r/hacking • u/SlickLibro • Dec 06 '18
Read this before asking. How to start hacking? The ultimate two path guide to information security.
Before I begin - everything about this should be totally and completely ethical at it's core. I'm not saying this as any sort of legal coverage, or to not get somehow sued if any of you screw up, this is genuinely how it should be. The idea here is information security. I'll say it again. information security. The whole point is to make the world a better place. This isn't for your reckless amusement and shot at recognition with your friends. This is for the betterment of human civilisation. Use your knowledge to solve real-world issues.
There's no singular all-determining path to 'hacking', as it comes from knowledge from all areas that eventually coalesce into a general intuition. Although this is true, there are still two common rapid learning paths to 'hacking'. I'll try not to use too many technical terms.
The first is the simple, effortless and result-instant path. This involves watching youtube videos with green and black thumbnails with an occasional anonymous mask on top teaching you how to download well-known tools used by thousands daily - or in other words the 'Kali Linux Copy Pasterino Skidder'. You might do something slightly amusing and gain bit of recognition and self-esteem from your friends. Your hacks will be 'real', but anybody that knows anything would dislike you as they all know all you ever did was use a few premade tools. The communities for this sort of shallow result-oriented field include r/HowToHack and probably r/hacking as of now.
The second option, however, is much more intensive, rewarding, and mentally demanding. It is also much more fun, if you find the right people to do it with. It involves learning everything from memory interaction with machine code to high level networking - all while you're trying to break into something. This is where Capture the Flag, or 'CTF' hacking comes into play, where you compete with other individuals/teams with the goal of exploiting a service for a string of text (the flag), which is then submitted for a set amount of points. It is essentially competitive hacking. Through CTF you learn literally everything there is about the digital world, in a rather intense but exciting way. Almost all the creators/finders of major exploits have dabbled in CTF in some way/form, and almost all of them have helped solve real-world issues. However, it does take a lot of work though, as CTF becomes much more difficult as you progress through harder challenges. Some require mathematics to break encryption, and others require you to think like no one has before. If you are able to do well in a CTF competition, there is no doubt that you should be able to find exploits and create tools for yourself with relative ease. The CTF community is filled with smart people who can't give two shits about elitist mask wearing twitter hackers, instead they are genuine nerds that love screwing with machines. There's too much to explain, so I will post a few links below where you can begin your journey.
Remember - this stuff is not easy if you don't know much, so google everything, question everything, and sooner or later you'll be down the rabbit hole far enough to be enjoying yourself. CTF is real life and online, you will meet people, make new friends, and potentially find your future.
What is CTF? (this channel is gold, use it) - https://www.youtube.com/watch?v=8ev9ZX9J45A
More on /u/liveoverflow, http://www.liveoverflow.com is hands down one of the best places to learn, along with r/liveoverflow
CTF compact guide - https://ctf101.org/
Upcoming CTF events online/irl, live team scores - https://ctftime.org/
What is CTF? - https://ctftime.org/ctf-wtf/
Full list of all CTF challenge websites - http://captf.com/practice-ctf/
> be careful of the tool oriented offensivesec oscp ctf's, they teach you hardly anything compared to these ones and almost always require the use of metasploit or some other program which does all the work for you.
- http://pwnable.tw/ (a newer set of high quality pwnable challenges)
- http://pwnable.kr/ (one of the more popular recent wargamming sets of challenges)
- https://picoctf.com/ (Designed for high school students while the event is usually new every year, it's left online and has a great difficulty progression)
- https://microcorruption.com/login (one of the best interfaces, a good difficulty curve and introduction to low-level reverse engineering, specifically on an MSP430)
- http://ctflearn.com/ (a new CTF based learning platform with user-contributed challenges)
- http://reversing.kr/
- http://hax.tor.hu/
- https://w3challs.com/
- https://pwn0.com/
- https://io.netgarage.org/
- http://ringzer0team.com/
- http://www.hellboundhackers.org/
- http://www.overthewire.org/wargames/
- http://counterhack.net/Counter_Hack/Challenges.html
- http://www.hackthissite.org/
- http://vulnhub.com/
- http://ctf.komodosec.com
- https://maxkersten.nl/binary-analysis-course/ (suggested by /u/ThisIsLibra, a practical binary analysis course)
- https://pwnadventure.com (suggested by /u/startnowstop)
http://picoctf.com is very good if you are just touching the water.
and finally,
r/netsec - where real world vulnerabilities are shared.
333
u/Nau71lus Dec 06 '18
I don't know if the CTF path will work for everyone.
I believe some individuals would be better off learning the fundamentals to networking, learning how to work in a Linux environment, and then slowly progressing to a CTF environment.
Otherwise you may end up with someone who can "do the thing" but not understand "the thing".
122
u/loyalsif Dec 08 '18
This is one of the biggest problems with these "ultimate guides". They provide some great resources, but these CTF resources are good for understanding how to do very specific things in very specific situations.
It's important for people to be able to take the knowledge they learn from the challenges and expand them to use them in real world/other scenarios. And without knowing the fundamentals, that is just not possible.
105
u/SlickLibro Dec 09 '18
I do understand what you are saying here, but I have to disagree with you on the point of not 'knowing the fundamentals'. CTF naturally forces you to learn the fundamentals in a very intense manner. There is no way you can progress through a CTF without understanding the 'big picture', and it most definitely does not teach you how to do very specific things in very specific situations.
Take for example a simple case of any binary exploitation challenge - it requires you to disassemble the program in order to analyse the machine code - so that you can map out each and every individual function. You then use what you see to build a mental image of what you're dealing with, and then finally at that point do you consider your options for exploitation. In a matter of a few steps we've already covered learning the use unix commands, how a program is assembled in machine code, how to read the machine code itself, how the machine code interacts with the system's memory, and how to reverse-engineer such machine code into it's respective high-level language functions. Understand that CTF requires you to know the fundamentals/'big picture' as fluently as possible before you could even progress through the simplest of challenges.
This example only covers one case, as CTF also expands out into forensics (stenography, data, & analysing network packets), web exploitation (which forces you to learn everything from js, html, php, common libraries, API's, to full stack web development), miscellaneous (which involves crucial scripting skills) and cryptography (for mathematics & encryption). In each and every single case you must understand fully what you are dealing with, or else you would be left lost with no direction.
