7 ms·

How to learn hacking

245 points by Faizann20 10y ago

IFightISIS 10y ago
Hey Faizan ! When, last year, french Law Enforcement asked your company for the connection logs of terrorists that used your VPN service to connect to the admin panel of an ISIS propaganda website, you never answered. When they wanted to subpoena the servers that where located in France, the only ones they had jurisdiction over, and for which your company had a legal obligation to keep the logs, they discovered that you stopped using servers in France after their first request for information. How do you feel about ISIS using your infrastructure ? P.S. Please don't try to tell me I'm lying. I obviously can't prove what I'm saying, but maybe you should ask your staff about all requests from law enforcement from the last two years, and filter those with the word "terrorism" on them. Then ask your staff why those received no answer.
vog 10y ago
I find it deeply disappointing that this totally skips some very important parts, namely attitude, motivation and ethics. (Except for so-called "Ethical Hacking". On the other hand, what should one expect from the blog of a security company?) I recommend the all-time classic "How To Become A Hacker" by Eric S. Raymond: http://www.catb.org/esr/faqs/hacker-howto.html http://www.catb.org/esr/faqs/hacker-howto.html
- initium 10y ago
  I just read How To Become A Hacker the other day and I highly recommend it. Not only is it a good read but the resources for continued reading mentioned in the text is very good content.
- perch56 10y ago
  Be careful not to confuse this blog with F-Secure the Finnish Security company. Seems to me the two are totally unrelated.
- sdevlin 10y ago
  ESR is a racist and a misogynist. And that document might as well be called "how to be ESR".
  - ms7 10y ago
    Care to share a source for that?
    - tptacek 10y ago
      The cites would fill the whole thread. You can take his word for it.
    - sdevlin 10y ago
      Just read his blog.
  - fao_ 10y ago
    Not to mention violently right-wing and believes he was, for a short period, a god[1] >.> [1]: http://www.catb.org/~esr/writings/dancing.html http://www.catb.org/~esr/writings/dancing.html
    - notduncansmith 10y ago
      Just read the linked post in full and that's an awfully reductive comment on the experiences he describes there. I suggest taking a more intellectually honest look at that writing (not to defend any of his other writing or views, which I haven't read).
      - tptacek 10y ago
        I think we're all pretty sure ESR is not in fact a god, and that nothing could have occurred with ESR or his magic flute to have demonstrated to him that he was. Rather, the story is more broadly illustrative of a pretty extreme narcissism and --- challenging --- variant of self-awareness. For a more down to earth example, consider how many of us would non-ironically write the following passage: I’m wondering about this because my wife Cathy asked me a simple question last night, and I realized I didn’t have an answer to it. “Are you” she asked “the most famous programmer in the world?” This was a question which I had, believe it or not, never thought about before. But it’s a reasonable one to ask, given recent evidence – notably, the unexpected success of my Patreon page. This is relevant because Patreon is mainly an arts-funding site – it’s clearly not designed for or by techies. It goes on in this vein. Here, by the way, is a link to his Patreon page: https://www.patreon.com/esr https://www.patreon.com/esr Apparently we value "the code that makes our digital world work" a bit less than we value the person who fries our french fries at McDonalds. If that sounds mean, well, it is, but it was also Eric Raymond who put forward the idea that his Patreon page may indicate that he's among the most famous programmers in the world. For a nerdier take on ESR's merits, hunt down Terry Lambert's take on fetchmail. (You should know who Terry Lambert is, if you don't already).
- kdbg 10y ago
  Except all this has in common with the original post is the word 'hack'. Actually what you've posted is quite clearly against what the original post is about. > There is another group of people who loudly call themselves hackers, but aren't. These are people (mainly adolescent males) who get a kick out of breaking into computers and phreaking the phone system. Real hackers call these people ‘crackers’ and want nothing to do with them. Real hackers mostly think crackers are lazy, irresponsible, and not very bright, and object that being able to break security doesn't make you a hacker any more than being able to hotwire cars makes you an automotive engineer. Unfortunately, many journalists and writers have been fooled into using the word ‘hacker’ to describe crackers; this irritates real hackers no end.
  - vog 10y ago
    I suspect this is a cultural thing. Here in Germany, most journalists and writers use the term "hacker" for both, the constructive and destructive parts. For example, the Chaos Communication Congress is described by media as "hacker congress" even though it has a wide scope where presentations about breaking into systems are just a minor part of it.
    - kdbg 10y ago
      oh, for sure. Hacker I think has a much more broad meaning than JUST security. I don't think security should be excluded from it though as the How to be a Hacker article promotes.
- Faizann20 10y ago
  Apologies if you find it disappointing. The people who daily ask me questions about hacking are mostly interested in "Getting a swag from Google" part and I was a little bit inclined to give resources to such people. It is by no means a thorough guide covering everything. It's just a start for people wanting to learn some stuff. I found these resources to be quite good. Best Regards.
snowwrestler 10y ago
It doesn't actually say.
- slmyers 10y ago
  I did get the impression he was quite accomplished -- given his acknowledgement from NASA -- so I guess... success?
EugeneOZ 10y ago
step 0: google "wordpress exploit" or "windows exploit framework". step 1: figure out how to run it step 10: deface some useless site or get access to computer of your friend. step 11: buy t-shirt with words "haxx00r" or "the matrix green failing letters".
- ndirish1842 10y ago
