Getting Into Infosec, Episode 43: Rana Khalil - From Cryptography to Pentester!
Published March 11, 2022 · 40 minutes
Episode page: https://www.gettingintoinfosec.com/episodes/rana/

[0:00] Rana Khalil: In the sense that, wow, you're able to create something from nothing when it comes to software development, creating programs. It felt the same way. Just the ability to do something that you didn't think was within your reach.

[0:32] Ayman Elsawah: My latest guest is Rana Khalil. Rana is a senior cybersecurity analyst and has an amazing professional background. She has spoken at many different conferences, including B-Sides, ISSA OS, Ottawa, and Hackfest.

[0:45] Rana Khalil: I admit that I want to finish all the boxes and he just kept updating them. But even looking back, I'm glad that he did because the OSCP is not just about getting the certification, but actually knowing how to pen test and the more experience you gain, the better.

[1:03] Ayman Elsawah: Rana was relentless in her pursuit of the OSCP and knew that the best type of learning is by doing.

[1:11] Rana Khalil: If you can explain something properly to someone, then you know you properly understand it. But if you can't, then there's definitely certain areas in your understanding that you didn't know were lacking.

[1:26] Ayman Elsawah: Another tried and true method of learning is to teach. This episode will surely motivate and help others looking to obtain certifications in full-time careers in information security. Please share with us your greatest takeaways from this episode by tagging us on social at GetIntoInfosec. All right, on to the show.

[1:47] Ayman Elsawah: My guest today is Rana Khalil. She is a senior cybersecurity assessment analyst and has a really diverse professional background. She has spoken at many different conferences, including B-Sides, ISSA, OWASP Ottawa, and Hackfest. And she's recently received the OSCP, a coveted security certification out there in the community. If you haven't heard of her, she has definitely written up and done tons of write-ups on the OSCP and different Hack the Box write-ups. Okay, as you can see, I'm totally messing it up.

[2:20] Rana Khalil: That's okay. I'm probably going to do the same, so it's all good.

[2:23] Ayman Elsawah: Yeah. So let's just hop into it. So hi, Rana. Welcome to the show.

[2:28] Rana Khalil: Hi, Eamon. Thank you for having me.

[2:29] Ayman Elsawah: Yeah, I've been looking forward to this episode for a while. And we've been connected for quite some time. And I've been following your path into security. And here we are. So I'm really excited to talk with you today.

[2:43] Rana Khalil: Thank you.

[2:44] Ayman Elsawah: Great. So for those out there that may not know who you are, can you take a second and tell us about yourself and what you do today?

[2:52] Rana Khalil: I'm currently a pen tester in the financial sector, so I moved to this team a month ago. I do not have the typical story growing up that most hackers do, where they grew up interested in technology and wanting to break things and put them back together. In fact, I remember when my dad got me my first laptop, I remember saying thank you and then telling him to give it to my younger sister because she'll make more use of it than I will. And the same thing with my first cell phone. And this lasted until university. I didn't start out in tech in university. I did a full year of biochem. And after a full year, I realized that I hated biology. But I loved calculus, so the mathematics courses that were part of my degree.

[3:38] Rana Khalil: And so a year after that, that's when I decided to switch to a mathematics degree. But because I knew that there were very little jobs in that field, As a backup plan, I decided to take a computer science degree. And it was just a backup plan, but that was probably one of the best decisions that I made in my life. Because as the degree progressed, I realized I kind of had a love-hate relationship with mathematics. I loved math, but it hated me. It's just like when you get deeper and deeper into it and the more abstract the concepts become and the more difficult it becomes to relate them back to applied mathematics. So through my journey of trying to make sense of it, that's where I came across cryptography.

[4:26] Rana Khalil: I think that's the first security related field that I came across and I still do. It's an amazing field and in another life I would be a cryptographer. But anyways, that was the first security related field I got introduced to. I ended up doing my honors project. So my bachelor's honors project in scale invariant fully homomorphic encryption over the integers. And for anyone listening that doesn't know what that is, it's a type of encryption that allows you to perform calculations on encrypted data without having to decrypt it first. It wasn't like conjunctured to be true. Well, it was conjunctured in 1978 by one of the guys that created RSA. And it was, I think, a year after RSA or around the same time as RSA.

[5:11] Rana Khalil: But it was only proven to be true in 2007, which is not too long ago at all.

