Pentesting vs. Bug Bounty vs. Pentesting ???

What is the difference between Pentesting and Pentesting? There are different jobs that can be described as "pentesting" and I want to talk a bit about it. This should also help you to better organize your own learning, as you better understand your goal.
Blog: liveoverflow.com/pentesting-vs-pentesting-vs-bug-bounty/
00:00 - Intro
00:32 - Pentesting: What most people think
01:19 - Pentesting: What I actually do
01:53 - Pentesting vs. "Pentesting"
03:49 - Better name: Application Security
04:14 - CTFs are Useless/Awesome!
05:21 - Opposite Side of Pentesting and AppSec
06:27 - I prefer being a Developer than Pentester
06:51 - Bug Bounty vs Pentesting
08:36 - Outro
-=[ ❤️ Support ]=-
→ per Video: www.patreon.com/join/liveoverflow
→ per Month: kzbin.info/door/lcE-kVhqyiHCcjYwcpfj9wjoin
-=[ 🐕 Social ]=-
→ Twitter: LiveOverflow/
→ Website: liveoverflow.com/
→ Subreddit: www.reddit.com/r/LiveOverflow/
→ Facebook: LiveOverflow/

[@MrVampify]

As a corp pentester, this actually gave me some really great insight to think about appsec and pentesting as separate areas of security. I've recently started teaching myself API which is really fun and trying to subvert obfuscation. I would say I'm mostly a pentester but occasionally dive into appsec for specific webapps and such.

[@m1cx657]

Bro I'm curious what do you do everyday as a pentester in a corp.

[@codr6934]

the fucc?

[@katzenschildkroete]

The only time I pen test is before an exam to make sure I have enough ink left

[@Karan-ow4wl]

Rofl

[@matthewlandry1352]

This is simply one brilliant channel. He has definitely got his mojo back. I also love his hilarious takes (like when the van pulls up to the building and the red skull lands on the door…like ghostbusters or something.

[@yourfellowhumanbeing2323]

True mate!!

[@_CryptoCat]

i love the drawing/animations in this (0:49 + 1:32), really cool! great breakdown of the different security roles and how the interchange.

[@PootytangFL]

This is actually a pretty interesting topic for job searching. In my job(in US) the "networking" red teamy stuff is called pentesting while the appsec stuff is called different things within different regions in the US. In my area what you called "appsec" is called VR (Vulnerability Research). While in other areas (mid west) it's known as security research. Fun note one of my first job interviews was for a "VR" position, i thought we were going be reverse engineering virtual reality equipment.

[@OmegaZ2]

This video actually helped me a lot. Thanks a lot for clarifying this two "sides" of IT security. I always been in love with the "pentesting" part, not much with the "appsec", but I think it's better to know and understand both sides :).

[@Fahodinho]

it's worth noting that these are not the ONLY sides of IT security. there are many other areas like webapp, netsec, analysis, etc

[@Gary-tp9dk]

Thank you very much for helping me clear some of the fog from my mind as I'm heading into the "appsec" world.

[@BugBountyReportsExplained]

Fully agree with that. In Poland, when we say pentesting, we mean the appsec side of things. The "other pentesting" jobs are rare I think and are usually called red-team member.

[@werren894]

first

[@niewazneniewazne1890]

Red team member?

[@ozz961]

Or red team ops

[@Andreea93chan]

The problem nowadays is that every company wants a Jack of all trades when hiring a pentester. I have already 7 years of experience in the field, however I constantly have the feeling that I am not good enough, even though I am constantly learning and gaining certifications. I've reached burnout. Officially. And I am only 28 years old.

[@kharbandaumang]

I can understand... I am a soc analyst and kind of expectations my company has ... 😭😭😭

[@bagdats6971]

Damn, I feel the same

[@ko-Daegu]

Cuz there’s no universal framework like doctors have When I employ a nurse I know exactly what she/he can/should and can’t/should do Not the same for pen tester

[@fabiofreitas7760]

Great video - really relatable to me as an appsec tester in europe. Also, I'd like to add that this distinction is the main reason I don't think OSCP is much valuable to anyone looking to get into the AppSec side of things. You're much better off investing your time and money into eWAPTXv2 or OSWE

[@reflectedcrosssite2848]

Just got my first security job and we actually do both kinds of pentesting!

