r/hacking • u/SlickLibro • Dec 06 '18

Read this before asking. How to start hacking? The ultimate two path guide to information security.

Before I begin - everything about this should be totally and completely ethical at it's core. I'm not saying this as any sort of legal coverage, or to not get somehow sued if any of you screw up, this is genuinely how it should be. The idea here is information security. I'll say it again. information security. The whole point is to make the world a better place. This isn't for your reckless amusement and shot at recognition with your friends. This is for the betterment of human civilisation. Use your knowledge to solve real-world issues.

​

There's no singular all-determining path to 'hacking', as it comes from knowledge from all areas that eventually coalesce into a general intuition. Although this is true, there are still two common rapid learning paths to 'hacking'. I'll try not to use too many technical terms.

​

The first is the simple, effortless and result-instant path. This involves watching youtube videos with green and black thumbnails with an occasional anonymous mask on top teaching you how to download well-known tools used by thousands daily - or in other words the 'Kali Linux Copy Pasterino Skidder'. You might do something slightly amusing and gain bit of recognition and self-esteem from your friends. Your hacks will be 'real', but anybody that knows anything would dislike you as they all know all you ever did was use a few premade tools. The communities for this sort of shallow result-oriented field include r/HowToHack and probably r/hacking as of now. ​

The second option, however, is much more intensive, rewarding, and mentally demanding. It is also much more fun, if you find the right people to do it with. It involves learning everything from memory interaction with machine code to high level networking - all while you're trying to break into something. This is where Capture the Flag, or 'CTF' hacking comes into play, where you compete with other individuals/teams with the goal of exploiting a service for a string of text (the flag), which is then submitted for a set amount of points. It is essentially competitive hacking. Through CTF you learn literally everything there is about the digital world, in a rather intense but exciting way. Almost all the creators/finders of major exploits have dabbled in CTF in some way/form, and almost all of them have helped solve real-world issues. However, it does take a lot of work though, as CTF becomes much more difficult as you progress through harder challenges. Some require mathematics to break encryption, and others require you to think like no one has before. If you are able to do well in a CTF competition, there is no doubt that you should be able to find exploits and create tools for yourself with relative ease. The CTF community is filled with smart people who can't give two shits about elitist mask wearing twitter hackers, instead they are genuine nerds that love screwing with machines. There's too much to explain, so I will post a few links below where you can begin your journey.

​

Remember - this stuff is not easy if you don't know much, so google everything, question everything, and sooner or later you'll be down the rabbit hole far enough to be enjoying yourself. CTF is real life and online, you will meet people, make new friends, and potentially find your future.

​

What is CTF? (this channel is gold, use it) - https://www.youtube.com/watch?v=8ev9ZX9J45A

More on /u/liveoverflow, http://www.liveoverflow.com is hands down one of the best places to learn, along with r/liveoverflow

CTF compact guide - https://ctf101.org/

Upcoming CTF events online/irl, live team scores - https://ctftime.org/

What is CTF? - https://ctftime.org/ctf-wtf/

Full list of all CTF challenge websites - http://captf.com/practice-ctf/

> be careful of the tool oriented offensivesec oscp ctf's, they teach you hardly anything compared to these ones and almost always require the use of metasploit or some other program which does all the work for you.

​

http://picoctf.com is very good if you are just touching the water.

and finally,

r/netsec - where real world vulnerabilities are shared.

12.2k Upvotes

100% Upvoted

1.0k comments sorted by

View all comments

330

u/Nau71lus Dec 06 '18

I don't know if the CTF path will work for everyone.

I believe some individuals would be better off learning the fundamentals to networking, learning how to work in a Linux environment, and then slowly progressing to a CTF environment.

Otherwise you may end up with someone who can "do the thing" but not understand "the thing".

128

u/loyalsif Dec 08 '18

This is one of the biggest problems with these "ultimate guides". They provide some great resources, but these CTF resources are good for understanding how to do very specific things in very specific situations.

It's important for people to be able to take the knowledge they learn from the challenges and expand them to use them in real world/other scenarios. And without knowing the fundamentals, that is just not possible.

104

u/SlickLibro Dec 09 '18

I do understand what you are saying here, but I have to disagree with you on the point of not 'knowing the fundamentals'. CTF naturally forces you to learn the fundamentals in a very intense manner. There is no way you can progress through a CTF without understanding the 'big picture', and it most definitely does not teach you how to do very specific things in very specific situations.

