So You Want To Be A Pentester?

however I've got so thanks like more people magical I was aiming on eight people but you know I won't want to go so this talk really is can't designed for anyone well this tours come about because I get a ridiculous amount of emails from people wanting to be a pen tester and lots and lots of different mistakes so how many of you here tried to break into the pentose to market yeah okay so I'm going to kind of guess as 50% more there two shots but the hands up basic I see lots and lots of different ways of doing it and I see lots of lots of the same mistakes I just would it's kind of how

they were fun talk about you know common common things that I see so basically been a pentose there's a bit of a hard life edan can testify to that he's word to me before and then most of you know Chloe Chloe County boy to me but being a pen tester for me you know it's it's long days it's lots of hard graft oh it's not about meeting their two interest in that right so pen testing is a bit like GT sports car racing in many ways so I have it on three go I raced GT cars gt3 TT Force I reckon the British GT and in the block pan on the way to the mom and what I do

in the GT race in the g8 GT racing world is the lifestyle is exactly the same as pen testing just slightly less glamorous so what the similarities as a pen tester you're gonna be working 12 hours + / done without doubt there are long days they're quite hard days six days a week potentially and you are going to be on the road a lot a lot of the a lot the time you go out to client sites you're living out of a single bag maybe two bags if you're driving your own car they using public transport and UK pretty screwed so you can use in one bag and it can be quite harsh harsh living

I know ever in the state's about a lot of American pentesting friends they spend sixty to seventy-five percent at that time working away from home working remotely it kind of it speaks really to the attrition rate of the industry the fact a lot of testers don't last that long in the commercial testing world because they get tired out and they burn out really quickly what we do why do in the GT racing world you know I go out you none of you will have ever seen my name in lights I fail ninety-eight Sun at the time but I'm out there I'm constantly out running every single morning I'm constantly in the simulator I'm constantly out testing

with my GT cars and I'm always working hard I fight in third the middle of the pack all the time occasionally when in my class but never making the podium in pentesting is exactly the same you know not yet at the time we're failing at what we do but if we fail consistently and we fail properly when we succeed we succeed big and we end up a shell which is what we always want to do so there's a lot of similarities my typical tip my typical day in the pentesting world up at full [ __ ] shower shave bang out a one-off mile run it just helps clear my mind get me set up for the day then it's

breakfast then I'm out on the road go it off out to client sites if I happen to be using public transport I'll go and check all my emails I'm on the road if not try and do that before right so I run a painting company myself so I've got to be in touch to everyone our clients like from nine possibly even five more realistically leaving at 6:00 in the evening maybe pushing it later depending on what we're doing food back home write up what I've done for the day but sleep rinse and repeat six days a week it's a wicked life I love it but it's hard and I thought it does really put a strain on your life it's great for

those of you young I've been doing this now for 26 years all of my life it does grow it does grungy down but as people that work me will attest to three o'clock in the morning understood online on the IRC on slack shutting away and working I just done sleep I've got used to it so really getting that first gig if you've got it in your mind that this is what you want to do you want to be a pen tester you've kind of got five challenges so you're gonna you're going to go out as a student or as someone who is looking to break into pen testing market you've got five five challenges really you need to

get a job to get a job you need to get in front in front of me to get an interview and to do that you need to get me to read your CV the world's hardest thing so I receive on average on average day fifteen hundred emails and most those are junk and I'll just I'll take control like shift delete get rid of emails but you need me to read that email that email needs to stick out and it needs to make an impression and that's the thing needs to make an impression to me if you're at usually please please please if you're gonna send me send me an e-mail you'll CV ignore what your lecturers are telling

you because they're telling you [ __ ] it's true I mean you don't ask anyone that's been in the industry my role long enough I ask you er right if you're gonna fire off a template email it is gonna go straight in my recycle bin and if you're gonna word it badly and I've got some cool canned examples don't think any of them are from anyone in this room I'm not sure if the stuff on here is yours please take its constructive criticism don't take it bad and don't want to make you cry you can send me any amount you've got to make me rain it somehow then I'm gonna read your CV it has got

to stick out it has got to be memorable because it in the day in your first year you're asking for a salary but you're asking for me to personally put 50,000 pounds of training into you to turn you into a pen tester that's taking into account things like desk space travel IT equipment training courses conferences that first year you are not going to know what you're doing every day you're going to be running around like a headless chicken and you're going to get the [ __ ] jobs you are going to be looking at code and done testing code but I'm testing myself and I'm kind of a list of things that are wrong with it

and I'm kind of hoping your than from at least one of those sometimes you're done sometimes as Chloe's found out recently you get thrown out on a pen test on your own unexpected to survive and then we'll see how well you do so we're I'm investing a lot of money in the MU if you come on board so you've got a truck you've got to really stand out from the crowd and on top of that you want a salary as well which on the subject of salaries if you're an intern don't ask me for 26,000 pounds a year because you just going straight in the recycle bin so how do you get this gig treat it like a pen test because it is

it's a it's a cross between social engineering recon and testing you're going to want me you're gonna want to try and get me to read that covering email or answer the phone shoes and how do you do it well if you're coming firstly who is it you want to work for I'm gonna use me as an example so if you want to work for a job security you need to know who is it you're addressing what you know where that sliders know okay so you need to know who it is that you're gonna be talking to you want to know everything about that person you want to be following them on LinkedIn you only follow on

