Q&A Reverse Engineering Websites

This short Q&A segment from CactusCon opens with the host handing out several prizes, including hardware badges and signed books, before turning to the guest's background. The conversation centers on how the guest approached reverse engineering websites over the course of a long penetration testing career.

The guest recounts starting penetration testing around 2010, when a heavy workload of roughly fifty engagements a year pushed him to learn the common vulnerability classes well and then automate the repeatable parts of testing. He describes how the repetition eventually became tedious, which led him to spend more time on the parts automation could not reach, such as reasoning about how an application was built and what its developers were likely to have done. After moving to a firm with fewer, longer engagements, he had room to dig deeper and refined his process within about a year.

The segment closes with the guest noting that it has taken him a while to put this method into words and teach it, because his long experience makes it hard to judge what others already know. For a practitioner, the main takeaway is the progression from broad knowledge and automation toward manual, reasoning-driven analysis of how a web application behaves.