Episode 20 · · 38 min
Leron Gray From Navy E6 to Pentester, SANS Mentor and Nerdcore Rapper!
Penetration tester and SANS mentor
Episode summary
Leron Gray is a man of many talents. Although he didn't really get into infosec until much later in life, he always had a creative side. He now finds himself as a pentester working from home and a nerdcore rapper producing amazing beats!
BIO
Leron is a penetration tester and a ten-year Navy veteran with four years of experience as a Cryptologic Technician (Networks), focusing primarily on offensive cyber operations. He holds a Bachelor's degree from Dakota State University in Cyber Operations. With a passion for Python, he loves automating tedious daily routine tasks for efficiency and considers himself to always be in a position to learn more and pass on knowledge. He always enjoys competing in as many Capture-the-Flag events as possible and also often performs as a nerdcore rapper.
Leron currently holds eCPPT, eWPT, GPYC, GPEN, GAWN, GCFE, and GICSP certifications. He also maintains a blog and maintains an active Twitter discussing music, information security, and wrestling.
Notes
Went to a high school that made you choose majors
Grew up poor, was not allowed to go out much
Technological learning came from school
Didn't really get into computers until he was 25
Has been in music since Jr. High School (Marching band, jazz band, and concert band... all the bands)
Networking is the biggest thing that Leron says would help
Leron offers his passionate opinion on "aptitude" (it's a pet peeve of his)
Quotes
"I learned a lot... I made sure not to waste any opportunity for learning."
"Job searching, in general, is a pain."
"I don't think I would be where I am right now if I hadn't gone out and made that effort."
"One of the big deals that people had were degrees. I wasn't really sure why; I have 10 years of IT/Cyber experience."
"It turned out the company no longer owned that server. Their DNS was still pointing to it though."
"I took Java in high school and was really bad at it and I found out everyone is bad at Java, so it doesn't really matter."
"It's so much easier to learn when you have a problem to fix."
"It's not even just information security that learning Python could help... it could be anything you do... often enough to warrant not to do it [manually]."
"Nobody does a CTF and expects not to learn something by the time they leave."
"Job searches shouldn't be like that: they should be based on your merit."
"Maybe the person can't get OSCP, but maybe they have the skills or knowledge."
"The idea of aptitude... raises too many borders."
Before infosec: Navy E6 electronics technician and cryptologic technician
Chapters
- 0:00
Intro: pentester, Python fan and nerdcore rapper
Ayman introduces Leron and teases his views on degrees and aptitude.
- 1:23
Leron's pentesting job and typical day
He describes web app testing, remote work, side projects and how reports work at his company.
- 3:33
From Brooklyn Tech to the Navy and cyber operations
He joins the Navy, volunteers for a ship's network and cross-rates into offensive cyber work.
- 6:46
Leaving the military and finishing his degree
Leron explains the E6 rank and how he earned a degree in two years.
- 8:28
The job hunt: degree, certifications and referrals
Networking groups, a resume rewrite and HR keyword screens shape his search.
- 14:55
First months of web app testing and a bug bounty
He is surprised by how many OWASP Top 10 flaws he sees and recounts a dangling DNS bounty.
- 17:32
Learning Python and his coding tools
Solving real problems, a SANS course and Visual Studio Code help him automate tasks.
- 21:57
Growing up poor and an early password-reuse hack
A single family computer and getting caught using his cousin's account shaped his early tech life.
- 24:24
Music and creativity in pentesting
Marching bands and rapping feed the creative thinking pentesting requires.
- 26:18
Advice for aspiring pentesters
Follow news, do CTFs and vulnerable VMs, build a portfolio and network at conferences.
- 31:25
Other security fields and the aptitude debate
Leron urges people to explore roles beyond pentesting and explains why aptitude is a pet peeve.
- 36:13
The SANS SEC 573 mentor class and closing
He describes his Seattle Python mentoring course; Ayman closes with a community plug.
Key takeaways
- Volunteer for unfamiliar technical work, such as a ship's network, to build skills that open doors later.
- Learn programming by solving real problems you face, even small ones like automating downloads.
- Put certifications and a degree prominently on your resume because HR screeners often search for keywords.
- Network in person at conferences and local hacker groups, because referrals matter even with strong skills.
- Do CTFs and vulnerable VMs on your own time and build a portfolio that shows genuine passion.
- Explore other security fields and play to your strengths instead of being limited by 'aptitude'.
Notable quotes
I learned so much over the last couple of years that I made sure not to waste any opportunity
it's so much easier to learn when you have a problem to fix.
Participate in all the CTFs you can because you're learning some skill set at some point.
Questions answered in this episode
- How did Leron Gray become a penetration tester?
- Leron served in the Navy as an electronics technician and later a cryptologic technician doing offensive cyber operations. He left as an E6, finished a degree, networked at hacker groups and conferences, and landed a remote web app pentesting job.
- Do you need a degree to get a pentesting job?
- Leron found that adding his degree to his resume increased responses even though he had about ten years of experience, but he also says certifications and referrals from people you have met matter.
- How can you get into pentesting without experience?
- Leron recommends reading security news, practicing on CTFs and vulnerable VMs like Metasploitable in your own time, learning Python, and networking at conferences.
