Currently I am potentially facing impostor syndrome in regards to the role and skillset of blue team members (defence) and red team members (attack).
I personally specialise in defence capabilities, such as secure system design, secure programming, secure website architecture, etc.
For example, I have a thorough understanding of how to design a website that is resistant to cross-site scripting, using techniques such as Content-Security-Policy, sandboxing, etc.
However, I have limited experience with actually performing cross-site scripting attacks. I am aware of, but not familiar with the various techniques, WAF bypasses, etc, and I would definitely find it challenging to construct an advanced XSS attack right this second without some prior research.
It seems within the security community that red team members (pen testers, etc) have all the knowledge of the defence people, and they have 'ranked-up' and proven themselves to be good enough for attacking.
My question is whether there really is a distinct difference between blue and red teamers in regards to skillset and experience, or are all red teamers just defence people who have got through initiation and are now doing the trendy hacking stuff?