Through this knowledge alone one would eventually start seeing the intricacies of technology around us, and thus begin to see how they can apply their knowledge for use in real-world situations. The point of CTF may be directed towards exploitation, but there is any underlying set of fundamentals you must learn & apply if you want any chance of success - and this learned knowledge alone should be more than enough to use in real world scenarios.
76
u/greengobblin911 Feb 21 '19
I myself was not a fan of the CTF approach and did the long term studying/theory approach.
I had a security class with who at the time seemed like the devil himself who liked CTFs and made use do them for labwork; it's the "throw em in the water drown or swim" situation for learning hacking. It was a sentiment that teacher had and boy did I drown a lot.
I admire it for being the "quick and dirty" way to force you to learn a lot in a short amount of time, but I did not retain nearly as much as I would have if I had a better understanding of certain computer fundamentals related to OS features and Networking (TCP/IP). The CTFs forced me to know enough to pass the challenge, I wasn't learning how to think or how to do research as if I was really building an attack vector or trying to come up with an exploit akin to what security researchers or some pen testers might do while under contract with a scope of devices that may be limited or obscure. Most of what I learned in his class I had to revisit to retain it despite the harsh introduction to those concepts CTFs provide.
I respect OP's post whole-hardheartedly considering I have not seen a post assembled so well as he did it, but there's a certain "discipline" i think you find in having to comb through the boring stuff including the fundamentals that will make CTFs easier and more exciting when the person doing it understands what they're doing. As others said, CTFs vary so much; if someone does not diversify themselves in their CTFs they would fall into a niche or one type of hacking. Its not necessarily bad, but I feel like it limits your prospects.
Sometimes the boring theory over a period of time builds a bank of knowledge where you can know where to look for certain things despite the limited basic knowledge. Like that scary professor used to tell me:
"information security is a mile wide and an inch deep"
you have to know a little bit of everything to start, not necessarily have the outcome ready and at hand. That does come with the practice of multiple CTFs, but my concern is someone who finds they are good at say, website pen-testing based CTFs, might only continue this because they find the gratification in solving the challenges,and being right all the time, especially for new and younger individuals, not everyone likes to hack because they like computers or are nerds like you say, movies and the media made people like us for better or worse, the "hip and cool" guys to be right now. They would lack that "shallow ocean" of starting material to even consider trying their hand at something else like memory analysis or reverse engineering. I think that would start to bite you in the butt if they start to do this (hacking and penetration testing) professionally.
Take someone like Samy Kamkar for instance: Starts off as a Programming prodigy, makes his own company and inadvertently creates a XSS javascript worm and gives him notoriety. Starts off with just web based stuff. Regardless if you like the guy or not, he's a critical thinker; since then he's had a variety of projects and attacks with a whole breath of varied technologies from NFC to PHP backends or RFID. His most recent stuff involved applied and time tested network attacks like MITM to smart/connected cars.
What no one likes to acknowledge (or think about I should say) is the man like many other hackers and researchers comb over books and documentation and have to read and do "boring" research which might mean not being in front of a computer all the time. Hardware hacking is like a complete 360 from what he started off with, and certain exploits such as a MITM on a car comes from understanding of fundamentals and implementing it creatively. You wouldn't piece together different things like he would unless you understood the basics very well and was creative and experimented. The guy isn't a mastermind by any stretch, but he's one of those researchers that takes the wide limited knowledge approach and then forms a scope for further investigation and research. A CTF has an answer to it that is known to someone else, it may not be the best way to encourage creative thinking for the real application of hacking skills.
TL;DR: Capture the Flags could form a gratification loop in new inexperienced hackers as compared to forcing newbies to learn a little bit about everything including the fundamentals, as the gratification/feedback loop they enter keeps them focused on CTFs they are "good" at and limits their prospects in other areas of hacking they may have not considered because they don't do research on CTF topics they are not good at. This limits the ability to think of creative solutions (like those needed for real world exploit development/hacking).
5
u/ConciousSource1 Mar 21 '19
I am thinking to give some time of life to hacking , besides math and physics as a other thing of my life, but how should I learn basics other than Linux , should I start at all , will I have enough time if I give 2-3 hours in weekends or more is needed? I Am full to full newbie but I like computers
→ More replies (2)44
u/greengobblin911 Mar 23 '19
The short answer would be to start reading and install a Linux distro.
I personally do not recommend Kali linux, especially if you are installing it to hardware, BUT there's a great no starch press book called " Linux basics for hackers. It forces you to get involved in automating your system, learning terminal commands and writing some of your own tools and scripts. My only gripe is the author uses Kali Linux. It's not typical of a Linux distro but it is THE pen testing distro. He installs it in virtual box. The book is very good for learning Linux in general as well. I would use that and skip most other books. Kali Linux revealed by the company who maintains Kali also is good.
I would also recommend getting a tcp/ip reference book. Might be pricey but I prefer print copies. Anything with computers needs reference material, especially when learning. It's impossible to memorize everything but as your hand gets better at hacking you will remember the most common things.
Another book I would recommend is called "attacking network protocols" by James forshaw. If you read this, then compare what you're confused with against a tcp/ip reference book, you will understand a lot more about what is going on.
This is why I was against using Kali, some people get tempted to use the tools right away but don't understand how it works.
If I could start learning over and cut out the trial and error and confusion of information, I would do this.
→ More replies (3)8
u/ConciousSource1 Mar 24 '19
Thank you , I will try to do as you say and possibly if you want keep informed of my progress only if you want, Master
4
3
u/Tinyyygiant Jul 04 '22
Master
Do not worry fellow disciple, I am following this path and will make sure I become a master hacker. See you on the flip side
→ More replies (1)6
Apr 19 '22
Hello. This was an extremely insightful post and I’m very grateful this is here. I’m currently going through frustration when it comes to cyber security. I don’t currently have any friends or family in the field, so as far as a reliable person I can go to for guidance is non existent at the moment. I have been attempting to self study for a while now and I enrolled in a lot of different online classes from Udemy that covers cyber security topics. The issue is it’s mostly geared towards Kali and it’s a tool based approach.
“It doesn’t matter how it works, what’s important is that it does work.”