Show notes and links
Show the original episode notes
Leron Gray is a man of many talents. Although he didn't really get into infosec until much later in life, he always had a creative side. He now finds himself as a pentester working from home and a nerdcore rapper producing amazing beats!
BIO
Leron is a penetration tester and a ten-year Navy veteran with four years of experience as a Cryptologic Technician (Networks), focusing primarily on offensive cyber operations. He holds a Bachelor's degree from Dakota State University in Cyber Operations. With a passion for Python, he loves automating tedious daily routine tasks for efficiency and considers himself to always be in a position to learn more and pass on knowledge. He always enjoys competing in as many Capture-the-Flag events as possible and also often performs as a nerdcore rapper.
Leron currently holds eCPPT, eWPT, GPYC, GPEN, GAWN, GCFE, and GICSP certifications. He also maintains a blog and maintains an active Twitter discussing music, information security, and wrestling.
Notes
-
Went to a high school that made you choose majors
-
Grew up poor, was not allowed to go out much
-
Technological learning came from school
-
Didn't really get into computers until he was 25
-
Has been in music since Jr. High School (Marching band, jazz band, and concert band... all the bands)
-
Networking is the biggest thing that Leron says would help
-
Leron offers his passionate opinion on "aptitude" (it's a pet peeve of his)
Quotes
-
"I learned a lot... I made sure not to waste any opportunity for learning."
-
"Job searching, in general, is a pain."
-
"I don't think I would be where I am right now if I hadn't gone out and made that effort."
-
"One of the big deals that people had were degrees. I wasn't really sure why; I have 10 years of IT/Cyber experience."
-
"It turned out the company no longer owned that server. Their DNS was still pointing to it though."
-
"I took Java in high school and was really bad at it and I found out everyone is bad at Java, so it doesn't really matter."
-
"It's so much easier to learn when you have a problem to fix."
-
"It's not even just information security that learning Python could help... it could be anything you do... often enough to warrant not to do it [manually]."
-
"Nobody does a CTF and expects not to learn something by the time they leave."
-
"Job searches shouldn't be like that: they should be based on your merit."
-
"Maybe the person can't get OSCP, but maybe they have the skills or knowledge."
-
"The idea of aptitude... raises too many borders."
Links
-
Leron on Twitter: https://twitter.com/mcohmi
-
Leron's Blog: https://daddycocoaman.dev/
-
Leron's GitHub: https://github.com/daddycocoaman
-
Class that Leron Is Mentoring: https://www.sans.org/mentor/class/sec573-seattle-19mar2019-leron-gray
-
Visual Studio Code: https://code.visualstudio.com/
-
PyCharm: https://www.jetbrains.com/pycharm/
-
IPython Notebook: https://ipython.org/notebook.html
-
San Antonio's Hackers Association: https://satxhackers.org/wp/
-
MC OHM-I: https://www.mcohmi.com
- Intro Music: Cascadia by Trash80 - https://trash80.com/#/content/133/weeklybeats-2012-week5 (Released under Creative Commons)
- Outro Music: https://soundcloud.com/mc-ohm-i/domain
Getting Into Infosec
-
Twitter: https://twitter.com/coffeewithayman
-
YouTube: https://www.youtube.com/channel/UCg6gV_gdfc188HZdN8LUx4A
-
Book: https://www.amazon.com/Breaking-Step-Step-Starting-Information-ebook/dp/B07N15GTPC/
See omnystudio.com/listener for privacy information.
Mentioned in this episode:
Full transcript
Transcribed from the episode audio. Spoof ads (Ayman's parody commercials poking fun at the industry) are marked.Download .txt
One of the big deals that people had were degrees. And I wasn't really sure why, because from my experience, like I have 10 years of IT slash cyber experience, it was kind of confusing for me. I realized that if I didn't put my degree on paper, even though I didn't have it yet, that the chances of me getting someone to reach back were a lot slimmer.
Hey everyone, I'm Eamon Elsua and this is Getting Into Infosec. My guest this week is Leron Gray. He's quite a talented individual. He's a professional pen tester.
I am surprised that just the amount of things that come out of development and are broken.
He also loves Python and automation and is also a Nerdcore rapper.
But recently I brought a bunch of beats off a website and for whatever reason, they don't give you a download all link. They give you each individual stem which stem being like you know the kick or the snare i get really excited when i have guests that create their own music we also talked about aptitude and he gave us a little opinion on it and apparently it's a pet peeve of his the idea of aptitude to me is kind of it raises so many borders right in my opinion i had a good time talking with the rock
All right, on to the show. Hi, Laurent. Thanks for coming on the show.
No problem. How are you doing?
Good, good. So maybe you could tell us a little about yourself and what you do today.
I'm currently a pen tester working out of Seattle for a company in D.C. I work remote. The job mostly involves web app pen testing with a little bit of networking in the back, but primarily web app. I'm also a SANS mentor for the SEC 573 Automating Information Security with Python course. And I'm also a rapper.
Yeah, that's actually how I originally found you. I think I saw or heard some of your music and I was like, I need to have them on the show because as you know, I let my guests choose their outro music. So can't wait to have that on. So great. Yeah, that's pretty cool. So there's a lot to cover there. So what's your typical day like basically or typical week?
So usually I wake up.
Okay.
