How to start hacking? The ultimate two path guide to information security.

We should make this a sticky, we could reduce 50% of the posts here.

I don't know if the CTF path will work for everyone.

I believe some individuals would be better off learning the fundamentals to networking, learning how to work in a Linux environment, and then slowly progressing to a CTF environment.

Otherwise you may end up with someone who can "do the thing" but not understand "the thing".

Been subbed here for about 2 months, this is the first post I actually found worthwhile, thanks.

There is a MASSIVE flaw in this suggestion. CTF's are amazing to put what you have learned to the test... but CTF's are not going to teach you core fundamentals. Every hacker should aspire to know not only the big picture but all the individual pieces that make up the puzzle. No CTF is going to help you memorize the 4 layers of the TCP/IP stack and the 7 layers of the OSI model. Not that knowing those two things are essential but a basic understanding of Networking (at least) ABSOLUTELY is. You could spend the next year playing with CTF's everyday and only learn a quarter of what you could learn in a single CISCO networking course. I just feel that there is no substitution for really sitting down and studying the craft. Listen to a Defcon talk while you take a free Python class on www.CodeAcademy.com, spend 30 minutes a day on a free class with www.Cybrary.com and another 30 minutes reading one of Kevin Mitnick's book to help immerse yourself into the world and mindset of a hacker. I can only speak for myself but I had to break some bad, lazy habits. CyberSecurity saved my life and made me a better person. I feel like a part of that was making myself sit down and crack open a book for at least an hour a day, it helped create discipline. I got a hold of "The Basics of Hacking and Penetration Testing - by Pat Engebretson on Syngress Press." By the time I finished it, I COULD NOT WAIT to restart it because I was getting apparent, noticable results. CTF's are totally kickass, I endorse them fully (who the hell wouldn't?!) but if learning is your goal I feel there's faster ways to make gains. When it comes to practice though, there's nothing on earth better than a CTF.

Bookmarking this

[removed]

I think that you missed the third way which may be linked to ctf path but they can be independent. Read read and read books and articles about how things work in network and computer world. If you are doing ctf you will need to read and learn how things work but you still can read without ctf.

I’m really interested in becoming an ethical hacker. I’m getting a late start at the age of 30 and I am not very familiar with any of it, but I am pretty good with electronics and software. Im gonna humble brag a little but I think I have a good mind for it. I’m a critical thinker/can think outside the box and I’m a good problem solver maybe even a problem solving addict lol. The idea of doing it for a living isn’t just a dream it’s something I am willing to give my all. Thank you for this information. Does anyone have any recommendations for a starter machine and OS that would be best as I learn and progress?

another fact to add would be~ you need to be committed towards it and have patience. You won't become a hacker over night. You will have to read lots of books related to hacking. To get started you need to have the following requirements.

Programming Languages:

Learn C, Assembly, C++ for system hacking.

Learn any object oriented programming - C++ or Java or C# whichever you are comfortable with

Learn PHP, Python etc for website related hacking

Master SQL in order to perform SQL Injection on website and retrieving information or gaining unauthorized access to the database

1. Computer Networks

Its a heart of hacking. First learn basics of network. Learn TCP/IP suite and learn how things actually work on the network

1. Linux

Get used to linux environment. In order to start with linux go for Ubuntu since its debian based user friendly OS. Learn commands and get used to commands to ease your work while working on Kali Linux(Linux distro for penetration Testers)

-----

After all that you should get started with the practicals. To get started with practicals you should have the following things.

1. Virtual Box or VMWare Workstation:

Used to create virtual environment for practicing hacking and perform penetration testing. Install kali linux, one or more windows OSes and metasploitable linux(intentionally vulnerable linux) in your Virtual box or VMWare workstation.

You can also install Kali linux on your hard disk and create virtual windows OSes and linux. Choose whichever you are comfortable with.

1. Kali Linux:

Its a debian based linux distro meant for penetration testers. There are n number of tools already built in to distro viz Nmap, Wireshark, Burpsuite, OWASP ZAP, Metasploit to name a few. Learn how to use the tools by either google searching, going through hack related sites and youtube videos. Now use Kali linux to perform penetration testing on windows or metasploitable linux.

