10 Questions with Aditya Raj Singh: Pentester Spotlight

The Cobalt Pentester Spotlight highlights the fascinating journey of our Core members. Through an interview style, we share their experiences, background, and insights into the world of an accomplished ethical hacker.

Today, we feature Aditya’s journey.

1. Can you tell us a bit about yourself and how you got started in penetration testing?

I have always been fascinated by technology, and my journey into penetration testing started early on. I was introduced to programming during my school years and quickly developed a love for tinkering with computers. The ever-changing nature of this field kept me hooked, as there was always something new for me to learn, which motivated me to keep growing.

When I went to college, I knew I wanted to dive deeper into cybersecurity, so I chose a program that offered a specialization in cybersecurity, which deepened my interest even further. After graduating, I began participating in bug bounty programs on an occasional basis, which provided hands-on experience and ultimately led to my first full-time role as a pentester. That was the beginning of my professional journey, and now I am proud to be working as a Lead Pentester at Cobalt.

2. What educational background and certifications do you have that prepared you for a career in pentesting?

I hold a bachelor's degree in Computer Science and Engineering, with a specialization in computer networking and cybersecurity, which gave me a solid foundation for my career in pentesting. After completing my degree and stepping into the world of pentesting, I went on to complete certifications like OSCP, CREST CRT, CREST CPSA, eWPTXv2, eCPPTv2, eMAPT, and ISO/IEC 27001:2022 ISMS Lead Auditor. These certifications helped me build on my knowledge and develop the hands-on skills needed to tackle real-world security challenges effectively.

3. What are your go-to tools and techniques when conducting pentests, and why do you find them effective?

My go-to tools when conducting pentests include Metasploit, Netexec, Impacket scripts, custom PowerShell scripts, custom Bash scripts, custom Python scripts, and Burp Suite Professional (with several extensions). I find these tools effective because they offer a great balance between automation and manual control, allowing me to efficiently identify vulnerabilities while also digging deeper when needed. Each of these tools brings something unique to the table, helping me adapt to different scenarios and challenges.

4. For individuals aspiring to enter the field, what advice would you offer in terms of skills development, networking, and breaking into the industry?

For those aspiring to enter the field of penetration testing, my advice is to focus on four primary activities.

Firstly, start by building a strong foundation in cybersecurity fundamentals. From there, dive into specific penetration testing techniques. Also, keep in mind that hands-on experience is crucial in this field, so practice on platforms like TryHackMe, and HackTheBox, or set up your local lab environment.

Secondly, building connections is incredibly valuable in this field, so attend conferences, join online forums, and participate in local meetups or workshops. In addition, engaging with professionals on platforms like LinkedIn or Twitter as the community is generous with knowledge sharing. Networking can open doors to mentorship opportunities, job leads, and collaborations that will help you grow in this field.

Thirdly, breaking into penetration testing can be a little bit challenging at first, but persistence pays off. So, start with smaller security roles to gain relevant experience. Certifications like OSCP, eCPPT, and SANS (If you can afford them) can also help demonstrate your skills to potential employers.

Lastly, consider contributing to open-source projects and bug bounty programs to build your portfolio and showcase your abilities to potential employers.

5. How do you approach client interactions during penetration tests? Are there specific communication skills that you find crucial for success in this aspect of the job?

When it comes to client interactions during penetration tests, I prioritize transparent and timely communication. My approach is to keep the client informed at every stage of the pentest, ensuring they understand what is happening, why it is happening, and what the potential implications are. I believe in building trust through honesty and openness, so I make it a point to discuss both the successes and challenges we encounter during the test.

6. Can you share your experiences and preferences in terms of teamwork, communication, and coordination when engaging in pentests?

When working on a pentest, I place a strong emphasis on teamwork, communication, and coordination as these are essential for a successful pentest. By maintaining an interactive and friendly environment, I make sure that everyone feels comfortable sharing their thoughts and ideas openly. This helps the team to stay aligned and ensures that our communication is clear and consistent.

I aim to create a collaborative atmosphere where each team member can leverage their strengths, which not only enhances our work but also makes the process more enjoyable. While encouraging a positive and open environment, I always keep our focus on delivering high-quality results, ensuring that we meet our objectives as a team.

7. Looking ahead, how do you envision the future of penetration testing evolving in 2024, and what do you believe will be the key challenges and opportunities in the coming years?

Looking ahead, I see penetration testing in 2024 becoming more dynamic as AI and machine learning take on a bigger role in pentesting workflows. While automation will help us work faster, the human element will still be crucial for outsmarting complex vulnerabilities. As attacks become more sophisticated, we will need to continuously update our skills to stay ahead of the growing complexity of the IT environment.

8. Can you share your experience representing Cobalt at Black Hat 2024? How do Cobalt Core events inspire and impact your work?

Representing Cobalt at Black Hat 2024 was both an honor and a unique opportunity. Being there as a part of Cobalt gave me a sense of pride and responsibility, knowing that I was not only representing myself but also a community of talented and dedicated professionals. The interactions I had at our booth and during the sessions were invaluable as they allowed me to share my experiences and learn from the perspectives of others in the field. It was a moment to both give and receive knowledge.

Attending the Cobalt Core event was like a shot of adrenaline for my professional growth. It made me feel energized and full of new ideas. These gatherings are more than just educational as they are truly transformative. Each event leaves me inspired and equipped with fresh perspectives that I can immediately apply to my work. Cobalt Core events don’t just keep me informed, they keep me excited about what is next in our field.

9. Is it fishing to ask about the swag? 

Attending Cobalt Core events at Black Hat and Defcon has been a game-changer for me—and the swag is a nice perk too! It adds a fun touch and makes me feel even more connected to the Cobalt community. But honestly, what sticks with me is how these events remind me why I am so passionate about what I do.

10. What has your partnership with Cobalt been like?

My partnership with Cobalt has been an incredible journey. As a core pentester, I have had the opportunity to work with a talented and dedicated team of professionals. Cobalt has provided me with a supportive environment that encourages innovation and professional growth. I have been able to contribute to challenging and impactful projects, and I'm excited to continue making a positive impact with Cobalt.