[5:18] Ayman Elsawah: That's amazing. That's pretty cool.

[5:21] Rana Khalil: Oh, I was just going to say, and what's even cooler is the professor that I did it with, like that I did my honors project with and ended up being my master's supervisor was actually pretty well known in the cryptography circles. He created an algorithm called CASP. His name is Carlisle Adams, and his algorithm was called CAST, and it competed with AES back when this created the competition for a new algorithm that replaces DES. It was an amazing field, and I had been set to do my master's in it, but then things took a 180 turn when I did my last co-op term, and that's how I ended up in the field that I'm in right now.

[6:00] Ayman Elsawah: Okay, so there's a lot to unpack there. So did you discover cryptography before or after computer science?

[6:07] Rana Khalil: During my computer science degree, towards the end, because there was a course specific to cryptography that I took.

[6:14] Ayman Elsawah: And was it optional?

[6:15] Rana Khalil: It was optional.

[6:16] Ayman Elsawah: Oh, wow. Okay.

[6:17] Rana Khalil: Yeah. But because I love math, I specifically picked the computer science courses that mathematics-related, so discrete, what was it called? The courses that were related to math. So most of my courses were not actually in software development courses, theoretical computer science courses.

[6:32] Ayman Elsawah: Oh, really? Okay. Okay. How did you feel when you discovered that there was a conjunction between math and computer science?

[6:38] Rana Khalil: Amazing. I absolutely loved it. Because like I said, when you get deeper into math, it just becomes so abstract. When numbers start, there's no number at all on the paper that you're studying. And it's all letters. That's when you know you've lost a grip on reality. Obviously, they all have real applications, right? It becomes so difficult to relate it back to reality. And so when I discovered cryptography, which is real applied math, it was amazing. Like I love the field and I still do.

[7:12] Ayman Elsawah: What are some good cryptography courses that people out there can study? I know about Dan Bonet's cryptography course on Stanford, but there's that you would recommend to folks out there?

[7:22] Rana Khalil: I was just going to mention that one. I haven't studied ones online. It was purely through what I studied in university. I know, I don't know if I say it correctly. It's Siberia, is that right?

[7:32] Ayman Elsawah: Siberia?

[7:33] Rana Khalil: Yeah, they have a couple of courses, but I personally haven't done them myself to recommend them.

[7:38] Ayman Elsawah: Right. And so stepping back to your transitions, what was that turn that happened at the end of your master's that you're referring to?

[7:45] Rana Khalil: So beginning of my master's, it was my last co-op term of my bachelor's degree. As usual, I was right in the fact that there aren't many job opportunities in the mathematics field. That's why every co-op term, that means work term, every work term that I had, it was always in computer science and it was always in software development. And so the last term just happened to be in a small security company. And I was working in quality assurance as part of the QA team. Like I tested, we had automated test cases that we ran on the applications that were developed in-house. And as part of the team, I was like, well, we should not just test that the applications are functional. We should also test if the applications are secure.

[8:30] Rana Khalil: And so I asked my supervisor if he would let me take some time out of my day to test the security of the applications. That we were developing. And I told him that I knew how to do it because we did it in school. And to my surprise, he said, yes. And that's when I realized do something that I actually did not know how to do. And so I remember that day I went back home and I went on Amazon and I bought the application hackers handbook, which is those that don't know. It's like the Bible. It's considered the Bible of web security.

[9:00] Ayman Elsawah: Right, right. That's right. Yeah.

[9:02] Rana Khalil: Yep. And I remember like I would spend all night reading it and then I would go back to work and test out and implement what I learned. And that's how I got introduced to the area of web application security. And through that, I got introduced to web application vulnerability scanners, which are automated tools that are used to crawl your web application and look for vulnerabilities. It was just like when I found out that there are such tools, I was like, oh my God, that's so amazing. They do what took me so long to learn to do, right? And that's how they're advertised as well as point and click tools that will find all the vulnerabilities in your application and you'll be secure if you use them.

[9:48] Rana Khalil: So, yeah.

[9:49] Ayman Elsawah: Knowing the manual way how to do it, of course, is always really beneficial and it'll teach you how the tool works, right? So I'm sure there's no time lost in doing it manually at first, right?

[10:00] Rana Khalil: Oh, I'm getting there.

