constantly troubleshooting and and fixing just to be able to uh get the experience and and get the education you need so I mean you mentioned try hack me hack the Box are those the two big ones that you recommend and like which one would I start with are there any others that you'd recommend for getting experience sure I'd say uh tryck me is a good one because it's a little more newbie friendly it they have a little more stepbystep instructions it's kind of I really recommend people start with that then they go on to hack the Box although with hack the box with their hack the Box Academy they've added a lot more education educational content on there and and a big Plus for people that may not know this and I know this from from working previously for ID and being familiar with one of the former uh developers that developed content at IE uh Demetrios he used to work there he was part of e-learning security and built a lot of that original content that e-learning security had e-learning security used to be the biggest competition for offensive security Now offse SEC and so he's over there at hack the box now and they're doing training a little bit different you know like a lot of the stuff that IE was doing in some of the video training or some of the training out there is a lot of video and labs and some people like more text read it sure to the point and get through it so if anyone likeed the old e-learn security style is kind of influenced by that but really great content they've got certifications now like a pentester CT uh bug Bounty CT which is actually a web app pentesting CT they've got Cloud stuff I mean it's a really really good uh option out there and and all their content is up to up up to date new and then adding more content as they go along over thewire and under thewire ctfs are good places to practice your hacking skills over thewire is Linux based and under thewire is uh windows-based so not only can you learn security and hacking in those both both those platforms with the windows option you're able to learn some Powershell with the Linux version you're able to understand Linux security more so those are a couple of good options as well and they're completely free I mean what I love about your book and i' recommend it for anyone who's starting is that you go through like a road map of how to start from like Zero to Hero if you like and you Philip perhaps you can you know go through some of this like you mentioned a whole like Sears you mentioned Labs now right in the beginning you talk about prerequisite skills and then you get into like certifications and you've kind of mentioned as as I said some of those already so perhaps you can give us a road map like if I'm starting in 2024 perhaps just come out came out of school or I'm still in school I just recently interviewed someone who's 18 years old and he's getting like bug bound he's ready for hacks that he's doing but let's say someone who's older wants to you know move from another job to to become a pentester like you can you give us like a road map like where do I start do I need to start like with A+ or where do I start and you know it's kind of give me like the path that you would take if you starting now in 2024 sure if I was starting new and this is was kind of a good example because someone in our local Dallas cyber security Community when I first met him and anyone that's on has been on Twitter for a while or EX is called was Tinker SEC and so when I met Tinker he was a an IT recruiter and he wanted to get into security so he learned Linux and learned like security onion and all these other technologies that would be helpful in a sock roll and learning Linux he was working all that but at the same time too he was going through the A+ content uh Network plus a Security Plus to gain those basic skills now you don't necessarily have to get those certifications just learn the content and one good resource that I like is Professor Messer his YouTube channel he's got plus content Network plus and Security Plus so just getting through that content and understanding it will will put you in a good place to start learning the security and hacking content like on Haack the Box uh tryck me and those other platforms so that's kind of where I would start there make sure you learn it too because one of the things people get in too big of a hurry to want to jump into the hacking piece so make sure you learn the fun everyone wants to it's like you want to skip to dessert and bypass dinner so yeah make sure you're learning those Basics and take your time learning it because a good lesson I learned from someone was they went to college and they learned assembly program they had assembly programming course there and it one of those courses that basically is question and answer and he did enough to pass the class but once he got in a role as a pentester doing some reverse engineering some more advanced stuff he had to go back and learn assembly so while you're going through this stuff learn make sure you understand and know it because it's going to help you on the next step of your education journey and then once you get into the field so in your book you mentioned A+ Network plus Linux plus Security Plus so Linux is a core skill right some networking some hardware and some basic security knowledge is that correct that's correct and offensive security actually offers a free course for based on Cali Linux so kind of to get those Linux is not really a pentesting course they may have some tools there but it's more learning the operating system so this would be a good resource there especially considering you know the two major Linux distributions people are using as pentesters is either Cali Linux or paros I I think you said it in our previous interview which I've linked below fantastic interview that we had if you want to learn a bit more about Philip and his background like fighting bears and stuff Amazing Stories then have a have a look at that video you mentioned this concept about if you want to pick a lock you need to understand how a lock works right and it's going to help you yeah that's that's exactly right because if you're trying to hack into a system it's pretty much like picking lock if you ever see they've got some of these clear transparent locks that you can get and you can see the pins and the Tumblers and all that to see how it works so that's the same thing when it comes to trying to hack a system you have to understand uh the operating system whether it's you know could be a router you're hacking into or some other kind of network device or windows so if you get command line access to Windows or Linux then you need to understand the command line I mean you can do a lot more Googling and stuff but if you really need that Basics and that's really why you need the fundamentals so just understanding how that works understanding the technology uh and that's why some of us that came over from being a CIS admin it really wasn't that difficult of a path because we already understood the operating system and networking and so yeah understanding how that works uh any kind of security control understanding how it works makes it easier to break into it I