Thread by @CristiVlad25

2023 Hacker's Guide: How to Break into Pentesting and AppSec.

(thread)

1. Hands down, one of the best practical resources is @RealTryHackMe. I would take the "Complete Beginner" learning path, then the "Jr. Penetration Tester" path. It will get you off the ground in no time.

tryhackme.com/path-action/be…

2. Simultaneously, I would practice at @PortSwigger Academy. Personally, I'd focus on all things Broken Access Control.

portswigger.net/web-security/a…

3. Read reports and writeups on @PentesterLand. This is by far the best place to see the real impact of security issues.

Read, take notes, then apply what you learned.

pentester.land/list-of-bug-bo…

4. Participate in VDPs and rank on their leaderboards. Don't do paid bounty programs!

The goal is to become a pentester, who gets paid good money on a frequent basis, unlike a bounty hunter.

5. As your rank on HOFs/leaderboards and as you become experienced in finding security issues, apply to pentesting and appsec-related jobs.

PRO tip: Link your HOFs and ranks in your resume. It's the best showcase of skills. Nobody really cares about your certs.

6. Contribute to open-source security projects and publish your scripts (yes, learn coding!) to your GitHub profile. That goes perfectly well into your resume, as well.

You also give back to the community this way. You're a giver, not a taker.

7. If you enjoyed this thread, there's much more to come! So, stay tuned.

Motivate me to continue posting by liking, retweeting, and following me @cristivlad25.

#pentesting #appsec #infosec #cybersecurity #hacking #bugbountytips