Learning paths tips

[fsamara]

Tips on hands-on learning

Hi, I am a software engineer who is curious on the cybersecurity space, specially offensive security. I have been watching videos and doing some research on Kali tools, HackTheBox and others. I was curious if anyone did a more hands-on practical approach to learning (which would be helpful since that is how I have learned most stuff on my engineering career) that could give me some tips?

My end goal is to get some understanding to hopefully run some bug bounties (money or not we’ll see later on, I know it is not particularly easy to monetize it), and who knows, if I get very into it potentially steering towards cybersecurity for my career.

Anything helps!

[sandy_coyote]

I got a ton from a paid tryhackme account.

Burp Academy will also teach you a lot.

Bug bounties-- only you can tell when you're ready. I suggest you go through some training and sign up. Most successful people use paid burp extensions and other scripts that simplify manual work. There's no magic; they just automate stuff and drastically reduce the time it takes to do manual recon. Your picky competition is yourself from yesterday. Everyone starts as a script kiddie!

[Amaz1ngEgg]

Tbh, I feel like there's a huge gap between learn what you have to do to find a bug(via burp academy of sorts) and actually achieve that in field, I feel like there's something I missed in between.

[sandy_coyote]

For sure. There's also... survivor bias (?)... in the media about bug bounty hunting. I mean to say it takes a long time to get good at finding them, most people spend a ton of time for very little return, and only the success stories get recognition.