@Farah Hawa Talks About Learning How to Code, Javascript, Creating Content, Mentorship and more!

### Overview In this live stream interview, Farah Hawa, an Application Security Engineer at Bugcrowd, part-time bug bounty hunter, and YouTube content creator, discusses her transition into infosec, her learning methodologies, and her approach to web application security. Coming from a non-technical educational background with a degree in mass media, Hawa shares insights into how structured self-study, mentorship, and content creation accelerated her career in application security and triage.

### Key Topics - **Non-Technical Transition to Infosec**: Hawa graduated with a bachelor's degree in mass media. Encouraged by her father to explore cybersecurity rather than general software engineering, she transitioned into web application testing through hands-on internships. - **Mentorship and Learning Strategy**: Her second internship at AppSecure under Anand Prakash provided a pivotal learning environment where her mentor guided her to research root causes autonomously rather than spoon-feeding answers. She also credits content creator Vickie Li's accessible blog posts as a major inspiration. - **Content Creation and Networking**: Hawa began posting bug bounty findings and educational resources on LinkedIn and YouTube. This visibility led to collaborations with Bugcrowd and an eventual invitation from Michael (Codingo) to join Bugcrowd as an Application Security Engineer. - **Certifications and Career Advice**: Holding a Certified Ethical Hacker (CEH) certification, Hawa clarifies that while it served as an HR filter and personal commitment tool, it offered minimal practical value for web hacking skills. She recommends OSCP over CEH for foundational hands-on security concepts. - **Mental Health and Industry Evolution**: Hawa discusses managing burnout through consistent, incremental daily effort rather than overworking, alongside addressing imposter syndrome. She predicts the bug bounty landscape will move toward customized, crowdsourced penetration testing models (such as Bugcrowd's Next-Gen Pen Tests).

### Technical Details - **Coding for Hackers**: Hawa practiced coding across JavaScript, PHP, Python, and SQL using Codecademy and The New Boston. While not strictly mandatory for all bug bounty hunting, she emphasizes that understanding JavaScript, server-side languages, and database query mechanics enables hunters to visualize backend request processing and evaluate vulnerability impact. - **Core Study Resources**: Practical training combined PortSwigger Web Security Academy, *The Web Application Hacker's Handbook*, and hands-on labs like PentesterLab. - **Methodology & Recon**: Rather than relying solely on extensive subdomain enumeration, Hawa prioritizes deep application analysis. She documents every feature and workflow exhaustively using Notion to uncover logical flaws and access control bypasses. Her recon stack includes Amass, cert.sh, Dirsearch, Wayback URLs, LinkFinder, and Google Dorking for exposed sensitive organizational data. - **Burp Suite Setup**: Alongside core features (Scope tab and HTTP history), she highlights Turbo Intruder for race conditions, HTTP Request Smuggler, INQL for GraphQL analysis, and JSON Web Token extensions.

### Takeaways - Beginners should master web fundamentals (HTTP, headers, cookies, browser security) before attempting vulnerability exploitation. - Starting with swag-only or Hall of Fame programs found via Google Dorking helps build foundational skills and confidence without the intense competition of large public programs. - Knowing JavaScript is critical for understanding Cross-Site Scripting (XSS) context and demonstrating real business impact over simple popup alerts.