Beginner Hacking Tutorial | User Friendly | Easy to follow

Beginner Hacking Tutorial | User Friendly | Easy to follow - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+---- Thread: Beginner Hacking Tutorial | User Friendly | Easy to follow (/showthread.php?tid=3750530)

Pages: Pages 1 2 3 4 5 6

Beginner Hacking Tutorial | User Friendly | Easy to follow - Monte Cristo - Sep 13, 2013

Without jumping to stereotypical conclusions, I feel this part of the forum is mainly populated with users to whom are new to this section, and or forum. For my time here on HF, I've noticed that people post here without any prior knowledge of the rules, or even the other topic areas. So, in this thread, I hopefully will address problems, and explain this forum in more detail. Please if you did find this thread helpful, it takes a couple of seconds to show thanks by posting. Oh, and at the bottom, I've got a form to which you can reply with if you notice any grammatical or sentence structural errors (Yes, we all mistakes)

Introductions
Termernology
Methods
Tools
Dos Methods
Rules
FAQ
Jon's Corner
Conclusion
Errors
Thank You

What is this section you ask? This section is in place to answer your questions anything about hacking, whether it's about hacking a facebook, or grabbing an IP. This is the place to do so. I strongly advise members to whom are not experienced in any area, not to post useless threads like;

Code 
Can you teach me how to h4(k?

Whereas a better type of thread would be something with a purpose;

Code 
How could I go about hacking this email?

Not only does this save you effort, but also one whom intends to answer it. You'll not only get a better, and accurate answer, you'll also learn things in the process!
So, there's a quick introduction, and my main advice for those to whom are starting out; "Post with precision"

This part really is to state all the terms, with a brief description. If you think of any more terms to add, please do reply with the form in part 10. The brief description is copied from various sites to be certain upon accuracy. If there are problems with the description (it could be the case that I wrote it) please make that error aware of.
Let's start;

Booter
A program that can use a heap of computers to conduct a DDoS attack against a target. This essentially "boots" the person off the internet.

Bots
Also known as zombies, and similar to slaves, bots are computers that have software installed on their computer which allows others to control them (often called a bot herder).

Botnet
A control center for a series of bots and the method the bot master controls them. Often used to conduct DDoS attacks or perhaps install mining software. Botnet's typically come as either IRC or HTTP botnets, which relates to the method by which they are controlled (in an IRC channel or on a website). The typically difference between a Bot and a RAT is the scale involved and, usually, the command abilities and centralized external control location. Think RATs as smaller scale higher functioning as opposed to Bots being mass scale. RATs you instruct it to do something and receive information back. Bots you set an instruction and they simply read and enact that instruction.

Crypter
Used to encrypt software for the purposes of bypassing AV programs. Some have different success rates. Often they will be referred to as a FUD crypter or a UD crypter. Public crypters will often only be UD or not remain FUD for long. Paid crypters will often remain FUD for longer periods of time.

Dark Comet
A popular free RAT that many people use. This would be a good choice for people starting off with RATs. Use trusted links to download the software to ensure you're not installing a virus yourself. See https://hackforums.net/showthread.php?tid=2632776

DDoS
Distributed Denial of Service attack. This is exactly the same as DoS, however it uses multiple computers to conduct the attack. This has the effect of multiplying the effectiveness of the attack both in terms of the amount of bandwidth involved and also gives a wide range of attack vectors.

DoS
Denial of Service attack. This attack uses the process of sending packets of information to a target continuously to overwhelm it with information and cause it to stop servicing legitimate requests. It's extremely uncommon for a single source to have enough bandwidth to knock out a target unless it's a commercial platform vs something like a home connection. See DDoS.

Dox / Doxxing
The art of gathering information about a person starting from a small nugget of information. Seen the 4chan threads where someone posts a picture and suddenly their address, phone number, date of birth, social security number and favorite food on a Thursday between 11:23am and 11:24am is posted? They have been Dox'd.

Java Drive By (JDB)
Drive bys are referred to setting up software to install software to people who visit a particular URL. This is often in the form of presenting a Java applet or some other method the victim mindlessly agrees to.

E-Whoring
Typically the art of manipulating people with sexual material for some form of gain. The hacker pretends to be the girl in question and uses the relationship and trust typically to solicit money or perhaps install software / RATS on the victims PC.

FUD
Meaning Fully Undetected by Anti Virus

Cryptographic Hash
Hashes are basically strings of data which have been re-written in a different "language" to encrypt it. Types of hash include MD5, SHA1 and NTLM.

Keylogger
A piece of hidden software installed on a computer designed to monitor a users keystrokes or inputs. They can often send the results to a user specified email address in the form of log files. Think of it as a stripped down RAT.

Miner
What is called a bitcoin miner. Bitcoins are a form of internet currency which can be produced on your PC by calculating mathematical operations. As it's often resource intensive many botnets have taken to installing miners on each of their bots PC's allowing a single person to have the equivalent of 100's of PC's mining for them generating money.

Proxy
A method of relaying traffic through an additional point. Sometimes this will hide the original IP address, sometimes it will not, it depends on the proxy. Similar to a VPN however generally speaking considered a little less reliable and the traffic is not encrypted as with a VPN.

RATs
Remote Administration Tools, originally designed to aid administrators access computers remotely for legitimate purposes they are often these days used for malicious goals. Consists of control software and servers which are distributed to victims.

Remote Desktop Protocol (RDP)
Remote Desktop Protocol (RDP) is a proprietary protocol developed by Microsoft, which provides a user with a graphical interface to connect to another computer over a network connection

Resolvers
Used to translate some information into an IP address. This could be a website resolver (try ping www.google.com in command prompt), or even a skype name. Typically a prelude to some form of DoS attack.