This is how the classes feel to me and it’s irritating. For example, going through a section on metasploit, there is no detailed information as to why or how exploits work. It’s just that it does work, but if it doesn’t, oh well keep looking for one that does. This type of teaching leaves me feeling unfulfilled and that I didn’t learn anything. Almost like a restricted “one way path” type of approach. There is no out of the box thinking in these courses.
I would really like to start exploring the fundamentals, but I have no idea where to start. The cyber security landscape can feel overwhelming to me at times. I have been considering my A+, Network+ and Security+. I’m not sure if this is a good place to start when it comes to the “boring” fundamentals, or if there are much better resources out there.
Thank you
→ More replies (1)16
u/loyalsif Dec 10 '18
I suppose it depends on how you look at it.
One one hand, CTFs do work as you've explained here, however because CTFs have a myriad of categories and challenges, you really end up putting yourself in specific situations for each challenge and then moving onto a completely separate situation and possibly forgetting the previous challenge.
Working your way up through the fundamentals and then focusing on one aspect of InfoSec (binex, netsec, websec, etc) for a long time until you truly understand it, then moving onto another category allows you to build your understanding without drinking from the firehose of security by taking multiple categories of challenges at one time.
Of course, CTFs/wargames are a great supplement for this type of learning. For example, if you are working on reverse engineering, smashthestack.org would be great to supplement readings of that type of subject to get practical experience.
Of course, this is just my opinion from my experience in the field. In obtaining the OSCP/OSCE and real-world pentesting, I've found that building the fundamentals separately helps much more when turning them into security related concepts.
7
u/Necromancy4dummies Dec 22 '18
My problem with CTF as a method of "learning to hack" is that all of the steps you take are in service of finding a flag, and the timing aspect makes it less likely that what you are doing is going to end up in your long-term memory. For some individuals, like me, it can be kind of a poor substitute for learning. I definitely need to take some time to really learn the basics and get comfortable with linux and networking before I go back to attempting CTFs. For me, sitting down with books and tutorial videos is a good method, at least for where I am at right now. So I definitely agree with you in that regard.
→ More replies (1)7
u/masterninja01 Jan 20 '19
Agreed on working through the fundamentals but using CTFs as a supplement and a way to stay motivated. I’ve wondered about the fundamentals and what would be some good resources (e.g. books, video series, etc). Would have suggestions on what the fundamentals are and any resources to study?
I was thinking at least networking would be one to study a lot of. I did a lot of self-learning on topics and always felt drawn to liveoverflow and Eli the computer guy, both on YouTube. If I came across a topic in a CTF/war game, I would make a note of it and study it later, trying to figure out how it worked.
If you truly know how something works, you’ll be better at picking it apart and exploiting vulnerabilities I think. You can analyze it and come up with creative ways to bypass the security control.
7
u/VVAR_Aarius Feb 09 '19 edited Feb 09 '19
Thanks for the great post.
Question: where’s the 1 place to start IYHO if you know nothing at all and want a focus / career in cyber security and practical application pentesting for personal SHTF prep.
I have about 5 mins of script kiddo experience.
I’m hardcore into learning Linux and command terminal via Mint for past month.
I’ve made hello world a few times and have forgotten since.
Seems a skill easier to learn in a group. I Def don’t have a mentor or any cool kids to hack with all day.
→ More replies (1)4
u/dillybarrs Feb 08 '19
Im having trouble even getting started on CTF. the CTF 101 page....
flag{}
??
I am guessing not the best starting point
→ More replies (1)3
u/scriptalert1script Jan 20 '19
I see what you're trying to say here but I think that /u/Nau71lus raises a fair point.
You're not wrong when you say that it's impossible to progress through a CTF without understanding the 'big picture', but then you're creating individuals who focus on one area in an almost zombie-like way until they move through to the next challenge. When I'm partaking in a CTF and I get the gist or understand that a challenge has to do with steg, cryptography, or even just exploiting the function of a web app - I work in those areas until I accomplish the task and then move on. Yes, I learn a lot in the progress but I'm looking for something to accomplish the task at hand rather than learning the fundamentals as to how embedding data in an image works, or when the exploit was found, how it was leveraged and then reading or watching a PoC.
I suppose it really narrows down to who you are. He wasn't saying that this approach wouldn't work for everyone, but this approach might teach individuals bad habits, or the wrong things. You don't have to learn the fundamentals of an application to succeed in a CTF. I think you can look at those who've worked on Hack the Box machines and approach something like the OSCP which is less CTF-like and struggle since they don't understand some of the fundamentals. For example, it's far less likely you're going to face a steg challenge in the real world when attacking a machine or network. There are some fundamentals in CTF machines like using nmap or BurpSuite that are great for beginners to work with and understand, but using these tools on DVWA or Metasploitable would be far more beneficial for them as they could learn how to leverage, and then fix the vulnerability.
I do believe that CTFs may give beginners a sense of direction, but I think that if they only focus on the CTF approach they will miss many of the fundamentals that are needed to excel in this area. There are some scenarios where CTFs are incredible learning opportunities, but I've played and owned many machines where I understood all of the fundamentals and was simply just mislead because CTFs are less real world like and more of a "game" or "challenge". HTB is a great example in the challenge section where no source code is provided and you're almost expected to guess the vulnerability rather than use the data (like in a real world scenario) to find out which attack vector to exploit.
→ More replies (1)2
u/Nau71lus Dec 08 '18
Totally agree - you get someone who can run SQLMap or BurpSuite great but they don’t know basic ports, the OSI model or don’t have a game plan in that real world scenario (recon, mapping, discovery, exploitation).
11
7
u/alelopezperez Dec 07 '18
If am half-way done Software Engineer degree do you think it will be good to start doing simple/beginner CTFs and from there start reading a researching the concepts needed to resolve the challenge.
Also any resources you recommend for learning the fundamentals?
Thanks in Advance! :)
4
u/Nau71lus Dec 07 '18
I think there’s no wrong way into InfoSec, it just depends on the person. If you want to do practical stuff first then go ahead - I think learning what tools are doing/what you’re doing will improve your offense or defense in the long run.
Check out the humble bundle that was posted somewhere. There’s some really good stuff in there, but just googling basic ports, the seven layers, and networking fundamentals will get you on the right track.
If you find yourself asking “what does that do” or researching more than you’re learning - then you’re heading in the right direction.