Twitter if you can find their Facebook page see if you confront them you need as much background information as I that person as possible because you need to make an approach that is going to stick in their mind so if for instance you are dying to be a placement person for next academic year and you happen to rock up at a testing day when I'm at one of my new GT cars and talk to me about GT test you're gonna stick in my mind and I'm going to remember you for that time when you then email me and say hey it was really great to see you at the right at the race circuit are you going to be

looking for a placement shooting next year so an interesting approach was quite impressed but you want to find a way in now if you're gonna do it cold you're gonna flow you talk to any salesperson and I'll tell you if you send a cold email most time it's going to go nowhere if you send the warm email you're on a 50/50 chance of it ever being read if you send an email that that person's expecting you've got a much higher chance so you've gathered a lot of information about the person that you're targeting now look at the people that they connect to do you know any of those people so for instance if you come after me

do you know Chloe do you know Stuart can you get one of those to introduce you to me it's a lot warmer playing this it's all social engineering it's all reconnaissance and numeration so recon your target basically exactly what you do at a normal test find out as much as you can about them and prepare your attack so work out how you're going to make that project build a portfolio your work if you're going to send me a CV I'm going to read and you get me to read that CV and you'll see these sucks ass you're going in the bin if you send me your CV and you send me a portfolio your work so you've gone off and done some

like CTF thirty six five and you're a kick-ass report on a cross-site script in the sequel injection attacks is an example of your work it means a massive amount attest it to me you could be one of the greatest technical testers that exists if you can't write a good report you're worth fuck-all to me you have to be able to put what you've done in the testing world into the real world and you've got to be able to word it well so that you can then communicate that to the client right launch your attack so these this kind of works said the amount wait see what happens but don't wait forever I'm not going to chase you wait

said of those that follow up and funcle' then maybe help up on social media try LinkedIn try Twitter if you're not getting any engagement and this is the company you want to work for try again and keep trying start engaging with them if you want to go market pensive partners engage with PT PT on Twitter if you're a work at NCC hem up all the time start getting into conversations it makes you memorable if you're memorable that doors gonna open quicker most importantly never give up we are horrible people to try and get a door open to because we're really busy but just don't give up if you keep trying you know at some point your

name's gonna stick in our memory and we're gonna go that person's email me a few times I'm really keen let's actually start conversation with them right so things not to do here's the fun stuff if you're sending me an email do not title it sit dear sir/madam I'm binder I am binary non-specific so good luck there do you mr. Peter puzzle oh for God's sake no do not do that and the next one was hilarious dear Ken Monroe for Gus like I'm not Ken the same person is hermia followup with dear Tim Holman hello I'm not forwarding your emails for you attention to detail and things if you've done the [ __ ] the recon first you

know about that person so you'll be able to work out how to address it I think Chloe started his/her opening mom was hey Paige how are you today nice nice and informal that's pretty much how I kind of communicate if you're going to attach something do not send me a docx file a PPT hell no and don't so many a zip file or any other form of archived PDF is acceptable text is fine but yeah PDF them all equally if you're going through a recruiter just make sure your recruiters not doctoring your CV because one of my favorite tricks is to do a shot some of your CV versus what the recruiter sent me because I love

comparing them and seeing whether they've been doctored or not I don't try and fish me by sending me a blank extension file it happens quite a lot so I'll have CV dot nothing at all you're not gonna get read on top of that I don't use Windows as kind of this really demonstrates I've got no idea right really bad examples of emails make it flow but kind of get over what it is you won so in this email this such a really good example of a generic email you know there's nothing really that's wrong with this it just doesn't stick in my mind it's not interesting and it doesn't really do it for me but this is probably a good a

good example of a average email come on down okay way dumb one this is hilarious and yeah I love one-liners I come from the old school of Perl cut Perl scripting if I could put on one single line I will that's not the way to set an opening email with this one it was really really interesting in the fact that I think they'd lifted a template from someone because they had someone else's name at the bottom before light on so main to was different to name and I was like come on attention to detail please you want me to employ you that's not going to work yeah so yeah more examples right so you actually get me to

open your CV and read it the first thing I'm going to do is I'm going to unleash spider fill on your ass I'm going to background you like you've never been background before I'm going to know everything he's post on the Internet I'm going to drill into your social media I will find as much information about you as possible basics I'm interested you've got me interested so now I'm interested to you who are you so if you're for social media is full of I hatched this he you know straight away you're getting deleted tweet number two is hilarious I'm supposed to be at work on putting a sickie that really tells me that you're not actually that interested