  step 12: ? step 13: profit
  - localfugue 10y ago
    You forgot binary.
planetix 10y ago
So what's the business of this company and its CEO? Other than trying to collect subscribers to his blog. Also really confusing name considering there's the Finnish security company called F-Secure who also have a technical blog: https://labsblog.f-secure.com/ https://labsblog.f-secure.com/ And now also run a security course in Helsinki University: http://mooc.fi/courses/2016/cybersecurity/ http://mooc.fi/courses/2016/cybersecurity/
- Faizann20 10y ago
  If you think I am trying to collect subscribers, I have removed the "Subscribe to us" text from the post. F stands for my name and I liked the domain. There is no business of this company. All I do is learn stuff, try to come up with good articles and post them. I plan to convert it into a proper company once my studies are over. I am just a student at the moment. Hope everything is good now. Best Regards.
  - saycheese 10y ago
    "All I do is learn stuff" sounding phrase dot com would be more inline with your stated objectives. Currently, name & logo look like something a company would use and are potientally easily confused with other companies using similar names; as mentioned in other comments. Just to be clear, it is obvious you put a lot of work into this, thanks for sharing. Keep it up!
fao_ 10y ago
> Account Suspended It's a dead link
- Faizann20 10y ago
  Try now.
616c 10y ago
If people actually care about this topic, and want to see someone doing a genuinely good job, check out LiveOverflow. Some other posters here will make fun of his dubstep intro music, green on black terminal text intro with the Rabbit, but he admitted in his first QA it was tongue and cheek. His subreddit: https://reddit.com/r/liveoverflow https://reddit.com/r/liveoverflow His YouTube channel: https://www.youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w https://www.youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w I have taken more traditional infosec coursework for $DAYJOB. I must say this stuff, the more novice stuff beneath and the more advanced stuff above my head, is well structured, even if informal, entertaining, and inspiring. I definitely want to give back to the community like him with solid content and a very unassuming attitude. This is exactly the kind of teacher we need in this space! (This is not to say F Security is assuming or crappy, I just wanted to talk up someone who really is teaching how to hack the way I think it ought to be done!)
- LiveOverflow 10y ago
  Thank you so much! I have also recently started building https://liveoverflow.com https://liveoverflow.com, which might have a better structure than a YouTube channel or subreddit. Also some people may have actually seen a video of mine, because my most popular video so far is the DirtyCow video which got referenced by news sites and on the dirtycow github repository. My personal recommendation is to checkout the AngularJS Sandbox bypass series: https://www.youtube.com/playlist?list=PLhixgUqwRTjwJTIkNopKuGLk3Pm9Ri1sF https://www.youtube.com/playlist?list=PLhixgUqwRTjwJTIkNopKu... Criticism and feedback is always welcome.
  - risk 10y ago
    Thank you for the videos. They are such a valuable thing for infosec students. Please keep up the excellent work.
    - LiveOverflow 10y ago
      If you have feedback from infosec students, or topics that would benefit students, please contact me :)
saycheese 10y ago
Link is dead and returns this error: "This Account has been suspended. Contact your hosting provider for more information." _________ Google's Cache: http://webcache.googleusercontent.com/search?q=cache:http://fsecurify.com/how-to-learn-hacking/ http://webcache.googleusercontent.com/search?q=cache:http://...
- eriknstr 10y ago
  Link works fine for me.
  - saycheese 10y ago
    Agree, it's back up (right now); it was down for 30-40 minutes though.
johnchills 10y ago
As a junior security employee, I am still trying to figure out where to take my career. I have thought about various different paths: pentesting, development (JS, C, python, exploit...), reverse-engineering, web-app hacking, network-engineering and I cannot for the life of me decide where to focus my studies. I have reservations about pentesting because For example, I think a lot of it is unskilled work (e.g., pressing scan on nessus, clicking exploit on Burp) or work which will be automated in the near future. So for those who are more experienced than me, or for those who can share some insight on security-careers, what tech-careers would you choose and what would you study if you were starting right now?
- LiveOverflow 10y ago
  > I have reservations about pentesting because For example, I think a lot of it is unskilled work (e.g., pressing scan on nessus, clicking exploit on Burp) or work which will be automated in the near future My job title is "Penetration tester" but I don't fall into that category. That's why I often refer to it as doing "application security analysis/audits". My current job is to do black/white box testing of single applications - and not a huge organisations where you just phish some employees. I have not worked for other companies, but as far as I can tell, many "penetration testing jobs" are actually what I do. It's fun, challenging and very technical. And obviously no scanners are used - I have never in my career used nessus or any other click2exploit tool.
homakov 10y ago
Unrelated: It's not cool to put all the logos of companies just because you found some low sev bug there, not even saying the name is kinda similar to known security corp F-Secure...
- Faizann20 10y ago
  I thought it would be a good motivation for others. Also, I did receive a book "Intro to Algorithms" by MIT Press Director on urgent delivery. So I think its okay to show other people what exactly they can achieve by going through the stuff I posted. Best Regards.
Faizann20 10y ago
In case the website does not work, you can try this link: http://webcache.googleusercontent.com/search?q=cache:http://fsecurify.com/how-to-learn-hacking/ http://webcache.googleusercontent.com/search?q=cache:http://...
ns8sl 10y ago
It is worth studying common weaknesses in code: https://cwe.mitre.org/ https://cwe.mitre.org/
wyclif 10y ago
Link to first book is dead.

