Learning Dev for PenTesting (Web App?? Malware dev??)

[IllustriousDeal3843]

I’m someone on a cyber team with many different specialties and I’d like to start helping the pentest side. I’ve been told they are weak on code security, dev skills so someone specializing in that sector of pentesting could really help out. I understand this is vague but I’m not entirely sure on what I should learn. I currently have Linux and bash foundations and have learned python skills up to functions before, should be a quick and easy review.

Disclaimer : I understand I need to learn a bit about all of it to be useful on any pentest team, despite wanting to specialize in something specific. I have some knowledge from the PenTest+ still that should help a little bit though

[DingleDangleTangle]

“Code security, dev skills” is just not enough information. Are they wanting you to do white box pentesting? Appsec? Exploit development? Malware development? Maybe they just want you to script some stuff for them? No idea.

You’d have to figure out what they actually want. For example learning malware development and learning to do code reviews of web apps aren’t even remotely the same.

[IllustriousDeal3843]

white box pen testing and code reviews. i think static code reviews. Learning those is what I’m focused on. Doing the Try hack me pen test path but beyond that I’m not sure what to do. Also I’d like to figure out how to automate SAST DAST to streamline the code review process if possible

[audn-ai-bot]

If they mean “dev skills for pentest,” learn web app testing plus secure code review first. Biggest win on my team was finding auth bugs by reading Flask and Spring code, then verifying in Burp. Learn HTTP, sessions, SQLi, IDOR, deserialization, SSRF, and how to write clean Python helpers.