build up your profile before you start going hitting people up so start putting really good posts on LinkedIn get yourself a good blog doesn't matter there's only five or six things on there but if they're interesting in a purse you know it's really gonna help you don't claim to have things that you haven't got if you have an OS if you claim to have an RCP number I'm based in Gibraltar so is off sick it's a very simple conversation for me to validate you have an OS CP number equally I'm a fellow of the British Computer Society really simple for me to phone up and go this person are they a follow no ok I won't

talk to them so just be honest if you've got no experience at all and you're just really passionate about InfoSec and pen testing that doesn't matter just show you're passionate you don't need to go and try and embellish it on five ways to [ __ ] up an interview dude I hacked your wireless yep that's fine it means nothing to me and you didn't have my permission so you can make it a crime that tells me a lot about your mentality towards what it is you're doing if you've got a country an interview a lot of my interviews are really random they will be over lunch or they I might send a longitude and latitude and tell you that's where I

want you to meet me it's going to be something interesting you have to look into it I might say I'll just million spoons by Manchester translation yeah at midday now your job is to find me okay being a pen tester means using your intelligence and using all the tools your disposal to come up with the answer I'm not going to give it to you on a plate and I'm starting to see a lot more companies do this now they're not going to say I'll come to our offices at one o'clock for a formal interview it's going to be a lot more random so great one example so this particular person understood who I was men stood

everything about me they've really gone into down from my background identified how to submit CV to me worked out they couldn't do it and subverted that systems or I put in a challenge on my website which has had it was three different steps no four different steps had complete and one of the steps I'd deliberately broken paint was a third step this person just as a vert enter mother you know I don't think I could do it his CV with a really nice covering email you know it worked engage me over that sometime do enough relationship understanding who I was was looking for and what the role entailed and early on started in negotiations two

ways they wanted to get out there join us for lunch and got the job it was quite that simple I'll make it sound simple so this was this is a exit example of a nice opening email an introductory mo that wasn't call that wasn't cold so it's in the warm area which was nice and above all never ever give up keep trying and if you keep trying you will crack it and if you ever get stuck do I think ping ping me a message advice is free if you want some ideas on sitting on your CV whether it looks good if you just really stuck and Kong get your head around how to make that

opening approach just give me a shout I can give you some pointers I won't give you the answers but I'll point you in the right direction I can critique four things for you so there you go a quick introduction into possibly breaking into pest Pam yeah pen test them questions over to you guys drill me for free that could also work see that's another that's just another way of doing it yeah I see you could quite happily do that right so if your LinkedIn says you currently work for someone else there was actually a specific example of that they were working for a different testing company but the task of them selling far worse on but if they're

working full-time somewhere else why are they looking for a pen testing internship it's just one one of those things it really doesn't make sense if you've got it you're going after a specific internship theoretically you're going to be putting a lot of time into your studying if you're working somewhere else and you've got really good reasons around that then that's fine but don't I wouldn't make an approach Antwoord basically I wouldn't make an approach knowing that I'm working full time and not disclose it so I'd be really open with it right for the outset so I'm where I'm working in this environment here really considering pentesting as a career I'm looking for an internship understand that I would I would need to

step away from my full-time role and I'm making you making it opening like that a hot email coming down to the British GT hanging out there talking to me about racing and then dropping in that you're looking for a internship after you've been like three or four times and you kind of got to know me and got to know him a team equally another hot way of doing it is just super said back will come up to reception but cannot reception already knowing some of the team so coming in just hanging out with some other team shooting pool joining the team down the pub going to be sides and go to the ups show party and having

a few drinks and getting to know the people it's all about knowing people it's all about social engineering and engineering the outcome that you want to you desire animal sure sorry done well might look for in a person someone who's outgoing reasonably confident within the specs of the industry because I know like most of us are socially awkward people drive ambition someone who really wants to learn someone who's got an identified area of passion so it could be that they'll really really interested in doing random [ __ ] with raspberry PI's it could be that they're really really interested in web technologies but it's just how having something that is more than yeah I saw Penta thing I say it pays a lot of

money and see these would you say that he would like search engine optimization probably they won't say if you're going for one of the big bigger corporate companies it still makes a lot of sense to target the person that has the overall say the decision maker at the end of the day if you can I get it way back Christ in about twelve years ago talk did the specific person that I wanted to work for and got them to a point where when the CV went into HR it got read because they'd already said oh we've had I've seen this guy you see these really really strong and he's got the experience so it's just a

case of promoting yourself a tea here really it's kind of like marketing yourself and just making sure that your own brand image is at front of the people of mindset making decisions to do to hire damn much again to marketing

I'll either you are evil I hate recruiters you know that and you're a cruise in the audience awesome right so I know I'm going to charge you thirty five percent of your salary to come and work for me no recruiters want so if you're on say fifty you want of salary 50 grand recruits gonna want to charge the company recruit you 35 percent on what to give them the CV it's just like no recruiters are evil don't you use them you know it's a good way to get your name out there it's a good way to find it easy or easier jobs but I don't go straight to the companies instead it's much easier recruit us a

horrible people sorry I can feel the lightning you know me too well I'm not telling you okay guys that's it thank you very much