[Generalpiggle]

In a previous thread I posed the question of where to start in the realm of hacking and of the many good replies there is one I am having trouble with, this answer was to gain experience and while I completely agree that experience is an excellent way to learn I don't know where I would get experience and therefore I came to ask you all, what is a good way for a beginner to get experience in hacking?

[Megan]

By actually hacking...

finding ways to get higher access in systems...look up exploits for certain versions I.e. lets say there's an exploit that allows you to gain root on MyBB 2.1.1, set up MyBB 2.1.1 on a server and then exploit it...stuff like that.

[meow]

?

You can't be told "where to get experience as a beginner". That's the whole point of it. Use what you learn and gain experience by doing so, that's all there is to it. If you ask to be spoonfed everything including "where to get experience" then you will never be respected by any actual hackers, much less make it far as a hacker.

---

By actually hacking...

finding ways to get higher access in systems...look up exploits for certain versions I.e. lets say there's an exploit that allows you to gain root on MyBB 2.1.1, set up MyBB 2.1.1 on a server and then exploit it...stuff like that.

This is very vague and unlikely to happen to a beginner ever. A beginner will not know PHP fluently, how to understand MyBB's system, or how to exploit vulnerabilities like that right off the bat.

Furthermore, how the fuck would you get experience if you "look up exploits"? The only thing that gives you experience in a situation of exploiting something is finding that vulnerability yourself. What you just said is teaching him how to be the actual definition of a skid.

[Nil]

First, you need to read a lot and get a solid foundation of the concepts under you. Perhaps join several hacking forums and read what other people are sharing and soak it in.

Only after you have a solid foundation, you could start reading hacking tutorials/watching hacking videos of the things you are interested in to get a second-hand experience of what your environment will look like, how they detected the issue/problem, and how they went about solving it. Depending on what type of hacking you want to begin in, start becoming familiar with the software involved with it.

But the key is to first get a root understanding of the subject before you can comfortably do things on your own. Following tutorials won't always explain things in detail or the "why" which will make it difficult once you're on your own and there's no instructions to follow. You can find sites that provide small or larger hacking challenges that you can start out on to get your hands wet and get a little practice and confidence.

This isn't exclusive to hacking. I provided pretty general advice in getting experience but just applied it to hacking. Understanding the "why" will put you ahead of many people and give you more freedom and autonomy when it comes to getting things done on your own. Of course, there are some deep-level concepts that aren't important for anyone to understand to accomplish tasks, but you get the gist of what I'm saying.

[Generalpiggle]

First, you need to read a lot and get a solid foundation of the concepts under you. Perhaps join several hacking forums and read what other people are sharing and soak it in.

Only after you have a solid foundation, you could start reading hacking tutorials/watching hacking videos of the things you are interested in to get a second-hand experience of what your environment will look like, how they detected the issue/problem, and how they went about solving it. Depending on what type of hacking you want to begin in, start becoming familiar with the software involved with it.

But the key is to first get a root understanding of the subject before you can comfortably do things on your own. Following tutorials won't always explain things in detail or the "why" which will make it difficult once you're on your own and there's no instructions to follow. You can find sites that provide small or larger hacking challenges that you can start out on to get your hands wet and get a little practice and confidence.

This isn't exclusive to hacking. I provided pretty general advice in getting experience but just applied it to hacking. Understanding the "why" will put you ahead of many people and give you more freedom and autonomy when it comes to getting things done on your own. Of course, there are some deep-level concepts that aren't important for anyone to understand to accomplish tasks, but you get the gist of what I'm saying.

Thank you very much, Ill be sure to keep this in mind and try to follow your advice.

[The Real Slim Shady]

I've been in the hacking scene/community since 1998. I've seen probably tens of thousands of people post the questions you're posting right now. Very few make it past this point. They don't get the answers they want to hear and give up. Of those that don't give up - most try to take short cuts. They'll follow tutorials and they'll learn how to do specific things or use a program to do what they want to do. They become script kiddies. no comprehension of how what they are doing works. If some aspect of the attack is different, they are unlikely to succeed. Sure you can have some successes in compromising accounts and services... but thats not hacking.

