Things I learned, being a highschool dropout, getting into vuln research and getting job at Microsoft:

1. Force yourself to watch/read (whatever works best) all the really technical stuff. Even if you understand only 1%, that's still progress, next time you will understand 2%.
2. There is no shame in messing with PoCs from other researchers. It's one of the best tool to really gain an understanding of how these bugs work, and you may find some variants or patch bypasses. We all build on the work of others, it's how this shit works.
3. If after a day of not getting results do the following: Try to think of some new approaches to break a target, write them on a paper and try them out next day. Keep repeating. It's not an easy thing, but if you keep going, day after day, week after week.. you will succeed.
4. There's lots of different bug classes and bug hunting techniques, but you should do whatever you enjoy most (for me that was logic bugs). That's the only way you will survive the grind and stay focused.
5. Fuck infosec twitter. Fuck this industry. Stay focused on doing what makes you happy and don't get distracted by all the other infosec bullshit or risk losing your sanity and turning into a polar bear.
You can follow @SandboxBear.
Tip: mention @twtextapp on a Twitter thread with the keyword “unroll” to get a link to it.

Latest Threads Unrolled: