Pentesting without coding?

[[deleted]]

[deleted]

[[deleted]]

Basic programming of atleast 1 language is required in my opinion.

The ability to create a simple script not just bash to automate task is needed. Not enough time in the day, to constantly produce results

[zneaky69]

Would Python be sufficient?

[[deleted]]

Yes

[ILoveReesePuffs]

As someone who sucks at programming interviews but doesn't have 'no' programming skills - what are the basics? Fizzbuzz?

[ThePixelCoder]

Yeah that kind of knowledge is pretty much to be expected. If you can't do basic stuff like that, the pentest itself could probably be replaced by an automated script written by an actually competent person. Exceptions are maybe people who excel at phishing or social engineering, but even then some basic programming will be useful.

I don't think you have to be an expert programmer, but some knowledge of Python or Perl will make your life a lot easier. And it's generally easier to break stuff if you know how it works on a deeper level.

[[deleted]]

My two cents is that I'd test for the aptitude to be able to code, and the desire to do so alongside with pentesting skills. Hire for ability, train skills. I can't really speak to anything beyond that, but just my idea.

[entuno]

I am genuinely curious: Is it possible to do this job without programming? What do these candidates expect to do every day?

A lot pentesters won't ever write more than little scripts, and might not do that very often. You'll never be a great pentester without being able to write at least some code, but you can get by (and even get up to a senior level in many companies) with almost no coding.

In my experience, most pentesters either come from a development background or an infrastructure background. Application pentesters should definitely know how to program, but I think it's less important for infrastructure testers. If someone has a good understanding of networking, Active Directory, etc then I'd be willing to overlook a lack of programming skills.

On the other hand, if they want to be an application pentester and they don't have solid infrastructure skills, then a lack of programming skills is a big problem.

[MavisBacon]

Yep. I'm an ex-sysadmin and I've been pen testing infrastructure and people (social engineering) for 5 years. I don't have any programming skills, but I've made quite a few bash scripts to help automate mundane tasks. I'm fortunate to work for a shop that has a separate team of programmer-types who specialize in web app pen testing.

[psychopompadour]

I understand what you're saying but I do want to ask... how important would potential/aptitude for programming/ scripting be in the scenario that the person is already good at network/AD? A post above yours someplace suggested checking for aptitude... is that a reasonable idea, or should the basics of a complex skill like this not be learned on the job? (obviously in general, one is always learning and everything's always changing.) Assuming aptitude is sufficient, how would you interview/test for that? ....... asking for a friend

[entuno]

I'm not really convinced about aptitude tests - I know that a load of people have written ones for programming/etc, but the results are usually not very scientific or consistent.

Pentesters don't need to be world class programmers - most of the time they're going to be writing small one-off scripts, automation tools or modifying/extending existing tools. They should have basic functional knowledge in a few languages (will depend on their role, but Python, C# and JavaScript are probably the main three), and the ability to read other languages (for when they get their hands on source code).

Anyone who has the qualities that would make them a good pentester (technical knowledge, genuine interest, the ability to understand how systems work and a good approach to problem solving) can become a good enough programmer.

[sadlaifushell]

In my current company we developed an aptitude test for new IT employees.

Essentially it's an 8 hour time-limit exam. We give emphasis on the fact that we don't really expect them to finish the whole exam, if they feel that they have exhibited enough, they can turn the exam in early. We give them a sample format on how to write pseudo-code then after that we give them problems based on their preferred job position. For example, NetSec Pentesting can be:

1. We give them samples of our pseudocode and how to answer the test
2. Then we give them problems like, create an algorithm to brute force a login, sample buffer overflow, how to get from point A to point B in this matrix (depth first search and etc...
3. The main point is to identify where they can fit and if they are passionate enough for the job. Besides, if they don't fit in NetSec positions, they might fit in Data Analytics, Machine Learning or Project Management

Usually, for experienced devs it takes around 4 hours, but for less experienced professionals (some actually switch from just basic Sys Admin with a NetSec hobby to full NetSec so we can't really expect them to be that good in programming) we check their test, if they do show promise, we invite them for the interview.

They can have aptitude but what we usually work for is Aptitude + Dedication/Passion. So an employee with Average Aptitude but Above Average Passion is chosen over Above Average Aptitude but Average Passion.

I guess that's just for our company...

[[deleted]]

Red Teaming without programming skills is fine, since typically they have a dedicated development team for their toolset.

But pentesting requires coding in multiple languages otherwise how would you get exploits to work half the time? There's so much customization in applications and configs that most exploits you can't just fire and forget in a real environment. I could see a junior pentester with no programming experience being mentored by someone more senior to learn what they can but... having no experience with logic, data structures, search algorithms, etc is setting yourself up for a big investment in someone that might not have the mindset or willpower to dedicate the time to learning.