I would kind of roll over, walk over to my office, have a morning meeting if there is one. I kind of just sit here and just hack away at whatever I'm supposed to be doing that week. It's pretty great being able to make my... Sort of like make my own schedule, but not really, you know, more of a flexible schedule, I guess. But my day just really consists of work. And then right afterwards, or maybe sometimes during the day, I'll kind of like work on some side projects as well. Some programming stuff, contribute to some open source tools and do whatever I can. I'm basically in front of my computer, like nine out of 10 hours of the day, which there are 24 hours in a day. So whatever math, right?
Yeah.
But I'm definitely... Sitting in front of my computer almost all day working on something.
Okay. And then do you need to dedicate time to writing reports as well after your findings to kind of document? Like what percentage of your time are you like hacking and then the other part possibly writing up?
So because of the way our reports work, at least my company, we don't really have like a lot to write. And it's because there's so many of us working on so many different things. We kind of just take our findings individually. It's not like a typical pen test schedule. Yeah, like the way that most pen test companies might work. We all take our own little findings because it's mostly web app stuff. And we just submit it to our supervisor. He compiles everything. And then that's on a weekly basis.
Oh, that's great.
Yeah. Primarily, like we're not writing our own full reports. We're just writing our findings and our remediations on stuff. And then we just give it to him and he'll help take care of that.
Oh, that's great. That's great.
Managerial stuff. Yeah.
Yeah. You get to work on the good stuff. That's awesome. So walk us through how you got into information security or cybersecurity to begin with.
Okay. So when I was in high school, I went to a Brooklyn technical high school in Brooklyn, New York. And we had majors in high schools or it's pretty ridiculous. The high school is kind of like college. It even looks like a college if it's like 5,000 plus students. And my major was computer science.
Wow.
To be honest, I didn't really go to class that often. I had AP Java, I had computer architecture and these A plus courses and all that stuff. But it was something I was interested in. When I was in high school, I originally wanted to do film and music composition.
Okay.
So I was kind of like way left field from information security. And then my grades didn't really work out for going to college. So I joined the Navy and I became an electronics technician where I worked on radar and communication systems. So I guess something a little different happened where the ship that I had been assigned to wasn't built yet. We call it pre-commissioning. And on the ship, they decided that they were going to have a very new navigation system that they had not put on any other ship before.
Okay.
But because my supervisors and all of them were a lot older, they didn't really have that many... They didn't have that much networking skill or they didn't really... No networking or computers that often so it kind of fell to me to monitor the navigation network which is straight up you know ethernet network all the way from the bridge to down to the engine room they left that on me mostly because i volunteered because i wanted to learn more about it okay and so that was my first quote it related experience so when i reached my six year mark I had the option of getting out or reenlisting. And I decided that instead of just getting out and, you know, just going to college or something, I was going to change my job, go at cross rating.
I was going to change my job to cryptologic technician for networks because they worked in the, like in a cybersecurity realm. I kind of wanted to see what that was about since I had the opportunity. So I switched jobs and then I ended up doing something completely different, like I would have never expected to have been doing. And I decided at that point, I noticed I didn't want to be stuck in a purely managerial position. And I was getting to that rank where if I had made one more rank that I would have been doing just mostly paperwork related things. And so I decided somewhere right after I changed my jobs that I was just going to get out and become a pen tester.
Okay. But when you were in the last position that you were in, what did you end up learning or what was the skill set that's required?
So it was an offensive security position.
Oh, okay.
But I learned a lot. I learned so much over the last couple of years that I made sure not to waste any opportunity for, you know, these resources and learning and just being the best that I could at the job so that I can set myself up for success later.
Gotcha. Okay. And so you had plenty of training and it was a good environment for you to learn, I'm assuming.
Oh yeah, yeah, absolutely. And in a very short amount of time, I actually became the tech lead. So I kind of got to do both sides. Like the important parts of the things that people talk about now are like, you need to be able to talk to the technical level and the managerial position. So I got stuck in that position. I wouldn't say stuck, not like a bad thing. I was placed in that position and it was probably like one of the best things I will ever, ever do, to be honest.
You had like the best of both worlds, basically.
Right.
Yeah.
And I got to talk to people and influence decisions. At the same time, I got to stick to my technical everyday work.
Right. That's great. And then how is your transition into the private sector?
It's been mostly smooth. I don't get to worry about the managerial stuff anymore. So now it's just all technical, which is great. But like take a step back. I'm coming from being in the military and as an E6 back to just, hey, I work for a bunch of people now, which is cool. So I don't have to worry about any of the stuff I worried about before. I'm just taking it pretty slow day by day.
Okay. And what's an E6 for those that don't know what that is?
So the military enlisted ranks go from E1, which is the lowest, to E9. E6 is in the Navy, Petty Officer First Class, which is someone who gets generally put in a leading position, a division of folks, so sometimes an entire department.
Great. And then somewhere in between there, you ended up getting your degree?
Right. So I finished my degree in December, just a couple of months ago. I was actually taking over the 2018 and the end of 2017. I was a full-time student as well as my full-time work. I was taking 12 credits a semester.
For how long?
A little over a year.
Okay.
I would say about five or four semesters because there's three semesters a year.
Yeah.
So I was taking 12 credits simply because I knew I had to finish my degree by the time I got out. It would have been best for business.
Yeah.
