The DMZ

forest

1:34 AM

@Azteca Keep authenticated backups.

That includes of the router.

forest

2:54 AM

Gillian, UK

1 11

assembly brute-force buffer-overflow c cookies malware one-time-password

Huh, this guy was suspended? He's always been very courteous from what I've seen.

A multi-month suspension seems kind of harsh.

For such a new user, I worry that this will turn him off of the site.

daya

7:00 AM

Hi, everyone can i start a discussion related to my career?

Kepotx

7:11 AM

well, I think chat is the best place for that, as it would be off-topic to ask it on the main website

Anonymous

@forest I am not sure why he was suspended

Anonymous

But this is the same guy that got mad at me for telling him his wording was incorrect.

Anonymous

Not that I even flagged that comment as I found it funny more than anything.

Anonymous

But it is him.

Kepotx

well, even if that kind of comment get flagged, it doesn't worth a multi-month suspension...

Anonymous

7:23 AM

Exactly.

Anonymous

But, it could mean he did a similar/worse thing on other occasions.

Anonymous

And as I mentioned yesterday the comments were all cleared on that post so I wonder what happened...

daya

7:54 AM

So, i am a beginner in infosec field, to become a successful pentester one day, i have two ways(researched from all sites and articles etc.) .

First one is go through all certs i.e, comptia+, network+, ccna, security+ and finally CEH. Second approach is study all necessary programming languages(C, python) and some web dev(html, css, js. php and mysql), operating systems, tcp/ip, cryptography. So, for me,second one is best but the thing i am worried about is without any cert, will i get any job in this field?

Anonymous

When you say CCNA which CCNA?

Anonymous

R&S?

Anonymous

Security?

Anonymous

CyberOps?

daya

i heard that CCNA is somewhat same as Network+ isn't?

Anonymous

7:56 AM

It depends which one you do.

Anonymous

I have a CCNA in R&S which is Routing & Switching so I guess you're referring to that one.

daya

I referring to which would help me to be a successful pentester

Anonymous

Well Routing & Switching probably won't help you that much then.

Anonymous

I wouldn't do a CCNA at all, I would just do the CompTia Network+

Anonymous

If you do a Cisco cert. you're pretty much only learning Cisco technologies, it is slightly different with the CCNA R&S because there is two exams but I wouldn't bother with a Cisco cert. at all.

Anonymous

7:59 AM

As a pen tester I cannot see a time where you will need to know the inner-workings of Routing & Switching.

Anonymous

Networking you will need to know.

Anonymous

How to configure BGP? I doubt it.

daya

So that's the whole point do i really need to do any certification?

Anonymous

Well, certifications help you get your foot into the door (the interview door) but they don't prove much past that.

daya

i mean i can study all without any formal cert

Anonymous

8:00 AM

Unfortunately we live in a world where without certifications I am not sure you will even get an interview.

Anonymous

Certs get you the interview, knowledge gets you the job.

Anonymous

I got lucky with getting my job without any certifications straight of school.

Anonymous

Really lucky.

daya

So i will need to acquire all certs related to security? Can you please name some most important which will be worth to take.

Anonymous

I am not the best person to ask for job advice, I'm really young with not much experience. It's just I thought I would chime in on the CCNA stuff because I myself have a CCNA in Routing and Switching.

Anonymous

8:04 AM

Not all certs that would be silly. Nobody has all certs most of them require refreshing so you couldn't keep it up if you had all security certs.

Anonymous

As I said, I am not the best person to ask for job advice because I'm really young with not much experience at all (First job); but I do know without any certs you will struggle for recruiters to even give you the time of day.

Anonymous

After all, almost everybody uses recruiters now so the recruiters are the initial judge and if their clients requirements are "OSCP certified" and you're not OSCP certified then the recuriter will not even speak with you.

Anonymous

That is the problem with recruiters they usually dont have any way of finding out your knowledge beyond your certs, qualifications, years of experience. You could know everything there is to no about security but if you've never had a job in it, never got a cert how do they know that?

Anonymous

You cannot just tell them everything you know as you don't have any evidence. Which us why certs get you into the interview so you can show the employer what you know.

Anonymous

Rather than trying to show the recruiter.

daya

8:08 AM

Yes, i agree.Thanks for so much guidance but looking forward for attention of more experience users.

Anonymous

No problem. Yeah you need someone who is actually worked a few years I am not that person.

Anonymous

Someone with wisdom. Like Rory0. @RoryAlsop

Anonymous

Rory gave me some career advice before actually he has a very good video I am sure he will be happy to send it your way.