[@KarahannAe]

Thank you for this video, I am a full stack developer developer and I just started learning about cyber security. I have been following a beginner's course but it was mostly about pentesting, focusing on topics like active directory security. I had started to feel unmotived because I'm not that interested in that area. Watching your video helped me release that I should start to look more into resources about appsec. Liked and subbed.

[@hamdyahmed5742]

Almost 1 year ago I could not understand your videos but now after spent 1 year in bug bounty finally I understand 🙂 Thanks for sharing these amazing videos

[@UnknownSend3r]

What resources did you use bro ? And have you caught any bugs.

[@pinkeyism]

Wow, what was your path/learning tools to learn from scratch?

[@GarrML]

Love it! Great breakdown here. I’m right there with you, “Appsec Pentester” is how I’ve referred to the application-focused side of “pentesting.”

[@dannynishen5773]

This was really helpful for me in figuring out where I am going in this field. Cybersecurity is an industry in its toddler stages and we are still trying to understand it depths. I gravitate more towards AppSec as well, i am into details and protecting user data. But I also like pentesting because it comes with really fun tools I can use.

[@lukor-tech]

I like it how you placed the texts where your hands were at the time. It's not 100% but sure works well in terms of visual coherence for me.

[@arivanhouten6343]

Finally another masterpiece!

[@ThingEngineer]

Amazing video that was long overdue. It seems a lot of people wanting to enter any of these professions often bounce around a bit confused and maybe even focus in the wrong area due to the exact confusions you cleared up here. Well done!

[@L1nkk9E]

I'm a network security engineer and implement security functions of osi layer 2 and 3, so blue team. Our customers sometimes have network "pentester" on site which then say "hey, I could do this and that", which is awesome, because our team always says how much more we need to implement, but it is never important enough. for some reasons external pentesters have a bigger impact then we, as external blue team. but in the end we all want the customers network to be safer, so it's fine with me ^^

[@koredump7800]

Even focusing on security since starting college, it wasn't until reaching industry that I realized red teaming/pentesting wasn't the thing I had been going for all along, but rather it was security/vulnerability research.

[@UnknownSend3r]

Why, what made you pick that than pentesting. And are you doing vulnerability research now ?

[@daviddelille1443]

I use the term "pentesting" to refer to engagements of limited scope. This includes internal and wireless network pentests. When the scope is not well-defined/limited, I would call that "red teaming". I do agree that "appsec" is a good term if you're only taking about reviewing (web) applications that run on a server/workstation.

[@MrMcPeon]

Working as soc analyst. Great vid explaining the industry and different sec areas! 👏

Very good video thanks for that! I also like the length of the video cause I almost never have the time to watch the long ones

[@lanjelot]

There's blackbox {internal,external} network pentesting (netpen), there's blackbox application pentesting (appsec). There's whitebox pentesting (network or application) where the pentester has access to everything they wish (source code, config files, etc). It all depends on the rules of engagement. Pentesting just means security testing

[@Minecodes]

i'm from Germany just like you and i do appsec (on my apps, the apps of my friends, the apps of my father, etc.) and i do red team (on the systems of my father), i do CTF too and i like it most 😉

[@Konami9999]

was macht dein vater beruflich?

[@Minecodes]

@@Konami9999 er ist Entwickler und hat auch eine private Webseite mit selbst programmiertem Webserver (alles in C++ programmiert und ich teste es)

[@UnknownSend3r]

How old are you ?

[@Minecodes]

@@UnknownSend3r 14 👉👈

[@UnknownSend3r]

@@Minecodes I had a feeling. Keep it up, you're going places.

[@mohdamrirazlan7879]

When it come to this “pentesting” it should always come with the RoE (Rules of Engagement) & SoW (scope of work)

[@m4rt_]

I work as a developer, and it is one of if not my favorite hobby, so I think I am already on the appsec side of it all. Learning how all the scanners and tools work may be useful, but it's not a ton of fun compared to my understanding of the appsec side. Also, atm I learn about all this security stuff because it is fun, but also because I want to understand how to make my code more secure.

[@Rea892]

Amazing Video, I'm an AppSec :) Thanks man to make some clarification on it.

[@cristymanjarrez5841]

This video really helped me clarify the path I want to take, thank you!

[@mhendrickx]

Good topic, in my place of work we call the corporation part rather red teaming, due to the "pivoting" nature. But yeah, generally we have pentest teams that are really appsec teams. Good video!

[@trieulieuf9]

Very informative, while learning bug bounty, I always don't feel the like doing recon and running tools on various subdomains and prefer main web application. Now I know they are 2 types of security testing.