And I wanted to finish my degree. So I was taking 12 credits. I was doing club courses. I was doing everything I possibly could to try to finish my degree. OK. By the end of 2018.
When did you start on the degree, though? When did you start?
I started in 2016, August 2016. Oh, nice.
So you finished in two years. So I guess mostly club courses is what helped.
For the gen ed stuff, yes. But then also the military also gives you like college credits for your job.
Ah, I see.
And because I had so many, so much school and training lined up, I got to start my degree like 50 credits.
I see.
Okay. That was a huge help.
Yeah. Okay, great. And so applying for jobs, you know, walk us through maybe how you were applying for jobs and things that employers were looking for.
So that was a pain. So I think, I don't know, I guess job searching in general is a pain. Right. So last April or April 2018, I started getting my resume together and I started, you know, networking more than I already was simply because I wanted to find people who, you know, who can give me some advice. And so when I was in San Antonio, there was a group called the San Antonio's Hackers Association and they helped me out with my resume as well as some of the BreakSec Slack channel in Seattle.
And how did you find all these groups?
Just from going to conferences, I went to B-Sides. I went to some of the other conferences that are held in Austin, Texas. And I just started meeting people, introducing myself. I think it's pretty important, I've realized. And I don't think I would be where I am right now if I hadn't gone out and made that effort. So I get into these groups and I get my resume reviewed and people give me advice. And everyone's like, you know, you should do this, you should do that. I'm like, okay. And I noticed that while I was submitting my resumes, that one of the big deals that people had were degrees. And I wasn't really sure why, because from my experience, like I have 10 years of IT slash cyber experience.
It was kind of confusing for me. I realized that if I didn't put my degree on paper, even though I didn't have it yet, That the chances of me getting someone to reach back were a lot slimmer. So, and it was even stranger because this was in October that I was putting on my resumes and I was getting my degree in December. And so I just started putting it on there because I'm like, I'm not going to fail any classes. Nothing's going to go wrong. I know nothing's going to go wrong because I'm not going to let it go wrong. So I started putting my degree on and then more attention came to my resume and with the help of some folks, I was able to secure the job that I have now.
With the help of some basically referrals or?
Right. Some referrals from some people I've met in the past, some people that I've done CTFs with, that I've been in meetings in San Antonio with. So I think the network connections really help, but you still have to have that clout. You know what I mean? Like having a referral isn't just a job, but you still need to work towards it. And that's what I've been doing over the last couple of years, which is making sure that my resume was up to par, making sure that at some point someone's going to look at my resume and go, oh, this guy's pretty dope. He had a unique position. He has a unique perspective and background. That's really what I was aiming for.
So it's a combination of things that were building up, you would say.
Absolutely. Absolutely.
Okay. And so how was the search? Did you notice a significant difference when you're applying with or without the degree? Yes. Walk us through that if you can.
So I didn't get that many interviews to begin with because this is my first time actually applying for a job. I wasn't really sure if it was a thing about just what people expect to have on resumes because I don't have the traditional things that you would find on a resume on mine, specifically for a pen testing position. And I wasn't really sure if it was just that or the fact that I didn't have my degree and people were just looking for keywords in their searches. So I just put the degree on there because at a certain point, I just got tired of not getting any callbacks or even just initial interviews or any responses at all. It was just the wildest thing. And I noticed that some of these positions started hitting me up after I got my job.
And I'm like, well, that's about three months timeframe. I don't really have time to be broke in Seattle. You know what I mean? Rent's expensive, right? Right.
Yeah. So getting a degree in certifications, you know, it seems to be controversial, especially if you go out on Twitter. Right. So it's good to get different perspectives on the matter. So you had a lot of certifications when you were applying, correct?
Right. I made sure to squeeze as much money as I could out of my previous job so I could get certification. Some of them I even paid for myself.
Okay. And so out of all the components in your job search, you had the skills, right? So I don't think there was too much of an argument as far as having the skills. But when it came to applying for jobs, having that translate into the job market, right? Tell me as far as maybe percentage or breakdown, how much all the other components really mattered for actually finally landing a job. I guess one is not trying to advocate to, you know, get this or that, right? But maybe you could expand on one. Is it dependent basically on the job market, the location? You know, just expand on the whole job search and how it related to you.
So primarily when I was first looking for jobs, I wasn't intentionally looking for degrees. I was looking for like certain certifications and LinkedIn, right? Things that had certain listings. And with OSCP being at the top of them and I didn't have it, It was a little more difficult, but I was still applying to jobs where I felt that I could have OSCP if I wanted, because that just seems to be the bread and butter of job searches in cybersecurity, at least in penetration testing anyway. And it's kind of weird because I have certifications that I would consider equivalent to OSCP, but they don't have the name to them. So I'm walking around with all the certifications and the skill set, but I can't really express it to someone who doesn't know what they are.
And I think one of the bigger issues is for bigger companies where the person reviewing the resume just may be an HR person. I don't mean to say that negatively, but an HR person who may not have awareness of all the things that are involved. It was a little more difficult. And I think with all the big companies in Seattle, there might've been more of that than in some other places where you just have smaller firms or companies where you just kind of submit your resume to a technical director or something like that. I'm not really sure if that helped or hurt me because I will say that there is a particular company that looked at my resume and said, wow, we think you'd be perfect for this other job that we have.
