how to NOT be a hacking noob in 2022 // ft. John Hammond

Cybersecurity career advice boils down to a simple, repeatable path: build real hands-on skill through Linux and Python, grind through CTFs and war-game platforms, and document what you learn—certifications can help with hiring filters, but they’re rarely the real learning engine. John Hammond, a cyber security researcher and educator known for capture-the-flag (CTF) competitions, frames “not being a hacking noob” as less about collecting badges and more about developing the ability to break things safely, then using that knowledge to defend real organizations.

Hammond’s starting-point checklist is blunt: Linux is non-negotiable, and Python is the most practical programming foundation for scripting attacks, automating enumeration, and writing small tools (like brute-force loops or injection attempts). He pushes back on the idea that someone must become a full software engineer. Basic programming concepts—variables, functions, and conditionals—are enough to begin doing meaningful security work, especially when paired with practice. On the Linux side, he acknowledges the Kali Linux “ready-made hacking tools” appeal, but argues that learning how to install and troubleshoot tools on a mainstream distro like Ubuntu is valuable because it teaches how packages, repositories, and configurations actually work.

Prerequisites, he says, don’t require textbook mastery. Even if someone can barely distinguish networking fundamentals, the learning can start immediately through ethical hacking goals and guided labs. Networking knowledge helps—especially for understanding common attack mechanics like TCP man-in-the-middle—but the mindset shift matters as much as the technical background. Coming from IT or networking roles is a common on-ramp; the industry often rewards people who can connect how systems work to how they fail.

The most consistent theme is that CTFs and cyber ranges build the skills that certifications only partially measure. Hammond describes CTFs as competitive “proof-of-work” puzzles where teams earn tokens by exploiting vulnerabilities or solving challenges. He credits CTF grinding with getting him jobs and with preparing him for real-world security work, including passing OSCP after extensive practice. He also treats walkthroughs and solution hints as training wheels: they’re appropriate when a learner hits a wall, as long as the goal is to eventually internalize the reasoning and solve independently.

On certifications, Hammond’s stance is pragmatic rather than dogmatic. Certifications can be a resume checkbox that helps with entry-level hiring—especially in regulated environments—but they don’t replace hands-on merit. He recommends choosing credentials based on the job market and the role being targeted, and he notes that different certs emphasize different skill areas (for example, OSCP-style exploitation versus security-plus-style baseline compliance). For someone building a first serious path, he suggests starting with hands-on certs like eJPT and then moving toward OSCP, while continuing to accumulate proof through blogs, GitHub, portfolios, and write-ups.

Finally, Hammond connects the “red team” learning loop to “blue team” outcomes. His current work emphasizes threat detection and incident response for mid-market organizations—using the same exploitation knowledge to prevent breaches, respond to malware and remote access trojans, and reduce the odds of ransomware and other real-world attacks. The practical takeaway: keep learning by doing what’s fun, document progress, and apply widely while building a portfolio of evidence that hiring managers can evaluate.