245 points by Faizann20 10y ago

Hey Faizan ! When, last year, french Law Enforcement asked your company for the connection logs of terrorists that used your VPN service to connect to the admin panel of an ISIS propaganda website, you never answered. When they wanted to subpoena the servers that where located in France, the only ones they had jurisdiction over, and for which your company had a legal obligation to keep the logs, they discovered that you stopped using servers in France after their first request for information. How do you feel about ISIS using your infrastructure ? P.S. Please don't try to tell me I'm lying. I obviously can't prove what I'm saying, but maybe you should ask your staff about all requests from law enforcement from the last two years, and filter those with the word "terrorism" on them. Then ask your staff why those received no answer.

vog 10y ago

I find it deeply disappointing that this totally skips some very important parts, namely attitude, motivation and ethics. (Except for so-called "Ethical Hacking". On the other hand, what should one expect from the blog of a security company?) I recommend the all-time classic "How To Become A Hacker" by Eric S. Raymond: http://www.catb.org/esr/faqs/hacker-howto.html http://www.catb.org/esr/faqs/hacker-howto.html

initium 10y ago
I just read How To Become A Hacker the other day and I highly recommend it. Not only is it a good read but the resources for continued reading mentioned in the text is very good content.
perch56 10y ago
Be careful not to confuse this blog with F-Secure the Finnish Security company. Seems to me the two are totally unrelated.
sdevlin 10y ago
ESR is a racist and a misogynist. And that document might as well be called "how to be ESR".
- ms7 10y ago
  Care to share a source for that?
  - tptacek 10y ago
    The cites would fill the whole thread. You can take his word for it.
  - sdevlin 10y ago
    Just read his blog.
- fao_ 10y ago
  Not to mention violently right-wing and believes he was, for a short period, a god[1] >.> [1]: http://www.catb.org/~esr/writings/dancing.html http://www.catb.org/~esr/writings/dancing.html
  - notduncansmith 10y ago
    Just read the linked post in full and that's an awfully reductive comment on the experiences he describes there. I suggest taking a more intellectually honest look at that writing (not to defend any of his other writing or views, which I haven't read).
    - tptacek 10y ago
      I think we're all pretty sure ESR is not in fact a god, and that nothing could have occurred with ESR or his magic flute to have demonstrated to him that he was. Rather, the story is more broadly illustrative of a pretty extreme narcissism and --- challenging --- variant of self-awareness. For a more down to earth example, consider how many of us would non-ironically write the following passage: I’m wondering about this because my wife Cathy asked me a simple question last night, and I realized I didn’t have an answer to it. “Are you” she asked “the most famous programmer in the world?” This was a question which I had, believe it or not, never thought about before. But it’s a reasonable one to ask, given recent evidence – notably, the unexpected success of my Patreon page. This is relevant because Patreon is mainly an arts-funding site – it’s clearly not designed for or by techies. It goes on in this vein. Here, by the way, is a link to his Patreon page: https://www.patreon.com/esr https://www.patreon.com/esr Apparently we value "the code that makes our digital world work" a bit less than we value the person who fries our french fries at McDonalds. If that sounds mean, well, it is, but it was also Eric Raymond who put forward the idea that his Patreon page may indicate that he's among the most famous programmers in the world. For a nerdier take on ESR's merits, hunt down Terry Lambert's take on fetchmail. (You should know who Terry Lambert is, if you don't already).
