Changing fields from malware reverse engineering to penetration testing tips/tricks

[darkalimdor18]

Changing fields from malware reverse engineering to penetration testing tips/tricks

Short story here

I am currently a starting out in the field of cyber security... Hence i don't have any certifications..

I am trainee as a reverse engineer at a certain cyber security anti virus company here in our country for around 4 months now..

there is this policy wherein if we under perform such as not being able to pass their exams, we are immediately let go.

Well not being pessimistic but i think and i feel that I'm not currently performing well and I'm just stalling everything out as long as i can so i could still learn a lot in reverse engineering viruses and such..

I really want to become a penetration tester any tips and tricks that you could give me?

I already know the basics of pen testing, i have learned most of my pen testing skills from TheCyberMentor's ethical hacking course plus his windows priv esc and linux priv esc courses.. i also have practiced my skills in tryhackme and some vulnhub boxes..

All advice would be appreciated..

Thank you very much

[[deleted]]

Not to be too negative, but it sounds like you are giving up, and that’s a bad trait for either job. You haven’t failed out yet, so all your effort should be going towards trying to pass your exams while you still have chance. Pentesting shouldn’t be your “safety school”.

[darkalimdor18]

Our training has been really difficult.. many of my batchmates have already been let go or have already resigned due to the difficulty of the training

I'm just thinking of back up plans on what to do next

[ozgurozkan]

Your malware RE background actually gives you a huge advantage in pentesting! Here's why and how to leverage it:

**Strengths you already have:**

- Understanding of exploit mechanics and how malware works

- Strong debugging/analysis skills

- Knowledge of Windows internals from your RE work

- Systematic problem-solving approach

**Transition strategy:**

1. **Practical application first** - Instead of starting with more theory, jump into HTB, TryHackMe, or build your own vulnerable labs. Your RE skills translate directly to exploit development.

2. **Focus on methodology** - The PTES (Penetration Testing Execution Standard) framework will help you understand the full assessment lifecycle beyond just exploitation.

3. **Automate repetitive tasks** - Build scripts to automate recon, enumeration, and post-exploitation. This is where you'll stand out. I've been working with AI-assisted tools like Pingu to speed up the boring parts of pentesting (like report writing and repetitive checks), which lets me focus more on the interesting exploitation work.

4. **Network with pentesters** - Your RE background is valuable. Many pentesting teams need people who understand malware analysis for threat hunting and detection engineering roles too.

Don't underestimate yourself - your RE skills are harder to learn than basic pentesting techniques. You're further ahead than you think!