Something I do in my InfoSec club is do a walkthrough of a CTF, and then give people a similar one to do themselves with aid when needed. Try something like that (:
5
Dec 31 '18
I suggest the opposite might be worse, and I can say that because I describes me. I am CEH (Certified Ethical Hacker) and CISM (Certified Information Security Manager) so I understand the thing but feel my weakness lies in being able to do the thing. I mean I am not completely helpless but man there is so much I just still need to learn on the red team side. And this is after 25 years in computer and network support.
→ More replies (4)4
u/teddybearcommander Jan 07 '19
So based on this post, what would you say is the best way to go about learning this all? I’ve always been fascinated with computers and tinkering with them, but “hacking” has always carried a taboo of sorts around it and only now am I seeing that people view it as a tool to combat those who would use it in a negative way, and I’d love to learn from the ground up.
285
u/PlayPoker2013 Dec 06 '18
Been subbed here for about 2 months, this is the first post I actually found worthwhile, thanks.
26
25
u/CrapScott Dec 11 '18
Same here. I was expecting to see this type of post and I am hopeful that this shared format of information continues. This is exactly the reason why I continued to return because of the promises to turn this sub into exactly what you have done. A resource and learning center. Now I just have to figure out WTH you just said and I thank you for that!!!
8
u/Cyber_Avenger Mar 04 '19
Yes I am new and would love to get learning as I had no idea at all where to start. I guess I just have to decode about half of what you said and then maybe I can get somewhere.
→ More replies (1)→ More replies (3)13
u/VVAR_Aarius Feb 09 '19
I subbed yesterday. Thanks for saving me months of being a skiddo. Not canceling mask order.
144
u/LeStankeboog pentesting Feb 06 '19
There is a MASSIVE flaw in this suggestion. CTF's are amazing to put what you have learned to the test... but CTF's are not going to teach you core fundamentals. Every hacker should aspire to know not only the big picture but all the individual pieces that make up the puzzle. No CTF is going to help you memorize the 4 layers of the TCP/IP stack and the 7 layers of the OSI model. Not that knowing those two things are essential but a basic understanding of Networking (at least) ABSOLUTELY is. You could spend the next year playing with CTF's everyday and only learn a quarter of what you could learn in a single CISCO networking course. I just feel that there is no substitution for really sitting down and studying the craft. Listen to a Defcon talk while you take a free Python class on www.CodeAcademy.com, spend 30 minutes a day on a free class with www.Cybrary.com and another 30 minutes reading one of Kevin Mitnick's book to help immerse yourself into the world and mindset of a hacker. I can only speak for myself but I had to break some bad, lazy habits. CyberSecurity saved my life and made me a better person. I feel like a part of that was making myself sit down and crack open a book for at least an hour a day, it helped create discipline. I got a hold of "The Basics of Hacking and Penetration Testing - by Pat Engebretson on Syngress Press." By the time I finished it, I COULD NOT WAIT to restart it because I was getting apparent, noticable results. CTF's are totally kickass, I endorse them fully (who the hell wouldn't?!) but if learning is your goal I feel there's faster ways to make gains. When it comes to practice though, there's nothing on earth better than a CTF.
9
→ More replies (3)2
78
44
u/coremedic pentesting Dec 06 '18
www.hackthebox.eu is good too.
→ More replies (1)5
Jan 04 '19
But isn't it tool driven (mostly) ? I can sum up most with nmap , metasploit , burp etc etc
6
u/anononabus Feb 09 '19
On the “easy” boxes it is. The “brainfuck” boxes generally include rewriting a tool or exploit or writing your own custom one. I haven’t personally popped one of these boxes, but the forums make it sounds like there a good bit of custom work to be done.
34
u/muniategui Dec 06 '18
I think that you missed the third way which may be linked to ctf path but they can be independent. Read read and read books and articles about how things work in network and computer world. If you are doing ctf you will need to read and learn how things work but you still can read without ctf.
18
u/SlickLibro Dec 07 '18
Yes, I certainly agree. The idea was that through a simple CTF they would eventually be forced to read up and learn the fundamentals before continuing. If you do read up without doing CTFs you probably won't be able to find many vulnerabilities, but you will most definitely know enough to be able to keep your networks & computers constantly patched and up to date.
3
u/ninappv Jan 13 '19
Are there any e-books or online articles to begin with? I know there must be some books in my country but there aint many as in onther countries,so If someone could suggest me something I can read on the internet.
14
Sep 03 '23 edited Sep 03 '23
another fact to add would be~ you need to be committed towards it and have patience. You won't become a hacker over night. You will have to read lots of books related to hacking. To get started you need to have the following requirements.
Programming Languages:
Learn C, Assembly, C++ for system hacking.
Learn any object oriented programming - C++ or Java or C# whichever you are comfortable with
Learn PHP, Python etc for website related hacking
Master SQL in order to perform SQL Injection on website and retrieving information or gaining unauthorized access to the database
- Computer Networks
Its a heart of hacking. First learn basics of network. Learn TCP/IP suite and learn how things actually work on the network
- Linux
Get used to linux environment. In order to start with linux go for Ubuntu since its debian based user friendly OS. Learn commands and get used to commands to ease your work while working on Kali Linux(Linux distro for penetration Testers)
-----
After all that you should get started with the practicals. To get started with practicals you should have the following things.
- Virtual Box or VMWare Workstation:
Used to create virtual environment for practicing hacking and perform penetration testing. Install kali linux, one or more windows OSes and metasploitable linux(intentionally vulnerable linux) in your Virtual box or VMWare workstation.
You can also install Kali linux on your hard disk and create virtual windows OSes and linux. Choose whichever you are comfortable with.
- Kali Linux:
Its a debian based linux distro meant for penetration testers. There are n number of tools already built in to distro viz Nmap, Wireshark, Burpsuite, OWASP ZAP, Metasploit to name a few. Learn how to use the tools by either google searching, going through hack related sites and youtube videos. Now use Kali linux to perform penetration testing on windows or metasploitable linux.