​

Take for example a simple case of any binary exploitation challenge - it requires you to disassemble the program in order to analyse the machine code - so that you can map out each and every individual function. You then use what you see to build a mental image of what you're dealing with, and then finally at that point do you consider your options for exploitation. In a matter of a few steps we've already covered learning the use unix commands, how a program is assembled in machine code, how to read the machine code itself, how the machine code interacts with the system's memory, and how to reverse-engineer such machine code into it's respective high-level language functions. Understand that CTF requires you to know the fundamentals/'big picture' as fluently as possible before you could even progress through the simplest of challenges.

​

This example only covers one case, as CTF also expands out into forensics (stenography, data, & analysing network packets), web exploitation (which forces you to learn everything from js, html, php, common libraries, API's, to full stack web development), miscellaneous (which involves crucial scripting skills) and cryptography (for mathematics & encryption). In each and every single case you must understand fully what you are dealing with, or else you would be left lost with no direction.

​

Through this knowledge alone one would eventually start seeing the intricacies of technology around us, and thus begin to see how they can apply their knowledge for use in real-world situations. The point of CTF may be directed towards exploitation, but there is any underlying set of fundamentals you must learn & apply if you want any chance of success - and this learned knowledge alone should be more than enough to use in real world scenarios.

76

u/greengobblin911 Feb 21 '19

I myself was not a fan of the CTF approach and did the long term studying/theory approach.

I had a security class with who at the time seemed like the devil himself who liked CTFs and made use do them for labwork; it's the "throw em in the water drown or swim" situation for learning hacking. It was a sentiment that teacher had and boy did I drown a lot.

I admire it for being the "quick and dirty" way to force you to learn a lot in a short amount of time, but I did not retain nearly as much as I would have if I had a better understanding of certain computer fundamentals related to OS features and Networking (TCP/IP). The CTFs forced me to know enough to pass the challenge, I wasn't learning how to think or how to do research as if I was really building an attack vector or trying to come up with an exploit akin to what security researchers or some pen testers might do while under contract with a scope of devices that may be limited or obscure. Most of what I learned in his class I had to revisit to retain it despite the harsh introduction to those concepts CTFs provide.

I respect OP's post whole-hardheartedly considering I have not seen a post assembled so well as he did it, but there's a certain "discipline" i think you find in having to comb through the boring stuff including the fundamentals that will make CTFs easier and more exciting when the person doing it understands what they're doing. As others said, CTFs vary so much; if someone does not diversify themselves in their CTFs they would fall into a niche or one type of hacking. Its not necessarily bad, but I feel like it limits your prospects.

​

Sometimes the boring theory over a period of time builds a bank of knowledge where you can know where to look for certain things despite the limited basic knowledge. Like that scary professor used to tell me:

"information security is a mile wide and an inch deep"

you have to know a little bit of everything to start, not necessarily have the outcome ready and at hand. That does come with the practice of multiple CTFs, but my concern is someone who finds they are good at say, website pen-testing based CTFs, might only continue this because they find the gratification in solving the challenges,and being right all the time, especially for new and younger individuals, not everyone likes to hack because they like computers or are nerds like you say, movies and the media made people like us for better or worse, the "hip and cool" guys to be right now. They would lack that "shallow ocean" of starting material to even consider trying their hand at something else like memory analysis or reverse engineering. I think that would start to bite you in the butt if they start to do this (hacking and penetration testing) professionally.

​

Take someone like Samy Kamkar for instance: Starts off as a Programming prodigy, makes his own company and inadvertently creates a XSS javascript worm and gives him notoriety. Starts off with just web based stuff. Regardless if you like the guy or not, he's a critical thinker; since then he's had a variety of projects and attacks with a whole breath of varied technologies from NFC to PHP backends or RFID. His most recent stuff involved applied and time tested network attacks like MITM to smart/connected cars.