kdbg 10y ago
Except all this has in common with the original post is the word 'hack'. Actually what you've posted is quite clearly against what the original post is about. > There is another group of people who loudly call themselves hackers, but aren't. These are people (mainly adolescent males) who get a kick out of breaking into computers and phreaking the phone system. Real hackers call these people ‘crackers’ and want nothing to do with them. Real hackers mostly think crackers are lazy, irresponsible, and not very bright, and object that being able to break security doesn't make you a hacker any more than being able to hotwire cars makes you an automotive engineer. Unfortunately, many journalists and writers have been fooled into using the word ‘hacker’ to describe crackers; this irritates real hackers no end.
- vog 10y ago
  I suspect this is a cultural thing. Here in Germany, most journalists and writers use the term "hacker" for both, the constructive and destructive parts. For example, the Chaos Communication Congress is described by media as "hacker congress" even though it has a wide scope where presentations about breaking into systems are just a minor part of it.
  - kdbg 10y ago
    oh, for sure. Hacker I think has a much more broad meaning than JUST security. I don't think security should be excluded from it though as the How to be a Hacker article promotes.
Faizann20 10y ago
Apologies if you find it disappointing. The people who daily ask me questions about hacking are mostly interested in "Getting a swag from Google" part and I was a little bit inclined to give resources to such people. It is by no means a thorough guide covering everything. It's just a start for people wanting to learn some stuff. I found these resources to be quite good. Best Regards.

snowwrestler 10y ago

It doesn't actually say.

slmyers 10y ago
I did get the impression he was quite accomplished -- given his acknowledgement from NASA -- so I guess... success?

EugeneOZ 10y ago

step 0: google "wordpress exploit" or "windows exploit framework". step 1: figure out how to run it step 10: deface some useless site or get access to computer of your friend. step 11: buy t-shirt with words "haxx00r" or "the matrix green failing letters".

ndirish1842 10y ago
step 12: ? step 13: profit
- localfugue 10y ago
  You forgot binary.

planetix 10y ago

So what's the business of this company and its CEO? Other than trying to collect subscribers to his blog. Also really confusing name considering there's the Finnish security company called F-Secure who also have a technical blog: https://labsblog.f-secure.com/ https://labsblog.f-secure.com/ And now also run a security course in Helsinki University: http://mooc.fi/courses/2016/cybersecurity/ http://mooc.fi/courses/2016/cybersecurity/

Faizann20 10y ago
If you think I am trying to collect subscribers, I have removed the "Subscribe to us" text from the post. F stands for my name and I liked the domain. There is no business of this company. All I do is learn stuff, try to come up with good articles and post them. I plan to convert it into a proper company once my studies are over. I am just a student at the moment. Hope everything is good now. Best Regards.
- saycheese 10y ago
  "All I do is learn stuff" sounding phrase dot com would be more inline with your stated objectives. Currently, name & logo look like something a company would use and are potientally easily confused with other companies using similar names; as mentioned in other comments. Just to be clear, it is obvious you put a lot of work into this, thanks for sharing. Keep it up!

fao_ 10y ago

> Account Suspended It's a dead link

Faizann20 10y ago
Try now.

