Task Hunting? Become Away….😤

And then after you go an OSCP you expect jobs to just start raining on you after you lot stamp that OSCP in your resume and showtime sending information technology out. Yea....no. If you're like me and all you take is OSCP and Hackthebox in terms of network security experience job hunting tin be admittedly excruciating. The interviews process can make you experience like you know admittedly aught; which is partially true if you were like me at the fourth dimension. What you don't realize later on you lot become that cert is that yous will exist interviewing with hackers who accept been hacking since before Offensive-Security (the company) even existed. On summit of that, you almost always will be interviewed by a panel of netsec folks who can detect BS a mile away and know the answer to every question they're asking you both inside, out, backwards, and frontwards.

"Oh then in OSCP you learned how to do SQLI attacks; good how do yous mitigate them…? Oh you didn't acquire that yet? Goodbye, adjacent candidate!"

Like, for real. Things can be pretty brutal. Often times it's the pentesters themselves giving the 'yay' or 'nay' too and so often times my potential wasn't considered. No one cared that I just one mean solar day decided to become a hacker and just did it out of pure passion and interest. A lot of times they look at, what you know, who you know and what can you hack, and that's information technology. What helped me out a lot was getting into bug bounties which entailed a lot of web app work. Another cardinal thing I was doing was using all the interview questions as study material for the next interview. When I kickoff started out I failed many opportunities at getting a job. Sometimes I would become three rounds and lose, 😩 but don't give up!

Yous found a nice wallpaper!

Really getting a job….🔨

Once yous actually go a job as a pentester (specifically at a pentesting company) information technology'south like joining the special forces or something (bad illustration). Instead of taking funds from your retirement account just to pay for more lab time in hopes of MAYBE getting a job in the afar future, you now accept an entire enterprise designed to get you, yes YOU, in position to hack some huge company's network, write a study, and evangelize information technology to the client. Everything that's in the department designed to improve your hacking skills and abilities and make yous a more productive pentester. Instead of hacking alone in your office or basement y'all now are surrounded with hackers, and if yous're blest, friends who accept been doing this since yous were in diapers (metaphorically and literally in some cases).

Training yous say? You want more than training after OSCP? Just make full out the course and take the course! Continue your retirement funds.

It feels like going from Golds Gym to an NFL conditioning facility; best way I tin can describe it. Obviously you make it and realize how footling yous know, I think that goes without maxim at this signal, but y'all acquire a tremendous corporeality in a brusk amount of time. Yous larn how to speak with clients, the business organization life-bicycle, reporting and documentation, and of course hacking skills. To exist honest I didn't really realize how much I learned until I spoke to someone who I did OSCP with who hadn't gotten a pentesting gig still. I could pretty much flood them with things that I was able to pick up from working with other hackers [ Shoutout to Radioboy ].

Hacking Huge Companies 🌆

Another affair y'all probably haven't thought about is the clients. Information technology's possible that you, yep You, could be placed on some huge company'southward internal network and tasked with "hacking them to pieces." It could be a eating house chain that yous just ate at concluding night or a huge tech company that you buy products from often. Can you imagine shelling some of your favorite companies and dumping the hashes of their entire Advertisement onto your terminal? There'south not many feelings that are better than passing OSCP if you're in this manufacture but doing that NEVER gets one-time!

Furthermore, their networks are commonly a lot more dynamic. So instead of hacking in a /24 network you could exist assigned multiple /16s or more than all with a diversity of vulns and exploits for y'all to savor. Information technology'south like hacking a Rain Forrest of hosts (lol). Yous'll be exposed to all kinds of networks as well, standard Windows Ad networks, AWS, Azure, and on and on. You'll as well have to piece of work around different antivirus solutions besides similar Sophos, Carbon Blackness, Splunk thing etc. etc.

I'one thousand going to be doing another blog about some of the uncomplicated things you should know staring out as a pentester which will touch base of operations on some of the specifics I've learned, don't worry 😉.

The Disappearing Act 🎩

When I was going through OSCP I used to wonder why information technology seemed like pentesters had such little time. What could it possibly exist that almost ever drives people from forums and channels where they once spent a lot of time? Now that I am a pentester I tin tell y'all: A lot of it due to the documentation associated with doing consultant work. Ofttimes times, with these super fun assessments, pentesters must construct long and detailed attack narratives for clients to read and digest. Sometimes these reports can exist super long and the last matter you'll want to do is hop a chat room and blazon more than than you already have to.

Also, a lot netsec chats talk about overcoming problems you encounter in the wild. "Hey does anyone know any tools that can be used to bypass AMSI?" But these kinds of questions can now be answered past the peers that you work with reducing the need for these types of conversation rooms fifty-fifty more than. You've already been talking about Bluekeep with your neighbors, why have the same conversation again online?

Some other factor is the learning aspect. Some engagements crave 100 percent focus and hours extracurricular enquiry. On top of this, sometimes there'due south a cert that someone wants to pursue and that too diminishes the time you come across that person online. This isn't exclusive to pentesters though. You lot may be experiencing that yourself as you go through OSCP or another cert of involvement. Fourth dimension can commencement condign an enemy and ofttimes times a way to combat that is letting social media, forums, and chats go. 

                      ########                  #                       #################            #                    ######################         #                   #########################      #                 ############################                ##############################                ###############################               ###############################               ##############################                               #    ########   #                  ##        ###        ####   ##                                       ###   ###                                     ####   ###                ####          ##########   ####                #######################   ####                  ####################   ####                   ##################  ####                     ############      ##                        ########        ###                       #########        #####                     ############      ######                    ########      #########                      #####       ########                        ###       #########                       ######    ############                      #######################                      #   #   ###  #   #   ##                      ########################                       ##     ##   ##     ##  Metasploit'south ish

If anybody has any questions about this hit me up on the tweets! @Clutchisback1 I am by no means some expert on this topic just wanted to share my personal experience for those who wonder what the transition was like for me. It really is better than what y'all can imagine, especially if you're at a job where you tin can't use your hacking skills...OMG...yous'll love it! Keep getting later on it and studying if you're in that transition phase looking for a task after OSCP. You'll go something if you don't give upward; Have religion!