Original subtitles

foreign

[Music]

here back again with another video

Welcome to the three-year cyber security

roadmap uh this is an idea or a concept

that I've been thinking of for probably

one or two years now and I was

originally inspired by a video or a

guide that black hills infosec or Black

Hills information security

um had come up with maybe five or six

years ago

that essentially provided you with a

five-year infosec uh plan if you will

and that was a guide that I really liked

and something that I forwarded to many

people who asked me the question how do

I get started in cyber security uh you

know specifically red teaming or pen

testing or rather the offensive side of

things and while that guide is very

useful

um I still think that uh you know a lot

of um the way I would set it out

especially towards the latter end of the

guide from year three to five is sort of

convoluted and uh really provides no

clear road map as to what what you

should do now

I've sort of taken that original

inspiration and I'll link the original

video in the description section and put

my experience and my knowledge of the

industry not just as a penetration test

and red team but also someone who has

developed a lot of educational material

a lot of people you know as an

individual who has coached and mentored

a lot of people to get into the career

successfully I think you know if you

head over to my LinkedIn page you'll be

able to see that all of the testimonials

have actually helped people get jobs in

this industry not that I'm bragging or

anything that's sort of why I think I

have the uh necessary experience to

guide you here so again the the idea

sort of came about uh primarily because

firstly

um you know I was looking to see whether

there was sort of a road map because

when you look at it realistically when

you talk when you come down when it

comes down to technology there's no real

clear-cut roadmap and that's perfectly

fine you know we can be expected to drop

an exact plan that works 100 of the time

however you see a lot of students

specifically you know either leaving

high school or students in college were

very fascinated by cyber security

they're very passionate about it and

they would like to get into a career or

get a career in cyber security and the

problem with it as I've extrapolated uh

over many many times is firstly the

trivialization which I won't go into

uh secondly there's a lot of knowledge a

lot of platforms a lot of content out

there and it can be difficult uh

especially because of all of this

information to stay focused and to stay

on a consistent track right and so the

the primary objective of this guide is

not to tell you what you can and cannot

do is to give you a guide that if you

are there by or if you essentially

follow roughly speaking you don't have

to follow it exactly I can almost

guarantee that you'll get a job now one

other thing that I've done is I've also

excluded any mention of certificates

because certificates are sort of thought

as the uh you know the only way to get a

job they aren't and I'm going to explain

why on my LinkedIn profile uh if you

take a very close look I've never even

posted most of my certifications though

that was sort of a social experiment

that I had to see firstly how the

industry treats me whether they

appreciate who I am without certificates

so on and so forth and I know for a fact

that now more than ever certificates

really don't

tell anyone anything they are still

important remember they're still

important especially the really good

certifications but they're not a

valuable uh instrument to essentially

assess a person's or an individual's

knowledge skills and abilities and I'll

get into that later so again coming back

to the video I apologize if I get

carried away this is sort of a guide or

a way to get you know on how to get

started with a Korean cyber security

just again as a caveat I'll be filling

in the blanks this is specifically

designed for people who want to get a

job in the offensive side of cyber

security I'll probably I'll probably

cover or make a guide on The Blue Team

side because I do have a bit of

experience in incident response Etc so

to get started you know coming back to

the question why am I making this guide

why am I making this video firstly

there's a lack of structure there's a

lack of a structured approach to

learning Core Concepts and the

fundamentals required to operate

successfully in the cyber security

industry and you know as a direct

consequence of that it can be very

daunting to get or to find a starting

point and you know essentially a point

where you can get started right and the

other reason and this comes to some of

the skills that you'll need to learn in

this industry uh and that is the ability

to be disciplined and the ability to set

time defined goals so you say that in

one month I'm going to learn this and by

the end of that month you should you

should have been able to learn that so

again it's about applying uh positive

pressure on yourself and setting

timelines and setting goals and once you

do that you'll actually see a change in

your career in your life Etc and finally

the final reason or motivation is to

demystify cyber security as a career now

just taking a look at this I think one

of the main things that I want to do is

to highlight the importance of

fundamentals why do I keep highlighting

this why do I keep telling people

fundamentals fundamentals fundamentals

the reason I say this is because cyber

security is a Synergy or it is an

intersection point of a plethora of

other technology or technological skills

or

it requires a lot of uh

a lot of knowledge not a lot but it

requires knowledge in various Fields

like networking operating systems a

little bit of scripting so on and so

forth and as a result if you get into

cyber security and you're lacking in

those three that I've just mentioned

it's going to be difficult and that's

why I get questions all the time when I

make a video on nmap and I cover

something and I always use this example

and I cover maybe you know performing a

syn scan and I say that's a half open

scan we're not completing the TCP

three-way handshake I get questions

saying what's the TCP three-way

handshake and why is it important when

we're performing a stealth scan why do

we essentially you know perform a half

open scan and how does that that affect

or how does that look from a network

traffic analysis perspective how does

the scan look uh you know in why shock

if I was too if false generalize the

traffic and how would that compare to a

you know a standard connect scan