[@fabiodan30]

Developer here. Some of your videos teach me new things about hardening my applications

[@hazzxd]

:D hilarious intro edit: and another brilliant video

[@eliasf.fyksen5838]

Great channel man, your videos keep me motivated

[@effsixteenblock50]

One point that I think should be touched on is that in bug bounty, you're not required / obligated to report on the security posture of all assets in scope. You can pick and choose what you want to attack / audit. In bug bounty, you're looking for a payout, which greatly skews how the engagement goes vs a proper pentest.

[@gustavorosas-dev]

Melhor relatório que eu já vi (1:51): "Verificou-se que o site carece de qualquer forma de proteção. Basta enviar 'Por favor, deixe-me entrar' e o site gerará um shell com permissões de root." Ri muito aqui.

[@m4rt_]

Penetration Testing or pentesting for short in my opinion can be any kind of security audit. This could for example be simulating what an attacker would do, and going through and testing the code/configs. Also, I've seen some kinds of pentesting where people try to physically break in by tricking lock mechanisms, picking locks, unhinging doors, sniffing RFID badges, tricking guards, etc. (A good video showing this is "Through the Eyes of a Thief" by DeviantOllam) Even this variation of pentesting has variations. For example, you could be simulating an attacker, you could be going through and looking at all they have with them, and explaining what is bad/good, etc.

[@rsinistic]

Another excellent video . Keep up the good work👍

[@Indic4Zone]

great video! this explains a lot , thank you for making such video 👍

[@nilgam6536]

Thank you very much for this video, and explanation of these differences !

[@knuubLP]

Thank you so much for this video! I am currently in the last semesters of my IT security master's degree. I struggle to find what I want to do exactly after university and I am doubting if my current job is the right one for me. I am mainly working a developer's job, but at a security focussed company. Your video encourages me to continue on this job for now, but still focus on the security side. Since now I was always afraid by mostly developing to miss out on the cool security stuff I might do in other jobs, but maybe this just isn't such a big problem as I might think.

[@outstanding1403]

And that describes the difference between an IT studies and IT security studies. I think if you want to go for pentesting the IT security one ist the better one. If you want to go for appsec a normal IT studies might be better.

[@zeynarz7614]

when he was spinning his pen I got flashbacks to the day in the life of a pentester video

[@fabiandtheink619]

When I first watched this video, I loved the idea behind it, but did not really agree with the categories you chose. This could be due to my personal views on some of these disciplins, but for me it is missing a certain symmetry, so I'll give it a try: Pentesting applications / application security or security/vulnerability research: - code audits, burp, ... - focus on finding software vulns Pentesting networks / network security or pentesting: - nmap, metasploit, ... - typically not covert - focus on inital access methods and reaching as many targets as possible Pentesting corporations (processes, configurations, and people) / red teaming: - bloodhound, cobalt strike, mimikatz, ... - physical or social aspects, depending on the scope - covert af - focus on post breach behaviors and specific objectives Pentesting specific blue team detections / purple teaming: - mitre caldera, scythe, lots of custom scripts - emulation of TTPs - focus on evaluating or developing single detection mechanisms

[@Fvneral_moon]

I can't believe after all these years, he is still making "pentester" jokes while spinning his pen mod 😂

[@ProCipher]

Could u make a video about : "How to land your first job as an 'Appsec' "

[@nivkochan8596]

You just helped me to decide what to do with my life , thank you so much for this video ..

[@EnderKill98]

Great video! Never thought about this!

[@bina7513]

I personally feel that knowing both pentesting and appsec is a nice boon to have. I can actually see both working together. Some companies do rely on their own brand of proprietary software and hardware (Chuck E. Cheese comes to mind courtesy of MDJ Michael's channel), from what I have heard. That makes me think that could cause problems on the corporate scale if the proprietary software and hardware is not secure enough, depending on the software and hardware's respective functions on a corporate network.

[@wouterr6063]

Excellent video! I think the US pentesting view is more how "hacking" is viewed by the public (non-technical people) with crazy tooling and stuff. This is probably also how script kiddies come into the field wanting to pwn some companies rather than auditing application code or reverse engineer some esoteric piece of code. I myself found "hacking" by watching more red team focused channels such as seytonic, but I found that I'm more of an appsec person. I'm happy that I'm now able to classify those different ways of "hacking".

