How to start hacking? The ultimate guide to start your learning!

[SWAT 120]

Introduction to Hacking

 

 

Hacking has been a part of computing for almost five decades and it is a very broad discipline, which covers a wide range of topics. The first known event of hacking had taken place in 1960 at MIT and at the same time, the term "Hacker" was originated. 

 

 

 

Hacking is the act of finding the possible entry points that exist in a computer system or a computer network and finally entering into them. Hacking is usually done to gain unauthorized access to a computer system or a computer network, either to harm the systems or to steal sensitive information available on the computer.  

 

 

 

Hacking is usually legal as long as it is being done to find weaknesses in a computer or network system for testing purpose. This sort of hacking is what we call Ethical Hacking.

 

 

 

A computer expert who does the act of hacking is called a "Hacker". Hackers are those who seek knowledge, to understand how systems operate, how they are designed, and then attempt to play with these systems.

 

 

 

Before I begin overwhelming you with information about this subject and its teachings, it’s important to know that hacking should be completely ethical at its core. I’m not saying this to cover my ass or to prevent myself from trouble, this is how it genuinely should be. The idea here is information security. I'll say it again. Information security. The whole point is to make the world a better place. This isn't for your reckless amusement and shot at recognition with your friends. This is for the betterment of human civilization. Use your knowledge to solve real-world issues.

 

 

 

Types of Hacking

 

 

 

Hacking can be split in several different categories, based on what’s being hacked. I’ll list a few examples.

 

 

• 
   
  
• Website Hacking: Hacking a website means taking unauthorized control over a web server and its associated software such as databases and other interfaces.
   
  Network Hacking: Hacking a network means gathering information about a network by using tools like Telnet, 
   
  NS lookup, Ping, Tracert, Netstat, etc. with the intent to harm the network system and hamper its operation.
   
   
  
• Email Hacking: It includes getting unauthorized access on an Email account and using it without taking the consent of its owner.
   
  
• Ethical Hacking: Ethical hacking involves finding weaknesses in a computer or network system for testing purpose and finally getting them fixed.
   
  
• Password Hacking: This is the process of recovering secret passwords from data that has been stored in or transmitted by a computer system.
   
  
• Computer Hacking: This is the process of stealing computer ID and password by applying hacking methods and getting unauthorized access to a computer system.
   
  Social Engineering: Social engineering is the art of manipulating people so they give up confidential information. 
   
  It's a useful tactic because it is usually easier to exploit your natural inclination to trust than it is to discover ways to hack your software.
   
  

 

Advantages of Hacking

 

 

 

Hacking is quite useful in the following scenarios:

 

 

• 
   
  
• To recover lost information, especially in case you lost your password.
   
  
• To perform penetration testing to strengthen computer and network security.
   
  
• To put adequate preventative measures in place to prevent security breaches.
   
  
• To have a computer system that prevents malicious hackers from gaining access.
  

 

Disadvantages of Hacking

 

 

 

Hacking is quite dangerous if it is done with harmful intent. It can cause:

 

 

• 
   
  
• Massive security breach.
   
  
• Unauthorized system access on private information.
   
  
• Privacy violation.
   
  
• Hampering system operation.
   
  
• Denial of service attacks
   
  
• Malicious attack on the system
  

 

Hacker types

 

 

 

Hackers can be classified into different categories such as white hat, black hat, and grey hat, based on their intent of hacking a system. 

 

These different terms come from old Spaghetti Westerns, where the bad guy wears a black cowboy hat and the good guy wears a white hat.

 

 

 

White Hat Hackers

 

 

 

White Hat hackers are also known as Ethical Hackers. They never intent to harm a

 

system, rather they try to find out weaknesses in a computer or a network system as a

 

part of penetration testing and vulnerability assessments.

 

Ethical hacking is not illegal and it is one of the demanding jobs available in the IT industry.

 

There are numerous companies that hire ethical hackers for penetration testing and

 

vulnerability assessments.

 

 

 

Black Hat Hackers

 

 

 

Black Hat hackers, also known as crackers, are those who hack in order to gain

 

unauthorized access to a system and harm its operations or steal sensitive information.

 

Black Hat hacking is always illegal because of its bad intent which includes stealing

 

corporate data, violating privacy, damaging the system, blocking network communication,

 

etc.

 

 

 

Grey Hat Hackers

 

Grey hat hackers are a blend of both black hat and white hat hackers. They act without

 

malicious intent but for their fun, they exploit a security weakness in a computer system

 

or network without the owner’s permission or knowledge.

 

Their intent is to bring the weakness to the attention of the owners and getting

 

appreciation or a little bounty from the owners.

 

 

 

Miscellaneous Hackers

 

 

 

Apart from the above well-known classes of hackers, we have the following categories of

 

hackers based on what they hack and how they do it.

 

 

 

Red hat hackers

 

 

 

Red hat hackers are again a blend of both black hat and white hat hackers. They are

 

usually on the level of hacking government agencies, top-secret information hubs, and

 

generally anything that falls under the category of sensitive information.

 

 

 

Blue Hat Hackers

 

 

 

A blue hat hacker is someone outside computer security consulting firms who is used to

 

bug-test a system prior to its launch. They look for loopholes that can be exploited and

 

try to close these gaps. Microsoft also uses the term BlueHat to represent a series of

 

security briefing events.