[10:02] Ayman Elsawah: Oh, okay. Sorry.

[10:03] Rana Khalil: Yes. The conclusion was definitely no time loss. That's when like, just because of how powerful they are and how much time I had spent into studying it and how I thought it was, it's just pretty amazing that the scanner understands the logic Of the application and can find like the types of vulnerabilities that I'm able to find. That's when I decided I'm not comfortable using these tools unless I know how they work. And that's where the 180 degree turn took because it was even more practical than cryptography. So like in cryptography, yes, it is practical, but then once you graduate There are very few cryptography related positions, right? The algorithms are already there. There's a lot of positions right now for quantum cryptography because that's a new thing right now.

[10:48] Rana Khalil: But this was way more practical. So that's when I convinced the same professor that I told you about. He was a little bit disappointed, but he agreed that I should do what I'm passionate about and what I want to do. And that's when I asked him that if it's okay that he stays my supervisor, but I do my master's degree in comparing open source web application vulnerability scanners and understanding what their limitations are and how they work. And the conclusion of that was these scanners, they're advertised to do something that they don't actually do. I would say like my research showed that they find less than 40% of the vulnerabilities and The vulnerabilities that they do find are low hanging vulnerabilities.

[11:30] Rana Khalil: And if the application uses like the more modern technologies that the application uses, the less, the lower the percentage of vulnerabilities found because crawling is apparently a very important factor. Because if you can't even get to the vulnerability, you're definitely not going to find it, right? And crawling the application, it was just like some of the scanners had difficulty with AJAX requests or just modern technologies. If an application is built solely in Node.js, You need a scanner that is able to crawl Node.js before it even looks for vulnerabilities in the application. So that was very insightful. Well, the knowledge that I gained from the master's degree that I did.

[12:07] Ayman Elsawah: Yeah, that's amazing. So is that research paper available? Can people read it if they wanted to?

[12:12] Rana Khalil: It is. I can send you the link after.

[12:16] Ayman Elsawah: Awesome. I'll put in the show notes and walk us through your first exploit. You've bought the web hackers handbook, right? And given the green light to assess and test the application. How was that? Walk us through like the first time you, you were able to exploit something or take advantage of something.

[12:33] Rana Khalil: So I don't exactly remember what the bug was that I exploited. But yeah, the first time is like when you developed a program in the sense that, wow, you're able to create something from nothing when it comes to like software development, right? Creating programs. It felt the same way. Just the ability to do something that you didn't think was within your reach.

[12:56] Ayman Elsawah: Yeah, that's amazing. That's cool. So now you're doing your master's, you're scheduled to graduate. Walk us through getting your first security job. Did you get it right after graduating or did it take some time?

[13:08] Rana Khalil: I did get it right after graduating. I had applied to the job that I'm currently in. And it just so happens that there was the B-Sides Ottawa conference at the same time, timeframe as the interviews for the job. And Tanya Jenka, I think you know her, at the time she was my mentor.

[13:28] Ayman Elsawah: Yeah. Oh, wow. That's cool.

[13:30] Rana Khalil: Yeah. And she had convinced me and encouraged me to give a presentation at Besides Ottawa about my research, about my master's research. So I asked supervisor when I first started. He was also attending Besides Ottawa. And so he attended my talk. And apparently that was one of the prominent reasons that he decided to hire me.

[13:54] Ayman Elsawah: Wow, that's awesome. That's amazing. That's the second time I've had a guest say that they were hired because their future manager saw them in the audience. So that's the lesson learned there is you have something to present, you know, just present something. I think Tanya said this, that there's always someone else that could benefit from what you have to say, right?

[14:12] Rana Khalil: Absolutely. Yeah. And she played such a huge role. I would have never done it if it wasn't for her. I remember she even sent the organizers that she's going to speak and she's amazing and you should accept her. And so she played a huge role in getting me to speak at the conference.

[14:28] Ayman Elsawah: Yeah. Tanya is awesome. We've had her on the show before and she's just an amazing human being. So that's really good to know. And there is, for those out there, there is a lot of imposter syndrome about trying to speak. I mean, I've had it before. Sometimes I still have it, but like I never tried to give talks and stuff, but you have to put yourself out there, right? So that other people can discover you and for your own benefit, just so you can share what a research or knowledge you have with others. So

[14:55] Rana Khalil: Yeah. If you benefit even just one person, it's worth it.