[@franciscog7110]

I can't decide what to do. I like redteam and also like appsec. But I'm not sure, how do you decide what is best for you?

[@wouterr6063]

@@franciscog7110 I think because I like programming and appsec goes more in detail on how to write applications. I think that by doeing redteam you learn more about what application stacks to use. Also I like CTF's and there the bugs live more on the appsec side rather than an outdated ubuntu version (for example).

[@davidhcefx]

@LiveOverflow I think you should simply flip the video vertically, because you are pointing to your left side Pentesting but it appears on our right side LOL (like in 7:20)

[@heheys3609]

Nice explanation. Now I found the reason I feel bored when learning those courses for pentesting: it relies on the tools to do the magic and loss the fun of finding the bugs myself

[@UnknownSend3r]

It's far from it. Just because you're using tools doesn't mean that's all there Is to it. Or that's the "magic"

[@jainishpandya4246]

Great man. Cleared all the clouds. Thanks

[@AlienAndrew51]

I started out wanting to do corporate pentesting and got a sec+, cysa+, and advanced digital forensics cert. Then became a developer since I found it more challenging and can do more to secure my organization. Also, there are alot more jobs in software development.

[@muhammadarsyad3370]

Thank you for the enlightenment, I thought pentest is just pentest

[@m10653]

Id say im a pentester but I only work with a single corporation and my day to day job looks more on like how you describe bug bounties as we test different parts of the corporation defined in our scope. So we are able to get into the weeds on a single application because our scope is limited to only part of the corp. And we get more visibility like what you get in app sec.

[@georgH]

As a customer of application security testers (we can it pentest), I would've never guessed that the general public thought that about "pentest" (European here)

[@gcm4312]

2:49 the "customer" / "product" of the company. I see what you did there :P

[@capability-snob]

Given that you're more on the app side, have you ever considered doing a deep dive into the object-capability model?

[@PlatinumVoid]

as a CyberSecurity consultant (big team but I am Red Teamer) in my company we do both... it categorizes as External, Internal, Web and Mobile Security assessments... It is true that in External/Internal scopes we do not focus much on Web Applications (lack of time which is usually up to a week), but still we analyze them manually. In my opinion itts kinda anti professional to just run Nessus and give the client the report...

[@monsieuralexandergulbu3678]

Love all of your video!

[@padaloni]

I've always made the distinction Network pentester vs Web App Penteser or Appsec pentester. To me Red teaming is using any technique possible to get into an organisation.

[@m.waheedanwar7105]

Yes i also think there is confusion in industry regarding this i also think there is a great intersection between two so it is very difficult to separate both

[@pi8tol]

legend come with legend video❤💫🔥

[@ReligionAndMaterialismDebunked]

I tried pen spinning a little while back. Nice pen spinner! :3

[@luisemilioogando]

Great. Do you have a course for appsec or any sources Im really interested

[@zeroxxtt2]

so should we call them pentesting and vulnerability assessment/analysis?

[@diegovente1747]

I'm Mobile apps developer, which subjects should I research to start learning about security in that field?

[@Lfomod1Dubstep]

It's always a good idea to know some security fundamentals when you're developing applications both for the web and mobile ofc. But it's also always recommended to have a third party security professional assess the security before release of the application :)

[@diegovente1747]

@@Lfomod1Dubstep Yeah completely agree on what You say, but I want to learn for myself, is just the way I do things

[@Lfomod1Dubstep]

@@diegovente1747 Yep, and that's a great thing! I wish more devs were thinking like you! Would make a safer world out there! :D So I vote yes! Go for it, learn and code safer apps from the beginning to save you time from after a pentest has been done and you have to remake everything because it was crap security wise ;)

[@p4nz9r60]

There are tons of books on Android and iOS security, start from there. Try to read the reports on bugs found in other mobile apps so you can learn what those other devs did wrong so you can avoid their mistakes. Most of all, try to develop a security-conscious mindset (CTFs can help you with that). For instance, never trust the input, even when you think its source is completely under your control, look at every line of code and try to find a way to break it. Learn to use tools for static and dynamic code analysis but be aware they won't catch all the bugs. But first and foremost, always be aware that, as an app designer/developer, you never see your creation what it really is, but as a more 'idealised' picture since you constantly think about whether your app does what it is intended to do or not. That view often creates a 'blind spot' since you don't see that your code can do what is intended given the right input, but also something that it should not do, given the specific set of inputs. That 'blind spot' disappears when you look at someone else's code, so @Lfomod's advisory to use some security professional to review your code is very useful.

