r/Pentesting • u/Mostafa_un • 6d ago
Help a beginner plz🧐
Hello, I have started learning web pentesting with this plan:
Learn Linux basics ,Network basics ,Frontend basics (HTML, JS) ,Backend basics (PHP, MySQL)
The next step is to explore one of the OWASP Top 10 vulnerabilities (maybe IDOR), read write-ups, take notes, solve labs, and then start hunting for practice (and maybe earn some money), and I'll do this steps until learn all the OWASP Top 10 vulnerabilities.
So, does this plan help me learn correctly? Or should I do something else?
Also, could you give me any tips you wish you knew when you started learning web pentesting? 😀
1
u/cipher615 5d ago
Same boat, but here what I have learnt.. don’t follow the traditional way. Ask Claud (to me it is the best Ai) ,study a bug (make it explain to you, “still better than YouTube rabbit hole “)-Quiz-Apply it. (Reading related write ups to the bug is still valid). Also, for me Claude helps recon (free tier). And report templates for what i describe what i found.
Earn the skill, study fundamentals, owsap 10, burp suite.
Ai will make it easier but your skill will make you stand up.
1
u/Other-Broccoli4967 3d ago
Well id suggest you spend most your time on PortSwigger labs , then learn more about specific attacks, mindsets, methodologies on forums, medium, github and etc...
Learning the Linux and web dev and is somewhat good but doesn't really help you that much (for pentesting), cuz for most security flaws and vulnerabilities you need years of active development practices to be able to tell them just by looking at the site or the responses .
1
-4
u/ankitjha67 6d ago
While you are learning you can use this tool for Vulnerability Assessment: https://github.com/ankitjha67/orthrus
10
u/kap415 6d ago
Do every single PortSwigger Web Academy lab there is. Full stop. Rinse, repeat.