I know some people in the industry that that actually will read the manual if they hadn't worked with this particular application server or a different application they'll find the uh the manual for it and read up on it to understand the technology better it's going to make it a lot more easier for you to to breach the system and you see a lot of security researchers find things that way they're just like for instance spect drops back in 2020 I believe they they found a vulnerability and active directory C ific services and they this was just basically doing research on it they didn't realize this vulnerability existed but going through doing the research they were studying learning more about active directory in depth and so just understanding the mechanics of it and even kind of going in showing some of the backgrounds the experience you may have say if you happen to work on automobiles there's actually pen testers that test uh automobiles so if you understand how those computer systems work how the car works then it's going to be a lot easier for you to learn how to pentest or secure that type of environment over someone that doesn't have that background so understanding technology is very very helpful I mean even if you want to be a good pentester then learning different Technologies learning cloud taking the classes is not always about the hacking classes uh fortunately when I got my first job as a pentester the hiring manager saw the value in building things and learning and part of the reason I got hired was because I had a home lab I taught myself web design a lot of the things I knew in security were self-taught so they were kind of looking for that I mean that's fantastic I I think you've mentioned it uh do you need to get the certifications or do you just need to go through the content you need the content certifications kind of help you get the foot your foot in the door and so having some kind of certification will help unless you unless you're really leveraging your network if you're really doing well on your networking you can get your resume to a hiring manager it you know you could get in without it some of the best hackers and pentesters I know have zero certifications or haven't taken any certification courses they've done other ways of self-learning and other content but you don't necessarily have to have the certifications but any of that stuff is helpful and one of the things I think that's super helpful too we're kind you you remember before in the past that artists and Graphics designers would have to have a portfolio we're kind of an age now that aspiring Security Professionals or Security Professionals really need to have a portfolio I mean if you're doing kind of scripts have a GitHub uh if you're writing content put that on medium or your GitHub or a Blog doing video content and walkthroughs you see a lot of people now that are uh you know really popular influencers and the way they got started was creating YouTube content to teach themselves and that's kind of how they got into it so any of that stuff you can put out there the more helpful it is we had someone in our local community that came to our Defcon 214 meeting in Dallas they did a presentation on malware and malware analysis A hiring manager from City group was in the audience saw his demonstration and basically he did kind of a technical interview before he he didn't even realize it not only putting this content out there also going to different meetups presenting at different meetups you know a hiring manager sees your your LinkedIn profile if you've got links to the videos and stuff you've had on there if You' got someone that has all the exact credentials and experience you do you're the one that's going to stand out more and on that same topic you look at the brand building thing and how it's really help people content uh Serena she networks is another prime example she was creating yeah she was creating content on Tik Tok and then moved over to YouTube and is originally like Cisco content and then she started doing some some pentesting stuff Black Hills information security group saw the value of that they really invest heavily into their marketing as far as effort and the people they use maybe not dollar-wise but content creation wise so content creation is a is a big deal so if if you're doing these things these are extra things to help you for me personally doing a podcast writing speaking at conferences really focusing on my network this is really what helped me a lot I had to switch jobs recently and I didn't really look that hard for job I reached out to a few people on knew but I was I my last day was on a Thursday by Friday I had two job offers and a lot of this was because I basically the day my last day I said hey I'm looking for a job and I contact a few people and I had a job that quick so if you know if you build a name for yourself people see your skills you're being displayed it's to make you a lot easier find a job and you know 2023 was a bigger a challenge because you know there's always the shortage of talent and people were trying to adjust to appease the shareholders plan for any recession and it got a lot more difficult so things like personal branding uh you know having a GitHub writing articles doing video walkthroughs is a way to set yourself a you know away from the rest because there's some really super talented people out there but sometimes the people who get the jobs are the ones that really put themselves out there and have a strong brand I was going to say that because you know I get push back on YouTube and I mean I'm sure you get the same thing people are saying the market isn't as good as it was a few years ago and what's your thoughts because it sounds like there's so many open positions yet there's so many beginners who struggling to get a job yeah I think there there's open positions out there and it's kind of tricky because soon as someone lays off other companies are hiring it's just it's a lot more difficult market and that's that's got to change at some point and really for people trying to break in is that's the most difficult for them getting the experience so if you're going to college make sure you take an internship get an internship i' really like to see apprenticeship programs because we really need to to bring up and educate people to help keep up with the demand and there's not enough being done in that area but if we could do like apprenticeship so if a company offered an apprenticeship someone comes in you know 3 months or 6 months and if they do a good job hire them on fulltime but if they don't maybe they're they're not worth you know they can't justify the budget maybe they're they're not that perfect fit but you're still letting someone get three months six months worth experience now they got experience to move on somewhere else and that's where it gets difficult not having the experiences so this is where you really have to optimize your networking online is great but you also need to do the iners I'd have to say I think that my network probably wouldn't be as strong as it is if it wasn't for the inperson stuff and so find like your different cyber security meetup