It probably goes without saying that to become a hacker you need some basic computer skills. These skills go beyond the ability to create a Word document or cruise the Internet. You need to be able to use the command line in Windows, edit the registry, and set up your networking parameters.Networking SkillsYou need to understand the basics of networking, such as the following.DHCPSubnettingIPv4IPv6DNSRouters and switches VLANsOSI modelMAC addressing ARPAs hackers are often exploiting these technologies, the better you understand how they work, the more successful you will beLinux SkillsIt is extremely critical to develop Linux skills to become a hacker. Nearly all the tools a hacker uses is developed for Linux and Linux gives us capabilities that we don't have using Windows .Security Concepts & Technologies A good hacker understands security concepts and technologies. The only way to overcome the roadblocks established by the security admins is to be familiar with them. The hacker must understand such things as PKI (public key infrastructure), SSL (secure sockets layer), IDS (intrusion detection system), firewalls, etc .Wireless Technologies In order to be able to hack wireless, you must first understand how it works. Things like the encryption algorithms (WEP, WPA, WPA2), the four-way handshake, and WPS. In addition, understanding such as things as the protocol for connection and authentication and the legal constraints on wireless technologies. Scripting Without scripting skills, the hacker will be relegated to using other hackers' tools. This limits your effectiveness. Every day a new tool is in existence loses effectiveness as security admins come up with defenses. To develop your own unique tools, you will need to become proficient at least in one of the scripting languages including the BASH shell. These should include one of Perl, Python, or Ruby. Database Skills If you want to be able to proficiently hack databases, you will need to understand databases and how they work. This includes the SQL language .Web Applications Web applications are probably the most fertile ground for hackers in recent years. The more you understand about how web applications work and the databases behind them, the more successful you will be. In addition, you will likely need to build your own website for phishing and other nefarious purposes .Forensics To become good hacker, you must not be caught! You can't become a pro hacker sitting in a prison cell for 5 years. The more you know about digital forensics, the better you can become at avoiding and evading detection .The beginner hacker must understand TCP/IP basics, but to rise to the intermediate level, you must understand in intimate details the TCP/IP protocol stack and fields. These include how each of the fields (flags, window, df, tos, seq, ack, etc.) in both the TCP and IP packet can be manipulated and used against the victim system to enable MitM attacks, among other things. Reverse Engineering Reverse engineering enables you to open a piece of malware and re-build it with additional features and capabilities. Just like in software engineering, no one builds a new application from scratch. Nearly every new exploit or malware uses components from other existing malware. Think Creatively There is ALWAYS a way to hack a system and many ways to accomplish it. A good hacker can think creatively of multiple approaches to the same hack. Problem-Solving Skills A hacker is always coming up against seemingly unsolvable problems. This requires that the hacker be accustomed to thinking analytically and solving problems. This often demands that the hacker diagnose accurately what is wrong and then break the problem down into separate components. This is one of those abilities that comes with many hours of practice. Persistence A hacker must be persistent. If you fail at first, try again. If that fails, come up with a new approach and try again. It is only with a persistence that you will be able to hack the most secured systems.

All The Best!

I study engineering (optics and lasers) and information security/hacking has always fascinated me. Many thanks for this.

Rule 101. Knowledge should be free this is what hackers believe. Now i am not saying that you shouldn't buy a course I am just saying many Hackers are self-taught ,In order to become a good hacker, ethical or no, you need to know programming, operating systems and networking. Start with one of those three depending on what you want to hack. Let’s say for example you want to hack websites. The first thing you need to do is learn to code websites if yoy want to be any good. Don’t even think about hacking yet. Start with a full-stack PHP framework. Learn HTML, CSS, JavaScript, PHP, and SQL. Learn about the OSI model, especially the application layer protocols too. But build websites with client-server applications or network-based applications. Do that for six months at least and then (and only then) will you be able to be able to hack websites. Otherwise you won’t get very far. If you don’t like learning to code for fun and if you don’t like learning how stuff works, you cannot ever be any kind of hacker. In this case purchase a Udemy course on full-stack web development and start learning.

