Hello amazing hackers! My name is Wesley and i am 30 years of age (just like fine cheese, i get better with age). My alter ego is The XSS Rat which is also a legal entity and my company. Besides owning my own company i have a dayjob as a QA engineer and i am a certified expert in performance testing.
When i get up in the morning on a weekend, i usually make time for my daughter so i don't get to hunt like i used to for 8 hours a day. I usually hunt with clients to show them how i perform my bug bounties and i allow them to perform the hacking while i correct them and guide them on how i would do it. It usually starts with exploring my target, that is very important. I need to get a good feel of what is supposed to happen so i know when something happens that is not supposed to happen. I use things like use guides, documentation and common sense while doing this. I study every parameter in depth and try to get well known with my target. I will try to change every parameter testing for things like logic flaws, XSS and CSRF issues. After i am done, i make another pass looking for XSS more carefully and to finish off, i try to randomly throw data at the application to see how it handles this, maybe even making use of my skills as a performance tester and using jmeter to try and trigger race conditions.
When i was a kid, the hacker scenes in movies are what got me interested. There always was a veil of mystery behind that wall of green scrolling text. When i got more serious about IT of course i learned there was nothing behind that facade but my attention was caught. I studied general IT for several years before i did anything infosec related and bug bounties are what i needed to earn money but not in a way that you might think. I wanted a job in cybersecurity but to do that i had to first get some experience. I was determined to show my skill after OSCP so i went straight into bug bounties and used it to show my merit.
Not at all, I think that most of all, a hacker is just someone that uses the same tools as engineers do but in a slightly different manner. This requires thorough understanding of a topic the hacker wants to sink their teeth into as to be able to mis-use something, we need to know how to use it first. That being said, i don't think hacking is easy either but it can be as simple as changing a number in the case of an IDOR.
I am personally a big proponent of certificates as long as they related directly to the work that someone is currently doing or wants to evolve towards and as long as that ambition is not bug bounties. The use of certificates is mainly to level the playing field and make sure we are all talking about the same thing in a demonstrable manner. The beauty about bug bounties is that you can investigate what you like and that you are not bound by having to display certain skills that a job would normally bind you to.
I have my OSCP certificate and am planning of getting my OSWE certificate after taking the training sometime soon and i believe that certificate has been my entry into the infosec scene. Besides those i hold a range of other certificates that are not related to infosec such as neoload performance testing tool expert certification and ISTQB technical test analyst.
There is a learning curve that makes it easy to initially learn new things but as we go along, the curve grows exponentially harder. This is why it's often easy to bring up the initial motivation to get into the field but to keep up with it is often mentally taxing as we are forever bound to keep learning lest we get left behind.
An overwhelming sense of dread and inadequatie is what almost killed my motivation several times. I was looking around me and seeing all these amazing hackers who are so much better than me even though i know i should not compare on a "level" basis. That is going to be a big trap that's easy to fall for so make sure you compare yourself to yesterday and not to someone else.
The sheer ease of hacking the human aspect of a company. I can trust a companies security policy all i want but unless the company stops the employees from going through the data collected, that will be the weakest link. An example i read online a while ago was of an attacker holding a victim at gunpoint and how it would take quite a strong will and disregards for danger to ignore that.
I used to find it difficult but as cliche as it may sound i really started enjoying working for my own company and the hours fade away into oblivion however i insist on spending several hours a day with my wife and daughter.