You're Learning The Wrong Way

Main ideas / lessons

• “Advanced” comes from fewer things learned, but deeper understanding of fundamentals, not from collecting more tools or more attack techniques.
• Many people mistake tool operation or surface-level “basics” for real competency—but true advancement requires reasoning about why vulnerabilities and exploits work in different environments.
• Professionals focus more time on fundamentals (how systems work: networking, OS behavior, authentication, data flow, web internals, AD concepts, etc.) rather than rushing into flashy exploitation.
• Interview reality: employers often expect architecture, logic, and system understanding, not only exploitation steps or payload recall.
• In real engagements, you must operate with uncertainty:
  • you won’t know everything,
  • targets vary widely,
  • there are multiple attack surfaces,
  • and you must decide what to do with limited time.

---

Core methodology / approach (detailed)

1) Learn fewer things, but go deeper into fundamentals

• Prioritize understanding over memorization:
  • why a vulnerability exists,
  • how functions/modules behave,
  • how payloads are composed,
  • and how data flows through the system.
• Treat “running an exploit” as not sufficient:
  • public exploits often fail across environments due to differences in patches/builds/config/ports.
  • therefore, you must be able to troubleshoot and reason about those differences.

2) Build real understanding from basics (common misconception check)

• “Beginner content” can still be correct and necessary:
  • networking basics,
  • HTTP and authentication concepts,
  • Linux and programming basics,
  • web suite basics,
  • CTF-style practical foundations.
• True advanced skill requires these fundamentals, even if they look “simple.”

3) Fundamentals to strengthen (examples mentioned)

• Web/networking:
  • HTTP concepts (including HTTP/2 and HTTP/3)
  • authentication, web requests/responses
• System and security fundamentals:
  • same-origin policy
  • DNS / authoritative name server concepts
  • cookie types/variants (mentioned: “JWD cookies”)
  • JSON vs multipart content types
• AD/system relationships and concepts (mentioned broadly):
  • trust relationships,
  • Windows/AD interaction reasoning,
  • Kerberos is taught, but domain-level reasoning may not be.

4) Use a “professional engagement mindset” (the six habits)

1. Attention to detail

   • Don’t assume; verify what services are actually exposed.
   • Example: discover a “web-looking” scenario but later realize another port exposes a debug service on the web target.

2. Depth over breadth

   • When you find features like file upload, ask deeper operational questions:
     • where files are stored,
     • naming conventions,
     • whether content type is enforced,
     • whether execution is possible,
     • visibility/public access to uploaded files,
     • extension validation behavior,
     • which middleware/service is involved.
   • Goal: understand the system workflow so vulnerabilities can be inferred.

3. “What if” thinking

   • After a low-privilege foothold, don’t stop at the login.
   • Ask:
     • how else can credentials be used?
     • possible lateral movement methods (e.g., password spraying)
     • what other hosts exist / who trusts whom
     • whether internal services can be accessed
     • trust relationships and escalation paths.

4. Comfort with not knowing

   • Modern environments combine many domains (web, cloud, containers, AD, AI/LLMs, etc.).
   • Even pros can’t know everything—so you must keep learning and investigating.

5. Time management and decision-making

   • In CTFs, time is self-paced; in real engagements, time is constrained.
   • If an exploit fails after a reasonable investment, move on.
   • Decide:
     • what gets time,
     • which targets are strategically valuable,
     • how to convert limited time into value.

6. Communication

   • Technical skill alone isn’t enough:
     • managers/clients won’t understand attack jargon.
     • you must clearly explain what you found, how it worked, impact, and remediation.
   • Pen testing is both technical and communication-driven.

5) View pentesting vs hacking differently (as stated)

• CTFs often give certainty (you know what’s vulnerable; you look for the flag).
• Real engagements give scope and deadlines, not answers.
• Success depends on judgment: what to focus on, what to ignore, and what matters.

---

How the video’s “advanced” level is measured (certification example)

PT2 certification (presented as aligning with the speaker’s definition of advanced)

• Not a magic test, and not a substitute for real engagements.
• 72-hour exam with:
  • 10 machines
  • two live attack surfaces for the duration: 1) Modern infrastructure attacks (Web, AI/LLMs, cloud, containers, “Provc” mentioned) 2) Active Directory (five Windows machines and two domains)
  • domains connected by a trust relationship forming an attack chain.
• You are not given a fixed path; you must:
  • decide what machine to start with,
  • understand the environment structure,
  • and extract maximum value in the time limit.
• Emphasis: knowing what to ignore can be more important than focusing on one technique.
• Reporting is heavily weighted:
  • 30% scoring is for the report
  • each finding must include:
    • description,
    • attack path,
    • payloads / POCs,
    • remediation.
  • Even with correct flags, a poor report can fail you.
• The speaker frames this as testing:
  • judgment,
  • fundamentals across modern tech,
  • reasoning under uncertainty,
  • and communication through reporting.

Experience/entry guidance given

• Not for complete beginners:
  • if you only know web and a little about a couple attacks, you likely lack AD/Linux fundamentals.
  • recommends completing PT1 first and guided CTF practice.
• For those with 1–3 years of experience but limited real engagements:
  • PT2 is framed as a way to test beyond training-lab comfort zones.
• Certification is treated as useful practice, but:
  • real client work is messy/unpredictable,
  • technologies change,
  • and only real engagements build the full nuance.

---

Practical “takeaway” conclusions

• To become truly advanced/professional:
  • stop chasing tool variety
  • strengthen fundamentals and reasoning
  • develop judgment, time control, and communication
  • get comfortable learning with no walkthroughs
  • use structured assessment (like PT2) to measure progress—but don’t treat it as the end goal.

---

Speakers / sources featured

• Speaker / source: The video narrator/speaker (no name explicitly provided in the subtitles).
• Mentioned references (not separate featured speakers):
  • “Track” platform (mentioned as part of PT2 subscription/promo)
  • “PT1” and “PT2” (Track certification levels/exams)
  • “Track Me” (the same brand referenced in the subtitles)
  • Interview process at “my company” (no company name given)
• No other distinct speakers are identified by name in the subtitles.