[14:58] Ayman Elsawah: Yeah. Well said. I've seen you do a lot of write-ups. I think I was also watching you go through the OSCP. So, you know, it wouldn't be just to have you on without talking about the OSCP, I guess. So, and some of the things you did was chronicle your path throughout. Maybe you could share some of that with us. How was your journey to the OSCP? And looking back, are there things you would have done differently?

[15:22] Rana Khalil: I'm trying to remember. It feels like it's been forever.

[15:24] Ayman Elsawah: Yeah.

[15:25] Rana Khalil: I had started my OSCP right when I started work, but I was a complete, so like, no, the OSCP is not just web security stuff, which is what I knew. Everything else I had zero experience in. And we were still with the old version of the OSCP, which is not as detailed as the newer version right now that they came up with last year. So I had zero knowledge in the other areas of pen testing. So I found it really difficult to follow the course material and be able to actually solve boxes in the lab and so on as a complete beginner. Between work and having to study and like a bunch of other things in my life, I ended up letting my lab time pass. And just not working on the OSCP. And then I promised myself, though, that when I do get into back into the labs in the OSCP, I'm going to be completely prepared to even just like do the exam.

[16:18] Rana Khalil: So I will go back into the labs and I will do the labs. But before I even do that, I want to be like in my head prepared enough to do the OSCP exam. So that's when I started studying for the OSCP on my own, so outside of the course material and outside of the labs. I remember looking for resources online and finding TJ Null's list of Hack the Box OSCP-like boxes. These are boxes that are in Hack the Box, and they're similar to the boxes that are in the OSCP labs. So I started doing them one by one and watching Ipsac's videos. So he does videos for walkthroughs for Hack the Box. And this way, I kind of learned his methodology of how to solve boxes. And I remember being adamant to do all the boxes.

[17:09] Rana Khalil: And every couple of months, DJ Nell would update them. And I'd be like, oh my god, my goal just got further away.

[17:17] Ayman Elsawah: That's funny.

[17:17] Rana Khalil: Yeah, because like I said, Adam meant that I want to finish all the boxes and he just kept updating them. Even looking back, I'm glad that he did because the OSCP is not just about getting the certification, but actually knowing how to pen test and the more experience you gain, the better. And so I started doing the boxes. I wanted to hold myself accountable on finishing them. So I came up with the idea of doing write-ups, which a lot of people do for Hack the Box. But I think I remember Tijanel commenting on my Twitter that I was the first one to actually complete the entire list and write about it. Which is awesome. But yeah, I started documenting them. I would post to, I think I started with one write up a week and then I just taking too long because there was like 50 boxes or a little bit more.

[18:05] Rana Khalil: So I started doing two a week and sometimes three a week. It felt like it was a full-time job. Like, Doing it and then writing it up and making sure it's presentable, so on. And people started responding to that, surprisingly. And they like my write-ups. They like the way I explain things. I do have to mention that did motivate me even more, like at times where you feel like, well, I already know what I'm doing. Why am I writing it up? It helps that someone out there says that they benefited from the write-ups. Because I owe a lot of gratitude. I don't know him, but I owe him a lot of gratitude, IPSAC, or all the videos that he puts out there. So just knowing that someone out there values my write-ups, even if it's just one person in the same way, that's enough for me to do them.

[18:53] Rana Khalil: So once I finished in all the boxes, I decided to go back into the OSCP labs. At the time, they had updated the material. They Implemented pretty much everything that I would have complained about after getting the OSCP because I wanted to get the OSCP first before I started complaining. But in the update, they actually implemented everything that I thought was missing. And now that I had like the document itself, the course is like 800 pages or like 900 pages. And just because I already had that knowledge and that experience, I was able to finish the like 800 pages in two weeks, including all the exercises that they have in that document in two weeks and a half.

[19:37] Ayman Elsawah: What 800 pages?

[19:38] Rana Khalil: They give you like a lab manual. Oh, okay.

[19:40] Ayman Elsawah: Lab manual. Okay. Gotcha.

