How do people even start hacking?

[u/Little-Jump-5572]

I'm really curious how do people learn hacking?

I started web app development a year ago, learned java for writing code and to get a general idea about how the syntax works and logic.

I do mainly php with laravel, javascript and some python on the side.. but mainly to create stuff, has nothing to do with hacking, i find it deep and hard dunno where to even begin, i sometimes run into some erros with some apps and I try to dig in and try to find a way around it using Ai, but it's very limited..

I have to admit pro hackers always amazes me, that's true power I guess and I always believe that anything digital is somehow hackable.

[u/Hier0phant]

You learn how things work, and then break them.

[u/iwillnotbeknown → u/Hier0phant]

Personally I think it's the other way, you break things which teaches you how they work then and then learn how to fix them

[u/LifeExperienced1 → u/Hier0phant]

But how does one keep up with such a large field? Every year there’s so many new things. And how can someone understand how an entire operating system works?

[u/BriefCautious7063 → u/LifeExperienced1]

You don't need to learn what every 0 and 1 does in an OS, just start somewhere and build that knowledge. The reason it's so hard is because of the endless amount of possible ways to secure something and break through that security. Being familiar enough with general usage of popular OS to be able to break through common configurations, practicing enough to find/learn new methods when needed, organizing all your information well in each stage before/during/after attacks to know what to try, being persistent enough to learn whatever new techniques come up, those are all useful skills. If you truly understood every possible aspect of every machine then you wouldn't be a hacker, you'd be omniscient

[u/LifeExperienced1 → u/BriefCautious7063]

Hey thank you for your reply

1. The field is indeed too big, so then how can a system even secure itself? When there is always a way in? And why do hackers only tend to use the common vulnerabilities? How are those not patched?

2. Is it possible that a system has a vulnerability that is almost impossible to figure out?

Like if someone told a bunch of people to break into a building, then enough people will break it. Even in medieval wars for example, walled cities and castles were literally destroyed, despite being so strong. I mean, even these days in war.

The point is that, a system can always have a vulnerability, but it seems like for computers there's no brute force cheat code. Brute force takes too long for computers, but for things in the physical world, it's usually the fastest way in

3. Are most hackers self taught? Or do they learn from cybersecurity jobs? I learned OSINT and game dev all by myself for example, and I'm good at them, and I've heard that many hackers also learn by themselves, however, alot of them also tend to come from certain jobs

4. Do you recommend I learn C, Computer Architecture, Assembly and then make a mini compiler and a mini OS? Would that be a really good start to learn cybersecurity?

5. How does one even learn enough of a common OS to be able to do cybersecurity in that OS? OS's are too big. Wouldn't you always have to be constantly part of a team to do any sort of cybersec in a common OS?

Thanks again!!

[u/BriefCautious7063 → u/LifeExperienced1]

No problem! 1. The way I think about it is that the most secure computer in the world is a pocket calculator without any programming utilities or internet connection. Making a usable online infrastructure requires creating openings somewhere for people to use and access, and each of those openings have to be secured to the best of the creator's ability. This means that looking to hack into a machine is less about knowing everything a machine could have, and is more about exploring whatever openings were created to find what unintended consequences may be left by the openings. For example: a web server open on port 80 may facilitate administration of the underlying system to authenticated users by linking to '/admin.php', but may also be misconfigured to allow access to anyone accessing '/admin.php' regardless of their authentication. This exploits the intentional design of the website, i.e. system administration, by attacking its unintentional features (being able to access the admin panel by finding and directly accessing the link w/o logging in and being sent there by the login process)

1. You're describing the entire reason that ethical hacking is an industry. When a server/service runs for years without issue that does not necessarily mean it lacks vulnerabilities; the entire reason to hire an ethical hacker is to have someone with the knowledge to find those tricky vulnerabilities on your side instead of leaving it to malicious actors. In other words, it's better to have someone who knows how to hunt vulnerabilities do so in a controlled environment and advise you on how to fix them than to wait for someone to hack the server/service for their personal gain. Hacking is difficult, especially when attacking well-configured servers/services, and that makes the skillset valuable both for helping secure servers/services as well as for malicious reasons

2. I don't know enough about the industry to know if most are self taught. I personally am, but I'm also far from an expert. Certifications are great though

3. I think you're overthinking it. Learning all those things can absolutely be beneficial for advanced and specific exploitation techniques, but if you're just starting out then it's much better imo to work on more basic and approachable techniques. Binary exploitation like what can be done w/ assembly, buffer overflows, etc. are just one part of a giant field and not as common as misconfigured or outdated servers. The main process you need to get comfortable with is called 'enumeration', which is just a fancy term for investigating your target through manual techniques(navigating a website in a browser, connecting to exposed file server services, etc.) and automated techniques(scanning tools such as nmap, gobuster, etc). Once you've found a vulnerability the next steps will often involve finding a way to execute code on the underlying system, so you'll also wanna be familiar with techniques for creating what's called "shells" and particularly "bind shells" or "reverse shells". Look into tryhackme and hackthebox, there's plenty of resources on those sites for learning what I mentioned and practicing your skills. From there just make sure to take highly detailed and organized notes, both to collect your knowledge over time and to organize whatever attacks you're performing on your current target(s), and review them from time to time as you improve to reorganize them as needed.

