Nowadays, every other college or school student wants to be a hacker. Due to media hype, the term hacker is considered both cool and criminal at the same time. Now, since my blog is basically about my journey into hacking, I receive many emails on how to become a hacker. "I'm a beginner in hacking, how should I start?" or "I want to be able to hack my friend's Facebook account" are some of the more frequent queries.
In this article I will attempt to answer these and more. I will give detailed technical instructions on how to get started as a beginner, how to evolve as you gain more knowledge and expertise in the domain and also describing the different types of cyber attacks and must know facts about hacking. Hacking is a skill. And you must remember that if you want to learn hacking solely for the fun of hacking into your friend's Facebook account or email, things will not work out for you. You should decide to learn hacking because of your fascination for technology and your desire to be an expert in computer systems.
"Being a hacker is lots of fun, but it's a kind of fun that takes lots of effort. The effort takes motivation."
The hacker mindset
In order to become a hacker, you must start thinking like one. We encounter all kinds of technology in our real life. Look at them from a hacker's perspective by thinking of ways to hack them. Hacking is not only about computers. It is also about how you use logic and ingenuity to solve the problems you encounter in your day today life. Nothing is really hack-proof. Auto-rickshaw meters, electronic voting machines, electronic doors, biometric systems, cars and even a yatch have all been hacked in the past. Whenever you encounter any technology, think about how it can be exploited to perform another action. You should possess a natural curiosity for solving puzzles and taking up challenges.
Read my previous post to know more: Understand The Hacker MindsetTo Become A Real Hacker
Know your technology
Becoming a hacker is no easy task. It will not happen in days or weeks. It will take you many months and even years to reach to the level where you can call yourself a hacker. The main reason for this is that being a hacker requires a lot of technical know-how. If you want to hack a computer, it only seems logical that you first know how it works, right? You should be familiar with the ins and outs of computers and know a little bit about everything in the IT domain. For this, you need to learn many things. This learning phase is when most aspiring hackers will give up.
General IT knowledge:
· Learn how to install Windows and Linux. Use VirtualBox or VMware to practice this.
· Learn networking concepts like IP address, subnets, TCP/IP, OSI model, LAN,WAN
· Functions of switch, router, firewall, access point etc
· What is DNS, DHCP, SNMP, ARP, NAT?
· What is HTTP, FTP, Telnet, RDP, SSH, POP, SMTP, SSL, NetBios?
These bullet points are just bare minimum concepts, and you have to learn them thoroughly. For instance, you need to know how data travels through the OSI layers, and the role of each layer in the data transfer. I would recommend taking a networking course such as CompTIA's N+ certification.
Programming Languages
Programming knowledge is necessary, although not mandatory to become a hacker. Some of the world's best hackers started out as programmers. If you know programming, you will be able to dissect code and analyze it. You will be able to write your own scripts or your own hacking tools. So, which programming language should you learn then? HTML and JavaScript are languages of the internet. So make sure you learn them first. they are also incredibly easy to grasp and learn. If your are enrolled in an undergraduate computer science degree, you will most probably be learning C,C++ and Java. These three major languages are good and you should keep learning them, but for a hacker, Python is the best language. "Why?" You ask. Because python is an extremely powerful language and it easy to learn at the same time. With Python you can achieve your results with minimal coding, and it does not need to be compiled. That means, just as you finish writing a script, you can immediately run it without having to compile it. And later on in life, if you decide to become a programmer instead of a hacker, Python can develop GUI applications also. In fact, a large part of YouTube is written in Python.
Another language you should learn is PHP. PHP is also free and open source. It is a server side scripting language, meaning, login pages and other web based forms are handled by PHP. Knowledge of ASP. NET will also be helpful. You should also know MySQL commands and syntax. This knowledge will be vital later when you perform SQL injection attacks against websites. Download XAMPP package and start practicing PHP and MySQL
Another important thing to note is that most colleges will not teach you advanced programming concepts. File handling and Network socket programming are two very important concepts you should familiarize yourself with, regardless of the language.
Read my previous post to know more: Programming Languages For Hackers And Learn It From Most 6 Helpful Websites
Open Source
The hacker community is a big supporter of Open Source software. You should contribute to open source projects when you can. In order to improve your programming skills, you can start an open source project and work on it. Download the source code of popular open source projects and study the code. Sourceforge and Github are excellent starting points. Alternatively, start your own project and post the source code online. This will help you get recognition.
