First of all, a penetration tester is a cybersecurity professional who carries out targeted attacks on a company’s IT infrastructure or any computer system. These attacks are authorised; in other words, companies commission these services to test their infrastructure for vulnerabilities, for ethical purposes and without actually compromising the company.
This may mean that a qualification or degree related to cybersecurity in order to practise in this field. However, some professionals in this field do not have formal training to work as a penetration tester.
What does a penetration tester do?
Its main aim is to help to identify vulnerabilities and recommend solutions to these vulnerabilities in both the digital and physical networks, to prevent a real hacker from discovering them and attacking you.
So a penetration tester needs to be proficient in using a range of technical tools, such as Nmap and Wireshark, to help them identify these vulnerabilities during penetration tests. They also document the processes and activities carried out so that they can subsequently produce a report on the entire audit for their colleagues and clients.
These are some of its features:
- Conducting vulnerability assessments
- Network scanning using tools such as Nmap
- Carrying out an analysis of the network structure and protocols using tools such as Wireshark
- Identify the most common vulnerabilities in IT systems, such as those listed in the OWASP Top 10
- Review large amounts of data relating to the target company, looking for passwords and usernames.
- Carrying out privilege escalation, lateral movement, pivoting and post-exploitation
Typical characteristics of a penetration tester
Now that we have a clear understanding of what a pentester does, it is also important to consider whether pentesting is the right kind of work for you. This isn’t a hard and fast rule, but the typical qualities are:
Problem-solving skills
A good penetration tester is someone who is extremely tenacious when it comes to solving problems. They are keen to get to the root of the problem and think creatively.
Creativity
To defend yourself against an attacker, you have to think like one. This therefore requires you to think beyond simply scanning for typical vulnerabilities.
Interesting fact
In cybersecurity You never stop learning about new technologies, vulnerabilities and concepts. It’s a wonderful career, but it also demands a great deal of sacrifice.
There are several disciplines within penetration testing, as you can specialise in testing websites or in network penetration testing.
Generally speaking, the skills techniques basic are:
- Knowledge of networks
- Knowledge of Linux
- Knowledge of Windows and PowerShell
- Bash scripting
- As for another scripting language, I’d recommend Python as it’s very versatile
It can take many months to study these concepts. What’s more, there are many cybersecurity courses available that offer a much more focused approach and allow you to get the most out of this type of degree.
What does a web pentester need to know?
That said, if we focus on a web penetration tester, they must have knowledge of various web technologies:
- HTML, CSS and JavaScript: HTML, CSS and JavaScript – the cornerstones of web development – are essential for understanding the basic workings of web applications.
- Server-side programming languages: cKnowing programming languages such as PHP, Python, Ruby, Node.js and Java – which are commonly used on the server-side of web applications – is vital for understanding the underlying logic and identifying vulnerabilities.
- Web Frameworks and Libraries: Penetration testers should be familiar with popular frameworks such as Django, Flask, Ruby on Rails, Express.js, React, Angular and Vue.js, as they may be vulnerable.
- Communication Protocols and Technologies: working with protocols such as HTTP, HTTPS, REST and SOAP, and related technologies such as JSON and XML.
- Databases: Familiarity with query languages such as SQL and NoSQL, and popular database management systems such as MySQL, PostgreSQL, MongoDB and Oracle, can be useful for identifying SQL injections.
- Web Content Management: Become familiar with web content management systems such as WordPress, Drupal and Joomla.
- Front-end technologies: Understanding front-end technologies such as jQuery, Bootstrap, ReactJS and AngularJS can help in identifying vulnerabilities relating to the client-side of web applications.
- Web Services and APIs: using web services and APIs, including RESTful, SOAP and GraphQL.
Penetration testing is a career that involves constant learning; it is therefore essential that you enjoy it, as cybersecurity is constantly changing and evolving, and you need to keep pace with these developments.