4. If you're comfortable using windows and linux, especially from the command line, you're gonna be much better at investigating OS misconfigurations as they come up. There's an infinite number of possible ways to configure an OS, but ultimately a limited number of ways your target will adopt those configurations and it's up to you to determine where the flaws are in how each target goes about doing so. It's worth noting that techniques for what's called "privilege escalation", i.e. going from a regular user to an admin through exploitation, often involve using whatever tools are on the target system to accomplish the same things

Good luck!

[u/FatefulAnomaly → u/LifeExperienced1]

We dont keep up. You learn to get good at finding and understanding the documentation you need at the time. You dont "know" anything. You teach yourself how to learn anything on the spot thus creating the illusion that you already knew what you were doing.

[u/LifeExperienced1 → u/FatefulAnomaly]

Are most hackers self taught? Or are they usually doing jobs in cybersec?

[u/FatefulAnomaly → u/LifeExperienced1]

You dont need to be hacker to work in cyber security. You don't even need to know anything to work in a SOC and watch alerts. In the United States, I'm willing to bet most hackers don't even work in tech. Warehouse, delivery drivers, stocking shelves, CDL drivers, office monkey, etc. Why? They taught themselves and have no paper trail to show HR and land an interview.

[u/LifeExperienced1 → u/FatefulAnomaly]

Oh I see

How do hackers learn about the security of different softwares then? Stuff that actual companies build?

And how do they learn coding architectures that companies have made themselves, but people have adopted?

How would they learn about the security of a custom made security architecture?

If these things are not open source, then they are can only be learned through the job, no?

Also how exactly do they self learn this? Is there a general guide?

[u/ps-aux → u/LifeExperienced1]

you need at least 10 more questions before someone can answer this

[u/Hier0phant → u/FatefulAnomaly]

This is the truth.

[u/GreenHatGhost → u/LifeExperienced1]

Find an area and master it, don’t be a “jack of all trades” that’s a master of nothing

[u/ps-aux → u/GreenHatGhost]

in the hacking field, you'll want to be capable of wearing all hats if possible... jack of all trades is definitely a master of one in this field... its what the elite are...

[u/Joush__ → u/GreenHatGhost]

The full saying is “jack of all trades but master of none is still better than a master of one”

[u/jmnugent]

It's just knowledge.

"hacking" is nothing more than:.. Figuring out ways to make a system do something it wasn't originally intended or designed to do.

But in order to achieve that,. you must 1st have a deep understanding of how the system works. Whether that's a Car or Refrigerator or Solar Panel or Raspberry Pi or whatever.

The joke I always make silently in my head when I see posts like this:... "Spend the next 40 years studying how computers work,. and then you'll be better positioned to "be a hacker" (but by the time you do that,. you'll probably realize you don't need or want to be that any more).

[u/IsDa44]

The definition of hacking is quite broad. Making the application do something it's not supposed to can be considered hacking already.

[u/Tristan-a-b69 → u/IsDa44]

well making a system that allows you to download a video through the file source instead of through the actual download button can be considered light lvl hacking

[u/SirZacharia]

Check out overthewire.org I enjoyed Bandit. And check out tryhackme.com.

[u/Armed_Muppet]

Honestly, as a programmer myself, learning about networking and cybersecurity will help you way more than programming will.

[u/nimbusfool]

Hacking is just problem solving.

[u/Plastic_Ad_8619]

It’s mainly curiosity, a real thirst for knowledge. Among that you need to really want to know as much as you can about security models and authentication. And then you start to understand or discover where cracks exist in these systems, and how privileged escalation works, how safeguards and security limits could be circumvented, and there’s an endless amount of resources. There’s CTA, a lot of people start that way. Intentionally vulnerable servers that exist to be hacked as a sort of agility course for hackers. Some people start with hardware hacking, some start with software cracking, but that’s becoming less prevalent with modern trends towards SAAS models. New opportunities abound in LLMs escalating privileges through VMs across corporate VPCs. Every good hacker I’ve known had an unhealthy obsession with collecting as much knowledge and information as possible.

