Short answer: bug bounty pays per valid finding and most participants earn nothing, because the easy issues in mature programs are already reported. Penetration testing pays a salary regardless of what you find. Bounties are a superb portfolio and a poor first income — do them alongside a job, not instead of one.

Short answer: AWS permits customer security testing of eight service categories — including EC2, RDS, Lambda, API Gateway and CloudFront — without prior approval, on resources you own. Denial of service, and anything touching another tenant or AWS's own infrastructure, remains forbidden and requires a separate process. Your customer's permission is still mandatory: AWS's policy is not authorisation to test somebody else's account.

Le test d'intrusion attire beaucoup, en partie pour de bonnes raisons — un métier utile, technique, bien payé — en partie pour de mauvaises, entretenues par les vidéos où quelqu'un « hacke le Pentagone » en trois minutes. Cet article donne un chemin réaliste pour devenir pentester junior en 2026, sans mythes ni raccourcis.

Le OWASP Top 10 est utile parce qu'il classe les erreurs, pas parce qu'il les invente. Voici les cinq erreurs qui reviennent dans presque toutes les missions de pentest web que nous menons — avec des requêtes réelles et le code qui les corrige. Aucune n'est neuve. Toutes sont encore là.

Un pentest sans document écrit encadrant la mission n'est pas un pentest, c'est une intrusion. Cet article détaille ce qu'un document de Rules of Engagement (RoE) doit contenir, propose un modèle prêt à adapter, et pointe les erreurs qui reviennent le plus.

Short answer: Kerberoasting abuses a normal Kerberos feature — any authenticated domain user can request a service ticket for any service account, and part of that ticket is encrypted with the account's password hash. The attacker requests tickets, takes them offline, and cracks the weak ones. No exploit, no privilege required, and it still works in most domains.

Short answer: start with nmap -sn to find live hosts, then nmap -sS -p- --min-rate 1000 to find open ports, then nmap -sV -sC -p <open ports> to identify what is running. Everything else is refinement. Only scan systems you own or have written permission to test.

Short answer: the red team emulates a real attacker to test whether the organisation detects and responds; the blue team defends, detects and responds; the purple team is the two working in the same room so that every attack produces a detection rule. Red teams are glamorous and rare. Blue teams are where most jobs and most learning are.

Short answer: practise on systems you own, on deliberately vulnerable machines in your own lab, on platforms built for it, or inside a bug bounty program's stated scope. Everything else — including a single scan of a company you do not have written permission to test — is a criminal offence in most countries, regardless of intent or damage.

Short answer: Kali Linux is a Debian-based distribution that ships around 600 preinstalled security tools. It is legal to download and use, it is excellent as a disposable testing machine, and it is a poor choice as your everyday operating system. Learn Linux on Ubuntu or Debian; run Kali in a virtual machine for the work.