Why I'm Learning Pentesting in Public
I’m Sebastian. For the last couple of months I’ve been spending my evenings working through INE’s eJPT material — port scans, Metasploit, privilege escalation, the whole on-ramp into offensive security. eJPT is most of the way done at this point; the only module I haven’t touched yet is web application testing. After that, the plan is HTB Academy’s CPTS, then OffSec’s OSCP. Once those are behind me, I want to freelance as a penetration tester.
That’s the roadmap. This blog is what happens on the way there.
Why write any of this down publicly
I already keep a private study journal — a running, daily, unfiltered log of what I did and what went wrong. Most of it isn’t fit for anyone else to read: half-finished thoughts, wrong guesses, the kind of shorthand that only makes sense to me an hour after I wrote it. A few weeks ago I spent an embarrassing amount of time on a pivoting exercise because I misread a subnet mask — did the math in my head instead of on paper, got it wrong, and only caught it after resetting the lab twice and blaming the network instead of myself. That story’s more useful to someone else once it’s been turned into an actual explanation of how to read a netmask without guessing, not left as three lines of frustrated journal shorthand. That’s the job of this blog: take what’s actually happening in the study process and turn it into something a stranger could learn from.
There’s a second reason, less noble but just as real. In a year or two I want people to hire me for security work, and nobody hires a stranger. Writing publicly now — while I’m still learning, still getting things wrong, still capable of being told I’m wrong — is a longer and more honest track record than a certifications page put up the week I start looking for clients.
What this blog will and won’t be
It won’t be walkthroughs of graded labs or exam content. INE’s skill checks, HTB’s active machines, and everything about the OSCP exam itself are all off the table — not as a style choice, but because publishing that kind of material is against the rules of the platforms that make it, and breaking that trust isn’t a great opening move for a security career. What I’ll write instead are the generalized versions: how a technique actually works, what the underlying concept is, what mistake I made and what I’d tell someone to check before they make the same one. If I ever do write about a specific box, it’ll be one that’s been officially retired, per HTB’s own policy.
Expect a mix: technique explainers (the kind of thing I wish existed when I was first trying to understand pivoting), methodology posts (the checklists I actually use, not the ones that look good in a course slide), and occasional posts written for a non-technical reader — because eventually some of the people reading this will be evaluating whether to hire me, not whether to copy my commands.
What’s next
Roughly in order: a post on reading netmasks without guessing (the CIDR story above, done properly this time), one on a habit that’s saved me from a specific kind of silent Metasploit failure more than once, and a methodology post on the recon checklist I actually reach for. After that, it depends on what eJPT’s web application module and CPTS turn up.
Nothing here gets published without me reading it first — this is a real name on a real career, and I’d rather post less often and be right.