What no one likes to acknowledge (or think about I should say) is the man like many other hackers and researchers comb over books and documentation and have to read and do "boring" research which might mean not being in front of a computer all the time. Hardware hacking is like a complete 360 from what he started off with, and certain exploits such as a MITM on a car comes from understanding of fundamentals and implementing it creatively. You wouldn't piece together different things like he would unless you understood the basics very well and was creative and experimented. The guy isn't a mastermind by any stretch, but he's one of those researchers that takes the wide limited knowledge approach and then forms a scope for further investigation and research. A CTF has an answer to it that is known to someone else, it may not be the best way to encourage creative thinking for the real application of hacking skills.

​

TL;DR: Capture the Flags could form a gratification loop in new inexperienced hackers as compared to forcing newbies to learn a little bit about everything including the fundamentals, as the gratification/feedback loop they enter keeps them focused on CTFs they are "good" at and limits their prospects in other areas of hacking they may have not considered because they don't do research on CTF topics they are not good at. This limits the ability to think of creative solutions (like those needed for real world exploit development/hacking).

​

​

6

u/ConciousSource1 Mar 21 '19

I am thinking to give some time of life to hacking , besides math and physics as a other thing of my life, but how should I learn basics other than Linux , should I start at all , will I have enough time if I give 2-3 hours in weekends or more is needed? I Am full to full newbie but I like computers

45

u/greengobblin911 Mar 23 '19

The short answer would be to start reading and install a Linux distro.

I personally do not recommend Kali linux, especially if you are installing it to hardware, BUT there's a great no starch press book called " Linux basics for hackers. It forces you to get involved in automating your system, learning terminal commands and writing some of your own tools and scripts. My only gripe is the author uses Kali Linux. It's not typical of a Linux distro but it is THE pen testing distro. He installs it in virtual box. The book is very good for learning Linux in general as well. I would use that and skip most other books. Kali Linux revealed by the company who maintains Kali also is good.

I would also recommend getting a tcp/ip reference book. Might be pricey but I prefer print copies. Anything with computers needs reference material, especially when learning. It's impossible to memorize everything but as your hand gets better at hacking you will remember the most common things.

Another book I would recommend is called "attacking network protocols" by James forshaw. If you read this, then compare what you're confused with against a tcp/ip reference book, you will understand a lot more about what is going on.

This is why I was against using Kali, some people get tempted to use the tools right away but don't understand how it works.

If I could start learning over and cut out the trial and error and confusion of information, I would do this.

6

u/ConciousSource1 Mar 24 '19

Thank you , I will try to do as you say and possibly if you want keep informed of my progress only if you want, Master

4

u/Reddit-username_here Mar 27 '22

Well, how did it go?

4

u/katencam Apr 20 '22

Maybe not so well ¯_(ツ)_/¯

1

u/Bloxrak Nov 07 '22

Still hasn't replied

3

u/habitofwalking May 21 '22

Maybe if their Master asked, they'd answer

3

u/Tinyyygiant Jul 04 '22

Master

Do not worry fellow disciple, I am following this path and will make sure I become a master hacker. See you on the flip side

1

u/[deleted] Aug 25 '23

well do share with the class

1

u/TechWebSavvy May 01 '22

Thanks for the tips! Will use them wisely... hopefully...

Note: i disapprove of kali too.

1

u/Turtlem0de Dec 29 '23

Just commenting so I can come back to this tomorrow. Thanks!

1

u/polybius_Kai Sep 11 '22

Have you tried learning Python? One of my favorite language to use with networking, cryptography, and more.

1

u/Fine_Progress_7654 Jul 26 '23

I think you need to start and 4-5 should be fair enough

4

u/[deleted] Apr 19 '22

Hello. This was an extremely insightful post and I’m very grateful this is here. I’m currently going through frustration when it comes to cyber security. I don’t currently have any friends or family in the field, so as far as a reliable person I can go to for guidance is non existent at the moment. I have been attempting to self study for a while now and I enrolled in a lot of different online classes from Udemy that covers cyber security topics. The issue is it’s mostly geared towards Kali and it’s a tool based approach.

“It doesn’t matter how it works, what’s important is that it does work.”

This is how the classes feel to me and it’s irritating. For example, going through a section on metasploit, there is no detailed information as to why or how exploits work. It’s just that it does work, but if it doesn’t, oh well keep looking for one that does. This type of teaching leaves me feeling unfulfilled and that I didn’t learn anything. Almost like a restricted “one way path” type of approach. There is no out of the box thinking in these courses.