groups the hacker associations we have a Dallas hackers Association those are throughout the world like in India you have null null groups you have Defcon groups OAS groups and these are good but one of the things and they're fun the more hacker type of meetups but one thing to keep in mind is your your Issa groups your Isa groups these more professional groups this is where your your hiring managers are going to be at a lot of cases is they're trying to help people these are good mentorship opportunities and so matter of fact speaking of Issa I met a young couple young men earlier this year and I've been kind of mentoring and helping them them out and one of them just recently got a job and you know we were introduced to his Issa meeting that's amazing I mean so I just want to flip back to networking because I talking about the other type of networking a question that often gets asked is CCNA or network Plus or doesn't it matter yeah I would say either those those is going be good uh CCNA is going to have some stuff that's applicable across all different networking types but Network plus would probably be an easier one and as far as entry level Sears my wife back in 2018 or 2017 went back to school to learn digital forensics and I was talking to a lot of people that were looking for entry level security folks and two of the certifications I kept hearing were Network plus and Security Plus yeah so yeah actually I used to have the actually had the CCNA myself yeah I mean I I I I'm I'm biased because of my history with Cisco I I love this ecna and I think it's a fantastic but it's good you know it's good to get your opinion because I I get the same thing from other people I interview that Network plus is enough you don't have to go and do CCNA even though I think CCNA is a fantastic way to open doors you know can open other doors as well yeah let's even like if you look at the CIS admin site you know I don't know if the MC is around I used to have the mcse and and network uh CN and those used to be kind of requirements but you know having that knowledge because I have people reach out to me all the time say yeah you you know you're assist admin you did all this you were Network Security application security do I have to have that background before I get started and you really don't it's just attain that knowledge so understanding that at a good level the networking requirements for pentester is not quite as much as someone that's a network administrator but you know it's not going to hurt anything to learn uh you know go the Cisco route some people do the CCNA and then get the security search they have there that doesn't hurt that can open up roles as a network security person and if you have your foot in the door in it or cyber security is going to make it easier to get into a pentesting role I think that's very valid and I always I always get the question people ask like is it this or that and my attitude is you know why do you always choose one or the other you can do more it's not as if you know you have to do this and not another CT because like Cisco SS can help you in other areas just E from an understanding point of view um it's not like you have to do this or this that you can do more and it just makes you a better person right yeah even going back to like the the comparison between Network plus and and the Cisco asserts if you're doing a network pin test you understand if you get access to a Cisco device you're going to understand how to com how to navigate the command line there and know how to use a device understand the security of it if you just went Network plus then that's some of the things you may not understand but typically the network hosts you'll usually get access to either be like desktops or servers and now you know a lot of these hybrid environments people are using cloud and on Prim or are purely cloud and so cloud is another area too that people uh should really take a look at because whenever I was getting started in pen testing you know you had some data centers where things were hosted but there really wasn't cloud back then and so it's really shifted more to a a hybrid or a cloud type environment so even understanding Technologies like Cloud taking some of those uh more lower level entry level cloud Sears to get those because I think there may be some of those that are free or very low low price and if you gain that that's kind of helpful you know if you're competing against someone else that doesn't have the cloud you're going to come out on top because so many companies are using cloud some way or another I don't think it's anything going away and some people are purely in the cloud and and some people are hybrid Philip now the um the important part right in your in chapter six in your book it's certifications and degrees we've kind of spoken about this already uh but I want to get like the road map um because you've got C here pentest plus ejpt a few sorts and last time you spoke about it and this time you've also mentioned hack the Box let's have done like Linux plus I've got the basic knowledge prerequisite knowledge which security or pen testing search should I go for something like ejpt has been fairly popular and I would recommend something like ejpt or TCM Academy has their their junior pentesting CT or their P pnppt CT one of those those are actually becoming more widely recognized because tenable the company that creates the nessus vulnerability scanner and some of their job descriptions they were actually looking for the PJP and so those are some more popular ones I really go that route over the c or pentest plus some companies if you're doing business with the government or if you're working for the government they like some of those DOD CS like pentest plus and C you know CH was probably the very first uh pentesting or eth hacking CT out there but also would try to go for more of the Practical certifications so like uh the PJ PT uh ocp and some of those are more practical so meaning you've got a lab environment you have to perform a pen test against those targets to get certified and that's really more practically showing how to use that knowledge that you're not just able to answer questions and people really really like that you're actually able to demonstrate and if you look at you know like look at like the the ccie from Cisco that's like the top CT they have and you have to not only do the qu questions in the in in the first section you have to go into the labs and perform troubleshooting and different things and even like the red hat C that was more practical I mean I remember back in my sis admid days a ccie and then red at CER were two of the biggest CTS if you have those you could write your write your own paycheck with those and so the with those practical certifications it proves that you can actually do the work and not just answer a question so give me the road map like what would you do like let's say 20124 what Would You Do Is it um TCM preps or like hack the box and then go ocp or what would be your path either like the TCM Academy or hack the Box the certifications there hack the Box are are pretty good it's practical they have extensive lab environments to