[@diegovente1747]

@@p4nz9r60 I will start with the books, you are right about the mindset, I think is developed with experience right nos I have about 3 years, is right that a professional is what is needed, but I like yo know what is about to happen, so yeah I Will follow this lead, thanks

[@mod_cyber1015]

appreciate your knowledge ! Man

[@iakashx]

awesome. Very well explained. Thanks. :)

[@Maxjoker98]

1:50 That report sounds like a joke, but sometimes it's way to close to reality.

[@RJ-is9ko]

Do you have videos on how to get into AppSec as a career? I am currently doing soft dev in college.

[@_vaibhav]

I am a newbie in computers. Learning to code. I aspire to get into bug bounty hunting. Where should I start, what should I learn and is it necessary to get a CS Degree for it?

[@aniruddhajadhav2474]

Pentesting is more important, if any organisation is hacked then all credit goes to pentesting methods. Other hand Application security is also important.

[@steneer6789]

Is there any course or cert that fit specifically for AppSec now?

[@000t9]

So helpful video , thank you :)

[@muhammadadel9537]

Best Explanation Ever!

[@blankeyezero]

I really love the theme music

[@mackey_d]

To sum up - if I would like to focus on web application penetration testing, which OSCP’s cert should I choose?

[@bhanuvishwa4676]

Where would incident response and threat hunting come, blue team? Pls do make share resources on any kind of careers related to forensics. malware, threat intelligence,... resources describing in this great detail on all roles in security would be great. Thanks in advance.

[@Johnny-tw5pr]

Where do I learn how to be a pentester/appsec?

[@willownot]

hello, i want to get into the cyber security business, i'm brazilian and would like to and i have a lot of affinity with the area, are there really any salaries that go from 100k to 350k per year? is there space to undertake?

[@h0rizonfire]

Where I work, we call app sec pen testing And red teaming red teaming. Might be an outlier. But we have both teams.

[@Fahodinho]

so i guess as opposed to CTFs, things like hackthebox are more useful for pentesting and not appsec right?

[@rujotheone]

Yes. If you want to do more appsec, you should do bug bounties more

[@giovannibocciato]

yeah, u doing best trick with pens

[@jessy6922]

For appsec what CTF categories they should focus on..and how much better you should get at it?

[@sasebot3927]

web & mobile, definitely not pwn or crypto much. i don't know answer to second question.

[@dummypg6129]

If you are the author of the code that has found to have vulnerability? Would you find yourself guilty of not knowing about it? or would you be open to resolution in improving yourself to not do the same mistake again?

[@k-sansenpai7774]

And I know nothing of these three... But I know sometimes that is repeated in walkthrough ctf

[@sammygun84]

How to become product pentester (appsec) what should to start to learn?

[@juaninfante7000]

where do u practice ur ctf ?

[@Caesar-Victor]

Someone plz help-me, is there any video about whats heappens in hardware while "execulting C", i saw here analyzing C assembly, but i'ld like to share to some folks lerning C about how it alocates memory and change values there.

[@logiciananimal]

The question is always "penetration testing of *what*?" The corporate stuff doesn't interest me either, but someone should be doing it sometimes too.

[@Thunder-dp7du]

You really hit the point

[@Haxr-dq6wt]

I thought you said that you will not make any other videos in your previous video

[@LiveOverflow]

No I did not?

[@grainfrizz]

Fantastic video

[@hitmovies8369]

Do you have to go to college for pentesting?

[@brandonevans5123]

Absolutely not

[@TinLethax]

I thing i do learn from this video is. text and "text" is different 😂

[@abhineetsagar]

Love you man

[@bnal5tab681]

I like going into details but it annoy me that some details I can't find a resources that example it for example I was studying SQL (Sql injection) and found that if you use /*!13337union*/ it would bypass the WAF but I don't really understand how is that because union is a command and /* */ is a comment so it should not be read but it did for some reason because of the ! and the five numbers after it

[@MrVampify]

This sounds to me like an accidental polyglot. Perhaps it parsed it in the web app differently before reaching server-side sanitation?

[@bnal5tab681]

@@MrVampify Just found out the reason dev.mysql.com/doc/refman/5.6/en/comments.html#docs-in-page-nav-container

[@skatenerdify]

A lot of (probably most of) european jobs require a person who knows their way around both pentesting and appsec :)