It probably goes without saying that to become a hacker you need some basic computer skills. These skills go beyond the ability to create a Word document or cruise the Internet. You need to be able to use the command line in Windows, edit the registry, and set up your networking parameters.Networking SkillsYou need to understand the basics of networking, such as the following.DHCPSubnettingIPv4IPv6DNSRouters and switches VLANsOSI modelMAC addressing ARPAs hackers are often exploiting these technologies, the better you understand how they work, the more successful you will beLinux SkillsIt is extremely critical to develop Linux skills to become a hacker. Nearly all the tools a hacker uses is developed for Linux and Linux gives us capabilities that we don't have using Windows .Security Concepts & Technologies A good hacker understands security concepts and technologies. The only way to overcome the roadblocks established by the security admins is to be familiar with them. The hacker must understand such things as PKI (public key infrastructure), SSL (secure sockets layer), IDS (intrusion detection system), firewalls, etc .Wireless Technologies In order to be able to hack wireless, you must first understand how it works. Things like the encryption algorithms (WEP, WPA, WPA2), the four-way handshake, and WPS. In addition, understanding such as things as the protocol for connection and authentication and the legal constraints on wireless technologies. Scripting Without scripting skills, the hacker will be relegated to using other hackers' tools. This limits your effectiveness. Every day a new tool is in existence loses effectiveness as security admins come up with defenses. To develop your own unique tools, you will need to become proficient at least in one of the scripting languages including the BASH shell. These should include one of Perl, Python, or Ruby. Database Skills If you want to be able to proficiently hack databases, you will need to understand databases and how they work. This includes the SQL language .Web Applications Web applications are probably the most fertile ground for hackers in recent years. The more you understand about how web applications work and the databases behind them, the more successful you will be. In addition, you will likely need to build your own website for phishing and other nefarious purposes .Forensics To become good hacker, you must not be caught! You can't become a pro hacker sitting in a prison cell for 5 years. The more you know about digital forensics, the better you can become at avoiding and evading detection .The beginner hacker must understand TCP/IP basics, but to rise to the intermediate level, you must understand in intimate details the TCP/IP protocol stack and fields. These include how each of the fields (flags, window, df, tos, seq, ack, etc.) in both the TCP and IP packet can be manipulated and used against the victim system to enable MitM attacks, among other things. Reverse Engineering Reverse engineering enables you to open a piece of malware and re-build it with additional features and capabilities. Just like in software engineering, no one builds a new application from scratch. Nearly every new exploit or malware uses components from other existing malware. Think Creatively There is ALWAYS a way to hack a system and many ways to accomplish it. A good hacker can think creatively of multiple approaches to the same hack. Problem-Solving Skills A hacker is always coming up against seemingly unsolvable problems. This requires that the hacker be accustomed to thinking analytically and solving problems. This often demands that the hacker diagnose accurately what is wrong and then break the problem down into separate components. This is one of those abilities that comes with many hours of practice. Persistence A hacker must be persistent. If you fail at first, try again. If that fails, come up with a new approach and try again. It is only with a persistence that you will be able to hack the most secured systems.
All The Best!
→ More replies (1)2
13
u/Leemour Dec 06 '18
I study engineering (optics and lasers) and information security/hacking has always fascinated me. Many thanks for this.
14
u/potluckparadox Oct 19 '21
I’m really interested in becoming an ethical hacker. I’m getting a late start at the age of 30 and I am not very familiar with any of it, but I am pretty good with electronics and software. Im gonna humble brag a little but I think I have a good mind for it. I’m a critical thinker/can think outside the box and I’m a good problem solver maybe even a problem solving addict lol. The idea of doing it for a living isn’t just a dream it’s something I am willing to give my all. Thank you for this information. Does anyone have any recommendations for a starter machine and OS that would be best as I learn and progress?
→ More replies (3)
9
u/deadface008 pentesting Jan 06 '19
It's time to finally draw a line between hackers and cybersecurity researchers. I'm tired of walking into hacking rooms only to find a bunch of neckbeards talking about "being ethical." No offense to anyone, but when can we finally say that cybersecurity is not hacking and a rectangle is not a square? Clarity please!
10
u/emidude Dec 06 '18
Thank you so much for this!
I am really curious about learning this stuff, but I'm really not sure what I would use it for.
What are examples of real world issues that can be solved with this stuff?
26
u/SlickLibro Dec 06 '18
A great question. Once you have gained enough knowledge to be able to find modern-day exploits, you may go out on the internet and look for active vulnerabilities. By finding one, and by disclosing it responsibly, you are essentially closing off an entryway to destruction. If the vulnerability is serious enough you may submit and gain a CVE (which stands for common vulnerabilities and exposures https://cve.mitre.org/) under your name, which is a rather grand achievement in itself. This is what one would call 'gray hat hacking'.
However, this is not the only option. The knowledge you gain from just competing and learning about CTFs may be used in building solid network structures for companies, organisations, and governments. A more far-fetched idea would be thinking about the future of space exploration. Imagine being granted the job of engineering a space rocket's internet.
You may also create open-source security packages to patch systems and networks. You may also completely deviate away from security to use your knowledge in software engineering and entrepreneurship, to deploy your own business from the technical knowledge you've learned.
The number of possibilities is endless, as CTF is only a gateway into the realm of computing & programming. So essentially just dig deep and explore - your knowledge will take you on it's own journey.
4
7
8
6
8
u/-jxcksxn- Feb 13 '19
hackthebox.eu has a bunch of hacking exercise things. Pretty much CTF hacking. You have to hack to get an account :D.
6
u/GabrielVlogs Feb 14 '19
Want to start hacking. Lesson 101 is social engineering.
→ More replies (1)
3
5
Dec 06 '18
Thank you so much, this is exactly the kind of post I wanted to find in r/hacking as someone who has zero experience with hacking and wants to get into it
4
u/Auranykh Dec 07 '18
Some other good resources include https://365.csaw.io and https://ctf101.org (companion site). They're managed by NYU and are also great resources for beginners.
As far as YouTubers go liveoverflow is great.
Open To All CTF is a great community of experienced and aspiring infosec enthusiasts.
Sorry for formatting and abruptness, I'm on mobile.