The few that do succeed and become impressive creatures... and they are few and far behind. but they all have the same thing in common - and i detailed it in your last thread.

But here's an example of the knowledge you should have if you want to be specialise in website hacking...

1. Understanding of the language it's coded in - eg. PHP/ASP/Perl/Python, etc
2. Understanding how the data on the page is stored. - eg. Flat File/Relational Database, etc
3. Understanding of how client side scripts work - eg. Javascript,/VBScript, etc
4. Understanding of how to configure/implement/etc the actual web server implementation - eg. Apache/nginx/lighttpd/IIS
5. Understanding of the actual DBMS implementation - eg Postgresql/mysql/mariadb/mssql/nosql/sqlite, etc
6. Understanding of the OS/Windows/Linux regarding shit like file permissions, dynamic libraries, etc
7. Understanding of the underlying protocols such as HTTP/HTTPS. Knowledge of shit like FTP/SSH/DNS is also very applicable.
8. Understanding of how ssl certificates work, how they interact with HTTP, what HSTS is, What Secure-Content-Policy is,a nd other security mechanisms

And this isn't even an exhaustive list. Theres far more avenues such as knowledge of control panels people use, like cPanel and Plesk. There is knowledge of how to use Proxies and VPN's. Theres knowledge of how to clean up after your attack. Hiding the compromise. Theres learning about Bruteforcing and such counter measures.

And this is just to become an expert in websites... theres an entirely different set of skills and knowledge required for hacking servers and network based attacks.

You could potentially spend the next 2 years learning the above and still be relatively new/inexperienced. Sure you'd know a lot more than most people - but you'd still be learning how to adapt and exploit shit to your advantage. It's not a quick process and requires an intense amount of work and dedication to actually become a pro. It takes initiative.

I'm not trying to discourage you, but rather give you a realistic picture of what to expect. there isn't going to be people handholding you to your goal. Asking questions like this is the wrong attitude. you need to be able to go out and find the answers to your own questions. The information is out there. One of the greatest skills you can acquire is the ability to find it.

[Generalpiggle]

I've been in the hacking scene/community since 1998. I've seen probably tens of thousands of people post the questions you're posting right now. Very few make it past this point. They don't get the answers they want to hear and give up. Of those that don't give up - most try to take short cuts. They'll follow tutorials and they'll learn how to do specific things or use a program to do what they want to do. They become script kiddies. no comprehension of how what they are doing works. If some aspect of the attack is different, they are unlikely to succeed. Sure you can have some successes in compromising accounts and services... but thats not hacking.

The few that do succeed and become impressive creatures... and they are few and far behind. but they all have the same thing in common - and i detailed it in your last thread.

But here's an example of the knowledge you should have if you want to be specialise in website hacking...

1. Understanding of the language it's coded in - eg. PHP/ASP/Perl/Python, etc
2. Understanding how the data on the page is stored. - eg. Flat File/Relational Database, etc
3. Understanding of how client side scripts work - eg. Javascript,/VBScript, etc
4. Understanding of how to configure/implement/etc the actual web server implementation - eg. Apache/nginx/lighttpd/IIS
5. Understanding of the actual DBMS implementation - eg Postgresql/mysql/mariadb/mssql/nosql/sqlite, etc
6. Understanding of the OS/Windows/Linux regarding shit like file permissions, dynamic libraries, etc
7. Understanding of the underlying protocols such as HTTP/HTTPS. Knowledge of shit like FTP/SSH/DNS is also very applicable.
8. Understanding of how ssl certificates work, how they interact with HTTP, what HSTS is, What Secure-Content-Policy is,a nd other security mechanisms

And this isn't even an exhaustive list. Theres far more avenues such as knowledge of control panels people use, like cPanel and Plesk. There is knowledge of how to use Proxies and VPN's. Theres knowledge of how to clean up after your attack. Hiding the compromise. Theres learning about Bruteforcing and such counter measures.

And this is just to become an expert in websites... theres an entirely different set of skills and knowledge required for hacking servers and network based attacks.

You could potentially spend the next 2 years learning the above and still be relatively new/inexperienced. Sure you'd know a lot more than most people - but you'd still be learning how to adapt and exploit shit to your advantage. It's not a slow process and requires an intense amount of work and dedication to actually become a pro. It takes initiative.

