Companies STOPPED Hiring For Pentesters, What You Should Do Instead

[@HelloworldXY32]

Very interesting. As someone who's currently starting in Cybersec, I'd want to know your opinions on a few things. I've been watching your videos and you've caused me to debate, but it doesn't harm my path too far. It'd mean a lot to me if you responded and considered each of these points separately. There's a truckload of them, I apologise if it might be too much, but I'm really interested in your points of view. - Is my mentality good? I've been trying to fit in basically all aspects of cybersecurity in my training, to be honest. One of my key mentalities is that hacking is not solely digitalised, and has many diverse vectors. It's more of a mentality rather than a simple, static field. Stuff like physical pentesting, hardware pentesting, and social engineering are areas I've tried touching upon despite having a high focus on security misconfigurations and pentesting. I've actually been learning Cybersec in duality with Dark Psychology/manipulation, to perfect social engineering and what i'd been calling "human hacking". I feel like I'm aiming to be more of a jack-of-all trades than just a single thing, and I'm not sure if I'm targetting too many things. Is this overexerting myself, or should I try to hone my skills and focus on one thing? Is it technically advantageous to do all of this, because all topics are interconnected in some way or another? - Even though it is technically another field, do you think learning psychology on the side would be advantageous to becoming a more versatile red-teamer through using stronger phising techniques? Manipulating targets in my opinion is much better and more sophisticated than simple impersonation and lightly tweaked spam. Do you also think this? - How successful would you think a red-teamer or security engineer/configurator be in terms of job roles? I've been weighing both of them as alternates to just a pentester, and I feel like I do gravitate more so to red-teaming due to the attitudes I mentioned above. I feel it might be worth pursuing that, but I'm not sure. What's your thoughts on these two? - What are your thoughts on OSINT/Open Source Intelligence? Do you think its a good field to try specialising in and practise? It falls hand-in-hand with social engineering and is needed to build a good portfolio on who to attack/manipulate in a company and what figures to impersonate; knowing more about the target is essential to hacking it. Do you think this'd be something worth pursuing and practising? - What are your thoughts on the Privilege Escalation and Command N Control (C2) sides of pentesting? Do you think these are still valid to learn for the role of a read-teamer or successful security analyst/auditor? I believe they might be, since spear phising and deployed malware is only for initial access. These kind of clear up what to do post-exploitation, and that's important for a real security breach/attack; practising persistence, controlling multiple points, and escalating privileges to move laterally and find a stronger foothold. - A penetration testing youtuber I've watched who has some experience in malware analysis has taught me in a stream (paraphrased) "you don't need to know how to build massive exploits and do all things fancy in a security field. Rather than writing code, you should focus on knowing how to read code and identify insecurities. Chances are you won't be hired by google or amazon, and you'll be up against a company's self-made website or web/service application at most". How far do you agree/disagree with this statement, and how would you correct it? - I have a personal thought here to your argument that penetration testing is useless, and I'd want to see your opinion on it; "Digital penetration testing is still a useful subject to start with because it teaches a lot of fundamentals about devices and operating systems from an offensive security point of view. Even if most ways used in penetration testing labs are outdated and phased out, they introduce you to many fundamental concepts of a device that act like building blocks, like server infrastructure, operating system infrastructure, attack vectors and data exfiltration. Besides that, Privilege Escalation and C2 tactics are also quite vital in my opinion to understand for any cybersec job role. I see penetration testing more as a first stepping stone, rather than a waste of time." How far do you agree? - What's your opinion on the resources "Hack The Box", "TryHackMe" and "Offsec"? Are they good resources to begin with, or do you recommend any other sites which can do better at tutoring on cyber security? What kind of certification resources would you suggest for job opportunities? - Do you have any interactive web resources and tactics which you could give me to set me on the path of being a more successful malware analyst? I know you've offered some things to another person in this comment section, but I don't believe I have everything I need from my current online learning resources specifically to succeed in this. What books, as well as online courses and practical examples would you suggest I study and do? And do you know of any good youtubers to use as inspiration? - I've seen a comment from you on another post already, but I'd like to address it in broader detail and maybe have a video from you on this? What do you think on ChatGPT's effect on not only the malware analysis field, but on the field of cybersec as a whole? I feel like penetration testers are less impacted by this than malware analysts and exploit crafters; an AI with unconstrained access to plaintext can analyse source code very quickly, and with enough samples and development for it, should be able to supply fixes after identifying it and even write generated responses. How good will it be at screening the configurations and network details of an entire organisation, however? Shouldn't it take more effort for an AI to do something more laterally involved like that? And moreso, what do you think the human-compliant effects of AI will be on malware analysts and other jobs? We will likely have AI incorporated into tools if its presumably not fully competent enough to screen for vulnerabilities; what could the implications of AI have in terms of being used by experts in the field as an assistant rather than replacement? Thank you again if you ever answer all of this. If not, been interesting to think about this to myself and write it out. Hope I can learn more as always :)

[@steventv2728]

A whole lotta yapping for something that isn't that'd complicated, no ones reading your wall of text buckaroo

[@HelloworldXY32]

​@@steventv2728I mean yeah, comment's 3 months old, thanks for spelling the obvious Sherlock. I do admit, it was more of a sketchpad of ideas for a moment rather than a genuine comment. Came into it with the expectation of not getting read, ended up drafting and sketching up points I could translate to other contexts in chunks later. Don't really care about this anymore; I've already answered most of those questions alone by now anyway. I get it, YT comments ain't meant to be that long. Vid got me thinking, so I typed away anyway. Still ended up being useful in the long run for me.