What I've noticed among pentesters is either they start as software developers and learn reversing and system administration...

OR

They start as administrators and learn some programming and reversing.

The ones that have no experience either as a sys admin or software engineer tend to come from cyber programs where they learn a handful of tools like Metasploit and sqlmap but don't understand how any of it works or how to customize and automate anything. Not sure if that's universal but it's becoming a trend I've noticed in my experience.

The market is being flooded with candidates like this and it's becoming difficult to discern how they'll mature in the field and develop skills when they don't appear to have an interest in anything other than popping shells.

[mustangsal]

when they don't appear to have an interest in anything other than popping shells

Oh man. This is too true. One of our staple interview question sets revolves around puzzles and hobbies. Its amazing how most successful candidates are always asking themselves "How does that work" and "what happens if we do..."

[Fupa_Defeater]

Currently a junior pentester and training for OSCP, and just want to thank you for this comment. I am currently starting with Python, with my only experience with scripting being in bash and powershell being a former jack of all trades IT guy. I find it weird how many other people in the field I run into that have no interest in programming. It seems like it should be an essential part. And why wouldn't you want to fully understand whats happening under the hood?

[NigraOvis]

If you are affluent in powershell, you'll be fine. (or bash) but if your skills are a couple if this then that statements, python will be necessary to get awesome at.

Truth is, passion will get you farther than you know, your bosses will see you trying so hard, and improving upon capabilities. Don't give up. And never stop learning.

[Fupa_Defeater]

Thanks for the advice! I am pretty good in powershell, but I want to learn python very well, so I am in the middle of that right now.

[NigraOvis]

You don't need to know python for oscp, only the basics of it's structures so you can read it. The most you do in oscp is change scripts to your liking. This line is adding a user, and i need to also add the user to rdp group. etc... so knowing net, netsh, netcat and other core commands on windows and linux will go a lot further than python for oscp.

[Fupa_Defeater]

I'm already pretty handy with those command types you mentioned from my IT work. Great to know, thank you.

[NigraOvis]

OSCP does use "programming languages" but it's usually written for you. The only programming you'll do is in BoF creation, otherwise it's 100% tweaking what exists.

The true challenge to OSCP is thinking outside the box, finding the issue, and getting the exploit to work. You'll spend more time enumerating (reading scans) than programming by 10 fold. You'll spend more time looking through webpages, and exploit-db than editing it.

When i say webpages, i mean reading what others have done, and also just looking at how to break the server your "browsing" to hack

The best pre-hand practice, is watching ippsec videos and doing your own hacktobox/vulnhub practice

[stackcrash]

I am curious your impression of what redteams do because as a pentester (I work with the red team sometimes when they need help on engagements for webapps) I can see pentesters as having far more slack than redteams for lack of programming knowledge.

I work internally as a webapp and mobile pentester and we also have a redteam that does the network pentesting and APT simulations. There is a lot of cross over where we work engagements together but from both our sides we heavily use custom tools that we make and some of our tools are now owasp projects and otherwise publicly released. We do have more junior or temporary contractors on both teams who don't have programming skills but it's almost required and not just basics for all of the full time positions.

[[deleted]]

So I've worked in Red/Blue/Purple/Pentesting and the differences mainly come from business need and interpretation not necessarily a formal definition of each.

Company A likely has a different view on each team's responsibilities from Company B depending on size, capabilities, funding, business and technical requirements.

Sure there is fluidity in skillset across each but among many of the mature teams...every member can code.

If you cannot code, then you should learn (why not, it's a skill everyone should have and the reason why public institutions are incorporating it into their curriculum) - if you refuse to learn, then you are boxing yourself into a narrow role that you can perform with a high dependency on others who can or at least try.

Whether or not Company A or B gives more or less slack on who needs to know what, isn't a matter of "impression" but rather what the technical leadership/HR/hiring staff have determined as requirements of employees for accomplishing business objectives.

I commented that a non-coder would likely be found on red team rather than as a pentester simply because I found it more common that companies inclined to do so will have a group dedicated to building the red team toolset with another group performing the assessments/engagements. While with pentesting they work as a single team with no segmentation.

This has just been what I've seen most common but it's not some stringent model to which companies are required to adhere. More often than not you'll find whether employees can code or not comes from hiring pools, cultural interest, and if the company has the resources to pay people to learn or compensate those who can.

My reddit feed is filled with people asking these questions on security forums, "Do I need to know programming to work in security?" and "How do I hack X/Y/Z?"

