Goal: Become a professional hacker. For money, this time.
I'd been hacking since before it had a career path. Reverse engineering software on the Amiga 500 and 2000 as a teenager. Writing 68k assembly in Seka assembler — which later became my DJ name, a joke that absolutely nobody ever got. Built entire AmiEx tools in assembly. Was interested in analyzing copy protection mechanisms in PC software. Direct memory access, compression algorithms, reverse engineering binaries — this was my playground before I ever touched a web framework.
That early assembly work is why the current FPGA project feels so natural. Low-level thinking. Registers. Timing. Bit manipulation. The brain never forgot.
The idea: take all that underground knowledge and make it legitimate. Get certified. Get hired. Wear the black hoodie professionally.
Three certifications, one conference, one year. The hacker speedrun.
SLAE — SecurityTube Linux Assembly Expert
Found it on Coursera (or similar). It resonated immediately because it involved writing custom shellcode and creating your own encryption routines to evade pattern-based antivirus detection. Not "run a tool and read the output" — actual low-level code that has to fool other code.
For someone who'd been writing 68k assembly since their early teens, x86 shellcode was a natural transition. Different instruction set, same mindset: you're writing code that operates at the boundary between software and hardware, where one wrong byte means a segfault and one right byte means you own the machine.
The certification required building custom encoders, polymorphic shellcode, and demonstrating that your payloads could bypass signature-based detection. The kind of work that makes antivirus vendors nervous and penetration testers employable.
OSCP — Offensive Security Certified Professional
The infamous one. Offensive Security's flagship certification. The exam: 24 hours. A set of target machines. Hack them or fail. No multiple choice. No partial credit. You either break in and prove it, or you don't.
The course (PWK — Penetration Testing with Kali Linux) covers everything: reconnaissance, exploitation, privilege escalation, pivoting, buffer overflows, web application attacks, post-exploitation. It's the most hands-on security certification that exists. Their motto: "Try Harder."
I passed. Of course I passed. But it was tough, and I loved the intellectual challenge. Every machine is a puzzle. Every privilege escalation is a chess move. The 24-hour time pressure turns it into a marathon of lateral thinking under stress.
Certified: 25th of March, 2017.
OSCE — Offensive Security Certified Expert
OSCP is for children. OSCE is the real deal.
Two months after OSCP, I signed up for CTP (Cracking the Perimeter) — the advanced course. Custom exploit development. Advanced web attacks. Network-level exploitation. Writing your own exploits from scratch against real software with real protections.
The exam: 48 hours. Not 24. Forty-eight.
I finished in 24.
And I'm still fairly sure I found a solution that was NOT the one they intended. Which, if you think about it, is the most hacker thing possible — solving the hacker exam in a way the exam designers didn't anticipate.
Certified: 26th of May, 2017.
OSCP to OSCE in two months. The speedrun was real.
DefCon 25 — Las Vegas, 2017
The pilgrimage. The biggest hacker conference on the planet. Caesar's Palace, Las Vegas. Flew there with my girlfriend and combined it with a California road trip.
The expectation: a gathering of the world's most brilliant hackers. The underground made visible. Black hoodies and zero-days.
The reality: a handful of truly skilled hackers surrounded by a million people marketing the shit out of "security." Corporate booths. Vendor swag. LinkedIn-grade networking. It felt like a trade show with better t-shirts.
And me? Couldn't connect. Even among the nerds. I'm just not a conference person. Too many people, too much noise, too little depth. The hallway conversations were surface-level. The talks were hit-or-miss. The village demos were cool but crowded.
Las Vegas itself was impressive. Caesar's Palace is an absurd complex. The desert heat. The casinos. The sheer excess of everything. Still wearing that DefCon 25 t-shirt. Right now, actually.
But the conference itself taught me something important about the security industry: the "true" hackers don't attend conferences. They reverse engineer Chinese firmware in WLAN routers. They fuzz Android kernels looking for buffer overflows. The best ones are invisible. And they don't have a booth at DefCon.
What happened:
I became a certified hacker. SLAE, OSCP, OSCE, DefCon. The full stack. Then I looked at the job market and discovered the gap between the fantasy and the reality.
The fantasy: wearing a black hoodie, finding zero-days, breaking into systems, living on the edge of legal and illegal.
The reality: penetration testers spend 80% of their time writing reports. Running automated tools. Filling out compliance checklists. The pay is mediocre for the skill level required. And the corporate security world is just as bureaucratic as every other corporate world.
The actual elite hackers — the ones finding zero-days in embedded systems, reverse engineering nation-state malware, building custom exploit chains — they don't work at consultancies. They work alone, or in small teams, and they sell their work to governments and exploit brokers. That's a different world entirely.
So I filed the certs, kept the knowledge, and moved on. The assembly skills came back 8 years later when I started writing Verilog for the FPGA DAC. The low-level thinking never leaves. The bit manipulation, the timing analysis, the register-level reasoning — it's all the same muscle. Different language, same brain.
The hacker era didn't become a career. It became a foundation.