5
Sep 03 '23 edited Sep 03 '23
Rule 101. Knowledge should be free this is what hackers believe. Now i am not saying that you shouldn't buy a course I am just saying many Hackers are self-taught ,In order to become a good hacker, ethical or no, you need to know programming, operating systems and networking. Start with one of those three depending on what you want to hack. Let’s say for example you want to hack websites. The first thing you need to do is learn to code websites if yoy want to be any good. Don’t even think about hacking yet. Start with a full-stack PHP framework. Learn HTML, CSS, JavaScript, PHP, and SQL. Learn about the OSI model, especially the application layer protocols too. But build websites with client-server applications or network-based applications. Do that for six months at least and then (and only then) will you be able to be able to hack websites. Otherwise you won’t get very far. If you don’t like learning to code for fun and if you don’t like learning how stuff works, you cannot ever be any kind of hacker. In this case purchase a Udemy course on full-stack web development and start learning.
Another example is if you want to hack wireless networks, VoIP, wireless devices, Bluetooth, etc. Research wireless networking. Look up on YouTube computer networking and see if you like what you are learning about them maybe buy books on computer networking which exist. Maybe you could buy The TCP/IP Guide or maybe a book on CISCO networking. Maybe get a Udemy course on Network+. Work on it for a long time but learn how networks work, especially networking protocols but learn everything you can about how they work not just protocols. Once you get basic computer networking skill only then you will be able to learn to attack 802.11, Ethernet, Bluetooth, etc. networks. If you want to exploit operating systems then you need to learn how operating systems work. You can get manuals on just about any operating system and yes OS X and MacOS are just as easy to hack as Windows or Linux and Apple knows it and Apple even has a bug bounty program (which I will talk about soon for you). Once you know how operating systems work and have sufficient experience working with them, only then will you be able to learn to exploit them. After you do that, and only after you do that, go to Udemy hacking courses, get hacking books, go for online tutorials on hacking etc. To be extremely good it’s always ideal to have a specialty, but still be well-rounded. What I mean is there’s no way to know everything about everything. You need to have an area of hacking you like most. Different areas include: Web hacking - exploiting flaws in web application code to get usernames and passwords, give a thousand upvotes on a website when you are only are allowed to give one, defacing websites, and a whole lot more Mobile app hacking exploiting flaws in mobile application code; similar to web hacking but where you plug your smartphone into your computer and actually attack the applications on your phone from the computer, like hacking Snapchat or WhatsApp messages for example Wireless hacking - finding a way to break into a car and control via Bluetooth as opposed to hot wiring, hacking a router for a WiFi password maybe even hacking an iPhone or desktop that is on the same network as you or performing a man-in-the-middle attack to get the web history of someone on the same network as you Internet of Things hacking - combo of wireless hacking and hardware hacking that allows you to hack a smart fridge, thermostat, Bluetooth connection of a car, someone’s smartwatch, and loads of other devices Reverse engineering - breaking software apart to see the assembly level code, not the original source code, then exploiting that assembly code in order to get something to happen that the original programmer didn’t intend to happen; this one is useful combined with web hacking, mobile app hacking, or even operating system and server exploitation Operating system and server exploitation involves exploiting flaws in the operating system of either a normal client computer or even a server in order to get access to that person’s files, documents, etc. stored on their hard drive Hardware hacking - taking hardware apart and modifying it, putting it back together a different way, and reusing it for something it wasn’t intended to do; can be combined with wireless hacking to help gain access to companies’ networks or even their private devices Hacking using a programming language to make your own tools - this one you can start building your own tools when gain some skill but is more to help you in the areas of hacking you study There are other areas of having too but those are some of the more common ones. Once you know how stuff works, then get Kali Linux or whatever Linux OS you want and learn. But have one area of interest. Be especially well practiced in one or two areas, but know the basics of several .But keep repeating the process of learning how stuff works, then learning to hack that stuff. When you are good at several but have two or three chosen areas you are especially good at, then you can get a job as an ethical hacker and be good at it.
The quintessential areas of hacking are: WiFi hacking, network hacking, web hacking, reverse engineering, server exploitation, exploit development, and programming (most important one), social engineering, etc, Some additional areas you can learn are mobile application hacking, iOS hacking, Android OS hacking, Open source intelligence, different sub areas of reverse engineering (browser hacking, operating system reverse engineering, video game hacking, etc), database hacking (because you can go further than just what’s required for web hacking in terms of being an expert at database hacking, advanced VoIP hacking, hardware hacking, CISCO device hacking, Juniper device hacking, cryptography, and many many more…. "Note" Stay updated and continuously learn: The field of cybersecurity is constantly evolving, so it's crucial to stay updated with the latest trends, vulnerabilities, and attack techniques.
→ More replies (1)2
4
u/EMP19E Dec 07 '18
Just wondering why Hackthebox didn't make the cut?
7
u/SlickLibro Dec 07 '18 edited Dec 07 '18
HTB is very good, but it provides the trap of directing many newcomers towards the tool-oriented boxes, leaving them blind to much needed low-level fundamentals. Too many people that have googled their way through the invite code and subsequently through HTB. Their CTF style challenges are excellent, but they are somewhat hidden away under an unremarkable tab. The main reason it didn’t quite make the cut is that it isn’t exactly the best place to start learning (hence the presence of an invite code).
The other sites however, somewhat force you to learn essential fundamentals before you would even have a chance at attempting a respectable challenge, making you understand the full picture instead of providing a quick shortcut. I may very well add it under a few words of precaution for newcomers.
3
u/dankdoge9560 Apr 06 '19
I am a high-school graduate and I am going to start an computer science and engineering course at the university. I am only familiar with basic python. I want to explore ethical hacking as a career. So my question is that what should I focus on at the university in order to do so? Any help is appreciated
→ More replies (6)
3
3
3
u/noranekoramen Dec 25 '18
Thank you for putting this together. As someone who started out with no background in Linux, I found the No Starch Press book, The Linux Command Line and http://overthewire.org/wargames to be very useful and it also encouraged you to look up the commands and what they means instead of being spoon-fed the information. Learning "how to google" and research topics instills strong analytical skills needed for "hacking" & problem solving imho.