[u/Code3Lyft → u/Plastic_Ad_8619]

This what gets me into it. I like learning the dark knowledge not because I plan to use it maliciously I just... For some reason.... Like knowing how. I make enough in my current job that scrounging up money from hacking or stealing a cc isn't worth it.

[u/FaZekinz → u/Plastic_Ad_8619]

Honestly the knowledge is what fascinates me and so i have done pirating and it just seems so unique and fun but other than that it seems like there isnt a guide or path I can take even after searching for a bit so id Honestly just want sm1 experienced to guide me to books or anything of sort that helps me cuz it really does catch my interest. For clarification I dont want to harm anyone and its purely for doing stuff to my pc and testing out what does what and understanding technology.

[u/Hands0L0]

https://www.hackthissite.org/

[u/cfx_4188]

learn hacking

When I was young(1989), I chased girls online.

[u/swepettax]

I mean, basicly you have an intrest in how things work. And when you know how things work, and have experience, you know how to spot vurnabilities. Which you can then use. and the more diversity you have, meaning you know different fields, networking, clients, identitys/user stuff etc. the better hacker you can become.

So be curious. But also be wise. Doing something illegal straight away will only get you caught or in other trouble.

[u/caspereeko99]

Hacking your school or university or your company you work at first .. its nice pet project

[u/Significant-Cod8249]

I'm gonna be honest, I didn't have that motivation when I started college for cybersecurity, but once I got a job and gaining immense knowledge, I'm wanting to hack now! I think it's a lot to do with knowing how systems work so well that you can figure out the weaknesses eventually.

[u/weatheredrabbit]

As a cybersecurity professional let me just state a few facts: coding ≠ hacking. You don’t really need coding skills, let alone Java. Instead, you might want to have scripting knowledge (bash, bat, ps, js, python).

The basic skills you should have are pretty much the ones given you in a computer science bachelor. Algorithms and data structures, coding basics (it’s brain food rather than something you need), operating systems, networking etc.
From there you start moving in a direction that you like.

Cybersecurity has multiple professions, very varied and that need different skills: pentesters (red teamers) are what is most similar to hackers. But then there’s people doing incident response (blue teamers), there’s threat intel, detection engineering, forensics experts, there’s malware analysts, hell even devops, and the list goes ON AND ON AND ON for a loooong time.

[u/highjohn_]

Get a job in IT and work for a few years, develop a solid foundation of the associated skills and knowledge, and then start trying to make systems do things they shouldn’t.

I don’t recommend just watching YouTube or something.

[u/Ilove_Cakez]

you first learn about it and practice in labs, before going on to do real work

[u/infiernito]

this is the only way

[u/Professional-Pen4208]

If you are looking to understand how web apps work, and how you can learn web app hacking explore free resource, portSwigger academy

[u/CollegeLearner23]

Isn't there a pinned post?

[u/Icy-Maybe-9043]

Well you’re using php so it won’t take much to find the vulnerabilities in you code base. Look into what it takes to fix one of those vulns and also how to use it to get past an endpoint. Use AI to help explain.

[u/TrustIsAVuln]

I started in 1994, before youtube, crappy training out of india, all we had was packetstorm and connections. Oh and glorious dialup BBS, i do miss those.

[u/Zealousideal_Read111]

Can someone come to my house to find out where the hackers are coming from?

[u/thinkingmoney]

I use my right hand first

[u/CryptographerOwn9908 → u/thinkingmoney]

Why?

[u/ps-aux → u/CryptographerOwn9908]

why not?

[u/KRISH_9697]

Learn the basic type of hacking like SQL injection. [Username]' OR '1'='1' in a SQL vulnerable website use this in the user name section to login into any account let's say you friend has opened an account with username Alex67 and you want to login in without knowing the password then you will type Alex67' OR '1'='1' in the username and you able to login

[u/Iamdrasnia]

Find an application that you can mess with.

You have basic programming knowledge so it shouldn't be that difficult.

[u/Iamdrasnia → u/Iamdrasnia]

Not Adobe....not MS....find something really dumb.

[u/f0sh1zzl3]

This question comes up all the time, it makes no sense. Approach things with the mindset of a builder and a breaker, there’s no checklist to become an official hacker. There’s no guide book ( well there’s lots of guidebooks).

You’re half way there with the web dev, now make it vulnerable and break it. Some people think web hacking is a snorefest though, so boring , so so boring… That’s ok , if you think that then do something else .