[19:42] Rana Khalil: In that manual, if you complete all the exercises, I can't remember exactly, but my final like lab report for just the exercises, not the exam report was like over 200 pages. And just like doing that in two weeks and a half, the only reason I was able to do that was because none of the material was new to me. I had all learned it on my own through my like Personal journey of studying for it the past i don't know like eight months oh wow amazing that's amazing okay Yeah. And then I spent the rest of the time in the labs. And one thing that I do regret is not spending enough time in the labs because I was focused on getting the certification. Because after spending this much time on it, you have tunnel vision, obviously, right?

[20:24] Rana Khalil: You're like, I spent so much time on it. There's no way I'm not passing right now, which is the incorrect way. I'm not approaching like the OSWE. That's the next cert that I'm doing. I'm definitely not approaching that cert that way. For the OSCP, I had approached it that way. So I was focused on getting the certification because I felt like it validated what I knew and I needed that validation. But I don't right now.

[20:47] Ayman Elsawah: What do you mean you would have spent more time in the labs? What would you have done more?

[20:51] Rana Khalil: Oh, like solved all the boxes in the labs because the labs are not just like individual boxes. They're connected just like a real network would be.

[20:59] Ayman Elsawah: If I understand correctly, like I'm trying to think from the perspective of someone who doesn't know what the OCP entails. Is it that you just did the minimum number of boxes to pass? Is that what you're saying? And you would have spent more time just to get all the boxes you can? Is that what you're saying?

[21:13] Rana Khalil: Well, there is no minimum number, right? You don't have to do any labs if you don't want and you can pass the exam. It doesn't matter as long as you can't buy the exam itself. You have to buy the lab time. But I know people who didn't even touch the labs at all and just did the exam. Yeah.

[21:29] Ayman Elsawah: Oh, I see. I see the labs. I see. Gotcha.

[21:31] Rana Khalil: Yeah. So for me, like, no, I didn't do the minimum. I actually did a good portion of the labs, but I do wish that if you talk to me then, like, I'd be like, no, don't talk to me until the OSCP is done. So I had like before OSCP and after OSCP time once that's it.

[21:47] Ayman Elsawah: Oh, that's funny.

[21:48] Rana Khalil: Yeah. I was like super focused because it was something that I had spent so much time and so much work studying for. I wasn't not going to get it.

[21:58] Ayman Elsawah: I see. But you still have access to the lab even after you pass, right? So it's like a prearranged amount of time. Is that right?

[22:04] Rana Khalil: Well, it depends. So if you do the exam during your lab time, then yes, you'll have access to the labs. But I did the exam after my lab time. I had just registered in a shorter period of lab time than, yeah.

[22:17] Ayman Elsawah: Okay. That's amazing. I mean, there's so much there, as you mentioned, about writing up and doing write-up. One of the things I think a lot of people say is to catalog your journey, right? So it helps you collect your thoughts and organize and really verify the stuff you're doing as you're writing it, right? Because you want to make sure that it's perfect.

[22:35] Rana Khalil: So you learn more by writing it because if you can explain something properly to someone, then you know you properly understand it. But if you can, then there's definitely certain areas in your understanding that you didn't know were lacking.

[22:48] Ayman Elsawah: Yeah. So tell us about the OSWE that you're currently going for right now.

[22:52] Rana Khalil: Yeah. So that cert is the OSCP is advertised to be more beginner friendly. The OSWE is rated as intermediate and it focuses specifically on web application security. And the way it approaches it is not from black box perspective, but from a white box perspective. So it's very, very heavy on code review and finding vulnerabilities by reviewing code. And like if for anyone listening and wondering if they should do it, I personally do not recommend doing it if you're a complete beginner because it's not catered towards beginners. I think you should have at least a year or two of web application and testing experience before you approach that cert or you wouldn't appreciate it for what it is. It is an amazing cert and the content that's taught in the cert is amazing and

[23:41] Rana Khalil: I don't know how the instructors found the vulnerabilities that they found. It's just amazing. But from a perspective of a beginner who hasn't even done black box pen testing when it comes to web applications, which is much easier than white box pen testing, they might not value the search for what it is.

[24:00] Ayman Elsawah: Okay, that's useful. What if you have experience like bug bounty hunting? Would that be applicable?

