Are you passionate about IT security and are wondering how you can get started in a career as a pentester or penetration tester? Matthias Göhring, Head of usd HeroLab and experienced penetration tester, answers the most important questions.
What does a penetration tester do?
As penetration testers, also known as white hat hackers, we detect vulnerabilities in IT systems and applications on behalf of organizations. For this purpose, we use methods, techniques and procedures that a real hacker would also use to find and exploit vulnerabilities. Our goal is to thoroughly analyze the security of the IT systems and applications and provide a profound statement about the risk of becoming a victim of a hacker attack. Subsequent to the pentest, we give the organization detailed corrective measures to fix the identified vulnerabilities in a timely manner, before they can be exploited by real attackers.
What skills should I have as a penetration tester?
In order to perform successfully as a penetration tester, a special passion for IT security is the key. We penetration testers analyze IT systems and applications, so a deep technical knowledge of operating systems, networks and protocols, programming languages, frameworks, software architecture and Windows domains is essential. Based on this, you need specific IT security know-how, for example around typical attack vectors and known vulnerabilities as well as tools for various use cases.
But technical knowledge alone is not enough: We put ourselves in the role of an attacker, so you need creativity and a certain hunting instinct to find even complex vulnerabilities at our customers. It is important that you work in a structured manner, always keep an overview and recognize correlations. This is the only way to identify vulnerabilities in the business logic of an application or to link information in such a way that individually adapted exploits can be developed. We also see ourselves as consultants. You must therefore be able to explain complex content to our customers in an understandable way and communicate the pentest results clearly in reports and presentations. This is the only way our customers can fix the identified vulnerabilities and sustainably increase their security level. In addition, a high sense of ethics and responsibility is essential, as we have access to sometimes highly sensitive data of our customers. You should be interested in continuing your education - because the digital world is short-lived.
In summary, you will need a combination of skills: technical knowledge, creativity, analytical thinking, conscientiousness, perseverance, communication skills, consulting skills, and the ability to work in a team.
How can I best learn these skills?
There is no official training for the profession of penetration tester. Thus, we recommend that you start with a solid technical knowledge - for example, through a university degree in IT or other related courses of study. Only those who understand the underlying technology can identify and correctly evaluate corresponding vulnerabilities. You can also acquire a solid technical foundation through self-taught practical experience, by working in companies that specialize in IT security or with the help of the security community.
For this reason, we give students the opportunity to get to know the profession at an early stage. We cooperate with universities and teach students about IT security in a practical manner through our Hacker Contest. At our Hacking Days, you can develop your ethical hacking skills, and our Hacking Night offers you as a Capture the Flag (CTF) the platform to compete with other IT security enthusiasts and to train your skills.
In addition, there are freely available resources to help you learn your ethical hacking skills. These include the TryHackMe learning platform and the CTF platform Hack the Box.
At all of these events, you'll learn the basics, and we'll show you how to build on them.
What are CTFs and how do they help me with my penetration tester career?
In the area of IT, "Capture the Flags" refers to competitions in which participants have to solve certain tasks in a team or alone, such as identifying vulnerabilities in running applications and exploiting them via an injection attack. This requires not only technical skills, but also creativity, a quick grasp of the issues, and sometimes unconventional thinking. Once the system has been successfully exploited, you receive a so-called "flag", usually in the form of a token. The goal is to collect as many flags as possible within a certain time. In this way, the game helps you train your skills and learn new technologies as well as techniques that are relevant in the field of IT security. You can practice all this at our CTF events, for example. In addition to our PentestLab, our security analysts use the "Hack the Box" platform to continuously improve their skills and knowledge in various areas of IT security, such as network security, fat client security or forensics. To sharpen the security mindset of the community, we ourselves submitted two VMs to Hack the Box, which were published in 2020: "Fatty" focuses on fat client attacks and "Oouch" on the impact of the smallest implementation errors of an OAuth2 authorization server.
How do we support you on your way to become a penetration tester?
If you choose to follow your career path with us, we will support you in the best possible way. Because in Capture the Flags you learn the methodological skills - but we show you how to translate your knowledge into a professional consulting service. In concrete terms, this means that you will go through our usd HeroLab onboarding program at the beginning, while we prepare you optimally for your subsequent final exam. Here we put your methodical skills, creativity, stamina and your consulting skills to the test. After successful completion, you will be certified as a "usd HeroLab Certified Professional" (UCP) and you will now be allowed to manage customer projects independently. In addition, we support you in acquiring certifications according to international standards, such as the Offensive Security certifications (e.g. Offensive Security Certified Professional [OSCP]). We consider ourselves security experts with the highest standards of quality. This is the only way we can guarantee excellent results and more security for our customers. Become part of our team and contribute to our mission "more security".
Are you interested in learning more about your career opportunities as a pentester? Ask us personally and come to our hacking events or visit us at the trade fairs. Find out more about your career opportunities with us here.
