Hackviser CAPT Review: A Developer's Perspective on Getting Certified

This article might be a little bit more personal than technical guides I’m usually writing. I would like to share that I finally took my first official steps into the cybersecurity space.

What does this mean for me? To be honest, not much has changed on my day-to-day side. I am still mainly a full-stack developer working on client's projects, which fulfills the majority of my working days. But I was always deeply attracted to the cybersecurity field. I can finally say I started my journey by earning an official certification from Hackviser: CAPT (Certified Associate Penetration Tester).

I have a few reasons for doing this. We are living in the age of AI, where AI-powered attacks against systems are starting to become a new phenomenon. Also, through my ongoing work with the Noiseamplifier agency, where we provide hosting services for our clients' projects, I realized it is a good time to study this part of the IT field. I want to learn how attackers think, understand the common ways systems get hacked, and, most importantly, learn how to protect the systems and code we deliver.

Where the Fascination Started

To be honest, this started many years ago when I was young, back in elementary school. I didn't have a strong desire to learn about computers in depth at first. Even though my father worked as a programmer my whole life, the passion somehow missed me. That was until a specific incident at the end of elementary school, which really scared me at the time.
You need to understand, this was the "dark age" of the internet. The security of most online services was quite naive: no rate limiting against brute-force attacks, terrible password policies, Two-Factor Authentication (2FA) was an unknown concept, and SSL encryption was very rare. It was incredibly common to see passwords like the name of a pet, partner, or child.

At that time, a friend asked me to visit him at home because he had something exciting to show me. When we met, what he showed me impacted my future life. He had downloaded the then notoriously known hacking software "Brutus" (at least, I hope I recall the name well, it's been almost 25 years, so it's hard to be accurate, yep I am old). The software was just a simple online password cracker, allowing users to try all possible combinations or run wordlist attacks against online services.
Using this, my friend managed to hack the entire school's email system and other services. It was crazy. He had everything: passwords, relationships between people at school, data about our teachers, just everything. It was a massive security breach. One guy who knew nothing about computers managed to broke into the lives of people we both knew.

As a teenager, I felt that wasn't right and advised him to scrap it all. I don't know what he actually did with the data, but something changed in me that day. I realized the internet wasn't just a magical place to talk with people, connect with friends, and find information, it could also be a genuinely dangerous. I felt an urgency to know more about computers and security. I guess just to get more control, or at least the illusion of control, over the beast the internet was starting to become.

So, when I got my first PC around 2005, I started learning about hacking. It was horrible at first because I didn't speak English very well, and there was no online resource available in my native language. My first obstacle was just reading the documentation and books. Over the years, this hobby led me to programming. I realized I didn't know anything about web apps, so I started learning web development simply because I wanted to understand them from a hacking perspective. By accident, this made me the developer I am today, working for clients on interesting projects.

The Hackviser Journey

Over the last few years, I was always so busy with projects that I never found the time to continue pursuing my passion for cybersecurity. Finally, I made a firm decision last year and started studying on a platform called Hackviser. For those who don't know, it's a platform similar to the more famous Hack The Box or TryHackMe.
Because of my ongoing client work, my journey there was quite slow. But this year, I was finally able to earn two certifications. First was the Core certification, which is more basic and doesn't require a final exam. Then, I got the more advanced one: CAPT (Certified Associate Penetration Tester).

The training consists of several modules that need to be completed before you can undertake the final exam. What is really lovely about Hackviser is that almost all the theory is tested hands-on. You don't just learn by reading, you always test your knowledge of the tools, theory, and problems on real-life example systems.

What You Learn During Exam Preparation

• Operating System Fundamentals: Covers Linux and Windows, focusing on using the command line on both systems.

• Cryptology Fundamentals: Teaches students about different encoding types, encrypting hashes, ASCII, Base64, Binary, SHA1, MD5, etc.