[24:05] Rana Khalil: Yeah, so most of bug bounty hunting is web apps, right? So yeah, it would definitely be applicable. Like you'd be able to create yourself. The applications that are being used are syllabuses online, it's public, and they're open source applications. So you'd be able to evaluate yourself if you think you have enough experience and you're comfortable with reading code. Then go for it. If you're not, then maybe you should spend a couple of months just learning. I had a software development background when I started it. So that wasn't an issue. But if you're starting from scratch when it comes to coding, you definitely need to know how web applications work. You need to be able to read web app code.

[24:43] Rana Khalil: You also need to be able to write in a scripting language because all the attack vectors are scripted from like zero to end. It's just like a point and click. You have to write a script that does all that for you. And if you don't have any experience in scripting languages, your three months lap time is going to pass by while you're just like learning how to use Python, for example, and it's not a good use of your time.

[25:07] Ayman Elsawah: Cool. So let's shift gears a little bit and talk about the life of a security professional. It's been a couple years now as a full time security professional. What are some reflections you could share with the audience in your career so far?

[25:21] Rana Khalil: For me, it's been two years. I do consider myself relatively new to the field. One thing that I will mention is when you get into the field, you'll realize that there is so many different areas of security that you can specialize in or even learn about. And as a beginner, something that I suffered with is wanting to know everything all at once. So pursuing, trying to know everything all at once and learning everything all at once just led me to have like very, very basic understanding of the areas that I was learning versus actually sitting down and focusing on one area or two areas and having a proper understanding that you would be able to do your job in that area. So one thing that I do recommend as a new person in the field, as a beginner in the

[26:09] Rana Khalil: Find out what interests you in security, what field of security interests you, and just sitting down and focusing on the area until you're comfortable with it. And then once you're comfortable with it and you want to learn more about a different area, then move to that area. That's one thing. And the second thing that I would say is previous experience in other fields really matters in security. So it's not just a matter of I'm going to give you a course like a certification or a book and that's it. You know how to do pen testing. If you have a background in software development, that's going to really help. If you have a background as a sysadmin, that's going to really help. So on it just people who are in those fields and want to break into security think that they've wasted their time but they haven't at all your background is going to be very handy once you do enter security so just be patient apply to security jobs while you do your normal job but know that your time is definitely not wasted with the skill sets that you have are developing i guess

[27:12] Ayman Elsawah: Yeah, there's a lot of people out there that say go in somewhere in IT first. If you're having a hard time going directly into security, which can be challenging depending on the industry and area you're in. So if you're having that difficulty, then go somewhere in technology. And at least that experience will help feed into security. Just have the security focus. But so many times I've heard all these experiences culminating together in their current security job.

[27:37] Rana Khalil: And you will have a skill set like other people who just started in security from the beginning of their career don't have. Like, for example, like with web apps, right? Someone who has developed web applications for, I don't know, 10 years and then entered the security field and started learning web app security will probably be better at it than someone who just, the first thing that they learned was how to pen test web applications. Because the person who has a software development background actually knows exactly how web application works. They know exactly the logic of developers, the mistakes that they're going to do and so on. So they will be better at that job than you are if you entered it from the get go.

[28:18] Rana Khalil: So I always say, if you want to specialize in the area, you're going to have to develop these skills while you're in security anyway. So if you're developing them before, good for you.

[28:29] Ayman Elsawah: Yeah, absolutely. 100,000%. That's amazing. There's a lot of pentesters that don't know basic sysadmin stuff and vice versa. So there is a threat of being very tunnel vision and not having the big picture. And so are you sometimes communicating with developers? So you find the vulnerability and then you have to discuss that vulnerability or get someone to fix it, I imagine. How's that experience been? Do you have to explain it and kind of step back or walk us through that?

[28:58] Rana Khalil: So far, so good. It really depends on the team. But yeah, you explained the vulnerability. I think from developers, most of the time, the reaction is positive because it is their code and it's like their baby, right? It is their code and they want it to be the best that it could be. And so the reaction is mostly positive. They go like, oh, wow, cool. I didn't know that you could do that. And I know exactly why this vulnerability is occurring because they developed it, right? They developed the application and they would fix it. Sometimes there's resistance from teams. You really experience all of it. It depends on the team, really. But most of the time it is a positive reaction.

[29:39] Ayman Elsawah: Okay, yeah, okay, great. And I don't know what, I guess, I don't want to dig too deep into your work, because I know they might be a little sensitive for that.

[29:50] Rana Khalil: As long as it's general, I mean, it's okay.