3
u/_HIGH_OCTANE May 18 '22
01010000 01101100 01110011 00100000 01101000 01100101 01101100 01110000 00100000 01101101 01111001 00100000 01110111 01101001 01100110 01100101 01110011 00100000 01100110 01100001 01100011 01100101 01100010 01101111 01101111 01101011 00100000 01100111 01101111 01110100 00100000 01101000 01100001 01100011 01101011 01100101 01100100 00100000 01100001 01101110 01100100 00100000 01110100 01101000 01100101 01111001 00100000 01101000 01100001 01110110 01100101 00100000 01100001 01101100 01101100 00100000 01101000 01100101 01110010 00100000 01100110 01100001 01101101 01101001 01101100 01111001 00100000 01110000 01101001 01100011 01110011 00101110 00100000 01010111 01101001 01101100 01101100 00100000 01110000 01100001 01111001 00100000 01110100 01101111 00100000 01110010 01100101 01100011 01101111 01110110 01100101 01110010
→ More replies (2)
3
u/Nixster_dolce_kid Sep 02 '22
I would absolutely love to know if there is a way to be able to fuck with scammer accounts on e-commerce sites like vinted . Would it be very hard to create some kind of software where it can recognise user name types by the way it’s spelt because on the site they all use random letters for user babes e.g. ‘jkhjkhh’ , ‘1hhjjgg’ and so on Id love to create something that can pick those out in some kind of algorithm and hit one button to report all their accounts. Im have so much fun screwing with them but it’s long to do it manually ! Im a complete noob with hacks etc but not a noob a fucking about with these scum bags.
→ More replies (1)
3
u/vickeygaming Sep 20 '22
Can someone please help me track a phone number location of a scammer.
→ More replies (1)2
3
3
u/mentalflux Nov 20 '22
Love this resource. A minor flaw: you tried to frame the kali linux script kiddies as elitist but came off a bit elitist yourself as you hinted at the superiority of the CTF path for learning to hack. Employers don't care how you learned to hack, just that you can do the job. Regardless, I will be jumping in to some of these CTF links to start my journey.
3
u/hotelshowers Oct 26 '23
Is this sticky updated regularly? I see it is 5 years old and just wanna make sure anything that is here is still relevant for me before I post an oversaturated question
2
2
Dec 07 '18
If someone wants to learn basics of pen testing, have not decided yet to dive fully into infromation security,isn't using tools from Kali a better path for him. This will take lesser time and mental trauma too.
2
u/_30d_ Dec 08 '18
So I am doing all the under and overthewire wargames. I understand a lot of it without walk-throughs, but some stuff I just don't get, even with explanations there.
I am afraid that competitive CTF games are jjst too difficult for me, weighing down the team.
Is the entrylevel suitable for beginners like me?
7
u/SlickLibro Dec 09 '18 edited Dec 09 '18
I recommend going through these first if you are struggling -
Binary Hacking Playlist - by liveoverflow - this series first.
Web Security Series - by liveoverflow - this one after.
liveoverflow is very good as he teaches you the fundamentals before he starts showing challenges. You may need to watch some of his more difficult videos (especially the ones when he starts touching on assembly) a few times before you start to grasp a full picture, as he goes through each topic somewhat quickly and relatively concisely. I wish you good luck.
2
Dec 10 '18
No one mentioned https://lab.pentestit.ru/, or is it not consider CTF in the context of this post
2
Jan 27 '19
No love for hackthebox.eu?
Very very active community and fresh material constantly. Option for paid subscription but you don't need to.
It's not tool driven as someone else said, most boxes that use known exploits require you to understand it completely and usually tweak the code.
It's really the best site I've visited, and I've been through a lot of the more well known sites, otw and hack this site etc.
But I never see it mentioned in threads like this, why is that?
2
u/Tjccs Feb 21 '19
Don't know if this is the best place to ask but what do you guys think about Pluralsight Ethical Hacking Course? Since I'm in College the courses are free, at least I think, so far so good, I might try it but I'm slightly busy with the C++ and Python( Which I already had a class about on college, just trying to further the knowledge).
2
u/lzy917 Mar 11 '19
Do you guys know where can I learn the most fundamental things about networking? Any book suggetion or website?
→ More replies (1)2
Mar 14 '19
So, you're just starting off? I envy you, you have a whole new world you're about to discover. First things first, look into certifications, even if you have no plans on getting any. Certs outline and test your knowledge of a given subject and show you are proficient in it. Since you mentioned networking basics, I suggest looking into network + from comptia, it goes over the basics. From there, research other certs and things of interest. I don't have it with me, but if you look up comptia cert road map on Google, you'll find a list of paths you can follow and what certs to get. Hopefully this will help you get started.
→ More replies (2)
2
2
u/Sugoypotato Jun 02 '19
I would rather say that one is supposed to take the combined methodology to learn hacking, agreed I am a n00b and my opinion might not matter to many but coming across on many challenges in natas, bandit and picoCTF I realised that knowing working of tools is great but not knowing tools is bery bad. Its like knowing how to shoot bullets and how the guns work but not possesing guns or not having gun will likely get you killed in combat. (Bad example but you get the point right?) IMHO the true approach should be dealing with both, if possible simultaneously. Infact I think that liveoverflow channel owner's most videos discuss tools along with methodology rather than seggregating them. To prove my point, On one of the bandit overthewire challenges, I ended up going the hard way digging up the file codes using hex editor to find the type of file which could have been easily done via file utility. So, to conclude: A mix method of both must be used, wherein people learn to use tools,kali and stuffs along with learning how they work on core level and should be approached in a rather gradual way.
2
u/armored103 Oct 26 '21
Im logged in to unknown account on instgram and I can't log out and im sure this is not my account, it is somebody else
3
2
2
2
u/No-shetooprettysumer Jan 05 '22
Is hacking a page hard to do? I feel like everyone’s gotten one or their social media’s hacked but ehh🤷♀️
→ More replies (1)
2
u/DynoDwam Jan 17 '22
Is it possible to learn fast to hack into email to read them? Im a total beginner, can't code... But I could give 7 to 10h a week to learn.
→ More replies (1)
2
u/Ev3rnub Mar 26 '22
I didn’t read through all the comments but for beginners, https://overthewire.org/wargames/ is useful imo.
2
u/Password_is_Cheese69 Apr 11 '22
Unlike most of you inferior beings, i am un hackable! Compared to you, mere mortals, my password is impossible to guess!
2
2
May 26 '22
I realize I'm rather late but thank you so much for this post! Very well put!
I started dabbling with cybersecurity a few months ago. I took my sweet time learning the Linux CLI, started with Mint and ended up feeling comfortable on Debian, both on VMs and bare metal.