And when they told me what this job was, I was like, this has nothing to do with my summary. But you're not looking at what I currently have. You're looking at the things that I've done almost 10 years ago.
Right.
So I was really confused. I'm new to the job market. So like, what am I doing? But at that point, I had to kind of refine my resume to have less of those points, even though they were pretty strong points. I needed them to build like a history of experience. And I started focusing more, like I put my certifications at the top this time. So I'm like, here are the things that I'm going for. Here in my summary, here's what I'm aiming for. Please stop looking solely at some of this other things that are closer towards the bottom. And I think that in some other markets, like if I were still in Texas or in the DC area, Or even San Francisco, I don't know. I think that the focus there would have been different towards what are my current experience, what I've been working on the last couple of years, rather than people wanting to fill positions simply because I had some skillset from X amount of years ago.
That's my personal opinion. I can't really speak to that as truth, but that's how I felt for a couple of months.
Yeah, it's great to get everybody's perspective because everybody's going to have a different perspective on things. That's kind of the hard part. And that's why we have the show, right? Cool. So any interesting war stories that you had in the past years that you can share with us?
I wouldn't say over the last couple of years and mostly because I can't really, most of that stuff was all in the classified environment anyway.
Yeah.
But I would say over the last month or two of me working in my current position. Been a lot of interesting things web app is not really my strong point but it's what i'm here doing i'm still learning some of the more nuanced things about web app penetration testing i would say i am surprised that just the amount of things that come out of development and are broken i've never seen this before i've never dealt with this environment and it's just weird that people don't sanitize inputs by default even when it's built into the framework that they're using yeah Right. Or just the vast amount of other simple OWASP top 10 things that seem to come through our shop. It's mind blowing. There's nothing like really out of this world, but I'm just shocked at the volume at which it exists because sheesh.
But yeah, I mean, I don't want to be like interesting, like amazing stories. Unfortunately, I just started working here.
Right. But yeah, I guess, you know, for a lot of the folks that have been around there, it starts to get numb and they're just like, they're just not surprised anymore. But yeah, that's interesting. And so do you do bug bounties and stuff outside of work?
I've been trying recently. I've been on HackerOne and Bug Crowd and I got a $50 brownie. I thought it was cool, I guess. It turned out, so this particular company had what I thought was a mail server and with an outdated software. And so I tested an exploit against it and it turned out that the company no longer owned that server. Their DNS was still pointing to it though. And so it turned into an issue of, oh, I don't know whose server I just touched then, even though I did due diligence, right? I made sure, or at least I thought I had due diligence.
I made sure that the... Yeah, I mean, it's in their scope, right?
Yeah, it's in their scope. Their DNS is pointing directly to the server. So I was like, okay, it's there.
That's funny.
And it turned out that they had some dangling DNS records. And so they fixed that up. And it was not as exciting as I thought it was going to be.
Okay.
I went from like a P1 down to like a P4 or something like that. I was so sad, but that was my first one. So I didn't really take it to heart. I've been trying to look at other things recently, but again, web apps stuff is primarily not my, it is my job now. It's not my, my primary experience. Anytime I do bug bounties, like I aim for like network stuff, but we're everyone moving to cloud infrastructures. I think it's probably a little more difficult to try to do network based attacks now than it was 10 years ago, maybe.
Right. It's not as prevalent, at least in certain markets and especially remotely. So let's talk about like Python. I've read your blog and you have a lot of blog posts about Python automating and things like that. Walk us through that and how one can start learning at least Python in relation to, say, pen testing or anything for helping infosec.
Okay, so I picked up Python a couple of years ago, mostly because it was briefly taught in my training for the military. We did about a week of Python. We had to build a calculator or something like that, whatever project you wanted to build. And after that, I was like, oh, this is really cool stuff. I took Java in high school, and I was really bad at it. And I found out everyone's bad at Java, so it doesn't even matter. So I started like learning more because when it came to work, I had to like deliver metrics. I had to do all this other stuff and it was just really time consuming to do. So there was a Python course I was offered at work. And so I took that. It was two weeks long and it was great.
Like I learned so much and I started working every day, like trying to learn something new at work and build all this stuff to interface all these APIs and together and all these cool things that people do with Python. And I realized that this is some really Like programming, I've never really considered myself a programmer or a developer per se, but being able to whip together like a script really quickly because you don't want to handle, you don't want to do everything manually or whatever. So, but I found out that it's so much easier to learn when you have a problem to fix.
Yes.
I don't think I would have been as involved if I didn't constantly have things that needed solutions come my way.
Yeah.
And so even like Python, like now, most of the time I only write, I don't wanna say only write, but most of the times my writing is involved because I need to solve something. And it doesn't have to be like any major project, but recently I brought a bunch of beats off a website. And for whatever reason, they don't give you a download all link. They give you each individual stem, which stem being like, you know, the kick or the snare or the horn section or whatever. They give you each individual link separately. And I was like, why am I going to spend all day just clicking all these links when I get to write something up, right? It only took me about five minutes. Yeah. And I was able to download those links as opposed to sitting there all day.
So it's not even just information security.
Right.
That, you know, learning Python can help. It can be just anything that you do every day or something that you may do often enough to warrant not wanting to do it manually.
I think that's a great example.