[29:53] Ayman Elsawah: Yeah, okay. Are there any war stories you could share with us, either where you've discovered something or any war stories you could share with us from either somewhere you've worked or anywhere you've been online?

[30:07] Rana Khalil: Yeah, you're right. I can't talk about that because I've been in one place this entire time. So it's so obvious.

[30:14] Ayman Elsawah: I know, right? Yeah.

[30:16] Rana Khalil: Yeah. And I know people will listen to this. So including the people who like the project teams that I tested applications for. So yeah.

[30:27] Ayman Elsawah: We could actually say, make a theory. Are there any war stories you've heard of that you could share with us? But I don't know. Do you do bug bounty or no?

[30:33] Rana Khalil: No, I don't.

[30:34] Ayman Elsawah: You don't participate in bug bounty. Okay.

[30:36] Rana Khalil: No, no one has that time. Yeah. So, okay.

[30:40] Ayman Elsawah: I don't get to talk about that. So tell us, you work full time. So let's talk about like all the things that are out there. So there's a lot of attraction to being a pen tester out there. But as you mentioned, there's so many different jobs in the information security field, right? AKA cybersecurity field. So for those out there that are just kind of really focused on being a pen tester, what is something you could share? And I know you're a pen tester, but what are some other jobs outside of pen testing that can use pen testing skills?

[31:10] Rana Khalil: Wow.

[31:11] Ayman Elsawah: Yeah, that's kind of a tough one.

[31:14] Rana Khalil: A bunch of jobs. I would say like there are detection engineering is becoming a big thing. And in order to know what to detect on like the MITRE ATT&CK framework, it would be useful to work with pen testers to see how they even attack things and like the Tactics and techniques that they use. So that's one thing that would require a pen tester skill set. Let's see. Again, application security, there is a security testing component to it, which is related to pen testing of web applications. Yeah, I'm sure there are others. I just can't think of them right now.

[31:49] Ayman Elsawah: Yeah, yeah. I think we have a couple more questions. Is there anything we didn't talk about that we should discuss?

[31:57] Rana Khalil: I don't know. I'm just going to be sure I made note of the questions that you were going to ask. No, we covered all of them.

[32:05] Ayman Elsawah: Yeah. Okay.

[32:06] Rana Khalil: Yeah.

[32:07] Ayman Elsawah: I could ask a question about like degree versus no degree. I don't know if you've come up. Okay, how about this? So what are some mistakes that you see are being done out there that you can share with the audience that maybe might help them accelerate their career or save them time? Written up a lot about the OSCP. So you've sought out a certification. You've done a lot of things. You've talked to a lot of people out there. I'm sure. So what are some mistakes you're seeing people make out there? If you had three pieces of advice for people out there, what is common mistakes you're seeing being done out there for people trying to get into the security field that you would ask people to stop making that maybe that can help them accelerate their career a little bit or prevent them from wasting time?

[32:56] Rana Khalil: Well, it depends on the person, right? Like one of the things that I've seen happen is people thinking that you won't gain the skill set in order to do your job until you get the job and you get trained on the job. However, that's not the case at all with security. Most employers want you to already know what you're doing. And I think that expectation comes from the fact that there are so many free and almost free resources online that you can use in order to improve your skill set and build your skill set. So I can say bar is high when it comes to hiring people, whether that's incorrect or not. I'm not going to get into gatekeeping and so on. One thing that my advice would be, there are a lot of resources online for you to build your skill set.

[33:44] Rana Khalil: It's just a matter of having the advantage of like having the personal time dedicated to do those things. So I guess my advice would be if you are in, if you do have the...

[33:53] Ayman Elsawah: I guess don't wait for getting the job to get the experience or...

[33:57] Rana Khalil: Yeah, but what I'm trying to say, I guess, is if you're fortunate enough that you can dedicate some of your personal time into learning the skill set, because I know some people don't have that personal time. If you're fortunate enough to have that personal time, I would dedicate a large portion of my personal time to improve my skill set. At least that'll get through the door from the beginning. At least that'll get you through the door and then you could slow down Your pace of learning a little bit because you are spending eight hours, for example, if it's a full time job, eight hours a day learning that material. So you could slow down the learning in your personal time. I feel a large curve when it comes to studying security because it's mostly not taught in schools, especially if you did a degree that is not security related.