• Network Security and Penetration Testing: An interesting module covering OSI model, network scanning tools like Nmap, and an introduction to the notoriously known Metasploit framework. The labs feature real vulnerabilities, mostly patched on well-maintained systems, but still out there in the wild on poorly maintained ones. These CVEs represent real-life scenarios you can attack. You get to hack many machines with guided help, which is great for total newbies since these warmup machines provide tutorials and hints if you get stuck.

• Web Application Security: Another awesome module, and very important for me as a web developer. While I am mostly aware of many of these attacks, I was glad to be able to touch the actual tools used by hackers trying to break into web apps, rather than just building them. It provides a very interesting mental switch to the "other side." As developers, we tend to get the job done fast because deadlines are pressing and budgets are tight, which might force us to omit necessary security checks. Being on the attacker's side is a great experience. As a developer, you become much more aware of what steps might lead to Remote Code Execution, SQL Injection, service misconfigurations, and similar problems. This module is theory-heavy, but each topic ends with a hands-on test, so your knowledge is always verified before you can finish. You learn everything from Information Gathering, Directory Scanning, Fuzzing, Brute Forcing, Wordlist Attacks, Cross-Site Scripting (XSS), SQL Injections, and File Inclusions, to Insecure Direct Object Reference (IDOR).

• Privilege Escalation Techniques: A very interesting module about getting root or administrator access on Linux and Windows systems. As a Unix guy, I quite hated the Windows modules, but it was necessary to go through them - Windows is just awful to me! However, I was surprised by how innocent-looking misconfigurations on a Linux system can often lead to privilege escalation. One might expect clever exploits to be necessary, but attackers often just use our laziness. As a Linux administrator, I know how easy it is to help yourself by granting passwordless sudo privileges to a binary needed for an automated script - the path of least resistance. But this same laziness often leads to successful privilege escalation. Again, it is amazing to go through this as an attacker because you learn about all the blind spots you might have on your own Linux machines, just waiting to be used against you.

• Open Source Intelligence (OSINT): This module is amazing as well. It teaches that reconnaissance might begin just by gathering publicly known information about targets. Even before an attacker touches your systems, they can get a surprising amount of information about the company, website, employees, and running services, purely through research on the public internet.

• Social Engineering: The famous weakest point in every security defense is always the human element. This will probably never change, and I think this is why even people outside the tech world should educate themselves about these techniques, mainly do not trust everything you see on the internet or receive via email.

• Real-World Scenarios: This is the final module before the exam. You have no hints, no guidance, and you need to finish tasks that often involve hacking into unknown systems using the knowledge you gained from all the previous modules. It is a really challenging and fun way to learn. I often had to step back into the theory to learn more about a possible attack vector. Hackviser designed these scenarios amazingly.

The Final Exam

Hackviser forbids sharing any specific information about the final exam on the public internet, which makes sense, so I will not comment on it in depth. I can only say it was quite a surprise. I felt like I was still missing some theory during the exam, but fortunately, search engines and AI tools are good sources for extensive research, so use them if you feel lost!
The exam is time-limited, you have only 24 hours. What was a bit of a surprise is that you are also obligated to fulfill an industry-standard security report detailing your vulnerability findings. I was caught off guard because none of the modules taught the theory of how this should be done. External resources are handy here, though Hackviser does have its own built-in reporting tool, which is especially helpful if you lack experience and need guidance. I still think my report was full of non-standard elements since it was my first time doing it, so I definitely need to educate myself more on that front.

Conclusion

In the end, I am glad I began this journey. Now, I am aiming for my next certificate to deepen my knowledge, and I hope to have more time between projects to study.
Hackviser is an awesome platform, and I think I will spend much more time there. They are not as widely known as Hack The Box or TryHackMe, but I really like their tests and the UI, which is very clean and understandable. When you compare the price of education here with other, more well-known platforms, it is positioned very well. Vouchers for certificates are often discounted, and the subscription isn't crazily expensive either. For beginners in cybersecurity, I can highly recommend them.