Another example is if you want to hack wireless networks, VoIP, wireless devices, Bluetooth, etc. Research wireless networking. Look up on YouTube computer networking and see if you like what you are learning about them maybe buy books on computer networking which exist. Maybe you could buy The TCP/IP Guide or maybe a book on CISCO networking. Maybe get a Udemy course on Network+. Work on it for a long time but learn how networks work, especially networking protocols but learn everything you can about how they work not just protocols. Once you get basic computer networking skill only then you will be able to learn to attack 802.11, Ethernet, Bluetooth, etc. networks. If you want to exploit operating systems then you need to learn how operating systems work. You can get manuals on just about any operating system and yes OS X and MacOS are just as easy to hack as Windows or Linux and Apple knows it and Apple even has a bug bounty program (which I will talk about soon for you). Once you know how operating systems work and have sufficient experience working with them, only then will you be able to learn to exploit them. After you do that, and only after you do that, go to Udemy hacking courses, get hacking books, go for online tutorials on hacking etc. To be extremely good it’s always ideal to have a specialty, but still be well-rounded. What I mean is there’s no way to know everything about everything. You need to have an area of hacking you like most. Different areas include: Web hacking - exploiting flaws in web application code to get usernames and passwords, give a thousand upvotes on a website when you are only are allowed to give one, defacing websites, and a whole lot more Mobile app hacking exploiting flaws in mobile application code; similar to web hacking but where you plug your smartphone into your computer and actually attack the applications on your phone from the computer, like hacking Snapchat or WhatsApp messages for example Wireless hacking - finding a way to break into a car and control via Bluetooth as opposed to hot wiring, hacking a router for a WiFi password maybe even hacking an iPhone or desktop that is on the same network as you or performing a man-in-the-middle attack to get the web history of someone on the same network as you Internet of Things hacking - combo of wireless hacking and hardware hacking that allows you to hack a smart fridge, thermostat, Bluetooth connection of a car, someone’s smartwatch, and loads of other devices Reverse engineering - breaking software apart to see the assembly level code, not the original source code, then exploiting that assembly code in order to get something to happen that the original programmer didn’t intend to happen; this one is useful combined with web hacking, mobile app hacking, or even operating system and server exploitation Operating system and server exploitation involves exploiting flaws in the operating system of either a normal client computer or even a server in order to get access to that person’s files, documents, etc. stored on their hard drive Hardware hacking - taking hardware apart and modifying it, putting it back together a different way, and reusing it for something it wasn’t intended to do; can be combined with wireless hacking to help gain access to companies’ networks or even their private devices Hacking using a programming language to make your own tools - this one you can start building your own tools when gain some skill but is more to help you in the areas of hacking you study There are other areas of having too but those are some of the more common ones. Once you know how stuff works, then get Kali Linux or whatever Linux OS you want and learn. But have one area of interest. Be especially well practiced in one or two areas, but know the basics of several .But keep repeating the process of learning how stuff works, then learning to hack that stuff. When you are good at several but have two or three chosen areas you are especially good at, then you can get a job as an ethical hacker and be good at it.

The quintessential areas of hacking are: WiFi hacking, network hacking, web hacking, reverse engineering, server exploitation, exploit development, and programming (most important one), social engineering, etc, Some additional areas you can learn are mobile application hacking, iOS hacking, Android OS hacking, Open source intelligence, different sub areas of reverse engineering (browser hacking, operating system reverse engineering, video game hacking, etc), database hacking (because you can go further than just what’s required for web hacking in terms of being an expert at database hacking, advanced VoIP hacking, hardware hacking, CISCO device hacking, Juniper device hacking, cryptography, and many many more…. "Note" Stay updated and continuously learn: The field of cybersecurity is constantly evolving, so it's crucial to stay updated with the latest trends, vulnerabilities, and attack techniques.

It's time to finally draw a line between hackers and cybersecurity researchers. I'm tired of walking into hacking rooms only to find a bunch of neckbeards talking about "being ethical." No offense to anyone, but when can we finally say that cybersecurity is not hacking and a rectangle is not a square? Clarity please!

Want to start hacking. Lesson 101 is social engineering.

[removed]

Thank you so much for this!

I am really curious about learning this stuff, but I'm really not sure what I would use it for.

What are examples of real world issues that can be solved with this stuff?

hackthebox.eu has a bunch of hacking exercise things. Pretty much CTF hacking. You have to hack to get an account :D.

this post changed my understanding of 'hacking'

So... which path are you personally recommending?

Thank you so much, this is exactly the kind of post I wanted to find in r/hacking as someone who has zero experience with hacking and wants to get into it

Thank you.

Some other good resources include https://365.csaw.io and https://ctf101.org (companion site). They're managed by NYU and are also great resources for beginners.

As far as YouTubers go liveoverflow is great.

Open To All CTF is a great community of experienced and aspiring infosec enthusiasts.

Sorry for formatting and abruptness, I'm on mobile.

[removed]

Just wondering why Hackthebox didn't make the cut?

I am a high-school graduate and I am going to start an computer science and engineering course at the university. I am only familiar with basic python. I want to explore ethical hacking as a career. So my question is that what should I focus on at the university in order to do so? Any help is appreciated

01010000 01101100 01110011 00100000 01101000 01100101 01101100 01110000 00100000 01101101 01111001 00100000 01110111 01101001 01100110 01100101 01110011 00100000 01100110 01100001 01100011 01100101 01100010 01101111 01101111 01101011 00100000 01100111 01101111 01110100 00100000 01101000 01100001 01100011 01101011 01100101 01100100 00100000 01100001 01101110 01100100 00100000 01110100 01101000 01100101 01111001 00100000 01101000 01100001 01110110 01100101 00100000 01100001 01101100 01101100 00100000 01101000 01100101 01110010 00100000 01100110 01100001 01101101 01101001 01101100 01111001 00100000 01110000 01101001 01100011 01110011 00101110 00100000 01010111 01101001 01101100 01101100 00100000 01110000 01100001 01111001 00100000 01110100 01101111 00100000 01110010 01100101 01100011 01101111 01110110 01100101 01110010

Theres a 3rd path where you just do labs and watch cringy hacking videos and slowly peice together how a network works and how a web application fits into that picture. Fake til you make it with bug bounties.

Thanks for the advices mate

and here i am learning stuff, thanks