you know practice that stuff in so that's one of the advantages you get with hack the boxes the the environment is just unreal all the targets you have so taking something like that because even like the C that they're offering now their pentesting CT would be recognized because there's some companies like cobalt.io Cobalt is pentest is a service one of their paths and also syac red team their pth to to join them or do pen testing for them is you have to go you can use the hack the box go through those labs go through those challenges and if you do these certain challenges then you're in line for an interview so to get your foot in the door for an interview and so working on something like that ejpt the P&P or either like the certification from from hack the box as a good starter and then maybe work on the ocp as like a next next step because it's pretty widely recognized and respected some of the CTS like CH and and pentest plus may help you get like a job internally as a pentester in organization but usually consulting firms are going to want something a little more more practical takes practical experience to get so the Crown Jewel I think last time you mentioned for like getting a job would be ocp right yeah it's still pretty popular it's it's it's evolved and kind of updated to to be more recent before they didn't have active directory active directories involved in it but some of the things I'm seeing about these they really don't none of them really have a clear picture of what you're seeing in real world I mean you do see some actor Direct but I think really for someone to come out with the a Next Level start someone needs to do something with an environment that's like a hybrid environment where it's you know some cloud and on Prim Technologies for people to to be able to test because that's what you're going to see in the real world so 2024 if I was starting basic networking Linux stuff then perhaps do um hack the box shts and then go for if it's a off sex um ocp SE and that's sort of the road map that I should follow right yes so Philip you I mean made some really good points I mean the cloud is is Big so you know it it'd be great to get more like a cloud hacking s but what about developers because you know some people might be into Dev they might want to hack like web application stuff like that is there sort of a path for them sure and that's probably one of the more uh popular areas and one of the nice things about web is you can do bug bounties to get experience yeah but web is very popular so if you're a developer even if someone if you're like a a quality assurance engineer you're testing out the applications you're already looking for bugs maybe not security bugs but those are really good past that developer to move over to web app pentesting because basically you're going to need to learn the security piece of it and and the hacking piece so Sans has their their uh gwap CT which is a web app pentesting CT but also like IE has a web app pentesting CT and one of the ones that I'm a big fan of that that's fairly new is the bug Bounty C through uh hack the Box they call it a bug Bounty CT but it's truly a web app pentesting certification uh also Port swiger web application secur Security Academy and a mutual friend of ours uh Rand khil does the whole series on uh Port sger Web Academy and that's totally free resource there using R's videos can make it even a better educational experience and make your you know be a lot better A lot easier to learn it than trying to just purely go through through their Academy also offensive security they've had an advanced web app pentesting start for several years that that deals more like source code more advanced pentesting but they came out with the oswa earlier this year or towards the end of last year that's a web app pentesting CT that's more relevant to what you're actually doing real world because you're not always dealing with source code especially when you're starting out as a beginner web at pentester you're not doing some of this Advanced testing so something like that would be good to to gain those skills I'm glad you mentioned r i mean r has amazing videos on YouTube and she's also on Udi now so fantastic to have her on Udi so if everyone who's watching I've put a link below to R's videos fantastic resource I'm so glad you you mentioned that because she does an amazing job teaching that um and she comes from a Dev background so you know someone fantastic to learn from and one of the things that that that's really nice too about her videos is a lot of these like Port swiger web application Security Academy you use burp site and there's these ways to doing it but also R also goes through and shows you how to create Python scripts to do the same thing she goes like A Step Above and Beyond so you mentioned bug Bounty a few times and it's it when it comes to experience it's that old old problem right how do I get I need a job to get experience but they want experience for me to get the job so is bug Bounty a way to get experience or any other suggestions to like if I if I'm new how do I get experience practically so bug Bounty is a good way to get experience and I had a talk with someone back in 2020 a hard manager for a pentesting company and when I say this don't make it don't worry that there's not pentesting jobs out there for the listeners there's lots of way about pentesting jobs but one of the things he brought up to me he said it was a lot easier to find web app pentesters than it was Network pentesters because of bug Bounty is giving people experience and it's really sad there's not nothing out there infrastructure P perspective but bug bounding are really good because not only are you going to you're actually putting experience in your resume people realize that if you do bug Bounty you're finding bugs that you can perform pentesting but there's also options out there like synac and uh Cobalt they do what's kind of referred to as pentest as a service it's not just really a bug Bounty people are performing full-fledged pentests and with them basically all you have to do is uh pass their technical entry entrance exam they maybe get web app to test or some of the pass on on uh hack the box if you score high enough you can get interviews and get into that so that's a really good way to get get experience and with the Cobalt I mean the differ with a bug Bounty you have to find bugs to get paid with Cobalt or synak you do the pentest you're getting paid for that and and once you work for like synac or Cobalt for you do that for a year then it's going to be easier to go in and find a a pentesting role somewhere because you actually got pentest experience the experience you're gaining is going to help you through the pentest interview someone asked you how to use certain functions in burp wheet or about these different vulnerabilities in the L top 10 if you're able to explain those and how to prevent or mitigate those vulnerabilities that's going to go a long way and that's another thing too like a good interview tip is if you're going for pentest interviews even if it's not web app pentesting understand the OAS top 10 because you're going to get asked