Linux
The Windows operating system may be easy and convenient for most users, but it is certainly not suited for hackers. With the exception of few windows only tools, most hacking tools run best under Linux environment. I have given a list of top ten popular hacking tools, and most out of those 10 tools run best under Linux. You can use any Linux distribution like Ubuntu or Fedora, but BackTrack and Kali are two major Linux distros specifically designed for hackers. They come loaded with all the popular hacking tools, saving you from the trouble of downloading them yourself. If you are not comfortable with leaving windows as yet, you can use VirtualBox to install BackTrack in your system, or you can dual boot your operating systems.
Information Technology is a huge field. If you look at your college or university, your professors know about programming concepts and theory, the System Administrator knows about networks and systems, the website developers know web programming and designing. You, as a hacker, must know all these things and more.
Even under the domain of hacking, there are many sub categories like web application security, network security, digital forensics, reverse engineering etc. Nobody can be good at everything. After you have adequate knowledge and experience in "general" hacking, you can choose a speciality and become an expert in it.
Must Read: An Introduction To Hacker’s OS: Kali Linux Setup Tutorial
Different Types of Cyber Attacks
A cyber attack, in simple terms, is an attack on your digital systems originating from malicious acts of an anonymous source. Cyber attack allows for an illegal access to your digital device, while gaining access or control of your digital device.
A different types of cyber attacks can be defined as an offensive tactic to gain an illegal control or access to your digital device, called the target system, initiated by a person or a computer against a website, computer system or a single digital device as well as a whole, which poses a serious threat to computer systems, information stored, financial structures and the entire network itself. Cyber attacks work towards compromising the integrity of the digital device and the information stored in it.
1. Backdoors – Backdoor is a type of cyber threat in which the attacker uses a back door to install a keylogging software, thereby allowing an illegal access to your system. This threat can turn out to be potentially serious as it allows for modification of the files, stealing information, installing unwanted software or even taking control of the entire computer.
2. Denial-of-Service Attack – A denial-of-service or a DOS attack generally means attacking the network to bring it down completely with useless traffic by affecting the host device which is connected to the internet. A DOS attack targets websites or services which are hosted on the servers of banks and credit card payment gateways.
3. Direct-access Attack – A direct-access attack simply means gaining physical access to the computer or its part and performing various functions or installing various types of devices to compromise security. The attacker can install software loaded with worms or download important data, using portable devices.
4. Eavesdropping – As the name suggests, eavesdropping means secretly listening to a conversation between the hosts on a network. There are various programs such as Carnivore and NarusInsight that can be used to eavesdrop.
5. Spoofing – Spoofing is a cyber attack where a person or a program impersonate another by creating false data in order to gain illegal access to a system. Such threats are commonly found in emails where the sender’s address is spoofed.
6. Tampering – Tampering is a web based attack where certain parameters in the URL are changed without the customer’s knowledge; and when the customer keys in that URL, it looks and appears exactly the same. Tampering is basically done by hackers and criminals to steal the identity and obtain illegal access to information.
7. Repudiation Attack – A repudiation attack occurs when the user denies the fact that he or she has performed a certain action or has initiated a transaction. A user can simply deny having knowledge of the transaction or communication and later claim that such transaction or communication never took place.
8. Information Disclosure– Information disclosure breach means that the information which is thought to be secured is released to unscrupulous elements who are not trustworthy.
9. Privilege Escalation Attack – A privilege escalation attack is a type of network intrusion which allows the user to have an elevated access to the network which was primarily not allowed. The attacker takes the advantage of the programming errors and permits an elevated access to the network.
10. Exploits – An exploit attack is basically a software designed to take advantage of a flaw in the system. The attacker plans to gain easy access to a computer system and gain control, allows privilege escalation or creates a DOS attack.
11. Social Engineering – An attack by a known or a malicious person is known as social engineering. They have knowledge about the programs used and the firewall security and thus it becomes easier to take advantage of trusted people and deceive them to gain passwords or other necessary information for a large social engineering attack.
12. Indirect attack – Indirect attack means an attack launched from a third party computer as it becomes more difficult to track the origin of the attack.
13. Computer crime – A crime undertaken with the use of a computer and a network is called as a computer crime.
14. Malware – Malware refers to malicious software that are being designed to damage or perform unwanted actions into the system. Malware is of many types like viruses, worms, Trojan horses, etc., which can cause havoc on a computer’s hard drive. They can either delete some files or a directory or simply gather data without the actual knowledge of the user.