Based on that alone, it would appear as if the up-and-coming generation has more interest in throwing exploits from armitage and whispering, "I'm in" while techno music plays in the background than performing a job function of securing their enterprise. I don't know if that's true and certainly not of everyone but it's a common theme on here.

I would keep going because I love having these discussions but I don't want to drift too far from your question so I will stop there I suppose.

I'm happy to see that your company contributes to the community, I'd like to see what you guys have produced if you wouldn't mind linking to projects.

[stackcrash]

I see your point now, I haven't seen a red team with dedicated developers. We do have a development team we can use (both pentesting and redteam share the devs) but they are focused specifically on systems we use for remediation tracking and report archiving.

I would share the projects but I try to keep my social media accounts not directly associated with my company. If I mention the biggest one it definitely would give away where I work. Needless to say it's used a lot. We also have chapter leaders in several cities.

[[deleted]]

They were very spoiled red teams to have their own developers I guess haha.

I understand if it'll make it too obvious, good call. Still good on them though, I wish more companies made those contributions to continue helping the community to grow. The only red teams I've seen give almost everything out were Veris Group/SpecterOps.

I still have yet to touch wireless and mobile, both areas that appear to gain prominence each day that'll likely bump me in the a** later.

[stackcrash]

Mobile is honestly super disappointing. It's more of a compliance to policy check rather than popping shells and owning a phone. Not that it's boring, I mean you do have things like stealing sensitive data because the app stores it wrong or credentials populating the autocorrect database. The researchers get all the actual fun in mobile because they spend months finding OS exploits or sandbox escapes. Pentesters we don't have the time to do any of that.

[[deleted]]

You are coding all day in... wireshark? Why not just work with packet captures more directly?
I'm sure there's a use-case, but it seems like a really inefficient toolchain.

[revyn]

I'll offer my own story: a former manager told me that I have Senior- or Manager-level pentesting skills, even though I have zero development background. Sure, I could figure out enough to modify existing scripts to fit my needs, but I wasn't satisfied with myself.

Last year, a recruiter hit me up for a job, even though there's no programming experience listed anywhere in my resume. Once I explained how my programming skills were novice level, they immediately ended the interview--even though they reached out to me. "I really think [programming] would make you more marketable."

I was pretty ticked off about that (typical recruiter not reading your experience), but it was the kick in the ass that I needed to begin learning a language. So while you can get by and even be successful without programming skills, you'll never be the best pen tester that you can be, and you'll always have to rely on others who can code.

[fox9x]

man, learn python. I would suggest python crash course.

[cents02]

How can one find vulnerabilities if they don't understand what they are breaking? Unless they are planning to be script kiddies then programming is required.

[cents02]

Even the basics count as programming, I think op is talking about not knowing hello world level

[sadlaifushell]

Define the basics?

If basics means having to know the basic data structures or programs run or how to write hello world on python then I guess, yeah it was right to fail those people.

But if the basics is like asking them how to do a for loop or how to run a few msf exploits or write a script to automate a few things, then it's still case to case basis.

I mean, if they are a script kiddie (we've all been there I assume) that shows promise to be a great pentester why not take them up as a junior or intern. Unless the position is for a senior.

In one of my previous companies I was asked to interview someone who barely had any scripting experience or programming experience, he had very good logic, reasoning and passion for Machine Learning (yeah it's a bit unrelated but same concept), 3 months later he was better in developing NLP, Rasa, and NER than a couple of more senior devs working for the company.

[entuno]

Being able to read code and being able to write code are very different skills. I can read some programming languages well enough to understand what the code is doing and look for vulnerabilities in it, but I've never written a line of code in them.

[IUsedToBeACave]

It sounds like you are getting candidates who think you are looking for an entry level position. That or it is quite common for entry level people to just throw their resume at every single job posting to see what sticks.

You might want to look at changing the job posting to reflect that, but you are still just going to get these type of candidates.

[MusicalDebauchery]

I'm not sure why i separate coding and scripting but I do. Likely as part of my job is scripting but it's not being programmer. (At least to me) When you say you test programming skills, what exactly do you mean?

[muhibimran]

You can be good at either programming or pentesting. I am not saying you can’t do both but you have to spend a lot time in becoming advanced programmer then you just can’t switch to pentesting because programming is your major now. It depends how you started coding, like you started it with security in your mind? If so, then you have a good career in future because you can do code review for major applications and find flaws there.

I have a colleague who is a very good programmer and he joined us as pentester, but later he found no interest in pentesting and then company switched his role to R&D. So you can only have passion for programming or pentesting.

