Kali Linux

[BlackCountryContractor]

I've started very slowly move towards cyber penetration testing and have been given a few prods/pokes by permies to at least consider it a career choice or at least look into it.

My question is has anyone found Kali Linux a good starting platform to learn from? Or should I start looking at other options?

 

[darrylmg]

I've started very slowly move towards cyber penetration testing and have been given a few prods/pokes by permies to at least consider it a career choice or at least look into it.

My question is has anyone found Kali Linux a good starting platform to learn from? Or should I start looking at other options?

It's very good.
There's a lot of stuff in there that you will need to learn if you're a complete novice. It depends on your background in computing and how good you want to be.
One thing I will mention, there's nothing like a good, solid understanding of the principles and methods that the foes use. This is the sort of stuff that the tools can't teach.
As with any good set of tools, get yourself set up with your own lab and remember the golden rule; never try the tools out on the public Internet.

 

[Mag]

This is something I'm in the process of moving towards, having done plenty of networking and network security in my career. I can only see the demand for this type of thing getting bigger and bigger.

I've used Kali for a few years for various basic tasks, like vulnerabilty scans, etc but I'm in the process of learning more about it.

I recently enrolled and passed the 'Cisco CCNA CyberOps' exam as this was a free scholarship Cisco offered where they teach you the basics of the cyber security analyst type role. It had some decent labs included with it, demoing how easy it is to XSS and ARP cache poisoning attacks, for example, all using Kali. It also contains a shed load of theory about incident handling, etc

A lot of 'cyber security' type training I have found is heavily driven towards process and how to manage incidents etc and less about the actual pen testing side of things.

Have you looked at the CEH courses, if pen testing is what you're looking at getting in to?

 

[amanwhoisquiet]

Have you looked at the CEH courses, if pen testing is what you're looking at getting in to?

Save your money here. They're not very well thought of in that industry. Buy one of the books if you must and have a skim through it, but once you get to the point where you want to certify have a look at CREST or OSCP. Get started by downloading flaky VMs from Vulnhub and trying to break them - and don't feel bad at following a walkthrough as soon as you get stuck. There's sometimes some good money in pentesting and it's a good set of tools to have in conjunction with something else, but for the most part it's very junior work and the money reflects that.

 

[Lance]

Most penetration testing is commercially driven rather than security. I know it sounds odd but that's the way it is.

Every time I've been involved with it (very often) it's more of a tick box exercise. Commercial pen test companies really just do:-

- vulnerability scan (using Nessus or similar tools)
- configuration validation (is it configured the same as per the design)

Neither of these require proper hacking skillz and can be done in a short amount of time (1 or 2 days for a new application). They charge a few k for some mid-range engineers, in smart suits, to write a report.

Whilst there might be some real value that can be added by a skilled hacker, it's far too expensive.
They could end up paying a contractor £100k and he doesn't hack the system and that tells the client sweet FA. Or they pay a pen-test company £5k, get the boxes ticked and carry on.

IMO It is a good skill but not much use for getting work unless you want bits and pieces.

 

[Snarf]

Most penetration testing is commercially driven rather than security. I know it sounds odd but that's the way it is.

Every time I've been involved with it (very often) it's more of a tick box exercise. Commercial pen test companies really just do:-

- vulnerability scan (using Nessus or similar tools)
- configuration validation (is it configured the same as per the design)

Neither of these require proper hacking skillz and can be done in a short amount of time (1 or 2 days for a new application). They charge a few k for some mid-range engineers, in smart suits, to write a report.

Whilst there might be some real value that can be added by a skilled hacker, it's far too expensive.
They could end up paying a contractor £100k and he doesn't hack the system and that tells the client sweet FA. Or they pay a pen-test company £5k, get the boxes ticked and carry on.

IMO It is a good skill but not much use for getting work unless you want bits and pieces.

That has been my experience in corporate IT too back as a permie Several conversations went along the lines of :

Mr Pink : "Is this public?"
Mr Blue : "Yes"
Mr Pink : "So we need to pen test it?"
Mr Blue : "Yes"

Mr Pink - Throws money at one of our approved suppliers who pass back a report showing all vulnerabilities.

Mr Blue : "Sooooo... Are we going to fix these?"
Mr Pink : "No time/budget.. We are logging the risk and will carry on as previously planned"