So I mean, learning Python isn't different. There's all sorts of resources out there everywhere. The SANS course that I'm mentoring, it's kind of, they start from the basics where you learn lists and all these Python types and then how to manipulate all these types. And then you get into learning all these modules that are used for forensics and offensive security and defensive security. And the whole point of the course is to get you to a point where you're comfortable just importing any module that you find And being able to use and write to it. That's the whole idea. The course focuses on information security because it is a science course. But ultimately, you can take those skills and apply them to almost anything that you want to write.
Do you need any prior programming background?
No, not at all. They start from the very basic.
Okay. And what's that course that you mentioned that was like a really awesome course that you took? Is it available publicly or?
No, it was a private in-house.
Oh, I see. I see. Okay. And what are some tools that you use like in your coding environment for Python?
So I use Visual Studio Code. I'm a big fan of it. I used to use PyCharm, but it just felt like so clunky and hard to navigate. So I use Visual Studio Code for almost everything that I write now. It doesn't even matter what language it is. So one of my current projects is in Python and JavaScript, and it's like a flask thing. And I didn't want to have like two separate environments to write things in. It seems kind of overkill. Visual Studio Code definitely has made my life so much easier, especially since I can move all my settings from one computer to another wherever I'm at. Just sync everything up is great.
That's awesome. And when you started off, did you use things like IPython Notebook or things like that to help?
I did not, but some of the learning environments or some of the courses I've took have used that. I used it at work in my previous work.
Mm-hmm.
Because it was the only thing I had available and it's great. Like I wouldn't knock it, especially since you can like, you know, it kind of throws in its own debugger by default and you can just kind of stop your script in any section of the code. It's great. But I personally don't use that now, although maybe I should, I don't know. It's something to consider, but it's the iPython notebook and Jupyter notebooks are pretty great. Absolutely.
Cool. So tell us about your younger days. You know, were you surrounded by technology? Were you not? Did you have that creative itch also when you were younger? You know, walk us through the younger LeBron.
All right. So I didn't really have a lot. I grew up in a mostly poor household. We had one computer. It was like one of those old gateway computers. Gateway turned into Dell, right? I think. I'm not even sure. I haven't heard of gateway in forever.
Yeah, I remember. Yeah.
But we had like this old gateway computer. And I kind of wanted to mess around with it and like to see the Internet. I was like 10 years old.
Mm hmm.
It probably wasn't the best place to be, but I was always home all the time. I wasn't really allowed to go outside that often. So it was kind of just, I wanted to pick something up inside. I didn't have that many video games for myself. And I didn't get my first laptop until I was about 17. And it's only because somebody gave it to me because they had an extra one. And then I was mostly up watching anime. Like I wasn't really doing anything in particular. All my technological learning came from school, the classes that I decided to go to at any rate. And after that, it was kind of like, all right, well, computers are computers. I like them. I like having one. Cool. But I didn't really, really get into it until about like four years ago.
I'm 29 now. So I was like 25 or something like that. I didn't really get into it until then. Like, I didn't know what subnetting was until, I don't know, 2012, 2013. But when I was younger, I didn't really have that many things. I wanted more stuff, but couldn't really get hands on anything.
Okay. And do you remember a situation where you kind of had to either social engineer yourself out of a situation or, you know, kind of just get out of a situation when you were younger, hack the system, quote unquote?
I'll tell you that my cousin, my cousin who I lived with, she had a computer herself and we'll just call it this password reuse, right?
Okay.
So if I wanted to get on her computer, I just used a password that I knew she had from something else. And I mean, that was like the closest thing I've ever done. And it was just a matter of like cleaning up logs behind me every time I was on.
Oh, okay.
But that was a learning experience because I still got caught.
How did you get caught?
I didn't, we were using AOL at the time. I guess I didn't really understand AOL as much as I thought I did as a browser. And so she was monitoring things that I didn't know existed. You know, you can monitor log on times at the time.
Is your older cousin?
Yes. She's about 10, 15 years older than I am. I'm not sure.
Oh, wow. Okay.
But yeah.
And how are you wiping the logs?
I thought it was just cool to clear your browser history. Gotcha. Not the case. It was wrong.
That's pretty cool. Did you always have a creative side when you were younger? Yeah. Because you're doing music now.
Yeah, so I've been doing music since junior high school. I used to play also sax. And eventually when I got to high school, I picked up some other instruments as well. But I've always been musically creative in some aspect. I played a lot of, I was in marching band, I was in jazz band, concert band, almost all the bands you can probably think of. And it's kind of been like that since then. And then now here I am performing at random conventions and conferences as a rapper with some of my friends. We still play music. One of my friends plays tenor sax, the other one plays trombone. And I play what's called the electronic wind instrument. And we just kind of rap over each other and play with each other.
And I've been doing that for a very long time.
That's awesome. Do you see a lot of the creative side in your current job now? Like tapping into that creative side?
Oh, yeah, absolutely. Absolutely. So there's a huge overlap between just creativity in general, right? And pen testing, because you have to be creative. If you were to follow any particular methodology, step by step, you're probably cutting yourself short. Because these methodologies are out there as a template, right? They're not there to be Follow step by step and say well if a then b right if this works then go on to this step right but granted that may happen but you have to approach it from a what if c happens right you can't just think inside the box all the time okay i think musical creativity is like one of those big things where You can definitely just sort of translate that into an expression of penetration testing in various creative forms, right?