questions about SQL injection cross-site scripting people will ask you about the different types and how you prevent or remediate those types of vulnerabilities yeah and Ron's Ron's course goes through all of that so great way to learn Philip you were mentioning like networking versus like uh web hacking so I want to ask this question 2024 what do you think are the hot areas that if I'm new I should focus on one that you know came up quite a bit recently was API so API hacking was like a big area is it is that still good you know where would you focus your time and energy if you were starting now yeah API is still hot that's a good area to focus on cloud is good to focus on the nice thing about API if you're learning web app pen testing this is a similar technology so really you know sometimes you R doing a web pentest you may may find apis because what apis do is make it easier to interact on different platforms back in my CIS admin days in the late 90s early 2000s you remember the middleware servers we used to have like Microsoft bisw Works and what it did was make it easy to interact between different platforms mainframes as 400s and all this use this connect but Now API is you know you can communicate through mobile device through Mac windows Windows Linux those different operating systems makes it easier to communicate so API is a definite must uh some interesting things to get on to get into as well as some of the web 3 Technologies like some smart contracts those are some interesting areas one of the interesting things that uh black atme they had a smart contract hacking Village there which was kind of interesting and also getting into some of the API I mean some of the AI stuff because there's a company called protect AI that launched a bug b program it was the first bug b program for AI you know machine learning and uh large learning platform large Learning Management Systems they're doing bug bug crowds I mean bug bounties on that but another thing is too uh netspy recently started doing uh AI pen testing so if anyone's going to school for any kind of data analysis getting into AI That's a good one to learn because with everyone jumping on the AI bandwagon they're going to need AI pentesters I love it I mean I'm I'm I'm so glad that you're giving giving us these updates just for everyone who's watching I interviewed Corey who wrote This Book hacking apis fantastic book and what I love about what Corey and and the team are doing is they've also got free training so if you want to learn how to hack apis I'll put a link below so that you get free training there and they have a certification that you can also take the training is free you pay for the CT but I mean Philip it's fantastic these days you know free the lot of free trading out there from people like ra um and Cory's team uh Corey created a bunch of the es and you can get experience these days by doing bug Bounty so it it seems in some ways a lot easier than when we started yes it's funny that that it's was so much easier to hack back then things are more complicated but there's a lot more free content free or low price content because whenever I started learning to pentest I took the ocp course because IID run vulnerability scanners I did security and all these other things but I didn't have the hacking piece and I took off fensive Securities course which at the time was maybe $1,500 for 90 days uh training time but there's a lot more less expensive opportunities out there fensive Security's gotten more expensive and and it's kind of good to have the competition because everyone tries a little bit harder when there's competition I agree so apis AI seems so again let's say you were starting today I mean I think it really depends on your experience and what you love right but um AI would be a great place to to look at right yes and the thing is with AI just using to learn how to write with using AI in general because one of my favorite quotes was you won't be replaced by AI you'll be replaced by someone that uses AI so like writing has been one of the biggest areas I've seen to help uh you know using it to write scripts but the thing about this is when you're using AI as a tool then you have to understand something about it you just can't go throw this in there expected work if you don't understand how to develop code you're going to have a lot of problems with it same thing with writing you know if you're if you're not writing on a certain subject or where you understand the subject then trying to get correct accurate content out of it may be more difficult but using those type of things and I think just really one thing for listeners to to keep in mind is keep keep looking at the new technologies coming out because with Cloud people really late to adopt the security piece companies were using Cloud but not bring me people were educated on it and I was kind of laid into the game with that and so just kind of keep up with these Technologies because the cool thing is is there's going to be more and more interesting technologies that are going to evolve as we go so it's not just that so if you're if you if you're interested in automob bills you can do automobile pen testing but I think really to find your entry point is find something you're interested in because you're going to put in more time and effort to do it and then if it's fun then it's not like working and you're going to be more successful and then the other thing is look at areas that that may be easier for you to get into so if you you're working as assist admin or network administrator Network pin testing is going be a lot easier if you've been a developer then web app pentesting is going to be more more easy for you to learn so find whatever you need to find early the easiest way in but as you go along you can learn other things and and do multiple types of pen testing or specialize and after a while it's kind of good to specialize a good example is tyberius tyberius started out doing Network and web app pentest but found he liked web app better and he specialized in that so when you specialize you can get a lot better at it it's kind of near impossible to be good at everything there's some people out there that are that can do that exceptions to the rule but not everyone so once you get in there find what you like what comes easy for you get there specialize in that that way you can become better at that I love the way technology works though Philip I mean you and I have been around the block a few times you know not showing out ages um if someone's new if they jump on the new technology they can leap frog us right because you and I might not be so clued up about AI but if someone who's starting and they jump right into AI they can be way ahead of us in six months or a year true that's that's kind of like Cloud I mean a lot of people like me you know I didn't wasn't taking the cloud courses but people coming in knew maybe they were taking cloud and then they decideed they wanted to get into Cloud security or Cloud pentesting then they just all they had to do is take the pentesting classes so I mean it's it's they're a lot of cases they've got more more skills than you know certain skills that