15. Adware – Adware is a software that supports advertisements which renders ads to its author. It has advertisements embedded in the application. So when the program is running, it shows the advertisement. Basically, adware is similar to malware as it uses ads to inflict computers with deadly viruses.
16. Bots – Bots is a software application that runs automated tasks which are simple and repetitive in nature. Bots may or may not be malicious, but they are usually found to initiate a DoS attack or a click fraud while using the internet.
17. Ransomware – Ransomware is a type of cyber security threat which will restrict access to your computer system at first and will ask for a ransom in order for the restriction to be removed. This ransom is to be paid through online payment methods only which the user can be granted an access to their system.
18. Rootkits – A rootkit is a malicious software designed in such a way that hides certain process or programs from normal anti virus scan detection and continues to enjoy a privilege access to your system. It is that software which runs and gets activated each time you boot your system and are difficult to detect and can install various files and processes in the system.
19. Spyware – Spyware, as the name suggests, is a software which typically spies and gathers information from the system through a user’s internet connection without the user’s knowledge. A spyware software is majorly a hidden component of a freeware program which can be downloaded from the internet.
20. Scareware – Scareware is a type of threat which acts as a genuine system message and guides you to download and purchase useless and potentially dangerous software. Such scareware pop-ups seem to be similar to any system messages, but actually aren’t. The main purpose of the scareware is to create anxiety among the users and use that anxiety to coax them to download irrelevant softwares.
21. Trojan Horses – Trojan Horses are a form of threat that are malicious or harmful codes hidden behind genuine programs or data which can allow complete access to the system and can cause damage to the system or data corruption or loss/theft of data. It acts as a backdoor and hence it is not easily detectable.
22. Virus – A computer virus is a self replicating program which, when executed, replicates or even modifies by inserting copies of itself into another computer file and infects the affected areas once the virus succeeds in replicating. This virus can be harmful as it spreads like wildfire and can infect majority of the system in no time.
23. Worm – Just like a virus, worm is a self replicating program which relies on computer network and performs malicious actions and spreads itself onto other computer networks. Worms primarily rely on security failures to access the infected system.
24. Phishing – Phishing is a cyber threat which makes an attempt to gain sensitive information like passwords, usernames and other details for malicious reasons. It is basically an email fraud where the perpetrator sends a legitimate looking email and attempts to gain personal information.
25. Identity Theft – Identity theft is a crime wherein your personal details are stolen and these details are used to commit a fraud. An identity theft is committed when a criminal impersonates individuals and use the information for some financial gain.
26. Intellectual Property Theft – Intellectual Property theft is a theft of copyrighted material where it violates the copyrights and the patents. It is a cybercrime to get hands onto some trade secrets and patented documents and research. It is basically a theft of an idea, plan and the methodology being used.
27. Password Attacks – Password attack is a form of a threat to your system security where attackers usually try ways to gain access to your system password. They either simply guess the password or use an automated program to find the correct password and gain an entry into the system.
28. Bluesnarfing – Bluesnarfing is a threat of information through unauthorized means. The hackers can gain access to the information and data on a Bluetooth enabled phone using the wireless technology of the Bluetooth without alerting the user of the phone.
29. Bluejacking – Bluejacking is simply sending of texts, images or sounds, to another Bluetooth enabled device and is a harmless way of marketing. However, there is a thin line between bluejacking and bluesnarfing and if crossed it results into an act of threat.
30. DDoS – DDoS basically means a Distributed Denial of Service. It is an attempt to make any online service temporarily unavailable by generating overwhelming traffic from multiple sources or suspend services of a host connected to the internet.
31. Keylogger – A keylogger is a spyware that has the capability to spy on the happenings on the computer system. It has the capability to record every stroke on the keyboard, web sites visited and every information available on the system. This recorded log is then sent to a specified receiver.
38 Things That You Should Understand While Learning To Hacking
1. There is no software that can hack Facebook passwords (except key logging and phishing) same with e-mail account hacking.
2. Kernel is the main component of most computer operating systems; it is a bridge between applications and the actual data processing done at the hardware level. The kernel's responsibilities include managing the system's resources (the communication between-hardware and software components). Usually as a basic component of an operating system, a kernel can provide the lowest-level abstraction layer for the resources (especially processors and I/O devices) that application software must control to perform its function. It typically makes these facilities available to application processes through inter-process communication mechanisms and system calls.
3. Linux is a computer operating system which is based on free and open source software. Although many different varieties of Linux exist, all are Unix-like and based on the Linux kernel, an operating system kernel.
