5

I'm someone who's distant, industry-wise, from technology. I'm actually in the medical field. That said, I'm very interested in technology and specifically in information security.

I'd like to make a roadmap to be a professional Pentester and may eventually switch careers (I'm 20, so that wouldn't be life changing per se), or the more probable possibility to be a professional Pentester of hospital networks and medical services (that way I can work in both jobs which is what I want).

So, as I said, I need to make a syllabus for beginners to professional Pentesting as self-study material for anyone following the same path.

I currently have a plan to study courses in:

  1. CompTIA's Linux+

  2. Courses on Kali Linux

  3. CompTIA's Network+

  4. CompTIA's Security+

  5. EC-Council CEH

Note that I don't program in any language! Would you suggest adding programming courses, and which one? And how do evaluate this study plan?

Note2: This guide is not personal, it's general for ANYONE starting Pentesting. I hope it doesn't get deleted :(

EDIT FOR MODS:

So to narrow the scope of the question I'll add that this discussion hopes to produce a battery of opinions about the best way to approach Pentesting as a career for someone who doesn't have the ability to aquire a formal degree in the field or in Computer Science. The student/enthusiast will form his own personalized syllabus based on the opinions and experience (((which an outsider like me can't get ANYWHERE else due to not having the exposure to people in this field. I don't think there's one specific answer or one-size-fits-all model to learn any subject, and thus I think this should be open for discussion about experiences in the field and how to go about the path to learn.)))

To narrow it further I personally need to be a network and web apps Pentester. My interest here in these two specialties is derived from the fact that hospital networks are proven (by a security researcher) to be extremely vulnerable. And almost all devices on that network are also vulnerable. There are also some emerging technologies in Medical Social Networks and online medical apps with sensitive patients' data, I see a market or a career for such experience in the medical information field.

So to rephrase: What is a path you, experts, advise an enthusiast to pursue for a career in Network and Web Apps Pentesting?

  • Closed as too broad, but this is also off topic as it is down to opinion. You will see from various questions on this topic, that have been well structured, that this isn't suited to the Stack Exchange format. – Rory Alsop May 22 '14 at 10:18
  • 1
    You could look at the universities that do provide this sort of thing, and copy their syllabi. – Rory Alsop May 22 '14 at 10:19
  • University isn't an option since I'm in medschool. – Mars May 22 '14 at 13:28
  • 1
    Mars - I didn't suggest going to uni. just look at their syllabus – Rory Alsop May 22 '14 at 13:30
  • Oh my bad, you're right. This is a valid approach as well, though I'd prefer to see the hands on experiences from people as I've known from experience that academia is not a good way to learn. It's a way to certify one to start learning. – Mars May 22 '14 at 13:56
7

The list looks good and you seem to know where you want to arrive at. However, because the literature is so huge, what you may reckon as a good resource for you, might not be the best for someone who has other priorities, such as web, instead of hospital security testing. In this way, it becomes pretty hard to answer your question on a general list for everyone. You would benefit a lot more not on the actual material, but on the methodology. It is much easier to adapt an efficient methodology to other people's needs and let them decide which syllabus they should go hunting.

For my learning, for instance, I have thought of all subjects I needed/wanted to learn in order to improve my knowledge and skills. Obviously, because I cannot learn everything, I had to prioritize them into these high-level categories:

  1. Languages
  2. Networking
  3. Operating Systems
  4. Databases
  5. Web
  6. Cryptology

So I devised a way to maximize the time and efficiency with which I learn those subjects. During college and university, I usually had two subjects per day. I would have classes in the morning and by 13:00 I would be back home and ready for my afternoon independent study.

I would first start my study at home by revising what I had seen on that day. This is one of the most important stages (revising what you LISTENED at college, because when you listen passively, you don't really learn, you mainly introduce what you will learn at home). This would take most of my afternoon. Discipline is vital and as it is very difficult to focus on the same subject for too long, I was (and still am) very rigid with time. For every 45 minutes studied, I would take an exact fifteen-minute break. Then I would carry on for another 45 minutes, followed by another break. By 17:00 I had finished studying the stuff from college/university. I would have a longer break and then start my own study on one of the subjects above; one subject per day. I would start around 18:00 and allow myself at least one hour for this study: sometimes I would go until 21:00. It doesn't need to be hard reading. If I was studying Operating Systems on one evening for example, and all I did was to install a FreeBSD VM and set up a user account, I would already consider that as a time well spent studying, as a lot of experience is gained troubleshooting the blockers we find on our way.


As for how I approached these subjects, here is what I have to say:

  1. For languages, I would suggest you start with a higher level such as python for quick learning/results. However, those languages take many shortcuts, so if you really need to learn programming, also study C. If you understand those two languages, all others are just a matter of time.

  2. Networking. Set up VM Labs and play with Wireshark. Understand how the protocols work at a lower-level. Play with packets, modify them and see the results.

  3. Operating systems. I would suggest focusing on FreeBSD, Kali and obviously Windows.

  4. Databases are pretty important too, start with MySQL

  5. Build your own website, create a VM with FreeBSD and make it secure (as part of the OS study). Deploy Apache, make your first web-site, implement a login functionality and integrate it a database. Hack it, break it, nuke it, rebuild it all. OWASP and is your best guide.

  6. Crypto - Schneier is the best place for you to start

The point to take is that 1) you first learn about the subject itself (OS, databases, etc). 2) Then you learn how they interact with other components (a web server integrated with a database). 3) Then you learn how trust between these components works and how they can be abused, so that 4) you can secure it. Nothing stops you from learning all these four points in parallel, however the logical order is more or less that.

To actually answer your question, there are plenty of good resources. To name a few:


Tl;dr - There are plenty of resources out there. Knowing which one is right for you, and how to maximize your learning is where the wit lies.

  • @Mars - you are welcome. You might need some certifications to get your foot at the door; it will usually be a Junior level entry, which is a pretty crap pay. Your proposed time-scales above might be realistic, but only if you are gifted or austere: it will take a few years until you start becoming confident on your skills. Also, if you are not into travelling too much, the life of a pentester can be pretty chaotic: bad hotel food, not much rest and pressure from clients. Pentesters with lots of experience usually manage to work solely from home or under the conditions they choose, though. – Lex May 22 '14 at 15:27
  • // , Upvoted for Python and Schneier. – Nathan Basanese Nov 12 '18 at 21:30

Not the answer you're looking for? Browse other questions tagged or ask your own question.