So, you wanna be a pen tester? Are you Sure? On Security Weekly episode 486! https://youtu.be/bvKZvae3HiQ?list=PLlPkFwQHxYE4atQRxwAsTux2PmOuWGgAA

1. so,
you wanna be a pen tester?
are you sure?

2. wots a pentest?
• circumvention of security controls.
• identifying alternate functionality in a ‘system’.
• identifying alternate means of accessing functionality in a ‘system’.
• generally a very thorough and technical assessment of the security
controls and functionality in a ‘system’.
• wots a ‘system’? those things that provide business functionality and
access to information. (app, end point, protocol…)
• wots a pentester? deliberate professional breaker of things. hacker.

3. why?
• people seem to think that it is a sexy profession.
• oddly enough it is at least 50% boring and frustrating.
• then you write reports, that’s the exciting part.
• the actual exploitation is such a small part of the thing.
• there is an industry over emphasis on the ‘hacking’ thing…
• are you sure? it can be a lot of work.
• it really isn’t about the hack, it’s about making things better.

4. what are the top 10 thingies…
• probably the number one question, what are the top 10 coolest most
important hacking tools for penetration testers?
• what are the top 10 skills that are important to become the worlds
greatest hacker? make up lots of lies, plagiarize, and write a book!
• how do I become the bestest cyber hacker?
• can you hack my buddies hotmail for me?
• do I need a cool hacker handle?
• love the next two questions…
• do I really need to learn all that stuff to be a cool hacker?
• do I really have to work hard for many years to be a pentester?
• the best one: i have a $CERT or degree in * so that makes me an expert!!

5. what you really need
• attitude, aptitude, and initiative.
• desire.
• dedication.
• discipline.
• integrity.
• ethics.
• experience.
• knowledge.
• tools.
• so, how do I get me some?

6. tools?
• while somewhat important to the specific engagement the tools are not
as important overall. the most important things are:
• deep technical knowledge.
• team composition.
• project planning.
• scoping (what you can test).
• rules of engagement (tests you can run).
• logistics and controls.
• understanding the goals and objectives.
• methodology! and creativity!
• oh and writing and analysis…

7. no honestly, which tools do I need?
• the only required tool is the matter most (some) people have between
their ears. brains.
• a friend of mine said that the only tools are perspective and perception…
the rest are just pretty accessories and squirrels and shiny things
• the honest answer is a web browser to do the recon and information
gathering, a project management tool for scheduling, and a database to
track target data in. scripting is very very very very useful. learn one
• the remainder depend heavily on the nature of the engagement.
• it honestly isn’t about the tools, it’s about having the appropriate tool to
efficiently and effectively meet the pentest objectives. whichever tools
meets the requirements, they are mostly interchangeable.
• often pen testers talk about tactics, tools, techniques, and methodologies.
the tools are interchangeable for the most part.

8. ok, then what do we actually need?
• people with the training, painstaking attention to detail, experience,
analysis skills, and creativity to emulate attackers in a controlled
professional manner. oh and teamwork and soft skills, who can write.
• process, which includes determining the scope of the project, rules of
engagement, plus details like policies and process and procedures.
• technology. the tools are the easy part, anyone can download the tools,
which are readily available, but in the hands of an unskilled individual they
may do a lot of damage, and do not always achieve the objective of
identifying and demonstrating risk.
• pen testers are restricted by scope, legality, morality, and ethics, and there
are rules of engagement, always have both hands tied behind our backs.
we can’t do all the things that the attackers can do. bummer.
• you have to be the ball. what? (caddy shack)

9. no, what about me?
• how do I get to be a pentester?
• ask really good questions. then find answers. that’s it.
• honestly i have no idea, i can tell you what i did, and i can tell you the
things I would look for in new hires when i was a manager…
• my degree is in political science, but i have played with computers
and networks since the early 1980’s. i like to break stuff.
• i have always said that i can teach people the technology, but i cannot
teach good attitude, good team fit, problem solving, or curiosity
• why does this presentation seem like random rambling?
• why are your slides so boring?

10. what do I need?
• passion!
• interesting question in that we tend to think in terms of a single lone
wolf penetration tester, when the truth is that the best engagements are
run with teams.
• some of the skills that are required on that team are project
management, creativity, being methodical, analysis, and writing. am i
getting repetitive?
• some will need an extensive background in information security, and to
be very technical in their areas of expertise.
• team membership will vary based on the specifics of each engagement,
expertise in web skills are not as useful in a wireless or network test.
• oh, and someone to run the scanning tools. minions!
• a good security analyst and project manager are worth 100 testers!

11. what is the path?
• you may have noticed the theme to this discussion by now.
• highly technical and specialized knowledge moving into information
security as a pentester. they often have mucho academic background
and technical experience, may be self-taught.
• information security generalist willing to acquire technical skills to
become a pentester. unless there is mucho training budget often will
have to be self-taught. academics and certifications might help.
• it specialist: developer, dba, architect, network, sysadmin…!
• forge your own path, there is no spoon.
• must have a deep understanding what it is you are trying to pentest.
• i have met very few who started out their career as a pentester…

12. where?
• mentors.
• communities.
• education, training, certifications are one way.
• being the security person on an IT team.
• taking the initiative and learning on your own, or a mix.
• boutique consulting firms.
• large consulting integration or services firms.
• many enterprises had red or purple teams.
• what the industry really needs are more blue team people who know
how offensive security works…

13. is that your final answer?
• no.
• it is up to you to learn, to ensure that you can do it.
• nobody else can do it for you.
• if this is your chosen career path, do not take no for an answer.
• make it happen, do it. now I sound like a broken nike commercial
• do the hard work, learn what you need to learn.
• it isn’t about what others have done, it is your journey.
• make it your precious, your passion, you will make it.
• not everyone gets to be a pen tester, sorry
• lots of openings in blue team.

14. questions?
it is entirely possible that I do not have any answers that you will like 
Adrien de Beaupré, lots of certs and stuff
penetration tester and SANS instructor
a member of the fellowship of the testers of pens
Twitter @adriendb
adriendb@gmail.com
1 613 797 3912
http://www.intru-shun.ca
https://www.sans.org/instructors/adrien-de-beaupre