um you know so that's one example if you

don't know these fundamentals it becomes

very difficult to fully utilize the

tools that are right in front of you

and you have a much

um much steeper initial uh slope to

climb if that makes any sense

so the second that I would like to focus

on a lot is the demystification of cyber

security as a career which we'll get

into

so who is the target audience as I said

earlier high school and college or

university students interested in

getting into the cyber security field

this is obviously going to be the main

demographic however there's also another

core demographic that I've seen Rising

uh or increasing in number and that's

technology professionals are looking to

Pivot into cyber security for whatever

reason you could you know just be

interested in security you may have an

aptitude for it or a hunger for it or

you just may want to switch careers and

you find that you know cyber security is

something that fits you uh or you know

is something that you actually are very

um

you're very comfortable with thirdly

cyber Security Professionals looking to

identify knowledge gaps and level up

their skills so again if you're a

seasoned penetration tester or blue

teamer Etc this could be helpful for you

in identifying areas where you can

improve right and that's something that

I do regularly I always analyze my

knowledge gaps and I still find areas

where I'm uh I'm lacking severely

and finally anyone looking to get

started in the cyber security so you

know you could be at a completely

different job maybe a uh you know you

may be working as a contractor or maybe

someone in finance I've seen this happen

a lot and

these individuals are actually the most

successful because they treat it as a

proper career as opposed to the

trivialization that I talked about so if

I tell a contractor let's say he wants

to switch his jobs into technology and

he wants to get into cyber security for

whatever reason he could like it maybe

he likes the money

there's a plethora of motivations for

him wanting to him or her wanting to

switch uh his or her career however if I

give them a guide and I say this will

take three or five years when I revisit

them three or five years later they

already some of them and this is true I

already senior pen testers

because they follow it they understand

that this is a career it should be

treated with respect and if I follow or

adhere to this guide very closely or not

you know it could be roughly speaking

and I'm persistent and I want this is

something that I want and I set goals

and I say five years I'm going to be

working as a red team or a pen tester

they end up achieving that it's the

Dilly dallying and the constant hopping

from one position to the other that

waste a lot of time and this is

something that I have done so I'm

speaking from experience here

so let's start off with year one all

right what's the focus with Year One

this is what I would recommend start off

with operating systems in the context of

Windows learn how to install configure

and administer windows so learn about

Windows take a look at this internals

book learn about the various components

that make up Windows you know like the

kernel the NT kernel the registry how

passwords are stored Etc so essentially

learn how Windows works and the various

components that make up the operating

system

I would then recommend learning how to

secure and Harden windows so sort of

getting an understanding as to some of

the most common security

misconfigurations like setting the user

account control level to low as an

example so on and so forth and a great

um a great utility or guide that you can

utilize here the CIS benchmarks for

Windows which you can take a look at

uh and then I would also recommend

getting an understanding of how Windows

password hashes are how Windows

passwords are hashed and how they're

stored you know the Sam database how

authentication operates how

authentication Works rather and getting

to grips with understanding the

operating system that you could be using

you know just understanding how it works

and not being biased and saying Windows

is bad or Windows is the best operating

system just focus on learning it keep

the biases and the ideologies out of

your learning experience trust me this

is this is a very important tip don't

get stuck up with the oh I'm only going

to use Linux because Windows sends uh

you know Telemetry or you know as is

essentially a Telemetry operating system

that sends a lot of my data back to

Microsoft that's a very pessimistic view

of looking at things and if you're a

pessimist and you're not uh if you if

you're not open to learning things you

know

almost every day

you're going to be in trouble and you'll

see a while later

I would also recommend becoming

comfortable with the Windows command

line that's fairly simple learn the

commands learn how you know how

everything works learn about the common

utilities don't get into Powershell yet

Powershell is something that you'll get

into a bit later because you know it

requires you to have a certain

background and then finally and this is

very important because I see this a lot

learn how to set up and config an active

directory environment which I'll be

doing in another video that'll be

releasing this weekend probably

I'll show you how to set up an active

directory environment how to set up a

domain and configure it to be vulnerable

for your own practice so learn about

active directory the concept of you know

domains trusts forests trees so on and

so forth learn how

learn what active directory is and learn

the importance of active directory and

why companies utilize it because you

will be dealing with active directory a

lot especially if you're a penetration

tester

in the case of Linux the same thing

applies learn how to install config and

administer Linux learn how the Linux

operating systems are the Linux kernel

rather and you know the the collective

operating systems or Linux or gnu plus

Linux learn how this works and the

various components that make up the

operating system learn how to secure and

Harden Linux again the CIS benchmarks

are you know great guideline become

comfortable with the terminal this is a

very very important so I'll be making

follow-up videos regarding these

individual skills but learn how to use

the terminal learn about the common

commands you know Basics admin stuff

learn how to copy files how to you know

set up Chrome jobs

how to automate a lot of your you know

mundane or manual work with bash scripts

learn about environment variables learn

about other terminal emulators about

various shells