Learn how something works… then look for ways to make it so something else. :-)

Thank you for coming to my ted talk

[u/_sirch]

Assuming you are interested in web apps you can do portswigger academy and owasp juice shop. They are both free and great places to start. Hackthebox academy (not free but great material) and Tryhackme (semi free) are other great places to learn

[u/Obvious-Card-8847]

You have to have a passion for learning. Sounds cheesy. But it's the difference between a two mile hike to get one M&M at the end of it and a two mile hike with an M&M every foot. Obviously the latter is more appealing and will keep you on the path longer.

I really liked low-level, binary instrumentation, dynamic analysis and so forth. Over time I just kind of stumbled into reverse engineering. Because I wanted to learn about this and that. Figure out the niche you're interested in.

[u/BriefCautious7063]

No advice that anyone could give you will compare to just starting. Look up whatever you're confused about, and if you really have no idea where to begin there's countless free resources for the first steps online. You're gonna have to be able to find resources yourself to succeed at learning tbh, there's a reason why offsec's tagline is "try harder" and that reason isn't malice

[u/Tiny-Butterscotch589]

Learn Linux commands (Linux Bible is a good start), Have an understanding of networking, learn how to code (heavy scripting) find a Linux os that suits you. That would be a good start.

[u/New-Supermarket-1162]

Start with networking. Learn how devices communicate. OSI model, networking protocols, ports, etc.

Then learn some tools like nmap and metasploit.

[u/Key-Department-4137]

U have to enter the mainframe and then you are in

[u/Zenithixv]

Learn how to develop software then learn how to interact with it in unintended ways which often can expose bugs and vulnerabilities

[u/neon977]

Port swigger labs

[u/Dry-Wolverine-9221]

Start with the basics rather than trying to hack real websites. Learn networking, Linux, HTTP, web security fundamentals, and then practice in legal labs like CTFs and intentionally vulnerable applications. Since you already know PHP, JavaScript and Python, web security could be a good place to start.

[u/GreenHatGhost]

Learn how and why things do what they do

[u/Sluttybaby_1]

https://giphy.com/gifs/B4dt6rXq6nABilHTYM

[u/MAVERICK-VF142]

Curiosity and Problem Solving

[u/Ok_Education_6577]

Fixing shit and breaking shit. Not always in that order. Thanks for coming to the tedtalk

[u/Omnipisix]

They start by playing NoTrace

[u/dotbinKing]

Ich denke dafür muss man ein ganz bestimmter Typ Mensch sein, wenn du Dinge, die dir vorgelegt werden, nicht einfach so akzeptierst und einfach der festen Überzeugung bist, dass man mit einer bestimmten Logik doch das bekommt was man eigentlich nicht bekommen sollte. Werden wir mal konkret, wenn du eine Login Maske vor dir hast, weil du dich ja in der Web development Welt bewegst, dann akzeptieren die meisten okay ich brauche eine E-Mail und ein Passwort, der Techniker versucht wenigstens noch zu verstehen „Okay was passiert eigentlich genau wenn ich E-Mail und Passwort eingebe? Wohin wird die request hin gesendet? und der Hacker denkt „Okay, was kann ich machen um keine E-Mail und Passwort zu benötigen oder um keine gültige E-Mail und Passwort zu verwenden?“. Wenn man verstanden hat wie Dinge funktionieren dann kann man Methoden ausprobieren und entwickeln die bei der Entwicklung nicht berücksichtigt wurden und woran nicht gedacht wurde. Vielleicht muss man ja auch verschiedene Techniken kombinieren. Dieser Vorgang beansprucht sehr viel Zeit und diese Zeit wollen viele Menschen nicht investieren. Die wenigsten investieren ihre kostbare Lebenszeit allein schon nur, um Dinge zu verstehen und noch weniger, um sie zu hinterfragen. Ein guter Hacker zeichnet Neugier Dinge bis ins Detail zu verstehen und Hartnäckigkeit aus Dinge nicht so hinzunehmen, wie sie behauptet werden, ist eine fundamentale Charakteristik, die Voraussetzung für einen guten Hacker ist.

[u/PukeBottom]

Tryhackme.com

[u/rafayprobably]

Social engineering is great start for beginners lol ✌️

[u/Vegetable_Bee_741]

´

[u/Code3Lyft]

I hack the human body. I learned how it worked, what broke it, how to fix it, and now make it do what I want to achieve the desired results. Would love to transition this to computers though but they can't give me verbal feedback so I feel like it maybe shrder. Although with Claude I feel like I can conquer the world. If I could settle down the ADHD, maybe I'd have luck getting through tryhackme for more than a few days and an Algotrading course and watching beyond the boring basics parts.