Introduction
In this article, weâll discuss the ways that even complete beginners with no security background can get into ethical hacking. In case you are considering ethical hacking as a career, we will discuss important educational and experience-based considerations as you attempt to choose the right path to lead you to the ethical hacking career that suits you best. Weâll also discuss several careers that you definitely should consider as you get into ethical hacking.
What is ethical hacking?
Ethical hacking involves discovering security issues (referred to as vulnerabilities) and disclosing these to affected parties in a responsible fashion. The main difference between ethical hacking or âwhite hatâ hacking and unethical or âblack hatâ hacking is consent. In ethical hacking, the hacker is given consent to proceed with the hacking activities while still adhering to a certain scope of attack. In unethical hacking, the hacker proceeds to hack without authorization and does not disclose the vulnerabilities identified and may even exploit them for personal gain.
There are many methods you can use for ethical hacking, depending on your relationship with the client. Here are some of the most common methods:
Penetration testing
In penetration testing, the hacker is given consent to adhere to a certain scope in order to discover vulnerabilities, exploit them in a controlled fashion and then document and present them to the client along with recommendations to fix the discovered issues. A non-disclosure agreement is also involved, restricting the hacker from communicating the findings or private data with external parties.
Bug bounty hunting
In bounty hunting, the ethical hacker adheres to the given scope and identifies previously unknown vulnerabilities, reporting them to the vulnerable party participating in the bounty hunting program. Programs like these are good for aspiring ethical hackers, as they allow you to hone your work in a practical environment. Some bug bounty programs even offer cash rewards for finding vulnerabilities.
Zero-day research
This involves discovering vulnerabilities that nobody has ever previously found, which are referred to as zero days. Ethical hackers are required to responsibly report these zero days; however, some malicious hackers could also obtain info on zero days and abuse them for self-gain.
Security research
Some ethical hackers devote their time and effort to developing tools and resources that can be used to protect systems online from malicious attackers. Such tools can be used by other ethical hackers and, unfortunately, malicious hackers as well.
What knowledge is required to become an ethical hacker?
Now that we have a rough idea of what ethical hacking is, letâs discuss what knowledge we need to have in order to become proficient ethical hackers.
Before you can consider yourself an ethical hacker or apply for ethical hacking jobs, there is quite a lot that you will need to familiarize yourself with. You will need to have a good grasp of the following:
Programming
You will need to understand, at the very least, how to read code, if not write code yourself. Some experts suggest that being a master coder will make you a better hacker, but there are plenty of master hackers who are not coders. However, the more you know about coding concepts, the better youâll be able to conceptualize and think through the issues surrounding certain hacking techniques and vulnerability detection.
Networking
You really ought to understand the basics of networking and how routing and switching is done. A firm grasp of the OSI layer is a must. You want to be able to understand how networks and network devices behave.
Why? Imagine you are being hired to break into a well-defended bank or government building. It wouldnât do for you to avoid learning about the buildingâs network of hallways, ventilation systems and door lock systems prior to trying to break in!
Databases
Most systems have databases underlying them, which is where information is stored. You will want to be able to know how to make queries for when you will find yourself with database access as you hack ethically. Again, itâs important to understand the nuts and bolts of every type of system that you will be paid to try to break into.
Operating systems
As you hack ethically, you will stumble on Windows, Linux and Mac OSes. You might also be tasked with conducting tests on mobile operating systems as well. You will thus need to be comfortable with flexing your hacking muscles around many different types of OSes.
You should also understand that persistence and passion contribute a great deal to becoming a great ethical hacker. Some situations require that you chain different vulnerabilities together to achieve a successful exploit or exercise patience to obtain results, e.g., during brute-forcing.
Time and time again, successful professional ethical hackers will tell you to learn broadly about every aspect of computer networks. The more you know about the playing field and the many tools you have to use, the more flexible you can be while breaking into a system. Ethical hacking is only partially a process. Most of all, it is a problem to be solved by any method available.
How can I effectively learn ethical hacking?
This is a common question. Most beginners who get into ethical hacking do not know where to get their knowledge from or how to know if the information is reputable. Nor have they developed a systematic manner in which to study. As such, they find themselves bombarded with too much information and either get lost along the way or give up due to trying to study as much as possible from many topics.
The following are some of strategies newcomers can use:
Identify your area of interest
It is important to choose a topic that interests you and learn it well. As you are doing this, you will also want to know a bit of something in other topics as well.
For instance, say you are interested in network penetration testing. You will want to look into wireless pentesting, reverse engineering, malware analysis, web application pentesting and so on.
Follow the right people online
Ethical hackers are surprisingly forthright with their information and research findings on social media. A number of security professionals like to post their latest research work quickly via Twitter. Others will make more detailed blog posts on Medium (a free platform that allows authors to share their work with a greater social reach than personal blogs) in the form of tutorials walking you through their methods used to discover vulnerabilities. Follow this tag on Medium for some good examples.Â
Even better is meeting these professionals in person. If you can attend local or international conferences, you will be able to network with hackers you can learn from.