learn how to install various Linux

distributions again you don't have to

use them just fire up a VM try out Red

Hat try out Centos tryout Fedora get an

understanding of what makes these

distributions different because you'll

typically be seeing Centos Red Hat

Fedora Ubuntu on production systems so

learn about what makes them

you know that specific distribution

learn about what makes Santos Santos and

learn about the various features that

come packaged with you know security

focused

um distributions like uh you know red

hat for example

and this is very very important the last

two arguably the most important learn

about Vim said orc and rejects so

regular Expressions why do I say Vim

trust me a lot of people say this but

I'll explain why a text editor is Never

As Good

as Vim or a terminal editor even Nano is

like once you start using Vim when I've

gone to Nano just for a few seconds I I

can't comprehend it I really can't I

mean I can't imagine myself

using the control and ok to save

whatever I've typed in

I'm automatically hardwired to you know

use the the actual colon write or write

and quit or exit

Etc once you learn these key bindings or

these key binds that's it you'll never

forget them it's like riding a bicycle

or learning how to ride a bicycle once

you learn them you can wake up after a

coma you know of course without damaging

your brain if you can wake up from a

coma and you'd still be comfortable with

your keyboard

and then finally learn about git git is

of course Source control set up your own

GitHub repo learn how to you know

how to set up your own GitHub repo

locally with the get a terminal client

learn how to you know pull push

so on and so forth how to Fork all of

that good stuff and I've made an entire

video on that actually which I'll link

in the description

and then you can once you've covered

operating systems in the entirety you

can now say okay I've learned operating

systems now learn how to perform

scripting or how to write very basic

scripts starting off with Windows learn

how to utilize Powershell and write

Powershell scripts all right and that

will actually open up a huge Pandora's

Box especially in cyber security because

you learn a lot about what you can and

can do what antivirus signature based

antivirus systems pick up and this is

where you'll start going off the rails a

little bit and experimenting that's

perfectly fine again this is just a

guideline this is just a standardized

path that you can follow

next I would recommend learning again as

I said how to automate tasks on Linux by

leveraging shell scripts just focus on

Bash that's it and finally python now

the other languages you can focus but

please if you are going to learn a

programming or scripting language just

Learn Python we're already up to up to

speed with on you know on Python 3

there's tons of scripts that have been

developed look at them learn from them

write your own scripts whatever crazy

ideas you have just take that as a

project and say okay for one week I'm

going to try and build this with python

and during that week when you run into

issues when you perform your own

research

you will improve so much as a programmer

just by trying to build something

because that's what programmers do

programmers are building things they're

not watching how-to tutorials which is

why I switched up my entire scripting

series to focus on building stuff and

then I know once I do that once you

watch one or two of those videos that's

it you're on your way you don't have to

come back and watch stuff because you've

already got it you've got to tacit

understanding of what this is all about

you're supposed to use these languages

to develop things to automate stuff

that's what you're to solve problems

that's what these languages are about

people have convoluted programming into

this dark arts and you know all of this

stuff and again I've programmed for a

very long time I mean I've done Java

professionally I've developed Android

applications that are still on the

Google Play Store

I have done.net I have done C plus plus

I've done C I've done C sharp I've

delivered developed quite a lot of

programs for Windows I'm actually

developing a solution now for Windows

that I'll be sharing later on but

I know what programming is all about and

when I was learning programming

I followed very briefly the tutorial

Series where they you know they talk to

you about functions and Loops well they

are helpful they are very helpful these

are reference this is reference material

all right those how-to tutorial videos

that's reference material what does that

mean it means when you don't understand

something like how to write a function

or how to write a loop or if you don't

know if you don't understand about

arrays anything about arrays that's when

you switch to those reference videos

that's when you search on you know in

Google but that's when you try and find

help online if it isn't if it hasn't

already been answered but that's when

you start using these videos you don't

start off with these videos there's tons

of resources free code academy

what I'd recommend just say Okay I want

to learn how to do this I want to learn

how to automate an nmap scan with python

perform a Google search take a look at

the script

clone it download it run it understand

what's going on start making

modifications and then when you don't

understand some a segment within that

code that's when you start your research

or just start from scratch take a look

at a few tutorials on how to write a

basic very basic program do that once

you've got a hang of it say I want to

develop something else again it doesn't

matter whether it's been done before you

can do it your way so again just think

of it in that perspective don't get too

crazy with oh I'm going to build this

and just stuff that's important to you

doesn't matter Nothing Else Matters

what's important to you

finally of course here one focus on

networking all right this is this is so

important I mean I I cannot stress the

importance of a topic like networking

networking is so so important in cyber

security or in technology in general so

what's my recommendation start off by

understanding The OSI model this is very

easy to understand

and uh understanding the different

layers again very very easy it's very

intuitive you understand it you know

from the data link layer

to the network layer to the transport

layer

to the you know session layer

application layer

to the presentation layer just

understand what that abstraction means

and how that categorization

uh is used and why it's important and

you'll start to understand hey this