I'm not trying to discourage you, but rather give you a realistic picture of what to expect. there isn't going to be people handholding you to your goal. Asking questions like this is the wrong attitude. you need to be able to go out and find the answers to your own questions. The information is out there. One of the greatest skills you can acquire is the ability to find it.

Fair enough, to be quite honest I feel this answer has come across as more beneficial than the answer I was expecting so thank you for that, Im currently learning languages such as Javascript, Python, HTML, Ruby, etc. I also have some books to get myself used to the language and different things in the, as you put it "hacking scene". Thank you for your reply.

[mothered]

Simply stated, "hacking" Is a broad term that entails a massive list of attack vectors.

First and foremost, you need to establish the capacity of hacking you're Interested In. Work from there and once you've achieved your objective, select another form of hacking and work on that. This will be an ongoing process and you will need to learn, experiment, fail and succeed via your own volition.

@The Real Slim Shady has made some very valid points. I suggest you take It under advisement.

[6ix]

I'd also recomend doing some wargame's, they're very helpful, and you get alot of 'expierence' from them.

For example www.hackthissite.com is a great resource, there are alot of basic challenges that get you started in a specific subject eg. web app pentesting
also www.overthewire.org linux based hacking games are very helpful!

[insidious]

In a previous thread I posed the question of where to start in the realm of hacking and of the many good replies there is one I am having trouble with, this answer was to gain experience and while I completely agree that experience is an excellent way to learn I don't know where I would get experience and therefore I came to ask you all, what is a good way for a beginner to get experience in hacking?

Look around for CTFS. Even if you're too old/young for them, sign up anyway and try to do many of the problems. If you don't know something no matter how small, research it. Research, research, research, Google, more research. Keep doing.
That probably won't give you a solid foundation, but depending on the CTF you do and how well it was made, it can show you different areas of that hacking world.

Many CTF's require some prior experience (like coding knowledge) but if you already have that, many lead you from a progression of Very Easy ---> Difficult.

IMO that's a good way to get experience, and the competition part of it is fun, especially if you can get some other people/friends in on it.

There are also many completed CTFs which have problems on them you can still complete, those are good too.

I also love wargames. Smashthestack/overthewire have a bunch of fun stuff you can do which can give you something to do.

Hackthissite.com and other such sites are good

I recommend finding a way to get a good base, but those are somethings you can do to learn hacking.

Those are some pretty innocent white hat ways to gain experience. If you want blackhat, I s'pose you can go around looking for vulns in shit, but that's just a tad bit difficult to do for a beginner.

Before you do any of this, it's important to develop a base, however.
You probably want to know some important languages at least on a basic level. C, PHP, SQL, Python, Java are all good to know

Networking skills. Know how these things work, they help alot.
DHCP
NAT
Subnetting
IPv4
IPv6
Public v Private IP
DNS
Routers and switches
VLANs
OSI model
MAC addressing
ARP
Those are often-exploited technologies. The more you know about how they work, the better you will be (at least in my book).

Linux Skills. This Wargame http://overthewire.org/wargames/bandit/ is great for learning some linux basics, and it's made for absolute beginners.
That's not sufficient though. Get linux, play around with it. Use it.
Fuck Windows.
Want to learn linux? Uninstall windows, get rid of it, and use Linux as your daily driver. Start out with something simple, like Ubuntu or Linux Mint, and work your way down to more complex stuff like Archlinux and maybe even Gentoo. Force yourself to use a terminal by installing a window manager (like Awesome, i3, xmonad) which will also allow you to delve into those respective programming languages (Awesome --> Lua xmonad --> haskell. there's also a python version but i can't remember it rn)

Wireshark/TCP Dump, learn it

Virtualization, know it

Learn security/hacking concepts (books are good for this)

Scripting (PERL/Bash etc.)


It's hard to get any experience unless you have some type of base beforehand.
There is far too many things to know in the hacking world to put it in one post. Their are entire books dedicated to one small aspect of hacking. The Real Slim Shady's answer was very good, and i also recommend his advice. Following the advice in my post will only show you how to do specific things, and not lead to an over-arching and in-depth knowledge of a topic.