4. An exploit (from the verb to exploit, in the meaning of using something to one’s own advantage) is a piece of software, a chunk of data, or sequence of commands that takes advantage of a bug, glitch or vulnerability in order to cause unintended or unanticipated behavior to occur on computer software, hardware, or something electronic (usually computerized). This frequently includes such things as gaining control of a computer system.
5. A shell is a piece of software that provides an interface for users of an operating system which provides access to the services of a kernel. However, the term is also applied very loosely to applications and may include any software that is "built around" a particular component, such as web browsers and email clients that are "shells" for HTML rendering engines. The name shell originates from shells being an outer layer of interface between the user and the internals of the operating system (the kernel).
6. PHP is a general-purpose server-side scripting language originally designed for web development to produce dynamic web pages. For this purpose, PHP code is embedded into the HTML source document and interpreted by a web server with a PHP processor module, which generates the web page document. It also has evolved to include a command-line interface capability and can be used in standalone graphical applications.
7. JQuery is a cross-browser JavaScript library designed to simplify the client-side scripting of HTML. It was released in January 2006 at BarCamp NYC by John Resig. Used by over 49% of the 10,000 most visited websites, jQuery is the most popular JavaScript library in use today.
8. A network host is a computer connected to a computer network. A network host may offer information resources, services, and applications to users or other nodes on the network. A network host is a network node that is assigned a network layer host address.
9. In mathematics and computer science an algorithmis an effective method expressed as a finite list of well-defined instructions for calculating a function Algorithms are used for calculation, data processing, and automated reasoning. In simple words an algorithm is a step-by-step procedure for calculations.
10. There are many websites that can be searched for vulnerablities and can be hacked but if you are a real hacker then you should select the website and then try to hack it.
11. A router is a device that forwards data packets between computer networks, creating an overlay internetwork. A router is connected to two or more data lines from different networks. When data comes in on one of the lines, the router reads the address information in the packet to determine its ultimate destination. Then, using information in its routing table or routing policy, it directs the packet to the next network on its journey. Routers perform the "traffic directing" functions on the Internet. A data packet is typically forwarded from one router to another through the networks that constitute the internetwork until it gets to its destination node.
12. computer networks, a proxy server is a server (a computer system or an application) that acts as an intermediary for requests from clients seeking resources from other servers.
13. BB5 unlocking in Nokia phones is not possible to install unsigned OS in Nokia (not simlock).
14. The Metasploit Project is an open-source computer security project which provides information about security vulnerabilities and aids in penetration testing and IDS signature development. Its most well-known sub-project is the Metasploit Framework, a tool for developing and executing exploit code against a remote target machine. Other important sub-projects include the Opcode Database,shell code archive, and security research.
15. There is not a method to decrypt nokia MCUSW file and change it because if we do it then the check sum is changed than that of phone and its not installed
Symbian can be hacked by using ROM patcher and hellox
16. Free hosting websites don't allow to use rapid leech script and other forums.
17. Unix (officially trademarked as UNIX, sometimes also written as Unix) is a multitasking, multi-user computer operating system originally developed in 1969 by a group of AT&T employees at Bell Labs, including Ken Thompson, Dennis Ritchie, Brian Kernighan, Douglas McIlroy, and Joe Ossanna. The Unix operating system was first developed in assembly language.
18. A scripting language, script language, or extension language is a programming language that allows control of one or more applications. "Scripts" are distinct from the core code of the application, as they are usually written in a different language and are often created or at least modified by the end-user. Scripts are often interpreted from source code or bytecode
19. Cross-site scripting (XSS) is a type of computer security vulnerability typically found in Web applications that enables attackers to inject client-side script into Web pages viewed by other users. A cross-site scripting vulnerability may be used by attackers to bypass access controls such as the same origin policy.
20. A denial-of-service attack (DoS attack) or distributed denial-of-service attack (DDoS attack) is an attempt to make a computer resource unavailable to its intended
users. Although the means to carry out, motives for, and targets of a DoS attack may vary, it generally consists of the concerted efforts of a person, or multiple people to prevent an Internet site or service from functioning efficiently or at all, temporarily or indefinitely
21. Getting access to router doesn't provide you access to network.
22. A Media Access Control address (MAC address) is a unique identifier assigned to network interfaces for communications on the physical network segment. MAC addresses are used for numerous network technologies and most IEEE 802 network technologies including Ethernet. Logically, MAC addresses are used in the Media Access Control protocol sub-layer of the OSI reference model.
