A penetration tester (pentester) specializes in testing the cyber resilience of organisations’ IT to prevent cyber attacks. Similar to a malicious hacker, a pentester tries to exploit vulnerabilities in IT systems. The difference, however, is that a penetration tester only verifies, reports, and helps remediate vulnerabilities, but does not abuse them for criminal purposes.
In order to become a pentester, you need extensive knowledge in IT security and a variety of qualifications. This can sound a little challenging, but don’t worry, we have collected a few tips that will help you on your journey to become a penetration tester.
In this article you will also find some exciting insight from longtime penetration tester and CTO of bugshell, Inko Lorch. Bugshell is a platform for european cybersecurity experts that focuses mainly on penetration testing. As long as you are an EU citizen and already gained some experience, feel free to send us an application via our website! We appreciate every new member in our community and strongly believe that our bugshell family can share some helpful knowledge.
What is the role of a penetration tester?
Pentesters check computer systems, networks and applications for vulnerabilities. In doing so, they take the perspective of a real attacker. Based on the results, an action plan is presented to the tested organization in order to remediate the security vulnerabilities.
Penetration testing is a part of ethical hacking, in which good hackers (white hats) perform a variety of different tasks such as bug bounty hunting in order to strengthen the cyber resilience of organisations. This is the opposite of malicious hackers (black hats) to leverage their hacking skills for criminal acts.
The difference between penetration testing and other ethical hacking methods is that a penetration tester is paid for a specific time period to attack pre-defined targets. This allows penetration testers to test systems in the internal network of a company, hence, making it the most realistic cyberattack simulation.
So what responsibilities might a penetration tester have in an organization? Is it financially attractive?
Some of a penetration tester’s task are the following:
- Project acquisition & scoping
- Reconnaissance
- Vulnerability assessment & exploitation
- Source code reviews
- Reverse engineering
- Social engineering attacks (e.g. phishing)
A penetration tester’s average salary in 2023 in Germany is:
- < 3 years of professional experience = €51,000 p.a.
- 3-6 years of professional experience = €67,583 p.a.
- 7-9 years of professional experience = €70.369 p.a.
- > 9 years of professional experience = 80.945€ p.a.
In the following you will learn some basic tips on how to become a penetration tester. To discover more in-depth information about penetration testing, check out this article.
Tip 1: Learn the basics of penetration testing
Of course, a university degree in IT, cybersecurity, or computer science makes sense and facilitates entry into the working world of penetration testing. But, it is no problem if you have acquired your knowledge yourself as a career changer or autodidact. In fact, a lot of famous cybersecurity experts have already acquired their skills in their teens. There are still some requirements that you highly appreciated.
The following skills provide a good foundation:
- Windows and (Kali) Linux basics
- Functionality of networks and protocols (IP, TCP/UDP, HTTP …)
- Basic programming skills in languages like e.g. C or Python
- Willingness to adapt and learn
Work experience as an IT system administrator, web application developer, network administrator or IT security analyst also makes it easier to get started as a penetration tester. You can prove your skills with numerous courses that help you acquire certificates and increase your market value as a penetration tester. One example is the OSCP certification PEN-200.
You can learn more practical content with the next advise.
Tip 2 : Progress faster through learning services
The internet offers unlimited learning support via YouTube, forums and other platforms. This also applies to pentesting. To improve your skills as a pentester and gain practical experience to test real vulnerabilities, online learning offers by HackTheBox or TryHackMe are a good starting point. Since some information is hidden behind a paywall, here’s a hint: All knowledge is also available for free elsewhere, just not as pleasantly presented.
HackTheBox (HTB)
HackTheBox offers free registration and basic learning modules. Additional content can be purchased for a fee. HTB focuses primarily on gamification of ethical hacking. Participants can climb various ranks on their way to becoming a hacking guru and prove their skills in tasks of varying difficulty. HTB provide its own penetration tester package, consisting of 28 individual modules, which guarantees a good start, especially for newcomers. So it’s definitely worth taking a look!
TryHackMe (THM)
You can find similar offers on TryHackMe (THM). If you would describe yourself as a complete beginner, then you will find more entry-level content here. THM is probably a bit more suited for just learning new content and is also slightly cheaper.
If your budget doesn’t allow you to use one of the platforms, don’t worry: all content is available for free on the web and searching for it is a helpful part of your education. However, it can make sense to learn content on TryHackMe or YouTube and then try out your skills via HackTheBox. It’s up for you to decide which provider you prefer or whether you want to avoid paying for these services.
But let us help you a little. Have a look at HackTricks. Here you can find useful tricks and techniques for pentesting. VulnHub is also helpful as a source for virtual machines where you can try out the skills you have learned.
Tip 3: Every penetration tester has to know a programming language
Especially if you have no experience with programming languages, it is a good idea to start with Python. Programming and hacking are of course two different things. Still, basic knowledge of a programming language is essential if you want to become a pentesting professional. Python is a relatively simple and flexible programming language, but nevertheless powerful. It should definitely be part of a penetration tester’s repertoire.
A large number of cybersecurity and pentesting tools and scripts already exist in Python. But even if you get to the point of writing your own tools, Python can deliver with its simplicity and speed. Depending on what you want to achieve in the area of pentesting, other programming languages such as C or JavaScript may also make sense.
Final thoughts
The path to becoming a successful penetration tester is very dependent on what you want to focus on. With our tips, we want to provide you a guide on how to get started. Find your way to hone your skills. But be aware of one thing: Never skips the basics! Also, test your abilities with hacking simulations. When you acquired some experience, HackTricks and VulnHub will help you advance your skills even further. We hope you had fun reading this article and would love welcome you to our community as soon as you become a penetration tester!