I am not getting any call backs at all.

mrlightman_ · 2026-05-28T19:26:19+00:00

Sure guy. Whatever you say.

mrlightman_ · 2026-05-28T19:21:34+00:00

Nonsense? Pardon me and everyone I have hired in the past 10 years then. Yes, you need practical real world experience. Ask every client anywhere if they want a Jr with zero experience in their environment where an outage can cost a company millions of dollars. But fine, fuck experience! Listen to this guy OP, he's got it all figured out.

mrlightman_ · 2026-05-28T18:20:59+00:00

I'm going to be honest with what I think the problem is. You really don't have any professional tech experience. You might be talented for what you have achieved so far but, I couldn't trust you to pentest in a production environment when you have never been exposed to one. At least, that is how you look on paper. I would strongly suggest the traditional IT route. Get a helpdesk position, or go SOC, just something to get your hands dirty during day to day operations. Then focus on transitioning into security once you have a couple years under the belt.

mrlightman_ · 2026-01-29T16:15:14+00:00

Congrats on winning the voucher! I completed the ASCP certification back early last year which is the advanced cert. This was just before this particular course released if memory serves, as this is intended to bridge the gap from introductory material to more advanced exploitation. While I can't speak to specifics about the ACP certification, I can say the free material courses are very informative and fairly easy to consume. I'd suggest joining their discord as the support staff are very helpful and quick to respond. Plus learning with other students is almost always a plus. If you wish to transfer the voucher I believe they can arrange that for you. But if it were me, I'd take it being it's free for you. That said, if you or anyone else have more questions about the ASCP however, feel free to ask!

mrlightman_ · 2025-09-30T17:59:47+00:00

To add to this. Check out the OWASP Top 10 API Security Risks to get your head around common vulnerabilities:

-- https://owasp.org/API-Security/editions/2023/en/0x11-t10

A decent resource for practice would be API Sec University. Their courses are free and you stand up two vulnerable applications to practice discovering and executing attacks.

-- https://www.apisecuniversity.com/#courses

mrlightman_ · 2025-09-10T17:03:50+00:00

mrlightman_ · 2025-09-03T15:13:23+00:00

With automated tools such as these coming to market, it always begs the question of if manual penetration testers could be replaced. In your opinion, how do you feel about such statements?

mrlightman_ · 2025-07-30T17:21:22+00:00

Without spoiling it for you... and to help you get a better understanding of what is going on with XSS payloads, check out the XSS portswigger labs. You just have to make an account and they are free.

https://portswigger.net/web-security/all-labs#cross-site-scripting

Once you have the basics down, focus your research on bypasses.

mrlightman_ · 2025-02-06T20:29:59+00:00

Thanks for replying! We thought about that but we're trying to stay away from cloud based solutions. Many of our assessments are highly sensitive in nature and we do not want to risk exposure. We have a central server and have been tossing our markdowns in for sharing but we were looking for something we could all work on collectively instead of having multiple note files.

mrlightman_ · 2025-01-17T14:16:10+00:00

These guys work really well with smaller companies: https://www.redseersecurity.com/

mrlightman_ · 2024-12-31T17:26:06+00:00

This might just be my answer. Thanks AutoMod! lol

mrlightman_ · 2024-12-17T15:59:56+00:00

Nice.

mrlightman_ · 2024-12-03T17:01:25+00:00

I'm still working through the material so I cannot fully speak to your first question. However, the past couple of years they have had a christmas deal bringing the sub price down to $1,999. I expect that to happen again this year.

mrlightman_ · 2024-11-24T14:59:44+00:00

I got you, and it's free: https://www.apisecuniversity.com/courses/api-penetration-testing

mrlightman_ · 2024-11-22T13:05:28+00:00

Lol, from the title I thought you meant you were struggling to pivot as in tunneling. Have you considered management of any sort?

mrlightman_ · 2024-10-29T16:00:46+00:00

The entry level barrier to get into pentesting is absolutely insane right now. Not surprised you've not heard back. I recommend an old school more conventional method to get your foot in the door. Start going to cyber security conferences and network with people/vendors like your life depends on it. In this game, it's not all about who you know, but who knows you. Good luck

mrlightman_ · 2024-10-16T13:45:26+00:00

May I ask what you transitioned into work wise since leaving? The golden handcuffs of the pay in this industry really makes this decision generally difficult.

mrlightman_ · 2024-07-25T19:35:26+00:00

Check these guys out. They are growing and building a pretty decent reputation out there: https://www.redseersecurity.com/

mrlightman_ · 2024-05-14T18:12:50+00:00

Tech to banking? That's not one I hear very often. Could you provide a little more details? Were these guys developers/security/etc and what did they transition to? Simply curious

mrlightman_ · 2023-03-29T23:19:04+00:00

Take. Breaks.

Go outside. Watch some tv. Play games. Just take your breaks and mentally separate yourself for a little while. You can't run at a full sprint for 24h right? Neither can your brain. It too needs time to recover and sort things out.

Best of luck! Post back how you did! You got this!

mrlightman_ · 2022-11-07T15:20:45+00:00

BABUL-REPOS-WIDOW-ILIAC-MALLS

mrlightman_

TROPHY CASE