Anonymous

I would but I don't have it to hand.

daya

Actually i am undergraduate student ( BTECH in comp science) is it good start?

So at this point i am not actually looking for a job instead trying to acquire necessary skills.

Journeyman Geek

8:12 AM

@daya tbh, finding a job's a lot of luck and contacts

especially as an undergrad

daya

@Jour

*sorry

Journeyman Geek

If I'd give any advice whatsoever , talk to seniors, go to job fairs and talk to folks...

they can also tell you what you need to know in a specific place

Anonymous

^

daya

@JourneymanGeek for now i am not looking for a job, the question was, in future when i would acquire all skills, then without any cert will i can get a job?

Journeyman Geek

You can never acquire all the skills

Anonymous

8:16 AM

And its unlikely you'll get an interview with a cert.

Journeyman Geek

gotta think about it this way - the main people who will look at your list of certs is HR

Anonymous

^ or recruiters who don't even work for the company and have a list of reqs.

Journeyman Geek

in real interviews they'd ask you about your experiences, or even test you

Anonymous

And you don't meet those reqs they wont forward you to HR.

Journeyman Geek

hah

My current employer is a body shop...

Anonymous

8:17 AM

In England recruiters are really big.

Anonymous

So good luck getting even a phone interview without a cert.

Journeyman Geek

heh

@JoshuaJones You can still skip over those if someone recommended you

Anonymous

That is true :D

Anonymous

Basically how I got my job.

daya

I heard that practical knowledge is more important in infosec than so called "certs". But anyway it would be good if someone can guide me what certs to take and when.

Anonymous

8:20 AM

Well knowledge is always more important.

Anonymous

Technically a cert doesn't mean you know the stuff.

Anonymous

It's easy to cheat most certs.

Journeyman Geek

@daya well, you need to be able to show that knowledge

daya

@Ofcourse, i will be one day!

Anonymous

Certs are good because they instantly show a company / recruiter that you should have a good idea of what you're talking about.

Anonymous

8:21 AM

But they only go so far.

daya

again typo @JourneymanGeek

Anonymous

Having a cert doesn't mean you necessarily have the knowledge your cert shows.

Kepotx

with certs and diploma, it's much easyer to be a candidate. but only real knowledge/skill will make you the accepted one

Anonymous

^

Anonymous

Cert gets you into the building, knowledge keeps you in it.

Kepotx

8:23 AM

exactly

Anonymous

The amount of "CCNP" engineers we get applying here that aren't even CCNA level.

Anonymous

They're not even close to CCNA level and they own a CCNP. Just goes to show how certs can be misleading.

daya

What would be better say, i want to study networking from which i should study a network+ book or a good networking book(like james f. kurose)?

Journeyman Geek

@daya depends on what you want to do.

Personally I'd grab a book, and a reflashed router with the stuff you need, like vlans, and hack at it

Anonymous

" 2 Security is still a vast topic - 19h ago by M'vy "

Anonymous

8:26 AM

You need to figure out what type of security you're interested in.

Anonymous

Because you cannot know everything there is to know about all the topics. You need to pick some and work out which ones you enjoy the most.

daya

@JoshuaJones what i want to become is the individual who is able to penetrate a remote computer or server and can pentest on web application.

Anonymous

So in-terms of certs you have the OSCP.

Anonymous

That is HIGHLY regarded as a good cert. Maybe look into it.

Anonymous

^ for pen testing.

Anonymous

8:30 AM

Then you have the GIAC GPEN cert.

Anonymous

Another one that is regarded as excellent for pen testers

Anonymous

Obviously as you're a student cost could be an issue.

M'vy

What's your current status? Student? Employed? Unemployed?

daya

What are the prerequisties to take such certs? i have heard about OSCP which is really good.

Anonymous

He's a student Mvy. Undergrad.

daya

8:31 AM

Yes there is cost issue.

Anonymous

OSCP requires you to take the PWK course.

Anonymous

Once you complete that you have I believe 90 days to book the exam.

Anonymous

Exam is £60 per retry but you must take the PWK course.

M'vy

Find a uni that teaches infosec then?

Anonymous

^ Thats a good way.

Anonymous

8:32 AM

If you like that kinda' learning.

M'vy

Well, as you said, knowledge is everything.

daya

In India, there is no university which specifically teaches infosec. Only a cs/it degree.

Anonymous

Can you not emigrate?

M'vy

Lean your stuff, programming, networking, cryptography, security, then you can worry about applying it and get certs

daya

@JoshuaJones i can't!

Anonymous

8:35 AM

That's unfortunate. Usually if people cannot find a good course in their country they move to go to a better uni, etc.

daya

@M'vy that's the point at which i get frustrated sometimes. like:- networking which is most important to study but what topics to study actually? Since networking is very, very vast.