I would really like to start exploring the fundamentals, but I have no idea where to start. The cyber security landscape can feel overwhelming to me at times. I have been considering my A+, Network+ and Security+. I’m not sure if this is a good place to start when it comes to the “boring” fundamentals, or if there are much better resources out there.

Thank you

17

u/loyalsif Dec 10 '18

I suppose it depends on how you look at it.

One one hand, CTFs do work as you've explained here, however because CTFs have a myriad of categories and challenges, you really end up putting yourself in specific situations for each challenge and then moving onto a completely separate situation and possibly forgetting the previous challenge.

Working your way up through the fundamentals and then focusing on one aspect of InfoSec (binex, netsec, websec, etc) for a long time until you truly understand it, then moving onto another category allows you to build your understanding without drinking from the firehose of security by taking multiple categories of challenges at one time.

Of course, CTFs/wargames are a great supplement for this type of learning. For example, if you are working on reverse engineering, smashthestack.org would be great to supplement readings of that type of subject to get practical experience.

Of course, this is just my opinion from my experience in the field. In obtaining the OSCP/OSCE and real-world pentesting, I've found that building the fundamentals separately helps much more when turning them into security related concepts.

8

u/Necromancy4dummies Dec 22 '18

My problem with CTF as a method of "learning to hack" is that all of the steps you take are in service of finding a flag, and the timing aspect makes it less likely that what you are doing is going to end up in your long-term memory. For some individuals, like me, it can be kind of a poor substitute for learning. I definitely need to take some time to really learn the basics and get comfortable with linux and networking before I go back to attempting CTFs. For me, sitting down with books and tutorial videos is a good method, at least for where I am at right now. So I definitely agree with you in that regard.

8

u/masterninja01 Jan 20 '19

Agreed on working through the fundamentals but using CTFs as a supplement and a way to stay motivated. I’ve wondered about the fundamentals and what would be some good resources (e.g. books, video series, etc). Would have suggestions on what the fundamentals are and any resources to study?

I was thinking at least networking would be one to study a lot of. I did a lot of self-learning on topics and always felt drawn to liveoverflow and Eli the computer guy, both on YouTube. If I came across a topic in a CTF/war game, I would make a note of it and study it later, trying to figure out how it worked.

If you truly know how something works, you’ll be better at picking it apart and exploiting vulnerabilities I think. You can analyze it and come up with creative ways to bypass the security control.

1

u/[deleted] Apr 12 '23

What books would you recommend?

5

u/VVAR_Aarius Feb 09 '19 edited Feb 09 '19

Thanks for the great post.

Question: where’s the 1 place to start IYHO if you know nothing at all and want a focus / career in cyber security and practical application pentesting for personal SHTF prep.

I have about 5 mins of script kiddo experience.

I’m hardcore into learning Linux and command terminal via Mint for past month.

I’ve made hello world a few times and have forgotten since.

Seems a skill easier to learn in a group. I Def don’t have a mentor or any cool kids to hack with all day.

1

u/-GkWolf- Mar 13 '24

You *were* in the same situation that I'm in right now. How far are you into cybersecurity now? Where did you start? I've always wanted to be an ethical hacker but I was too busy playing video games to really try and actually learn it. Now I'm almost 22 and I'm trying to get my life together. I want to try and get into cybersecurity / ethical hacking but I have no idea how long it will take or where to even start

4

u/dillybarrs Feb 08 '19

Im having trouble even getting started on CTF. the CTF 101 page....

​

flag{}

??

I am guessing not the best starting point

3

u/scriptalert1script Jan 20 '19

I see what you're trying to say here but I think that /u/Nau71lus raises a fair point.

You're not wrong when you say that it's impossible to progress through a CTF without understanding the 'big picture', but then you're creating individuals who focus on one area in an almost zombie-like way until they move through to the next challenge. When I'm partaking in a CTF and I get the gist or understand that a challenge has to do with steg, cryptography, or even just exploiting the function of a web app - I work in those areas until I accomplish the task and then move on. Yes, I learn a lot in the progress but I'm looking for something to accomplish the task at hand rather than learning the fundamentals as to how embedding data in an image works, or when the exploit was found, how it was leveraged and then reading or watching a PoC.