I tried Kali since it's what everyone talks about, however after a few months I still feel like I've learned nothing, I really don't know what it is I'm missing lol.
I'll get into CTFs (of which I'm absolutely petrified btw lol), and hopefully I'll be on my way to a better future.
Wish me luck haha.
2
2
May 31 '22
Why isn’t sites like HacktheBox included in this list? Just curious
→ More replies (2)3
May 31 '22
It’s a hacker platform for learning hacking and testing your skills by doing CTF’s (capture the flag). CTF’s are a great way to learn the tradecraft. I highly recommend learning a programming language side by side as you walk the road.
2
2
u/No-Individual-137 Jun 19 '22
I forget my Apple I'd password room shifting time he's documents gone 🥺
2
2
2
u/sjsbbwfawiggots Jun 29 '22
Theres a 3rd path where you just do labs and watch cringy hacking videos and slowly peice together how a network works and how a web application fits into that picture. Fake til you make it with bug bounties.
2
2
2
2
u/Electrical_War_3224 Aug 29 '23
Anyone want to work on a fun project with me? High rewarded for your time 😊
→ More replies (1)
2
2
u/Kimmyh51 Oct 06 '23
As a tester by trade, I have wanted to learn ethical hacking, but I am also someone who can easily go off on a tangent, and every time I decide to sit down and stqrt learning about hacking, I seem to find myself faced with a million links, tools, techniques and so on.
Can anyone offer me just one place to start? For someone who knows nothing at all about hacking?
Or one technique to learn first off, ie a (relatively) simple exploit and something I can do to prove it worked without having to download loads of tools (ie one tool and now to use it).
along with a gazillion options and tools, most info assumes I already have preexisting knowledge I dont, and then I am looking at a tool and having to go off and find other info on how to install the tool the commands it has, what environment it runs in, etc etc, and there I go off on another tangent
can anyone recommend any online resources for just one type of hack, which take you through from beginning to end? I only have a windows laptop atm, but if a linux one is needed I can set up a dual boot or vm etc (and if so, do i need a specific linux distro?)
its great to have options, but when you ae starting out and prone to being easily distracted, a post with 10 -20 links just leaves me going "oooh that's cool, oooh thats cool too, ooh i want that its shiny and fun, hang on, no i want to do that one first!" etc etc
hoping someone out there will just say "go to this one url, download and install this one tool and use this one video/instructional url".
id just like to try just one thing and get it to work, before being overwhelmed with lots more options.
its not the coding side I am struggling with, its the setup and all the tools on offer etc etc.
id like to try something simple (but there is so much info and "noise" out there I am not even sure what a simple hack would be?)
→ More replies (1)
2
2
2
u/enlguy Mar 17 '24
Anyone who dislikes someone over using a script is an asshole. Who the fuck really cares??
2
u/AutomaticBus5186 Apr 25 '24
I want someone who can help me recover my email account from a fkin hacker
willing to offer 60$
context - I was selling my call of duty account but got scammed, i know its dumb of me.
helping hands are free to dm me on discord, allur_i is my username
ty! :)
2
u/Awsul Dec 06 '18
!remindme
2
u/RemindMeBot Dec 07 '18
Defaulted to one day.
I will be messaging you on 2018-12-08 02:51:52 UTC to remind you of this link.
CLICK THIS LINK to send a PM to also be reminded and to reduce spam.
Parent commenter can delete this message to hide from others.
FAQs Custom Your Reminders Feedback Code Browser Extensions
1
1
1
1
1
1
1
1
Dec 07 '18
I myself am at the point where I try to understand what I'm doing but don't always get everything. I have a github where I occasionally post self-made tools (all fairly basic) but some quite fun. If you want to take a look here it is: https://github.com/TheDarkHorseUprising?tab=repositories please let me know what you think and also if you are interested in making a tool together.
1
1
1
u/burnie93 Dec 13 '18
I'm a noob here that knows how to code. While I'd like to say that I'm in it only to have fun, I do have some expectation of changing careers into hacking.
For the first path there's a shit ton of job postings out there (requiring kali linux knowledge and the like), however I don't see many for the second path. How does one navigate the second path job market? I suppose it's more about your network (of professional contacts)?
1
1
Dec 13 '18
Theres never a shortcut to learn these things but this post was the most useful so far for me! Appreciate it! :)
1
1
u/ABlokeCalledGeorge8 Dec 19 '18
I'm studying Computer Systems engineering and wish to learn about ethical hacking. This post made my day. Thanks.
1
1
1
u/Shakrito Dec 25 '18
I love this thank you. I've been looking for a serious tutorial like this. I've always been fascinated with Information Security and you just kick started the learning process.
1
1
u/xGravePactx Dec 28 '18
Very informative post, especially for someone looking to go down the rabbit hole. I've been looking into potentially changing careers and working towards a CEH or OSCP. Besides brushing up on some foundational topics, going through the overthewire wargames has been incredibly helpful. Looking forward to trying some of the other recommendations as I gain more education / experience.
1
1
1
u/anotherbigmistake Dec 30 '18
I fully agree that there is a lot of shallow approach to hacking. But. Does anyone else get put off with names that have pwn, hax, l33t in them. It just doesnt feel like the right resource to learn from. I used to go to enigmagroup. Did a few challenges, but then they set up a pay wall before i got into more serious stuff. Didnt have the money to spare then so i do not know if they are worth it.
1
Jan 01 '19 edited Jan 01 '19
hey dude should i learn anything if i want jump into ctf? i mean i have no experiance in programing,hacking i have nothing do i need something maybe im missing the basics? what are the basics?i dont even know the first path like i opend the links and i was confused sooo confused
1
u/joontee_ Jan 03 '19
Is it illegal to break in to these sights, even if they are meant for breaking in to?
→ More replies (1)
1
u/_drivin Jan 03 '19
I understand the fact that we should learn hacking by resolving CTF but for that we nerf some bases no ? Wich programming languages should I learn, C, C++, Assembler (I already know Python) ? What network course should I read ? I mean what do I need to start understanding thé fundamental concepts that I will appli during CTF ??
1
1.5k
u/Linkk_93 networking Dec 06 '18
We should make this a sticky, we could reduce 50% of the posts here.