EvilZone

Well everything you've talked about so far implies that someone with a job title of a security tester shouldn't be using these tools... Your thread focuses on a corporate environment since you are talking about these positions

I definitely agree that there should be a little overlap when it comes to the skills and responsibilities of QA and Sec, but I think youre making an oversimplification of what we do.

Im not very fond of using automated scanners myself but something you program in 20 minutes is not going to have the same breadth or depth of the test cases it performs. There are thousands of ways to avoid certain defensive methods and plently of special case scenarios that require this bulk testing. I agree creating tools or test cases should be within the skillset of a security professional, but I think youre making it sound like if something is vulnerable to sqli or xss itll pop after 5 attempts...

In my experience automated testing does a lot to give you good places to look or identify patterns about the application, but nothing beats good ol manual analysis

I'm not sure of your current knowledge but If you want to avoid looking like a skid I would get a firm understanding of the fundamentals of things like networking (OSI stack, common protocols like FTP/SSH/HTTP), programming (Get comfy with one language), run a Operating Systems( try running linux as your main distro for a while and youll get comfy with the command line), etc. In my experience when I tried to rush into doing more "hacking" focused stuff I was moreso memorizing a process of running nmap and opening up metasploit against vulnerable VM's and thought that I was learning; but I was missing out.

I think this research with help when you try out attacks like shellshock, heartbleed, etc. you have the prior knowledge to actually investigate, dissect and understand the attack instead of just memorizing how to do it. Go ahead and get your feet wet with whatever tools or attack vectors tickle your fancy but unless you take the time to do your homework about how and why something works youll be missing out on the most enjoyable part of hacking.

Not sure what the focus of the class is but python has an awesome packet manipulation library called scapy that I used to throw together an ARP DoS tool. Its really powerful and intuitive once you get the hang of it and can be used for a bunch of projects, just limited by creativity .

http://www.secdev.org/projects/scapy/

Girl with chest hair or guy with tits o.o

Pretty sure server side needs have the openvpn default port of 1194 UDP open.

Do a port scan on your remote server to see what ports are open. You used putty so we know 22 is probably open.

This might sound silly, but I remember using an ssh tunnel to pivot a remote desktop connection through another machine. Could he tunnel his openvpn connection through port 22 if its not getting blocked, and the firewall on the remote server can redirect traffic from 22 to whatever port openvpn intended to use?

Have you tried running wireshark to see if thatll shed some light in how the conversation goes specifically? Also when you connect with putty what port are you using (assuming 22)?

I'm not sure how in-depth the application wanted you to appear as a browser  (running a java applet for example), and you have an interesting take on automation come out of it. But as a fun fact my first thought for a solution to your root issue was to alter the User-Agent header of the POST request.

I've never done it from python but it seems simple enough:

http://stackoverflow.com/questions/802134/changing-user-agent-on-urllib2-urlopen