23. Ankit fadias seminars are crap and its courses too.
24. Social engineering is the art of manipulating people into performing actions or divulging confidential information. While similar to a confidence trick or simple fraud, the term typically applies to trickery or deception for the purpose of information gathering, fraud, or computer system access; in most cases the attacker never comes face-to-face with the victim.
25. Rooting is a process that allows users of mobile phones and other devices running the Android operating system to attain privileged control (known as "root access") within Android's Linux subsystem with the goal of overcoming limitations that carriers and manufacturers put on some devices. It is analogous to jailbreaking on devices running the Apple iOS operating system.
26. Tethering means sharing the Internet connection of an Internet-capable mobile phone with other devices. This sharing can be offered over a wireless LAN (Wi-Fi), or over Bluetooth, or by physical connection using a cable. In the case of tethering over wireless LAN, the feature may be branded as a mobile hotspot. The Internet-connected mobile phone acts as a portable router when providing tethering services to others.
27. Malware, short for malicious software, consists of programming (code, scripts, active content, and other software) designed to disrupt or deny operation, gather information that leads to loss of privacy or exploitation, gain unauthorized access to system resources, and other abusive behavior.The expression is a general term used by computer professionals to mean a variety of forms of hostile, intrusive, or annoying software or program code.
28. A honeypot is a trap set to detect, deflect, or in some manner counteract attempts at unauthorized use of information systems. Generally it consists of a computer, data, or a network site that appears to be part of a network, but is actually isolated and monitored, and which seems to contain information or a resource of value to attackers.
29. A cache is a component that transparently stores data so that future requests for that data can be served faster. The data that is stored within a cache might be values that have been computed earlier or duplicates of original values that are stored elsewhere. If requested data is contained in the cache (cache hit), this request can be served by simply reading the cache, which is comparatively faster. Otherwise (cache miss), the data has to be recomputed or fetched from its original storage location, which is comparatively slower. Hence, the more requests can be served from the cache the faster the overall system performance.
30. A Trojan horse, or Trojan, is software that appears to perform a desirable function for the user prior to run or install, but (perhaps in addition to the expected function) steals information or harms the system. The term is derived from the Trojan Horse story in Greek mythology.
31. Overclocking is the process of operating a computer component at a higher clock rate (more clock cycles per second) than it was designed for or was specified by the manufacturer.
32. The MD5 Message-Digest Algorithm is a widely used cryptographic hash function that produces a 128-bit (16-byte) hash value., MD5 has been employed in a wide variety of security applications, and is also commonly used to check data integrity.
33. An assembly language is a low-level programming language for computers, microprocessors, microcontrollers, and other programmable devices. It implements a symbolic representation of the machine codes and other constants needed to program a given CPU architecture.
34. A hash function is any algorithm or subroutine that maps large data sets to smaller data sets, called keys. For example, a single integer can serve as an index to an array (associative array). The values returned by a hash function are called hash values, hash codes,hash sums, checksums or simply hashes.
35. In computer security and programming, a buffer overflow, or buffer overrun, is an anomaly where a program, while writing data to a buffer, overruns the buffer's boundary and overwrites adjacent memory. This is a special case of violation of memory safety.
36. Buffer overflows can be triggered by inputs that are designed to execute code, or alter the way the program operates. This may result in erratic program behavior, including memory access errors, incorrect results, a crash, or a breach of system security. They are thus the basis of many software vulnerabilities and can be maliciously exploited.
37. Remote File Inclusion (RFI) is a type of vulnerability most often found on websites. It allows an attacker to include a remote file, usually through a script on the web server. The vulnerability occurs due to the use of user-supplied input without proper validation. This can lead to something as minimal as outputting the contents of the file, but depending on the severity .
38. SQL often referred to as Structured Query Language is a programming language designed for managing data in relational database management systems (RDBMS). Originally based upon relational algebra and tuple relational calculus, its scope includes data insert, query, update and delete, schema creation and modification, and data access control.SQL injection or SQLi is a code injection technique that exploits a security vulnerability in some computer software. An injection occurs at the database level of an application (like queries). The vulnerability is present when user input is either incorrectly filtered for string literal escape characters embedded in SQL statements or user input is not strongly typed and unexpectedly executed. Using well designed query language interpreters can prevent SQL injections.
Final words
Now, let's talk about actual hacking. Here is a basic guide on how to become a hacker, Read and learn more hacking tutorials from that post and become an actual hacker (Only in legal ways).