[34:40] Rana Khalil: Even when it should have been like in software development, you're supposed to learn how to code securely, right? And that's not really taught. So there is a large curve at the beginning to get into security and to build your skill set. But there is also a bunch of resources online that will help you get there. So that's one. Second one for the complete opposite people who are like me, who will dedicate an insane amount of their personal time trying to learn everything and then get lost between the material. I would say pace yourself down. You could go slower, pace yourself and just focus on one area and become really good at that area. At least you'll become functional in that area. And then once you are, start exploring other areas.

[35:26] Rana Khalil: For me, it was web security. I am pretty good at it and I was good at it when I got my first job and that's what got me my job. So once I became like really comfortable with that area, I decided I wanted to experience more of the holistic approach of pen testing, right? And all the different areas. And that's why I pursued the OSCP certification. And then when I did get it, I came back to web security and I was like, well, I know how to do web security, but I've actually never done Source code review. And that's something that will level me up in, in the area of web security. And so I came back to it. And then after that, I'm going to switch completely, I think I want to be more involved in like infrastructure pen testing.

[36:07] Rana Khalil: But the idea is that to pace yourself, don't try to do everything at once, or your best, you just have a basic understanding, which is not really helpful in the workforce.

[36:17] Ayman Elsawah: Yeah, I'm glad you touched upon that because I think people get overwhelmed with all the information that's out there and they start getting distracted and go into different directions. So I've been a victim of that myself. So I guess pace yourself is what you're saying and just focus and set your mini goals. Is that what you're saying?

[36:34] Rana Khalil: Absolutely. Yep, that's what I did. I definitely did get lost at the beginning. And then this is where imposter syndrome kicks in. But if you focus on one area, you become really good at that area. And then you always have that area to fall back on if other areas don't work, right? So once you become really good at an area, you start moving around into other areas, see if you like them more. And then maybe you want to specialize in those areas. If not, you know, you still have that one area of pentesting that you're really good at. That would help you do the job that I guess you've been hired to do.

[37:07] Ayman Elsawah: Yeah. And having an understanding of source code is really important. I know all the applications that are out, a lot of them are web-based. So when a company hires a pen test team, they expect that team to review the source code and also test it from a white box perspective. So knowing that source code, it's even an interview question. I've been asked before, how would you store passwords? How would you do password storage? So write some pseudocode to do like a password storage mechanism, for example. So Knowing how to do some of the basics from web application security is really important.

[37:41] Rana Khalil: Absolutely. And I think it all goes back to not even just web app security. It all goes back to understanding the fundamentals before you learn how to break them. If you have that understanding of the fundamentals, it'll go a long way when you're learning about the misconfigurations and about the certain vulnerabilities that might exist. Because at that point, you actually have the fundamental knowledge to get you through the next step of learning, I guess.

[38:08] Ayman Elsawah: Okay, cool. Any parting advice you have for folks out there?

[38:12] Rana Khalil: I don't know. Like most of your guests. I already mentioned that, right? A couple of times.

[38:18] Ayman Elsawah: Yeah. Okay, we could skip it.

[38:20] Rana Khalil: Sorry.

[38:21] Ayman Elsawah: No worries. I let silence do the talking. So sometimes things come up. It's a tactic. So Rana, thank you so much for coming on the show. I really appreciate the wisdom you've shared. Thank you so much for all the write-ups that you do. I absolutely love them. I love it when anybody tries to take something complex and explain it. We really appreciate all the work you're doing and look forward to hearing more and seeing more on your journey.

[38:46] Rana Khalil: And thank you for having me. And thank you for organizing a podcast that actually makes it easier for beginners to get into infosec.

[38:54] Ayman Elsawah: Yeah, my pleasure.

[38:55] Rana Khalil: You're definitely doing your part.

[38:56] Ayman Elsawah: Oh, I appreciate that. At least I could do. Well, thank you so much.

[39:00] Rana Khalil: Thanks.

[39:01] Ayman Elsawah: Thank you. Hey, thanks for listening. So I built a lot of things and I'm building something new. I'm working on a new community. I want to bring everyone together with all the things that I've done into just one space. So I'm really excited about it and would love to stay in touch and get some early adopters or feedback. So check out the link below in the show notes and send me a hello. And that's about it. I hope you're having a wonderful day. Thanks. Talk to you soon.