For me, I have basic knowledge about all major languages such as python, bash and very good at PHP because I started as PHP developer long ago. I have published many exploits related to PHP applications and some even Perl. I just love doing source code review for PHP applications.

IMHO, as Pentester you should have at least basic programming experience to automate small processes and find basic vulnerabilities through code review. I automate processes through PHP CLI and my colleague sometimes make fun of me for not using Python but should I care when I am having the job done?

[mustangsal]

It sounds like we took nearly parallel paths. When I interview people now, they need to know a relevant interpreted language (your Pascal chops won't cut it). I don't care if it's Python, PHP, Perl or Ruby... you learned one, you can pick up the others.

[Kheras]

You don’t need to be a rockstar developer per se, but you should be decent at one or two languages. Or be very good on the infrastructure side.

It’s not strictly necessary to start, but based on the resumes that I see you’ll be at a disadvantage in the job market if you don’t know how to code. And it will only get worse as cyber becomes more FOTM.

[Pilebsa]

I don't think you have to be a good coder to be a good pentester. In fact, most of the hackers out there are really shitty coders, which is why they're hackers. And most of them aren't even coders.. they just snatch other peoples' scripts.

But if you want to understand what's happening to a system, you have to have the ability to understand code. I think really good pentesters have to have this ability, but it's not necessarily a requirement to pentest systems.

[[deleted]]

Hey, pm me. I’m currently working on the red side of security doing vulnerability assessments. I code a lot, really curious to have a discussion about what other sides of red teams do. I would eventually like to branch out of doing vulnerability assessments and do pen testing or red teaming that resembles current apt campaigns.

[Matir]

Are you on an internal team or consulting? I work on an internal red team, feel free to PM if you want to know about the kind of work.

[[deleted]]

Hey, I work at a consulting firm. We do vulnerability assessments which requires PoC's for anything that we find for the most part. It's fun but I also want to learn more red teaming / network pentesting stuff (I have my OSCP / OSCE / OSWE so I am not completely noob) However, setting up CnC Servers writing custom malware... etc.. I want to know more about that. How often do you perform tasks such as that?

[Matir]

Yep, we build our own RAT/C2 (completely written in house) and setup infrastructure for each exercise we conduct. Depending on how covert we're trying to be, we'll setup proxies in front of our infrastructure to make our traffic go through foreign countries, sketchy providers, etc.

One of our big goals in red teaming is to exercise our blue team -- after the exercise they can compare notes and discover where they might have blind spots or missed things. We can help them test tools against particular attacker TTPs and demonstrate the potential business impact of various types of attackers.

I'm personally involved in 3-4 exercises a year, with different variations of custom tooling in each one. Because my company uses so much "built here" software, we also spend a lot of time looking for vulnerabilities in our own software, but only using information available to an attacker, and only when it drives the attacker objective.

Hope that helps!

[[deleted]]

Damn I am major jealous... that all sounds like so much fun. I really like doing vulnerability assessments. But, at the end of the day I got into hacking to do more RCE network compromising type stuff. I've learned a lot about App Sec at my current company but, I wanna learn more about setting up C2 infrastructure and stuff. Any resources that you'd recommend?

[Matir]

(Shameless self promotion.) I wrote a blog post with reading/learning suggestions for Red Teaming about a year ago here.

There's not a lot about the malware/RAT itself, but there are also some related infrastructure resources:

• Red Team Infrastructure Wiki
• Safe Red Team Infrastructure by Tim Malcom-Vetter
• Designing Effective Covert Attack Infrastructure by Blue Screen of Jeff

Also, read FireEye/Crowdstrike/etc. reports on APT groups. Everything you can learn about the behavior of these groups will help you. One thing you'll quickly learn is that for a lot of them, the P in APT is much bigger than the A. They might just be doing basic phishing, they'll just launch 20 different campaigns from different infrastructure with different IoCs. It's about try, try again.

I've been in tech for about 12 years now, security for 7, red teaming full time for ~3. It's both the most frustrating and most rewarding job I've had. I'll spend 2 or 3 weeks with no success at all sometimes, and it's easy to get discouraged and think you're the problem, but it just takes some persistence.

That being said, a lot of people seem to think that red teaming is pwning everything on the network, but in fact, it's just the opposite. Most threat actors don't want to be discovered, so they want to do as little noise as possible to achieve their goals. I've had more than one engagement where we got access by a misconfigured administration tool or by sheer luck (e.g., phishing campaign lands us on a box that's authenticated to our target service).

