Some training days are about ticking boxes, and others are about feeling something click into place in your head. This one belonged to the second category. On the agenda: pentesting, exploitation, and — the cherry on top — writing my own tool. I won't go into any technical detail here (this isn't the place for it, nor the point), but I wanted to put into words what this day left me with.

The pleasure of method

What struck me first is how much the approach matters more than the tool. Pentesting is often pictured as a matter of magic commands typed at lightning speed. The reality is slower, more patient: you observe, you understand, you form a hypothesis, you verify it, and only then do you act. At fifty-five, after a lifetime spent tinkering with things until they worked, I find a familiar reflex here — never attacking a problem without first looking at it from every angle.

I worked step by step, one stage at a time, validating each result before moving to the next. It's less flashy than a movie montage, but infinitely more solid. And when something finally gives way, the satisfaction is all the greater because you know exactly why it gave way.

Metasploit — initial exploration phase, reading results step by step

The real challenge isn't always where you expect it

The most striking lesson of the day comes down to one idea: getting a door to give way is often the easy part. The real headache is what comes after. You can perfectly well get a machine to execute an instruction and still find yourself unable to retrieve the result, simply because the environment has been stripped of any tool to exfiltrate the information.

I spent a good while stuck on exactly that wall. Several logical attempts, several silent failures — the frustrating kind where nothing happens, with no error message to guide you.

Metasploit — successive attempts to retrieve a result in a constrained environment

I had to change angle, accept that my first idea wasn't the right one, and find a roundabout path. That ability to pivot when the obvious route is blocked is probably the most valuable thing I take away from this. It's not something you learn in a course: you live it, by banging your head against it enough times.

Metasploit — workaround found, extracting data through an alternative method

Two weaknesses, two worlds

The day also brought two very different families of problems into focus. On one side, flaws rooted in a technical defect buried in software. On the other, doors left wide open by simple configuration neglect — a default setting nobody ever bothered to change.

Metasploit — identifying a flaw on a Tomcat server Metasploit — exploiting the Tomcat vulnerability Metasploit — result of the exploitation, access obtained

The second category got me thinking well beyond the exercise itself. How many systems, in real life, are still running on factory settings nobody has ever touched? Security, we too often forget, isn't just about sophisticated code: it's first and foremost a matter of hygiene, rigor, and small habits. The most mundane flaw is sometimes the most devastating, precisely because it's mundane.

Metasploit — session established, illustrating the danger of default configurations

Stepping through the looking glass

The high point of the day, for me, was the moment I went from being a mere tool user to... a tool maker. Starting from a skeleton, I wrote my own module — a small program that reproduces, by my own hand, what a professional tool does automatically.

Building a custom Metasploit module — code structure

That step has something genuinely thrilling about it. As long as you're content pressing buttons, you stay on the surface: it works, great, but you don't really know why. The day you pop the hood and write the gears yourself, understanding changes in nature. You stop suffering the tool and start understanding it from the inside. And the first time my module spat out the expected result — exactly the same as the official tool's — I had that little dumb smile you only ever share with yourself.

Homemade Metasploit module — result identical to the official tool

What I'm packing away

This demanding learning path is not a smooth ride, and I wouldn't want it any other way. What I love is precisely these days when you walk out a bit drained but with the feeling of having understood something new — not memorized, understood.

Cybersecurity, seen from the inside, looks less and less like a field reserved for an elite and more and more like a craft: observation, patience, curiosity, and a taste for understanding how things are built in order to better take them apart — or protect them. At this stage, I think that's mainly what I came looking for.

See you out in the field.

*NoteBookLM summary