we don't have you know you you saw a lot of good jobs coming out that Amazon was hiring a lot of uh cloud security folks and really good paying jobs so a lot of times if you're up to date with the more uh newer Technologies more Cutting Edge technology sometimes that can to mean bigger paychecks or or maybe an opportunity may say if you're going into traditional Network pentesting maybe they'd expect more experience but if you got this certain type of experience it's hard to find you know that may be a GameChanger for you to get your foot out and that's kind of like what I love about it right because you if you jump onto what's new they're not going to expect you to have five years or 10 years of AI knowledge because it's too new and that's you know that's how you counteract the people with all the experience because I think the problem for someone who's starting out is they they might see all of these people like you with lots and lots of experience and they think well I'm I'm never going to get to that level but if you jump on something new you can leave frog us yes definitely and one of the things anyone listening to starting out don't let that intimidate you that someone's got 20 years or even five years because at the end of the day it depends on how good you are how talented you are with that type of whatever your wanting to learn because there's some people out there have been doing it 20 years they're not that great they just did it the money they're not really passionate about it they're not learning continue to learn they kind of fall behind but then there's a lot of people up and coming you know that are that are really good they got really good work ethics put in so don't let that bother you I mean I've seen people you know I had a student in one of my classes one time he showed up one semester and he said I want to be as good as you but I want to do it in shorter time is that possible I said yeah you just all you have to do is learn technology you don't have to spend six years as aist ad man you don't have to SP spend uh seven years in application security you just learn those skills and move on to that and you can do it quicker so it just all depends on the amount of time you're willing to invest and you know you can learn it quicker the more time you're able to put into it and I mean I love it I you know flip of you is like um interviewing someone who's 18 years old who's doing you know bug Bounty making money on the side and just learning so much because he has some time he's you know when he was at school he had lots of more time to study and you just had a passion I mean those barriers that we had I think have gone there's so many so many opportunities today yeah I think people are starting to realize that you know just because someone doesn't have much experience or they're new that that they're not talented because there's a lot of young Shar talented people out there and even people that that are you know second or third career they're they're doing really well they're putting in the time and effort to do it and when you're passionate about it and you put in the time you can be really good because as as I kind of mentioned some people just do it for job they get bored and they continue they they don't continue to grow and they fall behind Philip I obviously would recommend this book for someone who's starting and um I've got Cory's book as well highly recommend this book as well but you know what are your favorite books for 2024 uh I've interviewed people in the past and the same books seem to come up I don't know if there's any new books that you really like U you you obviously mentioned books in in in this book U that that you really like but you know any new books that you like or any books that you recommend that people buy yeah i' also second that on on Corey's book I actually had a copy of copy his book and have have kind of gone through his his API University course so yeah that's one of the ones I'd recommend there there's another one that's black hat graphql for another uh graphql hacking for apis that's another another good one out there yes so in your book you mentioned books like the the hack and Playbook you still recommend that yes and as far as the hacker Playbook goes there's there's three different books that I would would say the mus haves are are the second and third book and the third book gets into more red teaming so if you're interested in more red teaming then then that's the book to get and for listeners the difference between red teaming and pentesting red teaming is adversary emulation so you're trying to emulate a threat actor trying to go undetected a penetration test you're trying to F all the vulnerabilities and hack anything that's possibly exploitable so that's kind of the difference there and red teaming is becoming more more popular it's kind of uh more one of the niche or specialty areas of uh pentesting because companies are offensive security because people have been doing pentests for many years and they're seeing the need to perform these red team operations too so that's a like I said the the third book is really good for that I mean one of the things about um like web hacking is there was there's books that people have recommended but like I think last time you mentioned you should just go to Ports sger because they've got the information there right yeah because they originally wrote the book the web application security handbook the web application hacking hand hacker handbook which is like they ref used to be the Bible web app pentesting but the thing the the authors are some of the people that work at ports swigger they decided to just put all the content online used to you could actually pay uh per hour for lab time with for the old book and so whenever they wrote the new book they have the labs for free as well as the learning content you know it's a lot easier to update a website add content than trying to go through a publisher and revise and AD by the time it comes out it's not necessarily new sometimes that's great I will list the books below that you have in your book no Star seem to have a lot of great books right yes yeah no starch has really got some good out there and usually as far as like pentesting books that's some of the best one of the best place to get pentesting books from they're consistently putting out a lot of pentesting books some of the other Publishers don't have quite as many and one of the things I like about Bill the CEO and founder of that company he's very involved in the community so you see him at the conferences working uh the no start booth there at the at the conferences and stuff so so Philip any last advice before you wrap up if you were starting out in 20124 any like wisdom from all your years that we haven't kind of touched on the one thing I we hav't touched on and this kind of almost falls under networking but if you're studying find a study group find some people that you're studying with and this doesn't mean you have to meet in person uh back when I was going through the ocp I had three other people that I was studying with and one is IND in India so we haven't got to meet yet but the other two we run