makes a lot of sense you know you start

over the data link layer all the way to

you know various protocols Etc then

learn about the primary

the primary protocols like TCP IP the

transport protocols to be more specific

so TCP and UDP learn how they work

specifically in the case of TCP

what the three-way handshake is

uh what that looks like open up

Wireshark open up Wireshark why shark is

your friend learn about what traffic

looks like take a look at packets try

and perform some packet you know try and

dissect packets perform packet analysis

see what

each packet is made up of and when you

do that after understanding The OSI

model you can actually see it play out

you actually can see okay this is the

ethernet address and then you have the

actual uh let's say you can actually see

the the transport layer you can see it's

TCP okay you then move a layer up and

you can understand just from a packet

everything starts making sense all right

and then understand the common ports and

the common ports used by various

important services so there's 65 535 TCP

ports I'm not saying remember what each

of those ports is used for because none

of them are not all of them are

typically utilized by services but learn

about you know FTP SSH

telnet SMTP uh let's see let's see if I

can think of DNS uh Port 80 port 8080

Port 443 SMB these are very important

you'll you'll run across them

a ton of times there's no other way of

uh of putting it so

again I've mentioned Wireshark already

but that's very important now some

additional stuff that you can do is get

some gear you know uh and this is

something that black hills infosecond

pointed out which again to me when I

look back at it I didn't realize that I

had already done this because you know I

set up my own home network I have a you

know a very very well set up Network you

know with a firewall a real firewall PF

sense to be more specific so learn about

routing learn about subnets learn about

switches and how to set up imagine just

setting up your own home network again

you don't need crazy devices or crazy

crazy Hardware you can use whatever

routers you can get on the cheap I know

most of your students I did the same I

started off with some very very cheap uh

you know routers nothing too crazy but

understand how that network works you

know set up your network play around

with it Tinker with it and then learn

how firewalls work in auto configure

your own firewall and then see how that

plays out you know just

please this is the most important I mean

I can't stress it enough networking is

crazy important

and then finally

um this this is something that you can

get started with but not really if

you're not yeah I know this is where the

old theoretical aspect of it comes into

play but

security fundamentals are very very

important what do I mean by this basic

security Concepts like what an attack is

what a threat is what vulnerabilities

are what risk is how to calculate risk

uh the CIA Triads or confidentiality

integrity and availability you know the

three pillars that hold up cyber

security conceptually speaking then

about governance risk and compliance

which is GRC some Court infosec

terminology this is stuff that you can

pick up you know along the way but for

anyone that's looking for a guide that's

what I recommend and then take a look at

security standards like CIS or nist uh

which you know are obviously at least at

the moment

are pretty much the Benchmark when it

comes down to security standards

remember not pen testing standards not

yet security standards

so that's year one in a nutshell now

year two is when things start getting

crazy or not crazy but uh exciting I

should say exciting

so the first thing you should start off

and never ignore this trust me I've seen

a lot of people ignore this until it's

too late until they're told to write a

report and then you know we get a bit uh

you know things get a bit iffy so if

you're going into pen testing and red

teaming learn about the pen testing

execution standard this is sort of a

methodology or framework that you can

use that'll give you an idea as to what

an ideal assessment would look like the

phases that make up the assessment then

take a look at some methodologies like

the mighty attack framework the Cyber

kill chain uh the unified kill chain OS

top 10 as a guide for web application

pen testing and this is insanely

important the oasp security testing

guide this will sort of give you a

methodological approach to testing web

applications is something that I use a

lot now I have the PDF on my desktop at

all times when I'm testing a web app

and uh you know I sort of want to

you know perform not really for bug

bounty hunting but when I'm performing

an assessment on a web application this

is usually a very good way of ensuring

that I'm I'm very rigorous with my

Approach so the key thing here is

understand the industry standard

methodologies used for pen tests or

assessments and analyze open source pen

testing reports so take a look at pen

testing reports see what they're all

about demystify them because the problem

is be that people put it off for too

long they say I'll look at that later

it's not that important no just look at

a pen test report you don't have to do

anything else just open up a PDF just

read through it as if you are you are an

executive try and see if you can

understand what's going on and that'll

give you you know very good insight as

to how you can write good reports

yourself all right and we'll get back to

report writing shortly

uh another thing that you should start

focusing on in year two is setting up

your home lab so setting up a good home

lab now step one virtualization so

you know um this is something I think

I've heard a lot of people say in the

industry but uh

pretty much one of the first few

programs that any hacker secure cyber

security expert or infosec professional

you know will set up

on the assistant is a hypervisor

virtualization software so think of

virtualbox VMware again they're all free

versions virtual boxes would be my

preferred learn about how to use them

how to set up networks the various types

of networking options

so on and so forth learn about how to

take snapshots you know set up a Windows

box set up a Kali Linux system set up an

active directory environment whatever

you want just learn how to set up your

own home lab for testing because you'll

be doing a lot of testing and then also

take a look at devops this is something

that I did I'm very glad that I did it

early on and sort of exploring

containers when I started out I was

typically you know experimenting with uh