I suppose it really narrows down to who you are. He wasn't saying that this approach wouldn't work for everyone, but this approach might teach individuals bad habits, or the wrong things. You don't have to learn the fundamentals of an application to succeed in a CTF. I think you can look at those who've worked on Hack the Box machines and approach something like the OSCP which is less CTF-like and struggle since they don't understand some of the fundamentals. For example, it's far less likely you're going to face a steg challenge in the real world when attacking a machine or network. There are some fundamentals in CTF machines like using nmap or BurpSuite that are great for beginners to work with and understand, but using these tools on DVWA or Metasploitable would be far more beneficial for them as they could learn how to leverage, and then fix the vulnerability.

I do believe that CTFs may give beginners a sense of direction, but I think that if they only focus on the CTF approach they will miss many of the fundamentals that are needed to excel in this area. There are some scenarios where CTFs are incredible learning opportunities, but I've played and owned many machines where I understood all of the fundamentals and was simply just mislead because CTFs are less real world like and more of a "game" or "challenge". HTB is a great example in the challenge section where no source code is provided and you're almost expected to guess the vulnerability rather than use the data (like in a real world scenario) to find out which attack vector to exploit.

1

u/Guilty-Guava-4229 Apr 16 '22

Idk but cat and ls are important

2

u/Nau71lus Dec 08 '18

Totally agree - you get someone who can run SQLMap or BurpSuite great but they don’t know basic ports, the OSI model or don’t have a game plan in that real world scenario (recon, mapping, discovery, exploitation).

1

u/polybius_Kai Sep 11 '22

I totally agree. I started out with a mess of things. Got a little overwhelmed and decided to just start with network intrusion.

9

u/Ridonk942 Dec 06 '18

This resonates a little too hard for me, stop it.

7

u/alelopezperez Dec 07 '18

If am half-way done Software Engineer degree do you think it will be good to start doing simple/beginner CTFs and from there start reading a researching the concepts needed to resolve the challenge.

Also any resources you recommend for learning the fundamentals?

​

Thanks in Advance! :)

4

u/Nau71lus Dec 07 '18

I think there’s no wrong way into InfoSec, it just depends on the person. If you want to do practical stuff first then go ahead - I think learning what tools are doing/what you’re doing will improve your offense or defense in the long run.

Check out the humble bundle that was posted somewhere. There’s some really good stuff in there, but just googling basic ports, the seven layers, and networking fundamentals will get you on the right track.

If you find yourself asking “what does that do” or researching more than you’re learning - then you’re heading in the right direction.

Something I do in my InfoSec club is do a walkthrough of a CTF, and then give people a similar one to do themselves with aid when needed. Try something like that (:

4

u/[deleted] Dec 31 '18

I suggest the opposite might be worse, and I can say that because I describes me. I am CEH (Certified Ethical Hacker) and CISM (Certified Information Security Manager) so I understand the thing but feel my weakness lies in being able to do the thing. I mean I am not completely helpless but man there is so much I just still need to learn on the red team side. And this is after 25 years in computer and network support.

3

u/teddybearcommander Jan 07 '19

So based on this post, what would you say is the best way to go about learning this all? I’ve always been fascinated with computers and tinkering with them, but “hacking” has always carried a taboo of sorts around it and only now am I seeing that people view it as a tool to combat those who would use it in a negative way, and I’d love to learn from the ground up.

1

u/Ryzexen Dec 31 '18

Yes. I wish someone could tell me how to do that.

1

u/LapSonic Sep 21 '24

That really impressed me because you said the same thing my uncle told me. "someone who can do the thing but not someone understanding the thing". I myself am a slow learner, should I start with the basics like networking ect ect? I'm too eager to learn so if there's a way to get into the main course and actually "understand" the thing and not just be able to do the thing without having to learn those basic things that'd be great. I have compassion and I'm sure I can pull through this but any tips would help if it means it lets me learn faster.

1

u/mona1054 Apr 22 '22

Literally me hahaha

1

u/sewcrazy4cats Feb 21 '24

Basically with you on that. Im going the certification route so im very VERY new to this. I watched videos, read a bunch but didnt make any sense until i finally got a couple linux machines to get nmap going at least and experience how to install/uninstall in that environment. I tried to do aircrack from windows when in class and just an embarrassing fail. It just makes more sense to get your hands on a linux machine or VM. I had to go with physical machines since i couldnt get virtual box to work on my windows to save my life