 

 

 

Elite Hackers

 

 

 

This is a social status among hackers, which is used to describe the most skilled. Newly

 

discovered exploits will circulate among these hackers.

 

 

 

Script Kiddie

 

 

 

A script kiddie is a non-expert who breaks into computer systems by using pre-packaged

 

automated tools written by others, usually with little understanding of the underlying

 

concept, hence the term Kiddie.

 

 

 

Neophyte

 

 

 

A neophyte, "n00b", or "newbie" or "Green Hat Hacker" is someone who is new to hacking

 

or phreaking and has almost no knowledge or experience of the workings of technology

 

and hacking.

 

 

 

Hacktivist

 

 

 

A hacktivist is a hacker who utilizes technology to announce a social, ideological, religious,

 

or political message. In general, most hacktivism involves website defacement or denialof-service attacks.

 

 

 

If you've come this far, congratulations. Hell, it might even be time to give yourself a pat on the back.

 

By now, I hope that you've realized that there's no singular all-determining path to 'hacking', as it comes from knowledge from all areas that eventually coalesce into a general intuition. While it may be true, I'll do my best to narrow it down for you. There's basically two rapid learning paths to "hacking".

 

 

 

 

The first path

 

 

The first path is the most simple, effortless and instant result path. It involves watching YouTube videos with green and black thumbnails with an occasional anonymous mask on top teaching you how to download well-known tools used by thousands daily - or in other words the 'Kali Linux Copy Pasterino Skidder'. You might do something slightly amusing and gain a bit of recognition and self-esteem from your friends. Your hacks will be 'real', but anybody that knows anything would dislike you as they all know all you ever did was use a few premade tools. Most of you can make up your own guess of the shallow result oriented communities that can be fitted to this path. A lot of them are filled with kids that pretend they know what they're dealing with.

 

 

 

 

The second path

 

 

The second path is the most intensive, rewarding and mentally demanding. It's also the path which is much more fun according to me, and if you find like minded people to do it with. It involves learning everything from memory interaction with machine code to high level networking, all while you're trying to break into something. This is where Capture the Flag, or 'CTF' hacking comes into play, where you compete with other individuals/teams with the goal of exploiting a service for a string of text (the flag), which is then submitted for a set amount of points. It is essentially competitive hacking. Through CTF you learn literally everything there is about the digital world, in a rather intense but exciting way. Almost all the creators/finders of the major exploits have dabbled in CTF in some way/form, and almost all of them have helped solve real-world issues. However, it does take a lot of work though, as CTF becomes much more difficult as you progress through harder challenges. Some require godlike mathematics to break encryption, and others require you to think like no one has before. If you are able to do well in a CTF competition, there is no doubt that you should be able to find exploits and create tools for yourself with relative ease. The CTF community is filled with smart people who can't give two shits about elitist mask wearing twitter hackers, instead they are genuine nerds that love screwing with machines. I could be writing another hundred pages easily, but I've covered most of the bases needed for you to start. Remember, the only impossible journey is the one you never begin. All you need now is to give yourself a push in the direction you want to take.

 

 

 

Here's some sites that I can strongly recommend:

 

 

• 
   
  
• https://ctftime.org/ctf-wtf/ - What is CTF?
   
  
•  - An introduction to security Capture The Flag competitions
   
  
• http://www.liveoverflow.com - Hands down one of the best places to learn.
   
  
• https://ctf101.org/ -CTF compact guide
   
  
• https://ctftime.org/ - Upcoming CTF events online/live team scores
   
  
• http://captf.com/practice-ctf/ - Full list of all CTF challenge websites
  

 

Tip: Stay away from tool oriented offensivesec oscp ctf's, they teach you hardly anything compared to these ones and almost always require the use of metasploit or some other program which does all the work for you.

 

 

• 
   
  
• http://picoctf.com - Very good if you're a beginner. Primarly designed for high school students, while the event is usually new every year, it's left online and has a great difficulty progression.
   
  
• http://pwnable.tw/ - Offers a newer set of high quality pwnable challenges.
   
  
• http://pwnable.kr/ - One of the more popular recent wargamming sets of challenges.
   
  
• https://microcorruption.com/login - It has one of the best interfaces, a good difficulty curve and introduction to low-level reverse engineering, specifically on an MSP430)
   
  
• http://ctflearn.com/ - A new CTF based learning platform with user-contributed challenges.
   
  
• http://reversing.kr/
   
  
• http://hax.tor.hu/
   
  
• https://w3challs.com/
   
  
• https://pwn0.com/
   
  
• https://io.netgarage.org/
   
  
• http://ringzer0team.com/
   
  
• http://www.hellboundhackers.org/
   
  
• http://www.overthewire.org/wargames/
   
  
• http://counterhack.net/Counter_Hack/Challenges.html
   
  
• http://www.hackthissite.org/
   
  
• http://vulnhub.com/
   
  
• http://ctf.komodosec.com
   
  
• https://maxkersten.nl/binary-analysis-course/ - Practical binary analysis course
   
  
• https://pwnadventure.com
  

 

 

Now that I've worked my fingers to the bone, it's time to rest. Thank you for reading, and good luck on your journey!

[tmx 0]

Thank you for the amazing tutorial is there any specifics a green hat hacker could do through the second path?

[Ibuprofen0 0]

High quality post, my friend. Thanks, super appreciated it!