Zero to Hero: Hacking Your Way to Your First Pentest Gig | Christian Villapando | WWHF 2023

### Overview In this presentation at WWHF 2023, Christian Villapando shares guidance on how aspiring security professionals can break into the field and secure their first penetration testing gig. Speaking remotely from Manila, Villapando draws from his background as a pentest consultant for a US-based Fortune 100 company, master's student at the SANS Technology Institute, member of the Philippine CTF team Hacktivate, and advocate providing free cybersecurity training. He emphasizes that breaking into pentesting is achievable regardless of one's current age or background, provided one focuses on foundational skills, hands-on practice, and active community involvement.

### Key Topics - **Understanding Penetration Testing**: Villapando defines pentesting as an authorized attempt to access computer systems to improve an organization's security posture by identifying attack paths before malicious actors do. He clarifies that pentests are point-in-time assessments. - **The Reality of Daily Pentesting Work**: Contrary to popular media portrayals of non-stop hacking, a pentester spends considerable time on non-hacking activities. These include client communication, scope definition, troubleshooting connectivity issues, writing reports as testing progresses, and providing post-delivery support and presentations. - **Career Paths**: Aspiring professionals can enter the industry as full-time employees (at pentesting service firms or internal enterprise security teams), contractors paid by the hour for set durations (such as 3–6 months), or independent consultants running their own business, which provides more autonomy but relies heavily on industry reputation. - **Types of Assessments**: Common assessments include web applications, external network testing, internal active directory assessments, wireless testing, mobile pentesting, and product or IoT embedded device testing. Web application testing is highlighted as the most common engagement and the usual entry point for beginners. - **Core Fundamentals & Prerequisites**: Success requires solid grounding in computer networking (understanding concepts like TCP and the three-way handshake), operating systems (especially proficiency in Linux over standard Windows interfaces), and scripting or application development languages (recommending Python for scripting, alongside exposure to languages like PHP or Java). Those transitioning from other IT or infosec roles should also familiarize themselves with broader concepts like security controls, red and blue teams, and incident response.

### Technical Details & Learning Strategies - **Training Platforms**: Villapando advocates leveraging free and paid learning resources, mentioning PortSwigger Web Security Academy for web application security, Hack The Box, TryHackMe, and material from SANS and OffSec. - **Certifications**: While industry figures like Dave Kennedy and John Strand no longer need certifications due to their established reputations, certifications can help beginners pass initial HR screenings to land their first interview, though they are not an absolute requirement. - **Goal Setting**: To maintain consistent progress, learners should set structured goals: daily goals (learning two current infosec news items or exploits), weekly goals (studying technical fundamentals like TCP RFCs), monthly goals (participating in a CTF), and quarterly or yearly goals (completing an online course or passing an exam). - **Documentation and CTFs**: Writing public write-ups (e.g., documenting vulnerable machines on platforms like Medium) helps build communication skills and document personal growth. Hands-on CTF participation (such as competing in the DEF CON Red Team Village CTF) reinforces technical skills under realistic scenarios.

### Takeaways To land a first pentesting role, candidates should focus heavily on troubleshooting fundamentals, gain hands-on practice via CTFs and labs, document their progress, and network within the community. For those already in IT or infosec, volunteering for dirty work, vulnerability assessments, or internal testing tasks can provide crucial visibility and experience. Pentesting ultimately balances technical hacking with communicating business risk to clients.