lxc but Docker came along in kubernetes

and that was just insane what you could

do on the cheap uh you know with Docker

containers Etc so set up your own Cali

parrot box or install your own tools

just set up your own home lab and get

start get your hands dirty with vulnerab

boxes they're free you can go to

vulnerab download some hacking

challenges

Try It Out start hacking start learning

about where you know you have gaps

improve on those gaps you know you

really really very very very simple in

terms of what you should do

um

then I would recommend moving on to sort

of your pen testing fundamentals so what

do I mean by this well if you're using

Cali or parrot

I would recommend taking a look at the

Kali Linux revealed PDF it's a free pdf

that essentially guides you in how to

operationalize the Kali Linux

distribution so what all the tools are

used for how to configure Kali you know

the various uh ways you can install Kali

or Cali packages if you're looking for a

minimal installation Etc

then I would recommend learning netcat

and socat now specifically learn about

reverse shells learn about bind shells

learn how to utilize netgat is very very

important and then learn about file

transfers with Linux and windows so

learn how to transfer files from a Linux

system to a Windows system and vice

versa and the different ways you can do

that you know there's tons of ways uh

through SMB through the web you know

through a web server Etc and then you

can move on to passive information

gathering and osen now this is going to

be a lot you know there's a lot of stuff

to cover here but learn about how to

utilize what's publicly available to

gather information on Target and then

when it comes down to active information

again return to vaal Knob return to hack

the box return to triac me any other lab

platforms that you may want to use

you know move on to network and board

scanning nmap is your friend learn about

nmap Mass scan whatever tools you want

to use learn about and also rust scan I

should mention very very fast very very

cool uh learn about how to identify

active hosts on a network how to perform

board scans what to do if the things are

being blocked by a firewall how to speed

up and slow down your scans how to

utilize the nmap scripting engine which

brings me now to enumeration so once

you've identified open ports on a Target

system and the services that are running

on them your next step is to enumerate

as much information as possible from

these open ports that's where

enumeration comes into play there's tons

of tools that you can utilize based on

the protocol you're trying to enumerate

information from so learn about web

enumeration SMB enumeration SSH so on

and so forth and also take a look at

vulnerability scanning with tools like

openvas or nessus anything that you can

get your hands on learn about what that

looks like

uh take a look at vulnerability

assessment reports

understand that because in certain cases

you may be asked to do that instead of a

pen test not always the best of days but

hey

uh once that is done the next phase

which I always separate is the

exploitation and post exploitation phase

so learn about exploitation and post

exploitation Frameworks like Metasploit

and Powershell Empire so learn how to

use them by the way I'll be making

entirely new series on both of these and

showing you how to use them which you

know will be quite important but learn

how to use them use them to run exploits

again don't worry if anyone calls you a

skid or anything like that or noob yeah

again remember you're here to learn take

a look at Metasploit modules hell write

your own Metasploit module automate

whatever you want to automate I'll then

recommend searching for and modifying

exploits on exploitdb so once you've

taken a look at how the automated

exploitation Frameworks work you can

then say Okay I want to exploit the same

vulnerability but manually it could be a

python script it could be you know a A C

C plus plus C shop uh piece of code that

you need to compile learn about that

learn about how to compile exploits you

can then take a look at client-side

attacks like phishing browser exploits

you know

tons of stuff you can explore there

which I'll not go over right now and

very importantly you don't need to be an

expert in buff overflows but just learn

about what causes them and how they

exploit it you can take an example of a

Metasploit module and understand what

it's doing in order for the exploit to

work right

um

and then of course you know you can take

a look at explodb is a great place to

learn about this stuff take a look at

some exploit DB buffer overflow exploits

on exploit DB you can actually download

the vulnerable piece of software set it

up in your home lab whether it's running

on Windows and Linux and then try and

understand most of the exploit DB code

is very well documented so try and

understand what's going on the various

types of overflow attacks or overflow

exploits you know there's a lot of stuff

you can get into there

and then of course the classic which I

always recommend learn about the common

vulnerabilities and the the common CVS

that have have affected windows in the

past like you know Eternal blue blue

Cape uh and then you know on um on

linux's Samba cry shell shock

um hot blade you know some of the most

popular ones take a look at them

understand what caused them it's always

good to have that historical uh you know

perspective and while you're doing that

when you're taking a look at CVS take a

look at the common vulnerability scoring

systems or CVSs learn about you know the

structure of a cve and how that relates

to when it was publicly released or made

publicly available run about responsible

learn about responsible disclosure

Etc and then you can move on to post

exploitation techniques so this is where

you have you know your standard local

enumeration so living uh living on the

land uh then you can take a look at

automation scripts like win pays or lint

piece to automate local in uh you know

to automate the process of Performing

local enumeration on both operating

systems learn about privilege escalation

techniques again I know this is a lot

but I have reviewed or gone over this

you don't have to stick to three years

I know that this is a lot trust me

so this can spill over into the third

fourth or fifth year but this is sort of

giving you a guide as to what you should

know and what I would look for in a

junior pen test or someone who's looking

to get into pen testing was you know got

the certs Etc

and then of course password cracking

um which is quite important so learning