into conference conferences all the time one of them's actually in Texas and so by working in that study group and sometimes this is like joining some Discord servers people are sharing different tools and tips wasn't like we had a call to discuss things we were saying if I found this tool you know I found this blog post these different techniques and share it so you can do you know it's almost like crowd sourcing your research you can only do so much as one person you got three or four or 10 even 20 people that you're sharing content with you'll be able to find things easier than you would on your own I think that's great advice you learn so much more from you know just talking to other people and Philip that's what's so great about what you've done here and you've got a podcast as well you got to tell us about your podcast and tell us about the things that you're doing because you do a lot for the community yeah one of the things that that I love about security and especially the community is back in 2018 I kind of turned my focus into more helping other people because one of the things I kind of learned and thought about was you know I started thinking about my legacy and I started thinking about I've always been competitive and I've competed in powerlifting and stuff and one of the things I started thinking about was I you know I've never I've never been the best pentester and I'll claim that I've never been close to the best pentester but at one point I got to where what can I do to be most helpful and you know kind of leave a better Legacy and what that was coaching because the world needs more coaches and teachers and mentors that's what I started put my focus into 2018 so that's why I taught at College why I started different meetup groups speak at conferences do a lot of mentoring stuff so that's really uh really what drove me to that even writing the book was to be able to share that content with people that I would never get to meet because I gave my pentester blueprint talk at many conferences and every time I would go it was someone brand new they had heard it a lot of people didn't hear it so I thought the best way to share that is through a book and so hopefully there'll be some more coming at some point I've talked about a couple books to a couple different Publishers but my podcast the Philip Wy show has people sharing their stories and kind of the motivation was when I was teaching my class at Dallas College I would share my stories and the students said hey if you have any friends or any people you know in the field would you bring them in have them share their stories so that's kind of what I do through my podcast I'm bringing on different people uh throughout the industry not just pentesters but people blue team uh even some people that are content creators to share how content creation can help but the biggest thing is sharing stories and motivating people one of my favorite stories this year I was at hack spacecon there was a couple showed up there to uh attend my workshop since they they knew of me and they listen to my podcast and they came to the conference and when the husband walked away he was going to school to be a security uh engineer he was like a construction engineer and he was changing career paths and so when he walked away she told me thank you for doing your podcast there's times your podcast uh encourages him when I can't and one of the things I always like to ask and tell people this is not just me this is the stories that people share maybe someone was a construction worker uh I have a good friend that was AutoCAD drafter that we knew each other and people listen to this episode you know several people that were AutoCAD drafters they want to move into cyber security so that motivated them I had someone on a previous podcast that was an esthetician in the beauty industry she did that for 20 years and then went back to school got an it U associates degree then a Security Associates Degree now she works as a pentester so at over 40 something years old she's in these roles some people are always worried you know my and what's really funny being my age whenever I hearone think they're old at 30 it's kind of funny but I hear people all the time I'm 30 years old I'm 40 years old I'm 50 years old am I too old you're never too old if you're passionate about want to do it it's out there I mean I've had friends that started in cyber security at 50 years old but that's the whole thing the whole premise around the the podcast but also have bring on people to share different security research to mix it up every once a while but a lot of really great stories on how people got started my my old podcast actually had r on there and Jason hadock I've had Daniel misler on my new podcast and so it's it's just a lot of fun and just a way one of the things I like to do too is introduce people to people that are good resources that they can learn from and this is a good way to introduce people to some really good resources you know throughout the world you know that people don't even have to know uh because you know there's so many people you can learn from I love that and I mean I need to ask you that question because you've kind of alluded to that am I too old right I get that question all the time like the same as you like I'm 30 years old I'm too old um yeah I'm not too old at 50 or 40 or whatever but the interesting thing is is I've just really never and you know people worry about the age thing you know I'm 58 years old I don't run any kind of age discrimination it's not that hard to find a job based on age and other people I know too that really not having problems with that so it's really not limiting you because people realize you have this you know for older people people realize you get this all this world experience You' worked across different roles you've dealt with a lot of people you know experience is valuable even when it's not directly tied to what you're doing Philip you shared your age you're 58 and you managed to get a job or two job offers the very next day after you you you you lost your your one job right yes so I think that's an encouragement for a lot of people that you know you're never too old no definitely not so how would you how would you how how are things changed for you because you know as you get older do you are you still going after the same roles or do you find that sort of the roles change it's it's kind of changed but the biggest thing for me is from an education standpoint I can't stay up late like I used to when I was going through the OC in 2013 to 2012 I could stay up 5 o'clock in the morning get a few hours of sleep and I would be okay I can't do that anymore so that's the biggest thing that's been kind of challenging but one of the things people have to look at too which was kind of hard to me sometimes you want to cling on to the pentesting role or being technical but sometimes as you go along then you need to move on to like management roles and that type of thing and you know throughout the past year I've worked for some vendors so helping out on the marketing side has been helpful because you know if you're able to you know you're able to Market learn