So if A happens, okay, well, maybe something else happened somewhere else. Recently, we had a thing where we were trying out cross-site scripting on one page, right? But it wasn't actually affecting anything on that page. It was affecting something on a completely different page, right? And that was how we got access to do other things later. But it definitely takes a creative mindset of not just following anything that may be on a paper or something like that.
Yeah. Maybe we could talk about that for a second. Pen testing is almost the first thing that a lot of folks out there see that they want to do. So there's a lot of folks that are trying, they want to be pen testers. Okay. What advice would you have for folks trying to get into the pen testing field professionally?
I would say that you definitely have to, for one, keep up with as many resources as you possibly can. And so I have a list of sites that I read on almost every day because I want to make sure that I'm up to date with current techniques and all that stuff. I'm watching people on Twitter. Twitter is huge for information security environment. I'm following a bunch of people who find it very interesting. I also contribute to those same people, right? So when people build things on GitHub or whatever, or they place them on GitHub, I'll look through it, maybe find some way I can improve something and I'll like send in a pull request or something like that. I think ultimately it's important that you're actively all the time.
I wouldn't say all the time, like there's a family work, was it life work balance, but you primarily want to be making sure that you're constantly looking out for anything new and keeping up with all the news, keeping up with your networking. Making sure you're going out to conferences and finding out what the next big technique is. Right.
Yeah.
You can't just treat it as a nine to five job. Okay. Absolutely not because you're not going to get anywhere. Well, I was just into that. You're not going to get as far as you possibly could if you were to do this also in your off time. It's like, Even outside of penetration testing and almost any technical field, you need to have a portfolio or something that shows that you've been working and you have a genuine passion for the field. If you go do networking and you go to an interview, they may ask you, was your network like at home? It's the same concept. You got to have that side hustle of your passion to show that you are genuinely interested in it and you want to get into it. We actually had a conversation the other day where somebody said, you know, I want to get into the pen testing.
He said, I'm going to get my SEC plus. I said, cool, that's a start. But what do you want to do next after that? Right. What do you do now? What do you do next? And he says, I work in networking and I kind of want to move on to an offensive field. I said, well, I mean, I don't have years of experience to give you, but I can tell you that from my experience, right. You want to move, you can take whatever skillset you have now in your windows environment, Right and build your education any further education that you have because you already have a degree and your certifications around that so sec plus is cool but then if you want to stick the comp to your route you can go to the pen test plus or the cyber security analyst certification and that's what it's called right but ultimately on your off time
You have to get into vulnerable VMs or pick up Metasploitable or something like that and work on that and learn how all these techniques work, right, that you may have seen in your administration days and stuff like that and be able to eventually be able to do these yourself. And go through all these exercises and challenges and stuff like that. A lot of people say that CTFs are not helpful because they're not realistic, but I would 100% disagree. Participate in all the CTFs you can because you're learning some skill set at some point. You're not just doing things for fun. Oh, you are doing it for fun, but you're not doing things to not learn. Like nobody goes to CTF and expects not to learn something by the time they leave.
Right. And it doesn't matter how small it is either. So do CTFs, do hubs, or I'm sorry, vulnerable VMs in your own time. And there's so many resources out there for increasing skill sets in any aspect, whether it's web app or network based or whatever. There's a lot of resources out there and a lot of people to reach out to.
That's cool. That's really helpful. What are the realities, though, of really trying to switch into pen testing? I mean, you were lucky enough, I would say, right, to have the Navy education behind you, to have credits and a degree and certifications and all this kind of stuff. But for those out there that are just looking from scratch, either just pure from scratch or looking to transition into pen testing, what are the realities that they should be aware of?
Yeah, you're right. I was a little more lucky than most people. I don't deny that. I just happen to have a career path that gradually got into it. But I would say that the biggest thing that I found helps is networking, right? Because regardless of your qualifications as a standalone person, it's really difficult. At least I found it really difficult to even be considered for a job until I've had somebody who I've personally met face to face who can vouch for me in certain areas and something like that. It's kind of weird because job searches shouldn't be like that, right? They should be based on your merit. But you have so many people applying for jobs that it kind of becomes difficult for any one person to really give each resume justice or anything like that.
So I would say for sure that networking is a very huge portion of being able to secure a job. So just go to conferences, meet people, talk to people. And you never know who you run into, who knows whom. Actually, just the other day, I went to B-Side Seattle and I ran into someone who knew you. And she happened to look at my LinkedIn. She was like, oh, you know how I'm like, we haven't met. But that relation was already there. So when we started talking, right, she was asking me questions about pen testing, all that stuff, because you're in the environment already. So it's kind of little things like that can really affect someone's future.
Cool, cool. One other question is, do you think that those attracted to pen testing are attracted only because that's all they know? And there's other fields that they might not be aware of that they could be better suited for? What are your thoughts on that?
So I think everyone's attracted to pen testing because it sounds cool being the hacker, right? I would say that there are definitely a variety of fields that people are not aware about. And I know this is my own personal experience when I was in the Navy and there were certain people in my division, the defensive security stuff was just not there in their skillset or things that they were actually interested in, right? They got put there because of billeting, right? Actually, I wrote a slide and I was talking to some high school kids. I was like, everyone here is hacking. Right. And they think I'm going to get into your computer or something like that. But here's others, you know, forensics or incident response or even just like DevOps.