about uh you know various hashes uh what

that means about you know utilizing

tools like hashcat and John the Ripper

and finally how do you put all of this

into context well practice like hell

take participate in ctfs don't focus on

your performance you're just here to

learn that's what you are you're a

sponge again you just take a look at

walkthroughs write-ups participate in

ctfs join a team if you're in University

form a team it doesn't matter how bad

you perform you trust me the first time

you participate in a CTF

the date ends you will be a different

person than the day you actually got

started you you trust me you'll you

would have learned a lot a lot

so again research videos books blogs

write-ups courses certifications just

look for information and again you could

be looking for a very specific you know

piece of information that's fine

just uh you know utilize whatever is on

the internet if you know again if you're

on a budget I understand

um

but yeah also utilize platforms like

hack the Box try hack me to identify

your uh your the the areas

um where you have gaps so where you can

improve

uh learn now and then this is very

important based on the boxes that you do

or the boxes that you Pawn on hack the

Box vulnerable to try Acme

take a pen testing report template and

just write write a report just write a

report or better yet use that same

uh that same model and start a blog

start a YouTube channel

you know start putting out whatever

you're doing into the public space and

the blogs are the best way if you want

to start a YouTube channel let's find

that the great thing with blogs is that

it's immediately accessible I don't have

to watch a video I can just go through

it uh and uh people immediately know

your name they immediately know you are

linked you link your social profiles if

you're doing great work if you're doing

research on a particular vulnerability

whatever you want to do just do it and

then

just write a blog post doesn't matter

how simple it is that's your work treat

this remember this is your career this

is your craft so be proud of what you're

doing and take pride in your work and

very nicely publish a very detailed blog

post about what you're doing what you've

done Etc it'll be useful to someone

and that's how you sort of pass it along

which is what I which is what I did I

took all the stuff that I had learned

and I you know started making videos

about it again I had no big dreams about

being a superstar YouTuber no it was

just me sitting down every evening after

work or whatever I was doing on the

weekends and saying yeah this I you know

I can make a video on this because I can

answer a lot of questions so

have the right mentality in mind and of

course this is something that I do a lot

I've done and I'm so grateful I am so

grateful that I took notes and on

everything I was doing looking back at

some of the notes I took seven years ago

I mean I was an idiot but it's so cool

to say that that growth you know because

I was taking notes and I was making

mistakes I didn't understand Concepts if

you read some of my notes from earlier

on when I tried to explain stuff like a

buffer overflow

and Concepts like that I mean it was

really bad but again I was ironing out

my thoughts you know if you write and

writing is very important or typing

just document what you're doing it's

important to you don't think about other

people it this is this is your stuff

this is you so

all right so your next step and this is

something that is optional at least in

my mind but something that I recommend

you don't skip over and that is web app

and testing and or bug bounties and I'll

sort of explain how these two uh play

into each other right

um so why is this important well you'll

come across web apps uh web app pen

testing quite a lot of your pen test or

red email this is this is something that

you can opt out of specializing in but

it's good to know how to do it again you

don't have to specialize in web app and

testing because again it is an entire

field of its own really especially now

but I would recommend you know just

starting off with the with pawning or

hacking vulnerable web applications you

know that could be stuff like the damn

vulnerable web application it could be

OS motility stuff like that just getting

on you know getting into grips with what

web app and testing is and now I know

that there's a lot that falls on under

here but learning the fundamentals of

http of Recon Etc right and learning

about how the web works

and the best way that I've seen this you

know work

for me and one thing that I need to also

point out is that I've seen this a lot

in my career is that even with pen

testers or red teamers this is an area

or a topic that they either like or they

don't like I've seen those two types of

pen testers they either really

passionate about web apps and the web in

general or they're not they know how to

you know how to perform a pen test on a

web app but it's not something they

enjoy doing as a result they don't get

into bug Bounty so that's one uh One

path but I would recommend you getting

your hands dirty with web app and

testing before you come to that to that

assessment or to that judgment you know

before you actually make up a decision

on what you want to do so one of the

things I recommend doing is developing a

web app and more specifically PHP MySQL

the example or the application I can

give you an idea for is a very simple

content management system there's plenty

of guides out there already written code

but write it you know for yourself learn

about PHP as a server-side language

um you know the front end that's stuff

that you can pick up easily but

obviously JavaScript is going to be a

huge factor in that but develop your own

content management system very simple

one where you know you have a login page

and then once you log in you can write a

simple blog post and that's rendered uh

properly or the way you want it rendered

on the front end and the reason I say

this is this will teach you a lot about

where mistakes are made with regards to

developing web apps even if it's

extremely trivial it just gives you that

tacit understanding as to where

developers make mistakes even if they

don't make them anymore you'll still

find web apps with some very common

vulnerabilities but learn about you know

input sanitization you know upload

filters stuff like that and of course

code execution which is not that common

nowadays but you know you still may run

you still may come across it so develop

that content management system without

any security uh any uh secure code

process integrated into it and then try

