vpz

@vpz@infosec.pub

• ⁨Comment⁩ on ⁨Asset and Vulnerability Scanning⁩ ⁨⁨8⁩ ⁨months⁩ ago⁩:

  I’ve used Tenable Nessus Professional, and Tenable Security Center and both work well in their categories. Nessus Professional is a portable Nessus scanner a security person can take with them to do adhoc scans. Security Center (aka Tenable.sc) is a vulnerability management solution for an enterprise.

  Their competition is Rapid7 and Qualys, but I can’t speak to those myself.

• ⁨Comment⁩ on ⁨What are You Working on Wednesday (Special Thursday edition)⁩ ⁨⁨10⁩ ⁨months⁩ ago⁩:

  Pentesting skills are built upon skills in Linux and Windows system administration from the command line, networking, some coding usually in Python, knowledge of web applications and web servers, and more. When starting out it can feel bad because you want to learn out pentesting topic X, but then you figure out that you need to go learn at least the basics of fundamental topic A and B first. It’s normal so don’t worry about. Just dig in and enjoy the knowledge journey.

• ⁨Comment⁩ on ⁨Mentorship Monday - Discussions for career and learning!⁩ ⁨⁨1⁩ ⁨year⁩ ago⁩:

  Not a question but I’d like to provide some career guidance. If you’re interested in a career in penetration testing, please, please put some time in your training plan for technical writing. So many folks think the job is all hacking, but it’s really about a third project planning with meetings and such, a third hacking and a third writing. Writing rules of engagement, test plans, reports, presentations on results, etc. So business and writing is just as important as the technical stuff. A well rounded applicant will have better luck finding a role.

  Thanks for listening to my Ted talk.

• ⁨Comment⁩ on ⁨Training Tuesday - Discussions for certs, training and learning-at-home⁩ ⁨⁨1⁩ ⁨year⁩ ago⁩:

  I recently achieved a multi-year goal of obtaining the OffSec Certified Expert3 certification after achieving the OSCP, OSEP, OSWE, and OSED penetration testing certifications. It was a serious grind but I learned a lot, the skills are applicable to my work, and hopefully all this alphabet soup helps if I end up looking for a new position in the future. Right now I’m glad the grind is over and I can start building depth of knowledge in some of these areas.

• ⁨Comment⁩ on ⁨Linux Hardening - what are you must-haves?⁩ ⁨⁨1⁩ ⁨year⁩ ago⁩:

  There is no one way to secure Linux servers because Linux isn’t one thing due to distribution sprawl. How you do things depends on the distribution. If you want a general guide the CIS Benchmarks are a decent place to start. Then you can make a guide on how to implement them with your target Linux server distribution. Keep in mind this is for the OS and application hardening is just as important, and is an entirely different can of worms. downloads.cisecurity.org/#/