But like these all these other skill sets that are involved in making sure that things are secure. So because you hear hacking, you're going to think penetration testing or something similar to that. But in reality is that everybody has their own role to play. And so whether or not people are interested in those things is one thing. But a lot of people I've found aren't aware of all these different nuanced fields or subfields like reverse engineering, for example, and malware analysis may not be the same thing as far as a day to day job may be, but they're heavy relatable skills. So I've talked to people in the malware shop in my last shop, and they were like, I don't want to do this. But I kind of like this figuring out this puzzles of reverse engineering.
Like, well, you're in this job now, but later maybe you can take the same skill set and translate it to something else. I think there's definitely people or in an offensive security capacity. Right. You can do the exact same thing. Right. Break things apart in order to find holes in them as opposed to break things apart to figure out what happened or why this is bad or malicious or whatever. So I would definitely say that if you have a skill set and you think penetration testing is something that you may be interested in, you should also consider other fields just in case, right?
Right.
If you don't want to pigeonhole yourself into one thing.
Yeah. Is it a matter of aptitude also?
The idea of aptitude to me is kind of, it raises so many borders, right, in my opinion.
Yeah, go ahead and expand on that.
There's a lot of things I don't know, for example. I have the aptitude for penetration testing, I think, in my opinion. But I didn't go through the same career pipeline that you go from IT administrator into security team and all that stuff. So I may not know some of these basics that I don't even know that I don't know, right? So you need to have the experience and you need to be able to speak on these experiences well enough, in my opinion, right? It's not just a matter of what you are capable of doing, but is what can you bring to a team based on what you currently have? Gotcha. That's important. If people are so focused on, well, can you get OSCP? Maybe the person can't get OSCP, but maybe they have this other skillset and knowledge that are very relevant to being able to be a penetration tester.
Yeah, aptitude is one of those things, one of my little pet peeves. I'm just kind of like, don't think about a person based on, and granted, like businesses are businesses, right? Jobs are businesses. They want to know what you can do for them in the future, but they're hiring you based on what you can do now, mostly, sort of. So that's also just as important as opposed to play to your strengths, basically. I guess it's the easiest way of saying that.
Okay. That's awesome. No, I'm glad I asked. So you mentioned there were some folks in your group that really weren't interested in the job. Is that what you alluded to?
Right. My previous Navy job.
Yeah. So tell us more about those that really weren't interested in your job and your insights into that.
So that wasn't any fault of their own. It was mostly just because people got placed into positions based on billeting. And so they may not have always wanted to do this particular thing. And we kind of tried to work around that because sometimes we couldn't really move people around. It's the Navy, right? And government may not always end up where you would like to.
Bureaucracy. Yeah.
But what we did was... Make sure that they had the opportunity to grow into a position that they liked because they didn't have to stay at the same position for more than a year and a half, depending on when they got there. So just a year and a half of that, and then grow them into something that they actually wanted to do and give them that opportunity. It was just unfortunate timing for a lot of people who got placed in certain positions where their skill sets that they had learned up to that point were just weren't being put to use.
Okay.
Very unfortunate. I felt so bad for those guys. But yeah, it was a matter of, okay, what is your current position? It can't be helped. Unfortunately, it can't be helped. How do we move you into something that you do want? And we had to learn to build those people up to when they wanted to move to this new section, they could apply and say, no, I have been doing all this, but I've been learning all this in my spare time. And so I think I'm qualified to do this other position.
So you're going to be a SANS mentor. I think you mentioned, would you like to talk more about that?
All right, so the course is the SANSEC 573 Automating Information Security with Python course. It starts March 19th. It's twice a week. That's the schedule that I have set up. So it'll be Tuesdays and Thursdays for about a month. There's 20 sessions, I believe. 20 hours. And that course discounts now if anybody wants to just hit me up on LinkedIn or on Twitter. We can talk about all this stuff. But the course is, I'm expecting it to be a pretty fun course because it's a small group. And talking in a small group is a lot less formal than speaking in one of the bigger classes, like the SANS events. So it's based on the on-demand content, the SANS on-demand content, which is work at your own pace.
But I'll be there to help guide people through things that they might be having trouble with. Sort of like a tutor, right? It's a mentor position, so... Okay and how can they find future mentoring that you're doing because if they listen to the show a year from now for example so on the sans website in addition to finding all the sans events you can also find the mentor courses specifically if you're looking for those this course isn't being offered in seattle any other time as far as i'm aware so i decided hey i'll teach it all right so is this an in-person course your mentoring is only available in person correct Right. So it's an in-person course and it'll be held in somewhere near downtown Seattle.
Okay. Awesome. Well, Ron, it's been great talking to you. It's been a pleasure and I look forward to hearing some more music as well from you.
Absolutely. Thanks for having me.
All right. Thank you. Hey, thanks for listening. So I built a lot of things and I'm building something new. I'm working on a new community. I want to bring everyone together with all the things that I've done into just one space. So I'm really excited about it and would love to stay in touch and get some early adopters or feedback. So check out the link below in the show notes and send me a hello. And that's about it. I hope you're having a wonderful day. Thanks. Talk to you soon.