616c 10y ago

If people actually care about this topic, and want to see someone doing a genuinely good job, check out LiveOverflow. Some other posters here will make fun of his dubstep intro music, green on black terminal text intro with the Rabbit, but he admitted in his first QA it was tongue and cheek. His subreddit: https://reddit.com/r/liveoverflow https://reddit.com/r/liveoverflow His YouTube channel: https://www.youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w https://www.youtube.com/channel/UClcE-kVhqyiHCcjYwcpfj9w I have taken more traditional infosec coursework for $DAYJOB. I must say this stuff, the more novice stuff beneath and the more advanced stuff above my head, is well structured, even if informal, entertaining, and inspiring. I definitely want to give back to the community like him with solid content and a very unassuming attitude. This is exactly the kind of teacher we need in this space! (This is not to say F Security is assuming or crappy, I just wanted to talk up someone who really is teaching how to hack the way I think it ought to be done!)

LiveOverflow 10y ago
Thank you so much! I have also recently started building https://liveoverflow.com https://liveoverflow.com, which might have a better structure than a YouTube channel or subreddit. Also some people may have actually seen a video of mine, because my most popular video so far is the DirtyCow video which got referenced by news sites and on the dirtycow github repository. My personal recommendation is to checkout the AngularJS Sandbox bypass series: https://www.youtube.com/playlist?list=PLhixgUqwRTjwJTIkNopKuGLk3Pm9Ri1sF https://www.youtube.com/playlist?list=PLhixgUqwRTjwJTIkNopKu... Criticism and feedback is always welcome.
- risk 10y ago
  Thank you for the videos. They are such a valuable thing for infosec students. Please keep up the excellent work.
  - LiveOverflow 10y ago
    If you have feedback from infosec students, or topics that would benefit students, please contact me :)

saycheese 10y ago

Link is dead and returns this error: "This Account has been suspended. Contact your hosting provider for more information." _________ Google's Cache: http://webcache.googleusercontent.com/search?q=cache:http://fsecurify.com/how-to-learn-hacking/ http://webcache.googleusercontent.com/search?q=cache:http://...

eriknstr 10y ago
Link works fine for me.
- saycheese 10y ago
  Agree, it's back up (right now); it was down for 30-40 minutes though.

johnchills 10y ago

As a junior security employee, I am still trying to figure out where to take my career. I have thought about various different paths: pentesting, development (JS, C, python, exploit...), reverse-engineering, web-app hacking, network-engineering and I cannot for the life of me decide where to focus my studies. I have reservations about pentesting because For example, I think a lot of it is unskilled work (e.g., pressing scan on nessus, clicking exploit on Burp) or work which will be automated in the near future. So for those who are more experienced than me, or for those who can share some insight on security-careers, what tech-careers would you choose and what would you study if you were starting right now?

LiveOverflow 10y ago
> I have reservations about pentesting because For example, I think a lot of it is unskilled work (e.g., pressing scan on nessus, clicking exploit on Burp) or work which will be automated in the near future My job title is "Penetration tester" but I don't fall into that category. That's why I often refer to it as doing "application security analysis/audits". My current job is to do black/white box testing of single applications - and not a huge organisations where you just phish some employees. I have not worked for other companies, but as far as I can tell, many "penetration testing jobs" are actually what I do. It's fun, challenging and very technical. And obviously no scanners are used - I have never in my career used nessus or any other click2exploit tool.

homakov 10y ago

Unrelated: It's not cool to put all the logos of companies just because you found some low sev bug there, not even saying the name is kinda similar to known security corp F-Secure...

Faizann20 10y ago
I thought it would be a good motivation for others. Also, I did receive a book "Intro to Algorithms" by MIT Press Director on urgent delivery. So I think its okay to show other people what exactly they can achieve by going through the stuff I posted. Best Regards.

Faizann20 10y ago

In case the website does not work, you can try this link: http://webcache.googleusercontent.com/search?q=cache:http://fsecurify.com/how-to-learn-hacking/ http://webcache.googleusercontent.com/search?q=cache:http://...

ns8sl 10y ago

It is worth studying common weaknesses in code: https://cwe.mitre.org/ https://cwe.mitre.org/

wyclif 10y ago

Link to first book is dead.