Matt says:

Thanks for the kind words..

I think that what it takes to be a professional/really good pen tester is the desire to learn, think outside of the box, and not always rely upon the technical side of things. It’s rather easy to build a network that will thwart off every kind of attack thrown at it.. and it’s at this point that your average tester will fail. You really need to rely upon other methods to gain access to networks like these. You need to look at what services, procedures, etc. that a company relies on in order to operate (email, web browsing, et. al.) and get creative in how you exploit them.

It’s a well known fact that the weakest link in the chain is the human. Through manipulation, coercion, and, well, “social engineering”, you can take down this element quite easily, and also reliably. This is generally what separates a good pen tester from a great one.

If you sit in front of your computer, day after day, programming, learning code, learning tools and techniques, you’re going to lose your ability to socialize and, like I’ve shown a couple times on my blog, this is the best and most important tool that you have access to. You might as well throw Nessus and Metasploit out the window if you can’t walk up to someone and engage in conversation confidently.

I used to have a sales job where I was forced to walk up to people and just start talking to them. My job, essentially, was to manipulate and coerce them into buying… whatever. This was, by far, the best training possible to become a really good social engineer.

It really seems that the most difficult thing for a computer guy to learn is the social aspect. We tend to hold up in small dark places staring at screens for absurd amounts of time.

Beyond the social aspect, however, yes.. learning all the tools available is a good place to start. And yes, definitely understanding the magic behind the tool is critical. Anyone who picks up a tool and just starts using it is a script kiddy.. they’re basically the ankle biters of the world.

But once you understand how the tool works, you can then get it to work to it’s fullest potential. You can also take the tool and add to it, modify it, or whatever, to accomplish your end goal. But, I’ve seen a lot of people rewrite perfectly good tools because they thought it would be more “leet”. Well, sure.. you wrote a tool.. congrats.. but while you were busy writing this thing, I was busy hacking the planet.

The lesson here is.. don’t reinvent the wheel.. make a better wheel.

Assembly is good to know, no doubt.. but I’ve found that it’s becoming less and less important because of all of the tools that are out there these days. Without knowing it, you’ll never really develop any 0day.. but rarely, if ever, do I need 0day to break into something. Companies generally try to avoid being on the bleeding edge of technology.. so they’re usually using software that’s a bit old.

That said, I do know assembly and was, at one point, semi decent at writing it.. but I’d never really call myself proficient at writing assembly.. lol

Anyway, this response has gotten longer than I intended.. it gives me an idea for a post, though. So, thanks for that!

Matt says:

lol.. good to know that there’s at least one of you!

There are SO many good tools out there right now for testing web apps that it’s almost ridiculous. There was one released like, 3 weeks ago that I haven’t played with much yet called Skipfish. There’s also uh.. the Samurai framework. I think the biggest thing to know/learn when focusing on the web aspect is just knowing SQL/MySQL.. simple injections seem to be the most effective. Then XSS/clickjacking/blah blah blah.

I should probably do a post at some point about targeting websites. Most of my clients don’t host their own, though, so the information I get from them resides on some database well outside of their LAN, so it doesn’t really provide me with what I’m looking for (most of the time).

Matt says:

@kittygirl: Thanks for the kind words..

Yeah, I can honestly say that I’ve never had a virus or been hacked.. so I must be doing something right. To be entirely honest, the #1 thing that you can do as an end user to protect yourself is to NOT run Internet Explorer. Like, if you chose to do only one thing to protect yourself from threats on the internet, this would be the one you should choose.

My current suggestion is Google Chrome. Firefox is being heavily targeted now and it’s proving to be a little weak.. but still 1000% better than IE.

Keep reading.. I do my best to make my articles understandable by most. Some of them, though.. not so much.

Matt says:

@Volatile: This is probably going to come across a bit harsh, but I want you to interpret it as constructive criticism. I received a lot of that while I was going through the ranks and it’s something you have to kind of suck up and force yourself to listen to and benefit from. So, please take it as such.

1) Based on your “tone of text”, it kind of sounds like you’re throwing yourself a pitty party. This is essentially accepting defeat, which is not good. You may have to suck it up and do some jobs that you may perceive as being beneath you (which they probably are), but if you are as good as you think you are, they will turn into opportunities because others will notice your talents

2) Continuing on the same point as above, it’s somewhat arrogant to think a company would hire some no-name (no offense) off the street to come secure their networks, especially if their networks hold proprietary information, trade secrets, financial information, etc. Unfortunately, this is one of those things that a degree helps with. A company views a degree as something that makes the person who holds it trust worthy, experienced, dedicated, blah blah blah. Now, granted, it’s usually this mentality that gets them pwned, but I can understand where they’re coming from.

3) Dude, you’re only 20 years old. My whole career and experience changed between 20-26, but you have to be proactive about it.

4) There’s a backdoor to the whole degree thing. Companies trust other companies more than they trust degrees. For a number of logical reasons. So, if you don’t have a degree, but you have a company, you can circumvent a lot of the hiring requirements a company has. I started my first business when was uh.. 19 or 20.. something like that.. and it cost me $125 to incorporate and I was on my way. I sent out mailings, visited networking groups (business networking, not computer networking), and anything else I could think of to help build a client base. The one major thing that I had going for me, was that I was young, and owned a business, which made other business owners think I must be some kind of genius. Well, I was (ha!), but I was never, not once, asked what kind of credentials I have, or what degrees I have, etc. I had a few certs, and that was it.

