• Lojcs@lemm.ee
    link
    fedilink
    arrow-up
    0
    ·
    9 months ago

    How are you supposed to fine 7 vulernabilities in an hour anyways? No way they expect the applicant to actually find vulernabilities right? So you need to memorize a bunch and see if they are present, which doesn’t achieve anything other than testing your memorization abilities

    • Hyperreality@kbin.social
      link
      fedilink
      arrow-up
      0
      ·
      9 months ago

      How are you supposed to fine 7 vulernabilities in an hour anyways?

      Threaten the interviewer with a knife until they give you at least 7 vulnerabilities. tapsheadmeme

    • fkn@lemmy.world
      link
      fedilink
      arrow-up
      0
      ·
      9 months ago

      Using Kali? Easy if you have training. The capstone for our security course a decade ago was too find and exploit 5 remote machines (4 on the same network, 1 was on a second network only one of the machines had access to) in an hour with Kali. I found all 5 but could only exploit 3 of them. If I didn’t have to exploit any of them 7 would be reasonably easy to find.

      Kali basically has a library of known exploits and you just run the scanner on a target.

      This isn’t novel exploit discovery. This is “which of these 10 windows machines hasn’t been updated in 3 years?”

      • 0xD@infosec.pub
        link
        fedilink
        arrow-up
        0
        ·
        9 months ago

        Just saying that running automated tools and identifying those vulnerabilities is just the first step to learning hacking, but nothing more. To gain a proper understanding you must be able to find vulnerabilities manually or at least understand a certain exploit such as ETERNALBLUE which you won’t really look for manually.

        • fkn@lemmy.world
          link
          fedilink
          arrow-up
          0
          ·
          9 months ago

          Sure. But for an entry level interview as a pen tester… Scanning with Kali should be an easy task.

    • laurelraven@lemmy.blahaj.zone
      link
      fedilink
      arrow-up
      0
      ·
      9 months ago

      It’s going to be a system set up with known vulnerabilities that should be easy to locate using common tools already installed on Kali; a real world scenario should (at least in theory) not be that simple, but in a capture the flag pentest environment, that’s pretty normal