How to build your career as an Ethical Hacker ?
Greetings from InfoSecGyan..!
Though you're quite new, there is nothing to worry. It's really great to know that You’ve decided you’d like to be an Ethical Hacker..!
Here are our top 10 tips to get you started!
First of all, here is quick and layman definition of a HACKER. There are many misconfusions about definition of a Hacker.
In simple terms, Hacker is one who helps people or organizations to secure them or their environment which includes people, servers, networks, applications and other information assets from attackers.
1. Clear all your fundamentals:
A professional hacker is one who learns as much as she/he can about a particular information asset and then tries to break into it. Your concepts of basic networks (TCP/IP and other protocols), operating systems (Windows, Linux, UNIX, Android, iOS etc.) and databases (MySQL, MS SQL, Oracle etc.) should be crystal clear.
2. Read all Security Stuff:
There is so much information available on Internet about Information Security includes web application security, network security, mobile security, Information Security Audits, Latest hacks/vulnerabilities etc. You can select your favorite subject in which you are interested about.
3. Practice, Practice, and Practice:
Most of you have a Desktop/laptop at your home. Download freely available of latest version of Kali Linux (which is Specially designed for Pentesters) and get started! You can build a small lab at home by creating virtual machines (VirtualBox or VMware) and practice your tools and techniques against your own setup. You should be very familiar with standard tools such as Nmap, Nessus, Hping3, Netcat, Traceroute, Burpsuite etc.
4. Make some money, just by testing your skills:
Now a days a large number of sites run bug bounty programs such as Microsoft, Facebook, PayPal, Yahoo, eBay, Google, etc. You can test these sites as much as you wish without any fear of it being illegal, as long as you follow their bug bounty rules and perform responsible disclosure to them.
Remember, do not try to test any system/network which is not belongs to you or you are not authorized to.
5. Follow Communities/Forums:
There are lots of communities/forums that are active on Internet and also in your area. Attend their meets, conferences, present your ideas and research, and subscribe to their mailing list. There is a lot more you can learn from experts. I encourage, go for Nullcon and Garage4Hackers. They have got really awesome brains.
6. Do research and self-Study:
Choose your interest, say a mobile application security, and go deeper into it. Get an android or iOS phone, download some malicious mobile apps, and reverse engineer them. You’ll earn so much of confidence here.
7. Learn Programming Languages:
Its really not necessary to be a expert in programming languages but you should know basic understanding of a program and its flows. When you actually go on a field, you need to have basic understanding of programming languages without which your assessment may fail. Before you start your web application assessment you should have basic knowledge of at least HTML, javascript, php, asp. For Penetration Testing and exploit development you should know python, ruby.
8. Always be Ethical:
The knowledge and skills you gain as you go along are always a double-edged sword and you need to make sure you do not cross the line of ethics and legality. Do not test sites that don’t have an explicit bug bounty program like I said in point number 4. Do not call up a company and ask them to pay you because you have found some bug to report on their website. This is all illegal and doing such stupid this could put you up behind the bars.
9. Never stop Learning:
Cyber security field is so vast and so much exciting that you should never stop learning. If you feel that you have become expert on one topic, say mobile application security, then go for another topic, go and learn network Security, Web Services, cryptography, secure coding, Cloud Security, exploit development etc. But never ever stop learning.
10. Attend Good Trainings Programs:
Consider signing up for good courses mentioned below. Apart from these, learn basic Linux and commands.
Also, I would recommend you to go for Vivek Ramachandran's (SecurityTube.net) courses to advance your skills. I really love all of his video series, they are damn awesome.
Training programs to get you started:
1. Basic Networking:
Cisco Certified Network Associate (CCNA):
This is course is optional but I would like to recommend this course to you because here, you will be able to gain basic networking skills which will really help you to build up attack scenarios and perform attacks likewise. Before you start your penetration testing, you should understand how different network components works and communicates to each other. And it’s very cheap. Certification is not necessary, just course/training is sufficient.
2. Very Basic Course To Start with:
Certified Ethical Hacker (CEH)
This course will significantly benefit all those who are interested to know more about how hackers break into networks, build the capability of testing your own infrastructure, and enhance your vulnerability assessment and penetration testing capabilities. Here, you will get understanding of, which all different types of attacks are and how they works. Also, you will be able to perform many more attacks at certain level.However, there will be no a hands on but just theoretical.
This is recommended for people who are new into InfoSec/Hacking world and IT Auditor who want to learn basic attacks. With training, you also might need certificate in certain Indian companies when you apply for a job.
3. Advanced Course:
Offensive Security Certified Professional(OSCP)
It goes far beyond the usual courses that talk about the same old port scanning and vulnerability assessments. It is a completely hands-on, challenging, real-world oriented offensive security certification. It goes deep down into the depths of Penetration Testing and exploitation. Its bit difficult exam and need much more practice and patience.
Make sure, you get all your training completed from recognized institutes from where you will really learn something fruitful and don’t just believe on fake institute who just do marketing on internet and your local area. Once you get into this network, you will see lots of people/institute offers training on hacking and other things. Don’t believe them blindly. Always reviews before you choose institute.
And there are many more courses available out there, but they are all depends on your further interest.
Soooooooooooooo :)
Please comment down below if you have any queries, I would definitely love to help you out.
Happy Hacking…