5) You’ve chosen a tough road, no doubt. It’s definitely much easier to go to school, get dumbed down, and wind up with a piece of paper saying that you know about technology that’s already obsolete.. but, if you have a passion for it and are enthusiastic about it enough to learn the ins and outs of it, your talent will be discovered if you don’t let self pitty get in your way.

And, last but not least, how do you ever expect to get anywhere using Windows??? *zing*

Seriously, though.. dont get down on yourself when you get turned down, or no one shows real interest. You kind of have to make your own path and be a little more creative than others when you’re just starting. But, if you figure that most people your age are just starting college, in 4 years you could be 10x more advanced than they are when they graduate.

- matt

Matt says:

@wifey: Beef. It’s whats for dinner.

Matt says:

@Volatile: I’m glad you’re mature enough to accept criticism.. I think thats the biggest fault of a lot of people out there (especially in the tech field).. they view criticism as a blow to their ego.. lol

1) Yeah, when I said finding something beneath you, I definitely meant something in the tech field.. lol.

2) That USED to work.. but today it requires a bit more finesse. There have been a number of times that I have been poking around and have come across something on a website, or network, or.. whatever.. that is an enormous gaping hole and I will email the owners and inform them of it. This has, more than once, resulted in them asking me for assistance. You kind of have to walk softly, though, when doing this.. there are a lot of people out there that will view you as malicious for simply poking around. Also, as soon as you discover something, that’s the point at which you should stop. Crossing a boundary can wind up being expensive for you.

3 & 4) Being successful in penetration testing and security requires being able to plan and execute. When I first meet a client, I document everything they tell me. They often times don’t realize the information that they’re giving up. From that, I plan my attack, which route I’m going to take, what seems the most logical, etc. Then, I begin the actual testing. I do my passive/non intrusive tests first, just to see what information I can obtain, then I begin going into my more intrusive tests. But the whole thing is a plan, from A to B to C. There’s an old adage.. those who can, do.. those who can’t, teach. Whether you do, or teach, is up to you.

Nothing wrong with oldschool, but hubris is painful. Metasploit is just a tool, really. Could some kid pick it up and use it to exploit a network? Sure.. but he will be lost if he has to come up with a more creative approach, or has to make changes to code, or disassemble something. Prior to Metasploit, I’d have a million tiny pieces of code, all which I wrote on the fly, to do something based on whatever network I was attacking. Very little was universal, none of it was pretty. It was very utilitarian. Thats the primary difference between a hacker and a programmer. A programmer programs because he enjoys programming.. a hacker programs out of necessity to reach his objective. I’ve seen programmers who hack, and it’s kind of hilarious. They’ll spend hours working on making a piece of code as efficient as possible, when it’s really a one-time use type of thing. Meanwhile, I took a piece of code from this program, some from that one, implemented some of my own, and it compiled with only 384 warnings, but nothing fatal. Score! *pwned*. You don’t want to hire me to write accounting software for your business, obviously.

Metasploit basically makes my job easier and more efficient.. I can write the exploit without having to worry about writing a reverse shell, or handler, or blah blah blah.

Also, you mention having to go through and audit code, disassemble it, etc. Ask me how many times I’ve had to write 0day, or disassemble code to attack the network of a client. … Once. And it wasn’t even really necessary, to be honest. Companies generally don’t run bleeding edge software.. they run older, “stable”, stuff.

And, to be TOTALLY honest, any kid with a laptop, an energy drink, and a car (or bike) can penetrate most commercial networks these days. Drive to company building. Break WEP (or WPA, whatever). Poison ARP. Sniff. Use credentials to penetrate deeper. It’s sad, but thats generally the first point of entry for me. The client doesn’t care HOW you get in, the client cares about whether or not you CAN get in. Once you’ve accomplished that, you can get them to do just about anything when it comes to securing themselves. Granted, when doing anything for a client, you want to be thorough.. so you use more than one entry point, but so long as you’ve accomplished one, the client will feel that the expense was justified. But, yeah, it does suck when you can’t find a way in to a network.. it’s happened to me twice. It’s frustrating, and you hate having to tell the client that you weren’t able to do it.. but, they take satisfaction in that as well, because they feel more secure. So.

5) I don’t think so.. personally, I think programming would be the most difficult. Because, in order to write secure code, you have to keep up with the same stuff I do, but on top of that, you also have to write it in an efficient way, with a boss breathing down your neck to meet a deadline, who doesn’t care if the code is secure or not. I mean, sure, what I do requires a lot of research, reading, testing, blah blah blah.. but it IS my job.. where as with a programmer, it would just be a part of his job.

Yeah, I never finished highschool either. I dropped out on my 16th birthday because school was interfering with hacking.. lol. My mom was *pissed*. She’s less pissed now, because her nightmares of having a 30 year old son living with her never materialized.

To be honest.. I don’t know too many in my line of work that have CS degrees.. most of them have certs, experience, and passion.

Yeah, it’s probably good to understand how windows programs work.. most work something like this:

main() {
while() {
memoryleak();
exception();
bluescreen();
}
}

It’s frightening to think of myself as a savior. ‘Course, maybe I could make some bumperstickers to sell on here.. “WWMD?”