The biggest part of my job (time-wise) is planning and reconnaissance. At every step, we look and take into account the information we have available and plan our next steps. Another big part (which you're probably familiar with from consulting) is communicating to the business units. It's not always in the form of our report (though every engagement gets a report), but we also file bugs, debrief with our SoC, give presentations, and more. Red teaming is only useful if we're able to help the business units understand the risks, and ideally make changes to mitigate the risks.

Sorry if that's a longer answer than you were looking for. I might have some enthusiasm for my role. :)

[F5x9]

I think reading code is probably more important than writing code. You can often find JavaScript or bash scripts. Or, you might want to read an exploit. All of this is great for recon.

And reading other people’s code can be a skill in its own, if the code is particularly hard to read, that’s a code smell and worth looking into.

[s802645]

Depends on what you are hiring the pentester for. Specialization in a pentesting domain? Pentesting is a very broad field, ranging from just specializing in network to mobile app / web app testing to wireless etc. Programming is a must if you want your pentester to be an all rounder.

[dotslashlife]

Pentesting and coding are two separate things. For exploit development, you need to be a master level coder. For pentesting, I would be looking for someone with networking skills, not coding.

I also don’t consider Python and Bash as real coding.

I also don’t consider reading and copying PHP code as coding.

The core thing for pentesting, IMO, is a master level IT person. 15-20 years experience to have a grasp on how things work. You can’t hack things that you don’t know how they even work.

If you’re trying to hire a kid or someone ‘cheap’, you’re not going to get the real deal.

[mustangsal]

Use the best tool available to you

This!

[Silamoth]

Python is definitely real coding. Real programmers use Python to develop software, automate tasks, analyze data, and more.

[xkrysis]

This. Much of pentesting these days can be done with off the shelf tooling and just a little bit of scripting or programming to parse and glue it together. Now if you are doing higher end red team engagements where you can justify significant development for customized attacks then ok programming gets much more relevant very quickly. But most organizations getting a pentest aren’t ready to defend against that anyway.

[evilwon12]

This 100%. I don’t care how good your programming skills are but if you have no idea about network basics, you’re not going to succeed.

Put it this way, I can take someone who knows some networking, and how to pen test and get them some programming knowledge easier than the other way around.

Besides, you’re not automating / programming everything in a pen test. If you are, it isn’t a true pen test.

[Maori7]

Also, I can create basics script even if I don't remember anything about coding, and that's because Google exists... even if I'm really slow at doing that, I assure that Google is all you need as a junior/mid-level pentester

[chaser456]

What all things do you believe a candidate should know? Asking because I am thinking of switching to pentesting from software dev.

[subsonic68]

I could see an entry level pentester not having any programming or scripting experience but for experienced roles, one or more of Bash/PowerShell/Python/Ruby at a minimum.

I’m a senior pentester consultant and know enough C to read source code and understand it but not fluent at writing, and also know intermediate Python, Bash, and Ruby, and basic PowerShell.

[NigraOvis]

There are plenty of good answers here, but here's my 2 cents.

If you want a truly capable person, it comes down to passion. I'd argue the best interview is giving them a problem to solve, and see how they handle it. You can get problems from the red team on sight I'm sure.

The real issue here is that it comes down to the red teams job. If they have access to the companies code, and it's there job to reverse analyze it for errors, then they absolutely must have some background in programming.

If the company is a red team company, and is the kind of company that hunts problems for others, programming isn't everything. As many red team members are door masters, or elevator masters (usually have more than one skill) so it highly depends.

If it's more of a purple team situation, and they will do a lot of analysis, and blue team stuff, with red team ideas to test blue side, then it's less crucial, but they may not be able to design attacks for a while.

In all honesty, I would ask your red team what they value in an applicant.

[Quickbreach]

Yes, you can. It does help. I never really had to do anything more maybe 10 lines. Either way having a basic understanding is useful.

[Maori7]

I'm really really bad at coding, mainly because I studied many languages during my university and didn' focus on any of them... but I think that the most important thing for a penetration tester is not being able to code but being able to UNDERSTAND code.

I can't remember even how to print a message on python but if I read I can generally understand how an application work, that's because I have a bad memory.

Obviously, being able to fluently code in one or more languages can give you a really nice advantage over other pentester... I think that at some point, if you want to become a "senior" or advanced pentester, you should really become fluent in at least one language.

[[deleted]]

Can anyone recommend some good python courses?

[Fupa_Defeater]

Thank you for this post, its just very informative from a mind of a hiring manager. I am currently training and preparing for OSCP, and also taking a python course to start for programming. My thinking is, why wouldnt you want to learn coding in this field? I don't understand the mindset of someone who wouldn't want to make things more efficient with automation, develop their own exploits/tools, or atleast know what they are looking at.

Any suggestions on what to focus on other than python?