how to Market yourself better you're able to help sell products and so it's been kind of interesting to do other things I mean so some people like the management role I mean that's a seeso seeso role is a something people can shoot for you don't have to do it right away but you can spend that time being technical because most of my career were technical roles and so it's and as long as you like it I mean you never no one says you have to move into management I think it I mean it's a it's a very good point because a lot of people on YouTube are only focused on for instance red teaming but there's a vast number of roles right and that's one of the things I want to share would like to share too while we're on subject is there's more roles out there that are fun roles in security than just pin testing you know I spoke to someone early this week I have a Defcon group at Denton Texas Defcon 940 and she was working as a developer and she wants to go into compliance GRC work that interests her so you don't have to do a specific type of role because some of the things with pentesting is it looks all fun but some of the things you have to do is work late hours because companies sometimes worry about you taking down systems during production so you may work from midnight till 6:00 a.m. or something like that I've had uh pentest where I was working from 6:00 pm. to 6:00 am so sometimes it's not the most fun hours and something like GRC is more 9 to5 sometimes the people you're going to have to ask questions you're going to need to talk to them during business hours so you may spend some late nights writing reports but as as a general rule of thumb you're not going to have to be putting all those crazy hours I mean like incident response is another one that it's unpredictable could be late hours but one of the things I'd say too is go to different conferences take different types of training really look at what it is that you enjoy uh a story I like to share was one of my former co-workers at US Bank he was in it and he was taking uh courses through Sands for digital forensics and he took several courses and he decided I want to take a pentesting course to be better at digital forensics when he did that he decided he liked pentesting better and now he's been pentesting for six years seven years something like that now Philip this is a hard question to ask but are there any things in your life that you wish you had done differently or like based on sort of your experience the M some mistakes that you made that you you want to like warn other people about like perhaps you didn't believe in yourself enough or you didn't go after a job because you felt that you weren't good enough you know imposter syndrome something like that but is there anything that you wish you had changed or done differently sure like the impostor syndrome I wish I would have went after things you know because when I went to the pentesting role I have it have that experience but one of the things I think that's probably helped me the most is public speaking just getting it putting myself out there because you know the Imposter syndrome thing you think you don't have anything to share you're not good enough and once I get into public speaking I realized I had something to share I may not be the best you know there's people out there better but you know everyone you know not everyone's willing to share that information and so I would have really wished i' got into public speaking sooner it could have advanced where I'm at now a lot quicker so my first first time speaking was in 2015 and then the next time wasn't until 2018 oh wow so it's not like it's not long time ago it's like fairly recently in the span of your career yeah so anyone that really wants to get into public speaking the thing that helped me was Toast Masters and through Toast Masters what I really learned was when I speaking I didn't look nervous and that was really more what I was worried about the perception we would do video recordings of our presentations during our Toast Masters meetings and I'd go back and look at the videos I thought I didn't look nervous and people say yeah you did you did a good job so sometimes we just kind of underestimate ourselves we have that imposter syndrome so that was able to help me get over it and then speaking at conferences and doing the teaching and all that help me get more confident in speaking I mean real one time you know one time I'd been very scared nervous in front of a crowd and now I don't care how big the crowd is I would speak so over overcome that imposter I mean it's a problem for a lot of people right because um you look at other people and you think these guys are rock stars I mean I look at you and I think man amazing um I could never be like that so it's you need to just you know accept who you are right and you know I would just I'm going to say too I'm not a ninja pentester I'm not you know I can do pentests there's people out there that are lot better but one of the things that's helped me in being able to speak in public be able to do things like this I'm able to to get opportunities some of my peers aren't getting because they're not putting their your s out there you know sometimes some people in technology are very introverted and so one of the things I'd advise is people try to get over that I'm a super shy person but you put me amongst my peers of the people that are interested in things I am I can talk all day long and so it's just put yourself out there get to see people know people when you go to the conferences if you're if you like ctfs that's a good place for people that are kind of introverted to hang out you get to meet other people and and just kind of relax because that's one of the things I I really share with people that are new or even one that's not had done much networking go to these meetings I mean it's different if you put in a room full of salese I'm going to be quiet not say much but you put me in a room full of techies or security folks you know I'll I'll chat all day long you know Philip I really want to thank you for sharing and you know for giving back to the community so much uh just for everyone who's watching I'll say this Philip is an amazing person he's been so gracious with sort of our interactions fantastic person to follow so go and follow Philip please on Twitter or X go and watch his or listen to his podcast go and watch his YouTube videos philli thanks so much for sharing and giving back to the Next Generation well thanks for inviting me and and it's it's been honor and a pleasure

Channel: David Bombal

Views: 96,753

Keywords: oscp, pnpt, pentester, hacker, hack, hacking, pentesting, web hacking, free web hacking, free web hacking course, web, web hacking course, web hacking tutorial, owasp, owasp top 10, http, https, website, web hacking pro tips, web hacking book, ca, cookie, session hijack, session hijacking, xss, cross site scripting, kali linux, portswigger, jscript, javascript, xss attack, bug bounty, node js, node js hacking, ajax, xss bug bounty, xss video tutorial, sql injection, ai, artificial intelligence

Id: 10P4aoXdXTI

Length: 57min 39sec (3459 seconds)

Published: Sun Jan 21 2024