>get sued a week later when a real hacker breaks into their system and the IT department notices a security flaw that would easily be addressed by first few staps in pen testing
It's in crypto and I'm in Portugal.
Points out where working with me give no security guarantees, that they accept when agreeing to allow me to hack them, either in person, writing, or electronic communications, along with allowing the terms to change at any time, for any reason, without notice.
This is why you should hire me, the pen tester tester. For $2000 I'll make your network slightly less secure to see if the pen test catches it.
With the exception of Girl Scout cookies, I don't buy anything from anyone that shows up unannounced.
If I didn't know I needed it until now, I need to do research before I buy into it.
If I did know I needed it and you showed up randomly, I have no reason to expect that you provide any reasonable value with your services.
Door to door sales are as dead as cold calls and email.
- No one's hiring you unless you have an OSCP or similar certification.
- A real pen test will set off all kinds of alarms.
- You don't get paid until you deliver a 100+ page report detailing what you did and your findings.
You're implying that people who post on 4-chan have no clue how the real world works and no idea what business is like and how people make money!
You hope it'll set off alarms. Sometimes it doesn't, mostly because they don't have monitoring setup.
Pen tests aren't cheap. Even basic ones are ~$20k. There's only 2 types of companies that bother with them: ones that care about cybersecurity and ones that have to do it for compliance (PCI/CMMC/etc). Both will have some kind of IDS and a SIEM.
I'm pretty lazy, but I'd at least run a port scan so I have something to submit in a report. That takes a few minutes to run and can be scheduled to run daily so there's something in their logs.
That said, our audits always turn up something new (usually benign), so I'd be very suspicious of an "all clear" result.
Also, even without a prior pentest the admins should have a rough idea where problems areas are (or maybe even know them for a fact but cannot completely patch/disable them to not lock out legacy systems or so). A completely empty report would definitely raise suspicions
You're not paid for the test, you're paid for the report.
As a professional pen tester myself, you have to test at least some of the pens to make sure the ink isn't all dried up or run out. It's not hard.
So which is your favourite flavour?
Only the best marines are able to become pen testers.
It’s not hard.
well, unless the ink has dried
Get a lighter
LOL. I wish it was that easy. Also, if you say you did a pen test bjt didn't, then the client gets hit through an exploit you said you checked or should have checked for, you and your company are done.
Not me, just my company Try-N-Hack LLC.
Luckily I'll be back on my feet as ThisGuyHacks LLC in no time!
Just the same method I employ when people want refunds
At least do some auto scans with WebCheck, Shodan, nmap + vulnerability scans and some basic OSINT on their boss so you can report something and at least spook them a little bit.
I’ve always wanted to start a ghost busting business.
Just explain that after I’m done, all the strange sounds they hear have a perfectly logical explanation.