Remain consistent
Consistency is the name of the game. You will discover that in ethical hacking, just as in other areas of life, remaining consistent is what you do allows you to make the biggest strides. Devoting time each day to learning a new concept and practicing what you already know will make you a master ethical hacker faster than youâd think.
Have the right motivation
Most seasoned ethical hackers will tell you that what motivated them to become as good as they are was their passion. When your passion leads you to study ethical hacking, you will realize that it becomes fun and that learning one thing triggers you to want to learn three related things. On the other hand, it is much easier to quit when your only motivation is making money from the activity. Truth be told, the money will come as long as you are good at your area of expertise in ethical hacking.
Once you have gained knowledge in an area and feel confident enough in it, you can then choose to move to a different area or specialize in the previously-concluded one. It is worth noting that acquiring the basics in multiple areas of ethical hacking can be quite beneficial, since these skill sets correlate within cybersecurity.
For example: You may find that for you to gain remote code execution on a web server, you might be required to reverse-engineer, recompile and upload a malicious binary. You will have combined skills acquired from reverse engineering, programming and web application security.
Are there any in-demand certifications that I should consider taking?
There are a couple of ethical hacking certifications that are highly desired. These certifications show employers that you indeed understand a wide range of ethical hacking processes and procedures. They also qualify you for more of certain types of jobs â we know for a fact that HR gatekeepers will reject candidates who donât have certain certifications on their resumes.
Below are some certifications that you should consider:
- Certified Ethical Hacker (CEH)
- Offensive Security Certified Professional (OSCP)
- Computer Hacking Forensics Investigator (CHFI)Â
Even though it is true that certifications separate you from the competition, it is also very true that organizations are now beginning to consider individuals who can prove that their experience is more practical and hands-on. There have been numerous cases of certified hackers with a dozen certifications being unable to demonstrate desirable practical skills in person while the person who got the job was able to perform a hack (and show what they had done) during the interview.
What jobs can I consider getting as an ethical hacker?
Once you have developed your skills in ethical hacking and feel confident enough, you can now pursue various available career paths depending on your acquired skill set. Ethical hacking jobs are on the rise every single day. Ethical hackers sometimes also hold jobs in related fields, such as information security analyst, security engineer and cybersecurity analyst. But of course, the career tracks youâre really interested in are:
Penetration and vulnerability tester
This role requires a thorough understanding of how to conduct vulnerability assessments, systems and how to exploit them, and how to properly document and communicate findings. Understanding pentesting methodologies is naturally also key to this role.
Bug bounty hunter
This career requires a thorough understanding of how systems and applications work. Once you understand this, you will be able to discover vulnerabilities and misconfigurations that could lead to exploitation, where proper security measures were not enforced. Companies offer rewards for reported vulnerabilities on platforms such as Intigriti, HackerOne and Bugcrowd.
Red Teamer
This role is quite advanced but is also very desirable for people that want to get extremely hands-on in discovering vulnerabilities and helping companies strengthen their overall security posture. It requires that you are excellent (expert-level, even) in exploiting vulnerabilities, taking extreme measures in real-life scenarios in order to ensure that you are able to demonstrate how bad actors can gain unauthorized access into organizations.
Some of the most desirable skills here include malware writing (capable of bypassing antivirus), Wi-Fi hacking, social engineering (including using your personality to convince a receptionist or night watchman to let you into the restricted part of the building) and offensive skills such as the creation of rubber ducky scripts.
It is important to note that there are new and emerging roles within cybersecurity being created daily, and you wonât be missing out at all as an ethical hacker. For instance, letâs consider bug bounty hunting. According to this Bugcrowd report, 22 percent of hackers consider bounty hunting their full-time profession, while 77 percent have a full-time profession outside of bug hunting. 81 percent said their experience while bug hunting has helped them get a job, and 72 percent said bug hunting directly helped land them a job in cybersecurity.
Conclusion
In this article, we have discussed the basics of ethical hacking, looking at the knowledge that is required before one can become comfortable as an ethical hacker, and also how to begin learning how to hack. We have also included some careers aiming to excite newcomers to study and acquire as much knowledge as they can in order to fit within these careers.
The more knowledge you have across the board, the more desirable you will be to employers. This is because youâll be seen as someone who can handle a wide variety of tasks, not just the items that have been assigned to you. The way to rise through the ranks of any cybersecurity job is to be able to solve as many problems as you can, not just those that are under your jurisdiction.
We hope that this article has provided you with a good introduction to ethical hacking and excited you to explore further! If so, please explore further within this series, as it will provide dozens of quality articles to cover in detail many of the topics above that received only basic coverage. Good luck and have fun!
Sources
- Ethical Hackers: Vacancies increase by 4% but demand outweighs supply threefold, Joblift
- How to Become an Ethical Hacker, Medium
- Inside the Mind of a Hacker, Bugcrowd
