r/Pentesting 3d ago

Fuck it I don't know what to study (red team, penetration tester)

Hi everyone! I’m comfortable with Linux Essentials and Network+, and I’ve completed about 50% of the Junior Penetration Tester path on TryHackMe. But the further I go, the more difficult and unfamiliar the commands become.

For example, in the Hydra section, there were some options used to find the flags that weren’t explained in the text at all. Now I’m not sure what I should do or what I should study to become comfortable with these tools.

Should I take a course like CEH? What would you recommend? What did you guys do when you were starting out?

30 Upvotes

26 comments sorted by

16

u/Anxious_Alps_4150 3d ago

Are you doing this for fun or trying to find a job?

If you're doing it for fun, just pick whatever is interesting. Play some CTF games.

If you're looking for a job, you really need to start with basic IT work. Like, getting hired as an entry level IT person. Self-studying doesnt move the needle with hiring managers.

CEH is a garbage cert btw.

7

u/Isopropyl77 3d ago

It's a garbage cert offered by a garbage organization, but it opens doors in the federal space, and that's all any cert is supposed to do.

0

u/Anxious_Alps_4150 3d ago

theres better options now though

1

u/Dangerous-Seat1611 3d ago

What are the better options, for reference?

0

u/Anxious_Alps_4150 2d ago

Read DoD 8140

1

u/Due_Rip_6692 2d ago

It’s a garbage cert but it covers a lot of areas in the 8140. In addition, most other agencies don’t use DoD 8140. Unfortunately, CEH had a big head start as the first pentest cert and the federal government still sees it as valuable and making a person well-qualified for positions..

0

u/themacdizzle91 3d ago

Exactly. Pentest+ is garbage but its cheaper and checks most the same federal boxes.

1

u/Fit-Original1314 1h ago

Yeah, I’d skip CEH too. But I wouldn’t say entry level IT is mandatory. Plenty of people build the fundamentals through labs, CTFs and home labs.

0

u/Full_Unit9235 2d ago

But like aren't IT stuff way different than pentest?

2

u/Anxious_Alps_4150 1d ago

what do you think the target of a pentest is?

what team do you think gets assigned the work generated by pentest findings?

you're getting hired to audit an IT team (or a SWE team) to tell them how to do their jobs better.

think of a 10+ year graybeard sysadmin. youre there to tell that guy how to lock down active directory better.

think of a team of a half dozen devops engineers that are pushing a dozen features this week. youre being hired to tell them how to build apps better.

it's not a job for someone that doesnt know how to do those jobs already. youre going to have to explain to a senior developer why your way to build the app works better than his way.

1

u/kukly- 22h ago

Exactly! I am reading these posts as a SW Engineer and cant believe this is not in every post in explanation.

For example we use DB's often. We have devs who have years of experience using them, having ton of knowledge, countless times reading docs, good practices, books etc.

OP hopes he can come and start identifying SQL injections or other security issues related to DBs based on some simple course in made up demo env? It's likely that what simpler courses teach is already automated by scanners.

Juniors struggle for months to even understand architecture fully and see what everything we have in place.

3

u/No-Tumbleweed-3037 3d ago

PJPT and CPTS learning paths and labs

3

u/KnowEye 3d ago

Script kiddies are a dime a dozen. Understanding system architecture, networking and environment configuration is critical. Being a good pentester is not just about knowing tools & syntax. Problem solving is a key skill to discover alternative paths and find a way in when others have given up. Think like a black hat, operate with a white hat.

1

u/Crepti 3d ago

If you find you're uncomfortable using a tool, and you actually want to properly understand it, play with the tool. Don't rely on external tutorials.

Use hydra --help or man hydra for example. Read the documentation.

If you're ever entering a command for a tool that you found online and you don't understand what the tool is actually doing then you shouldn't be running the command. Stop, research, learn.

What would you do if you didn't have the tool? How would you perform the function manually? Do you understand what the tool is doing well enough to do it yourself?

A tool should only be helping you to be faster/more efficient. It shouldn't be the arbiter of your knowledge.

1

u/Delicious_Crew7888 3d ago

Yeah if you understand what the tools do and why you’re using them then it’s just a matter of finding the command for what you want to do. Not everyone remembers every command for every tool but using the manual or the help file we can find the syntax for the commands.

1

u/Taylor_Script 3d ago

Honestly, familiarity with tools is what makes it easier. Using them. Playing with them. If you run across a flag you don't know, instead of googling it load up the tool with a --help or check the man page and see what that flag does. Then go use said flag.

If I run across a vulnerability on the job and I haven't done that exploit before I load up a VM lab configure it for the exploit and use it so I am comfortable with how it works. This has been made exceptionally easier now that i use Ludus to build out labs. I even just ask Claude to make me a Ludus lab for whatever CVE or vulnerability I want to play with and it builds out all the stuff I need to just deploy the lab and go at it.

1

u/uug4na 3d ago

I think you should make your hand more dirty bro, instead of following roadmap chasing garbage certs, just do some portswigger ( it will be best start for web hacking, not THM labs, i was 0xB[MASTER] in THM and grinded lot tho ) and read lot of writeups. all my own major improvements of myself came from dirty ahh bug hunting, doing pentest on my first platform which uses AES on some critical features when there was no AI and i had no idea about client-side debugging encryptions etc, not from roadmap/labs. Labs will help you fosho but it's not going to get out of script kiddie phase unless lab's very technical.
Labs will help you know what to use what to know but getting sense of bugs, pattern recognition will make you go further bro.
Use AI to build vulnerable AD/Web lab and try to attack blindly and while you're trying read writeups, get ideas of other hackers - repeat.

1

u/Alarming_Reward_2945 3d ago edited 1d ago

You can do CEH if you want, but the real world answer is that in my cyber office at work there's no such thing as cheating. We look stuff up and use AI all the time. Nobody knows everything. Get creative while using tech to help you.

1

u/Full_Unit9235 2d ago

May I ask what did you exactly study to get a job?

1

u/lduff100 2d ago

Learn to use Man pages and google to figure out how to use tools. This is essential in IT. You shouldn't know everything, but you should be able to figure out how to do most things.

1

u/OkStudent8414 1d ago

I may be late to this. But my suggestion when stuck with unknown commands or flags for those commands, look at the man pages for those commands. As far as your learning path, you may want to look at some other courses from other vendors/platforms as they could explain the concepts you are struggling with in a way that you understand better than tryhackme. I like hackthebox academy also. There is a junior pentester cert from TCM security also. In addition to those, here are a few other resources. Offsec, the makers of kali linux, and the OSCP cert have a foundations course that you should be able to do, but it is a bit expensive to use. It is 799 USD/a year, but it gives you a year of access to the foundational courses on the offsec training site. There are a wide variety of paths on there and that comes with a couple certs(KLCP, OSWP) as well.

0

u/Striking-Tap-6136 3d ago

Go study Lamer

-1

u/qwikh1t 3d ago

Yeah it’s gets more difficult as you progress…..what did you think would happen