Should I mention in my resume I have written exploit code thats incorporated into MetaSploit framework?

Question

I have worked in cybersecurity industry for close to a decade and gained proficiency in using the open source exploit framework of MetaSploit for automated pen testing of systems that I was authorized to run pen tests on. As a result of an exploited vulnerability I discovered, I wrote a exploit module in MetaSploit that if exploited , gains the attacker a reverse shell on the vulnerable system. A reverse shell allows the attacker to directly control the victim's computer and issue arbitrary commands.

By releasing this module on MetaSploit, I allow others to freely use, hopefully for good and not malicious purposes. I can't control how others will use this. I don't get any compensation for this exploit code.

I am also active on GitHub and have projects composed of the raw exploit code that I allow others to fork and also download for their own pen testing uses. I maintain a disclaimer that this code must not be used for malicious purposes and only with asset owner consent

Given insider risk and vulnerabilities exploitation is a big , legitimate risk to businesses nowdays, my worry is that my side hobby of contributing to the white hat security community via writing of exploit code for pen testing automation, can make new employers nervous.

1. What negative implications can I expect in terms of future job prospects if I add this work to my resume?

2. How can I safely reveal I have written exploits in Metasploit without scaring away potential employers?

Answer 1

So, you bountied this question to ask for more in-depth answer(s).

Let me start with a premise:

Information is only as good as it's framing

Especially in the day of Misinformation - but to highlight what I mean - there is a fantastically hilarious website that warns against the evils of the chemical DiHydrogen Monoxide - with such hilarious points as DHMO is a major contributor in drownings, DHMO is the main ingredient of Acid Rain, postmortems showed that all serial killers had high percentages of DHMO in their system and so on and so forth.

DHMO is, of course, WATER.

Your concern is that someone will see you as someone who actively writes exploits in order to gain malicious access.

Whilst a valid concern on it's own, I think in the realm of IT Security, it isn't the drawback you think it is.

Instead - you want to frame the information in a Positive light:

• You don't want to gain unauthorised access to other peoples systems.

• Instead, Security is a journey and we are only as secure as our most recently patched vulnerability, by continuing to seek new vulnerabilities - we can defend against them

• You aren't making hacking tools

• You are giving security professionals the means to demonstrate a weakness in their security posture, so as to convince non-IT management to invest in security

Think of every hypothetical argument that someone could make - then look to see how you can turn it into a positive.

For example:

"Why do you think it is appropriate to make this publicly available?" "Well, I believe that sunlight is the best disinfectant. It isn't the known exploits that keep me up at night, it's the ones I don't know about and so haven't put in place policies, rules and procedures to guard against. By making it public, I am empowering other professionals to protect themselves"

Now, I will grant there is an artform in this and some are better at this than others - Case in point - Politicians: "It's not that we have failed to reach our targets, it's that our work has shown us how deep the problem goes"

Hopefully this will give you some ideas and things to think on how you can turn this around and defend your side-hobby.

That all said... The recruiters who are hiring for the jobs you probably want to get? They will see this kind of thing and salivate so wildly that they will slide off their chair. So many people call themselves Security professionals because they once added an IP to a Blacklist - but actually the really good ones are the ones taking an idea to PoC to successful exploit and then fixing it.

So I don't think you'll have any trouble.

Answer 2

You need to reframe your work as a positive contribution.

"Written exploit code" doesn't look good.

"Direct technical contributor to a security-testing platform" looks a bit better.

I'm not familiar with exactly what people look for, but you do need to cater your wording so HR people can comprehend it and not toss it in the trash.

Answer 3

The word is narrative.

"I want a job as a code monkey and I hacked stuff" - Then no. You'd be seen as a very scary lone wolf rogue coder like out of a tv show.

"As part of my skillset as a White Hat cyber-securty professional, I developed pentests that are used professionally". Now you are a pro that contributes to the profession. A likely team member.

Who and what you present yourself to potential employers is key.

Not just what you did, but the specific reason you did it.

Think of it this way, a locksmith that experiments on different safes at home is OK. They are a professional.

Someone in another field that does it, is a best "a little odd" (arguably) and at worst a potential criminal.

This isn't that different than the other answers, but hopefully gives you more context in the how and why.

Answer 4

If I was recruiting for security people, I'd snap you up in a minute. This is obviously more than 'script-kiddie' work, and you've thought about the ethics involved. You've certainly put yourself above the candidates who only talk about wotking within the OWASP Top Ten.

Answer 5

I would word it as:

Successfully discovered a new attack vector on a system at the request of its owner, and I have been able to write a POC code that was incorporated in a respectable pentesting suit to aid in discovery and mitigation of that attack vector.

This shows the four key information you want to focus on:

1. You had Authorization (you're not malicious)
2. You discovered a new vulnerability (read: zero-day)
3. You wrote a POC and incorporated it into a larger pentesting framework (you're not a script-kiddie)
4. You ethically disclosed the vulnerability (did not sell it for money)

Answer 6

In my experience, it depends on who reads your resume. Some will understand what that entails, and you will have an extra point for your effort and participation in cybersecurity as a whole and not just at work.

Some will read it and assume you used to exploit systems for fun in your free time (which arguably is still a plus), and you will lose a point.

You can focus on the exploit itself, or in the fact that you're active in the community, while explaining what the application is used for. Hopefully the interviewer is skilled enough in the area to value it. There's no way to guarantee that contribution will be taken positively or negatively.

My opinion would be to simply state that you contributed to Open-source Repositories of popular apps used in the field, that will prompt them to ask for details letting you explain what that entails how you see fit.