[@steventv2728]

@@HelloworldXY32Learn something that'll be valuable in the long run, i.e Reverse Engineering it might be hard but it's one of the best skills to have in infosec

[@HelloworldXY32]

@@steventv2728 Thanks for the suggestion; I'm already underway with rev engineering, binary exploits and bug hunting. Though I'm using the other easier topics as a launchpad into that, to learn higher level rules of thumb before I really dive into the lower level. It teaches useful habits and good security configurations along the way.

[@BDCAT-oanVietHung]

sory for my poor english writing skill if i write anything wrong but i want to ask if I want to become a malware analysis in the future so should i chosse to be on SOC team or pentester team to begin with as a college students , thank you for all the great video that you been making and hope you reply

[@brwakurdish6513]

waht best programming language to develope malwers like Trojan horse and ransowmer ?

[@AbdoMagdy-q7y]

From my research, the main route is: bug hunter → penetration tester → red team operator, what you're talking about is the fact that penetration testing is dying, so if I'm new, and just got my cybersecurity literacy or ABC by doing tryhackme paths, HTB, ... etc. How do I get into a red team operator position? If penetration tester background is a perquisite, can you please elaborate further in a separate video or a comment? Just a way to direct myself. Thank you.

[@MalTrakSecurity]

A lot of training companies try to tell you there's a prerequisite to every training. If you look deeply web attacks are quite different from red teaming ops. They don't depend on each other. Kali linux and metasploit kinda pentesting is useful but not related to web bug hunting and not widely used when you are a red team operator. The imagine of prerequisites and dependencies here is only created to sell you more courses. We do cover red teaming in MalTrak and it has everything you need. You can check maltrak.com/redteaming for that. Apart from this. You need to learn networking and network protocols, active directory attacks, powershell (offensively), C# or C++ is optional but recommended and dive into the red teaming world. Look into how real APT attacks work and learn from them, simulate their attacks and recreate their tools, techniques and everything. Keep up to date with new techniques on twitter and others. And follow MITRE ATT&CK and learn the techniques they cover in their charts. Hope that helps you out

[@AbdelrahmanMagdy-ny9wy]

@@MalTrakSecurity thank you so much, on the prequisite thing, it was a talk a by ebrahim hegazy, a bit outdated TBH. I've also watched your maltrak intro covering practical experience that the companies are looking for, and how certificates are somewhat of a scam. Although, I still want to make a self funding from finding bugs, I'm currently trying to write a roadmap to track progress and figure out an action plan that involves measuring each acquired skill. For example, Learning automation is simple, but there's a skill ceiling.

[@zerocool2765]

Is it possible to do freelancing in cybersecurity? If yes, then which domain do you recommend in the current market scenario for getting long term clients.

[@MalTrakSecurity]

It's possible in some domains. One as a consultant for incident response, building the security infrastructure and create the policies and processes to handle incidents. Another option is in the ISO & Risk management work. Help companies obtain different security certificates such as SOC 2 or ISO90001 or similar ones 3rd option is offering offensive security & red team services. From web pentesting, infrastructure pentesting, attack simulation, ransomware simulation, and cloud pentesting. Most of these services will require you to be seen as a consultant than just a freelancer. Web bug bounty hunting doesn't require that but no long-term clients in this web bug bounty world Hope that answers your question

[@zerocool2765]

@@MalTrakSecurity Thank you that was helpful. How do I get seen as a consultant? Should I create a personal brand? Frankly, I have no time for starting a podcast/KZbin channel.

[@EndemikBitki-xc6li]

Kanal başarılı arkadaşlar

[@MdHasan-pd7mn]

Hyy sir I am thinking of switching from pentest ING to malware analysis any tips you wanna share for me

[@MalTrakSecurity]

Well, first why you want to switch? If it's just for job opportunities but not passion, then you need to rethink the decision. If you are really interested in malware analysis and passionate about it then read Mastering Malware Analysis book Learning Malware Analysis book And practice a lot. And if you want to speed up the process, check out our malware analysis training at maltrak.com/join

[@MdHasan-pd7mn]

​@@MalTrakSecurity actually as a pentester I don't see growth in pentesting and there are a lot of drawbacks here too, that's why I want to switch for betterment with a little bit less stress 😬

[@ahmedrumble]

I have just heard that with the help of chatgpt, one can manage to create highly sophisticated malware with minimal knowledge of coding, enabling even scripts kiddies to create undetectable malware, does that mean, one studying to be a red teamer can neglect having advanced knowledge of programming And it's only sufficient to have the basic concept about what's going on ?

[@MalTrakSecurity]

It's possible but do you understand the code? can you explain it to the interviewers? can you answer a question on the spot? Also, most of ChatGPT work is unfinished and not working samples. You need to understand the code, complete it, fix it and make it work. That requires programming knowledge