This applies to all stuff

Anonymous

Well it depends how much you like networking.

Anonymous

If you want to pen-test you won't need to know CCIE (Or equiv) level of Routing & Switching.

M'vy

Pentesting requires a lot of skills

daya

I only like to know about protocols and no hardware stuff

Anonymous

8:39 AM

No hardware at all?

Anonymous

What about firewalls?

Anonymous

Or even just how switches & routers communicate.

daya

No, i mean only necessary things without going to much details.

Anonymous

Comptia Networking is good for that.

M'vy

You need to be curious about just everything, but you don't have to know all about it

Anonymous

8:40 AM

And they're not vendor specific.

daya

@M'vy ^

M'vy

This being said, there are some things you'll find over and over again

daya

@M'vy that's the point at which i get frustrated sometimes. like:- networking which is most important to study but what topics to study actually? Since networking is very, very vast.
This applies to all stuff

M'vy

most likely network related, scripting, etc.

You need to have a good grasp of how networks operate

Anonymous

OSI model is a good start.

M'vy

8:42 AM

pretty much all the OSI layers.

Anonymous

^_^ - great minds.

M'vy

^5

daya

Yes, i am studying it

Anonymous

Do you know about TCP and UDP?

M'vy

then ofc, all the internet protocols

daya

8:43 AM

Not much

M'vy

TPC/IP/DNS...

Anonymous

Well that is another good start considering it's everything.

daya

just started with application layer.

M'vy

probably a must have since all pentests are usually remote

Anonymous

You need to know your basic cmdline usage for networking is well.

Anonymous

8:44 AM

Ping, traceroute, ifconfig, etc, etc.

daya

i know that commands ): but didn't actually fully understand their outputs.

Anonymous

Man pages are a good start then :D

Anonymous

Windows & Linux

daya

i am comfortable with both

Still looking for a more experienced user who can tell more things about(my future concern) Can i get any job in infosec without any cert? Becasue as a student i can't afford their costly certification exams.

Thanks @M'vy and @JoshuaJones for guiding me

Anonymous

No problem.

Anonymous

8:56 AM

In regards to the cert, I am not from your country so I don't really know your countries opinion on certs but in this country at least - it requires a lot of luck to get a job without a cert.

Anonymous

But your countries view on certs could be very different.

daya

"This" country means your country?

Anonymous

Yes.

Anonymous

In the U.K certs are everything to recruiters and usually mean a lot to the company.

daya

BTW you are working as pentester?

Anonymous

8:59 AM

But that is our view of certs. Or at least the general view of certs but every company is also different.

Anonymous

No. I am a network engineer.

M'vy

nope

currently working as a R&D eng. for medical device

daya

okay

Actually, i read somewhere" to be a successful hacker you have to go through hell" and i am realising it as i have to study a lot!

Anonymous

Meanwhile I spend all day staring at small black windows @M'vy

Anonymous

It's more than "a lot"

Anonymous

9:04 AM

You never stop learning.

Anonymous

Even when you're the top of the field you will learn that's just life.

Anonymous

There is always more

daya

@JoshuaJones i agree

M'vy

hopefully yes

If you have the occasion, get involved in CTF

daya

Actually, in starting, i used to play with kali linux for about a year.

But later realised that it would never get me anywhere

M'vy

9:08 AM

Gee PWK is 800 USD?

daya

So now i am really serious about infosec(particulary to be a penetster one day)

@M'vy i can't get involved in ctf

Anonymous

What about Wargames Daya?

Anonymous

Or HackTheBox.com, etc?

daya

because at this point i don't know anything except some programming languages and basic linux skills

M'vy

There are easy ones, ones you can do for free, and ones you can team up.

daya

9:12 AM

Then i can try):

Still looking for a more experienced user who can tell more things about(my future concern) Can i get any job in infosec without any cert? Becasue as a student i can't afford their costly certification exams.

M'vy

In theory, you can get a job without knowing the first thing about it. How realistic is this though...

Ideally you want to get a diploma from a uni teaching the field you want to get a job for

So you can vouch for your skills in that domain

If you really need some certification level, it is not unheard of to have employer pay for it after

especially if they recruit post school

Anonymous

Daya if you have basic Linux skills attempt the Bandit labs on OverTheWire.

Anonymous

They are all just Linux based, they're not that difficult at all just requires knowledge of working around files, cat, base64 stuff like that.

Anonymous

It's really simple.

Anonymous

And it will get you in the mindset of thinking "How do I break X"

Transcript for