and hack it and you'll actually see

where the where mistakes are made you

learn how to assess web applications how

to test them for specific

vulnerabilities and do this in tandem

with the vulnerable web apps and the OS

top 10 and the OS security testing guide

they'll sort of give you an

understanding as to the types of

vulnerabilities you'll come across

nowadays on Modern web apps uh

what causes the vulnerabilities which

you can then re-implement within your

own web app or within your own lab and

then test you know it's a it's

essentially a cyclic process but learn

about that and then if you want to get

into bug bounties you know learn Recon

and watch everything from Jason Haddix

and namsec I mean these two guys have

you know really really

um

contributed a lot and of course I've not

mentioned other creators not because

they're not good or anything just not

enough space here there's a ton of other

creators that do bug Bounty stuff like

uh you know for example right off the

top of my head we have Stoke uh we have

uh you know Christy Christy Vlad uh

excellent stuff from him uh you know and

they did you know they're really good at

what they do which is web app and

testing among many other uh things or

many other areas of expertise or subject

matter but they'll really set you in the

right direction with regards to bug

bounties and then of course that'll

directly take you to web proxies where

you can utilize Oasis app if you're on a

low budget or you know the community

version of burp Suite but you know I

would recommend learning about how to

utilize zap first that will

um that'll sort of give you an idea as

to whether or not you want to invest in

a burp Suite license but that's up to

you and just get started with bug

bounties but I've always recommended

this start off with bug bounties locally

so look at the web apps you use on a

daily basis the the local ones to you

know uh specific to your region because

those are the ones that are most

important to you that you know a lot

about and do not take that uh lightly if

you know if you've used the web app

before you know a lot about how it works

and where the potential endpoints are

for example

so take that into consideration because

if you get into you know platforms like

background hacker one they sort of have

a competitive nature which for a

beginner can throw you off because it

now becomes about how many disclosures

you can get how many bounties you got

how much you got paid which is not good

to begin with if you want to make money

that's fine but in the beginning you

need to be comfortable with what you're

doing before you start going onto

platforms like hacker one you know you

know onto Public

public programs so keep that in mind and

of course

this process will eventually show you

what you're good at with regards to

vulnerabilities so you may you may be

good at cross-site scripting you may be

good at SQL injection you may be good at

uh

identifying uh insecure authorization or

local file inclusion vulnerabilities as

an example you know and uh take a look

at disclosures reports and blog posts by

other people doing bug bounties the

people you know who are very good at

identifying the vulnerabilities that you

like or that you're very good at

identifying as well you learn a lot from

them and this is where you start getting

into the community you know uh start

again it comes back to the idea of

having your own blog uh you know right

blog posts about vulnerabilities how you

did stuff of course taking into account

responsible disclosure and all of that

good stuff but yeah web app and testing

is a very tacit

um

very tacit path in that you need to get

your hands dirty and you will spend a

lot of time here if this is something

that you like this may be something

you'll end up pursuing you know in the

form of bug bounties so I personally

like web app and testing and I do bug

Bounty sometimes but I just don't have

the time because my primary job deviates

slightly from web app and testing so I

always find myself coming back and

having to gain momentum again and you

know all of that good stuff but I do

like whether I've been testing so yeah

that's uh generally speaking what I

recommend for year two when it comes

down to year three this is an area now

that you get into specializing right

uh and I haven't covered Blue Team as so

there's something that I'll probably

cover later but if you're into pen

testing in red teaming or the offensive

side of things anti-virus and ETR

evasion are very very important

um these are areas that I'll be delving

deeper into in their own videos because

they deserve their own videos another

one of course is active directory pen

testing which is another tangent that

you'll find yourself going down learn

about red teaming tactics techniques and

procedures for the mighty attack

framework or the Cyber kill chain but

learn the mighty attack framework learn

about port forwarding and pivoting

within a a large Network C2 Frameworks

like Havoc

um

Covenant partial Empire

you know plethora of others like Posh so

on and so forth learn about how they

work why they're utilized uh how to

utilize them not just for post

exploitation but also for exfiltration

learn about fish fishing and initial

access ttps this is arguably the most

important especially if you're in the in

red teaming then about how to set up you

know proper fishing infrastructure how

to set up or how to write good phishing

emails and that'll then take you deeper

into resource development where you

learn how to develop your own macros uh

how to develop your own malicious

documents your own malicious executables

payloads all that good stuff

and also you know then within year three

another great place or another important

area is adversary emulation this is

specific to the red team is but also

useful to the blue and purple teamers

learn about what adversary emulation is

analyze apt groups or thread groups and

their operations uh their previous

operations or historically speaking uh

learn about their trade craft their ttps

and their software or malware that

they've utilized the industries they

target and more important to this learn

how to utilize edrs and seems like Wazoo

they're you know completely free to

detect your attacks and understand the

defender's perspective so that you

understand what you look like what your

activity looks like uh if there is a

blue team in place because that's

something that you know is very very

important

um especially in the context of

adversity emulation because stealth and

persistence is is a key factor or key

determinant here

