Introduction
I have been asked more than once by now how you actually become a penetration tester and which approach I can recommend for it. There is neither a specialised vocational training for it nor a specialised degree programme. I would like to approach the answer from the reverse end and first answer the question of what a good penetration tester actually needs to know and be able to do. That means, at the very least, knowledge and skills in:
- IT system administration (operating systems, networks, etc.)
- Application development (various programming languages such as C, Java, PHP, Python)
- Theoretical attack techniques: buffer overflows, code execution, injections, among others
- Operating tools such as Nessus, Nikto, nmap, owasp-zap (and I do not mean at script-kiddie level)
- Developing your own tools or further developing existing ones
- Structured approaches to penetration testing (OSSTMM, OWASP Penetration Testing Guide)
- Writing reports (structured reports, writing up explanations and documentation)
Okay, the list is extensive, but I do not want to cross anything off. I consider every point relevant and necessary. After all, the question is not how one becomes a hacker, but how one starts a professional career as a penetration tester. That does take considerably more than just being able to hack.
The fundamentals (points 1 and 2)
As a foundation, I recommend either an apprenticeship as a Fachinformatiker (certified IT specialist, in the system integration or application development track) or, with the formal qualifications (from Fachabitur upwards), a computer science degree at a university of applied sciences. For the career goal of penetration tester, I would not choose a traditional university - given its emphasis on mathematics and theory, that would miss the mark. I would study computer science at a university of applied sciences, either pure computer science or at least something comparable with a technical focus. Media informatics and business informatics do not offer ideal prerequisites for penetration testers, but they are still better than nothing.
There is no getting around application development in either the apprenticeship or the degree, and basic IT system administration will hopefully be part of it as well. Otherwise you have to do a little extra on your own - just grab some old hardware and experiment with Linux & Windows. Virtualisation with Xen, kvm & Co allows you to set up an entire network on a single physical machine and is free of charge. This is where you can let off steam and deepen the fundamentals if you otherwise have no access to practical experience. You should certainly also learn a decent scripting language; I recommend Python (or Perl or Ruby or bash, but not PHP & Co).
The attack techniques (points 3 to 5)
Learning the theoretical and practical attack techniques in a targeted way without any "guide" requires a certain amount of self-discipline. There are good online courses on the web for this, such as the OSCP (Offensive Security Certified Professional) from Offensive Security. The CEH (Certified Ethical Hacker) is purely theoretical and provides no hands-on skills. You can teach yourself the CEH knowledge from books and the web as well, in case the OSCP is too "practical" for you. The hacking lab provided with the OSCP is definitely worth its money and I can only recommend it.
Apart from that, there are also plenty of freely available & vulnerable server images on the web that you can practise on for free. There are also a number of books, at different levels. Anyone who picks up some of this during their apprenticeship or degree has been pretty lucky. Or they study a bachelor's in IT security directly and actually get a good professor for the lecture. That is probably the exception, though. I would not specialise during the bachelor's anyway; that is what master's programmes are for.
Developing your own tools will become necessary as your experience grows and is more of a natural process of adapting to tools that are insufficient or missing altogether. Anyone who already has experience in programming or software development has it considerably easier here, even though penetration testing does not mean application development.
The professionalisation of hacking (points 6 and 7)
Professional penetration tests always follow a structured approach. Anyone who just "hacks away" will maybe find something, certainly not everything, and above all the test will not be reproducible. That massively reduces the value of a penetration test - a proper approach is urgently required in a professional environment. Various approaches are freely available (e.g. OSSTMM). You should at least orient yourself on one of them to start with, until you are able to make any adjustments that might be necessary.
After a penetration test, the report still has to be written. It has to be clearly understandable, complete and geared towards the target audience (which will never be uniform). It is also important to be able to write: to be able to present and explain facts in writing. To choose concrete wording. To have confident spelling and grammar.
Conclusion
The requirements for pentesters are very high. The path there requires a high degree of interest, intrinsic motivation and personal initiative. Nobody will prescribe the path to you in detail, and I also do not believe that you can really plan it. Anyone who enjoys discovering vulnerabilities and has fun doing it should set off down that path.
In the meantime, the course materials for the binsec academy GmbH "Pentest Training" are publicly available free of charge: https://binsec.wiki/de/security/howto/pentest-training/ The original article dates from 2014 and was updated in 2022: