[double07]

OK.

So, after reading Anima Templi's thread of "Where to start hacking!" I picked one of types => Web Hacking.

So, I learnt PHP, MySQL and I am finishing with learning JS (btw I am learning from w3schools.com), and what I am asking for atm is "What should I do next?". Where should I start hacking, any labs, or simulations etc. I want to get some exp. so I can get into some serious stuff. Any advice or reference?

[unnamed]

You first need to stop learning from w3schools.
I may sound harsh, but w3schools doesn't get you far, in fact some of their codes are outdated or badly written.

Check amazon.com for a good source of ebooks, you can either buy them or use google.


My 2 cents.

[double07]

No, not a problem at all.
Do you have any reference?

And, thank You for advice about w3schools. Much appreciated.

[unnamed]

No, not a problem at all.
Do you have any reference?

Even though "Sam's Teaches Yourself" books are not always good, some of them are definitely high quality, like the SQL one: http://www.amazon.com/Sams-Teach-Yoursel...ywords=sql


As for Javascript you can visit this link: http://stackoverflow.com/questions/11246...javascript



And as for php, I don't have any knowledge on that.


By the way, you don't have to rush through the ebooks.
Take your time, you will eventually get at the point you want.

[double07]

OK.
Thank You. I will look into it.

[Anima Templi]

Okay I will actually give you an useful answer instead of @"FZEROX" raging upon W3schools..

First of all I'm happy to hear that you have read my thread. I expect you to be fairly familiar with Javascript, HTML, SQL and PHP. The next thing to do would be to focus on one website application attack method. My favorite method is XSS, you could also choose SQL injection etc.

I practiced a lot of "live sites" like Ask.com, Utorrent.com, thedailyshow etc. (I listed some of the sites where I was able to find vulnerabilities) and that gave me a lot of experience. To keep you self clear of all charges you could setup some kind of lab at home. If you don't have another computer you could use as server you could always fire up a VM and use that instead. Learn how to exploit your own server and learn about how to setup a secure server. That will also give you the ability to see where people forget to secure their servers. For testing things like XSS you can either use some of the test sites (I know 1llusion has made some XSS tests you could practive on legally) or you could install some intentionally vulnerable web applications on your server to practice on like, http://www.dvwa.co.uk/ etc.

When you know that basics move on to more advanced techniques and topics, this is where the PHP knowledge will benefit you A LOT! I don't know if you have heard about the Ubuntu forums got hacked? I know the guy who discovered and invented the method the attackers (idiots) used to gain access to the fourms. 1llusion has some great tutorials on his blog on some advanced XSS methods too. Other than that research, practive and research!

I can't say it enough, it's the practical experience you learn from. The concept learn by doing is the most important way of learning everything computer related.

I know that I focused a lot of XSS in my reply, I simply choose one attack method to focus on to give you a better view on my points.

[unnamed]

Okay I will actually give you an useful answer instead of @"FZEROX" raging upon W3schools..

First of all I'm happy to hear that you have read my thread. I expect you to be fairly familiar with Javascript, HTML, SQL and PHP. The next thing to do would be to focus on one website application attack method. My favorite method is XSS, you could also choose SQL injection etc.

I practiced a lot of "live sites" like Ask.com, Utorrent.com, thedailyshow etc. (I listed some of the sites where I was able to find vulnerabilities) and that gave me a lot of experience. To keep you self clear of all charges you could setup some kind of lab at home. If you don't have another computer you could use as server you could always fire up a VM and use that instead. Learn how to exploit your own server and learn about how to setup a secure server. That will also give you the ability to see where people forget to secure their servers. For testing things like XSS you can either use some of the test sites (I know 1llusion has made some XSS tests you could practive on legally) or you could install some intentionally vulnerable web applications on your server to practice on like, http://www.dvwa.co.uk/ etc.

When you know that basics move on to more advanced techniques and topics, this is where the PHP knowledge will benefit you A LOT! I don't know if you have heard about the Ubuntu forums got hacked? I know the guy who discovered and invented the method the attackers (idiots) used to gain access to the fourms. 1llusion has some great tutorials on his blog on some advanced XSS methods too. Other than that research, practive and research!

I can't say it enough, it's the practical experience you learn from. The concept learn by doing is the most important way of learning everything computer related.

I know that I focused a lot of XSS in my reply, I simply choose one attack method to focus on to give you a better view on my points.

Please don't twist my words or actions.I never raged on w3schools.
I just expressed my opinion with reasonable arguments.

[lady_godiva]

I agree with AnimaTempli but if i can tell you something more, it looks like you learnt those languages really fast. I do not doubt about your skills but be sure you have truly learnt those languages as it is very important understanding how they work and how all the pieces work together. In my opinion a very basic knowledge won't be enough.

To sum up follow what AnimaTempli wrote but also keep improving you programming languages skills and consider (in the future) learning some new ones.

[double07]

@Anima Tempali - Thank You. So I am on the right way. We have the same opinion.

@lady_godiva - Well, actually I am learning fast. I don't want to express my skills, but I am above-above average intelligent. So, learning is not a problem. I just want to get on the right way, as Anima made me sure that I am. And thank You, also.

[double07]

@Anima Tempali - Thank You. So I am on the right way. We have the same opinion.

@lady_godiva - Well, actually I am learning fast. I don't want to express my skills, but I am above-above average intelligent. So, learning is not a problem. I just want to get on the right way, as Anima made me sure that I am. And thank You, also.