and of course this will take you down to

manually automatically emulating apts or

threat groups you know automatically

that could be through a tool like miter

Caldera or the atomic

um the atomic red team tests and then of

course manually most of your adversary

emulation or simulation campaigns will

be uh will involve you know manual face

to them especially in the resource

development side of things uh but uh

yeah that's uh what I recommend for year

three with regards to ready means

specific now another area that you can

get into and again this is very nuanced

this is something that I at least in my

experience I've seen that you either

like or you find

um intuitive or not it doesn't say

anything about your intelligence or

anything like that but reverse

engineering you know binary exploitation

malware analysis these are all very very

nuanced fields that require a lot of

prerequisite knowledge specifically with

regards to development and in my opinion

the only way way for you to successfully

learn reverse engineering is for you to

have developed an application either in

C C plus plus or c-sharp you know

specifically in the case of Windows that

that's not exclusively the case but

if you have developed a windows program

or net application reverse engineering

it will make sense it you'll actually

understand what's going on and so

that's what I recommend doing now of

course in most cases you're going to be

in a black box type of scenario where

you're reverse engineering and

executable or you're performing malware

analysis on a malware sample you've

never analyzed before and that's where

the other skills like you know of course

assembly is one of them both x86 and x64

is important but you know you have your

typical debugging skills disassembling

skills where you have you know either

immunity you're going to debugger so on

and so forth and also get rid to a

certain extent but this is an area that

I'll also be exploring just to give you

guys a taste of what this looks like

um you know using completely practical

examples but that's another area you can

focus on in year three now to put all of

this into context before we end the

video

um if you're a blue team as I said I'll

be making a guide on that because a lot

of people you know blue team really

isn't that popular especially in

colleges in universities but still of an

excellent field to pursue one that I

like and find myself you know uh now

more than ever getting back into

but that's only to better my operations

on the red team side so I'm a bit biased

there but I'll be setting up a guide for

the blue teamers and you know for anyone

wants to become a sock uh sock analyst

Etc

um so yeah that's really the guide that

I have come up with and I said I've put

a lot of time and Research into this and

um

again the reason I made it is to provide

you with a guideline or a roadmap if you

will

on what you should you should know at

the end of the three years and again it

doesn't have to it this is not you know

set in stone or anything like that it

can expand to three five six years

whatever time you have because I know a

lot of people especially those who are

transitioning careers already have a day

job so I can understand the time

constraints and one thing that you'll

find and this is completely normal and

it's something that I encourage is that

let's say on year two when you're taking

a look at pen testing or post

exploitation is you'll go off on

tangents of your own within a specific

topic maybe if you're taking a look at

exploitation Frameworks that's fine

that's actually awesome but always

remember to come back to the guide and

again you don't have to follow mine

there's plenty of other guides out there

what I really wanted to stress is that

if you want to achieve anything in life

you need a goal and you need a timeline

those are the two trust me I know it may

sound cliche but just try it out for

yourself and you know set a no-nonsense

deadline but a realistic one of course

stick into account all of the

all of the work that you may have or you

know the time constraints if you're a

student make sure it's realistic so

don't say I'm going to learn how to hack

active directory in a month that's

unrealistic you can say

six months say in 2022 oh sorry 2023

by let's say July

I am going to have

not mastered but I'm going to have

learned how to pen test in an active

directory environment just set it just

say this is July and then you take a

look at build up a rough outline of what

you need to learn again it doesn't need

to be complete when you begin once you

start getting into it you'll start

filling in blanks that you didn't even

know were there you'll start seeing

stuff that you didn't know were there

that is not available online you know

that that's what now upsets you or marks

you out as a pen tester because you'll

start having this innate knowledge of

Technologies and how to assess them you

know so on and so forth but

uh set a deadline say okay I'm going to

learn this in month one two three four

five six Etc and uh you don't have to be

crazy with your time you don't have to

say oh every day I'm gonna focus on my

ad pen testing for six hours that's

unrealistic it's inhuman you can only

focus on something for like four hours a

day intellectually speaking you know uh

otherwise that after that your brain

just turns off you know whatever you're

learning isn't um isn't really uh isn't

really being saved in your memory and

there's a lot of signs to back that up

so be realistic just say every every day

five days a week four days a week is

typically good for two hours I'm just

gonna do a deep end testing and trust me

you can take a vacation you can enjoy

your weekends you don't have to be crazy

about it trust me by the end of that six

months

again you'll not be able to recognize

who you were uh when you started with

regards to your skill set in a

particular topic like active directory

pen testing so

again I would love to hear what you guys

think in the comment section uh and of

course your feedback is extremely uh

valuable I do appreciate all the support

you guys give me uh if you found this

video helpful uh please give it a like

or share it with your peers especially

if you're in school or university if you

think this may be helpful but yeah

overall I would like to see what you

guys have to say in the comment section

I know I have we have a diverse audience

of

students professionals and people now

who are getting into management so I

really like to hear what you guys think

and yeah thank you very much for

watching this video and I'll be seeing

you in the next video

[Music]