Shells
Command line interfaces which can be controlled, often on websites. These are typically implemented on a mass scale to be combined into booter / stressor to conduct DDoS attacks.

Skid
(Script kid(die)). Someone who simply uses tools that others have provided without understanding what the underlying concepts are or what they are doing. For example, if you simply download a booter and attack an a friends IP, you're a skid. If you read this list and don't understand 90% of the terms, you're a skid. If you upload samples of your freshly crypted server to virustotal to check it, you're a skid. The important thing to know is that being a skid isn't horrible, we all start off that way, just remember to sit down, shut up and learn a bit before you go on about how you know everything.

Slaves
The name given to computers that have been infected with some form of controlling software. They are 'slaves' under the control of the person who infected them.

Spreaders
Typically automated software used to spam links to your virus around different mediums. This could be a facebook spreader which uses facebook, omegle spreader which chats automatically, etc.

Stresser
The same thing as a booter, a program that conducts a DDoS attack against a target. Often called a stressor for legal niceties.

UD
Meaning Undetected by some or most anti viruses. If 10 / 40 AV's detect a file its UD, if 0/40 detect it it's FUD.

VPS
Virtual Private Server. This is a place that gives you a virtual machine to host content on. Often used for a wide range of things, in the hacking context this could consist of hosting Botnets, setting up proxies to further hide your identity, running cracking tools, etc.

VPN
Virtual Private Nework. An encrypted connection between your home computer and the providers computer in some country. Often companies have multiple gateways making the internet believe you originate from this location. Commonly used to find services with no logs as to add difficulty in tracking the real sorce of any activities you may be undertaking (home IP address).

Zero-Day
A zero day is an exploit that no one has know about before. For example, an exploit that gives you administrator on every windows computer. It is called a Zero-Day because the people that own the software have had zero days to patch the exploit.

Zombie
A computer that has been implanted with a daemon that puts it under the control of a malicious hacker without the knowledge of the computer owner.

This section is just a small list of website, forum and general hacking methods I came up with. These methods range for beginner all the way up to higher end, so I recommend you don't start with some of the more complicated looking/sounding ones, research what is best to start out with. If you can think of other methods that I've missed please feel free to tell me in form part 10.

SQLi
XSS
XST
RCE/CGI-RCE
LFI/RFI
CSRF
SSI
Command Injection
Format String Exploitation
Elevation of privs via SUID bins
Shell escape string
LD_PRELOAD
IFS
Locals

This is a list of tools that I personally recommend to help you start hacking. People may disagree with me but this is just my opinion. If there are any more tools you guys recommend I'll of probably heard of them and might just have forgotten to add them in, if so please post down below in the Errors section. 1 or 2 of the descriptions have been copied from various sites for an accurate description.

SQLmap
SQLmap is software that is an penetration testing tool that automates the process and exploiting SQL injection flaws and taking over of database servers.
THC-Hydra
THC-Hydra is essentially a brute forcing tool that has been tested on multiple operating system.
NetCat
NetCat is basically used for network connections. Its list of features includes port scanning, transferring files, and port listening, and it can be used as a backdoor.
Filezilla
FileZilla Client is a fast and reliable cross-platform FTP, FTPS and SFTP client.
JohnTheRipper
JohnTheRipper essentially the same thing as THC-Hydra, a brute forcing tool that has been tested on multiple operating system.
Hashcat Plus
HashCat Plus is my favourite piece of software which is used to crack hashes, it is a md5crypt, phpass, mscash2 and WPA / WPA2 cracker. If you have a Nvidia graphics card you will need to use cudaHashcat-plus, if you have an AMD graphics card you will need to use oclHashcat-plus.
theHarvester
theHarvester is basically some software that is used for looking up all the A records for a websites so you can find all of a websites sub domains and basically all the juicies.
Burp Suite
Burb Suite is software that will basically penetration tests a website for all it's vulnerability.
Acunetix
Acunetix is software which penetration tests a website for SQLi, XXS and many more vulnerabilities.
Nmap
I personally use Nmap just for port scanning and network scanning, however, it can be used for much more.
Metasploit
Metasploit is yet another penetration testing tool.
PuTTY
PuTTY is an SSH and Telnet client, however it can be used for other protocols aswell.

Dos stands for denial of service, so as the name implies, I denies your internet service. Dos attacks are used to take down people home connections and web servers with layer 4 floods and websites and servers with layer 7 floods.

Internet Control Message Protocol (ICMP) flood
A type of ICMP flood, called a Smurf attack, is where you are sending packets to a network with an IP address which is spoofed to be the actual victims IP address. This then promptly uses up all the networks bandwidth and stops real packets from being processed.
SYN flood
The easiest way I can explain SYN floods is like this. Think of a website and it has a limited number of connections available, say 20 for demonstration purposes. This attack method will send TCP packets to the website, these packets are understood as connection requests by the website. This means there is now a half connection. Here's where the clever part is, because the IP address is forged to be the actual victims, the requests never get accepted from the other side, so the half open connection is left there. Due to the fact that the website can only have 20 connections it can't let anyone else connect, it is theoretically saying "Sorry lads, I have 20 connections already, I'm full. Wait till there is more connections available."
Teardrop attacks
Teardrop attacks are like sending bits of an IP with over-sized payloads to the specific target. This causes systems to crash due to the fact that they had bugs in their coding.
Low-rate Denial-of-Service attacks
As simply as I can explain it is that LDos attacks are like sending high rate TCP packets, but every so often.
Asymmetry of resource utilization in starvation attacks
This type of attack is basically self explanatory from the name, you theoretically consume the resources on the victims computer. In order to perform this attack you must either have a:
- Computer with more power/larger network bandwidth.
- Have a botnet and order the slaves to attack as a group.
- Gain access to a computer on the victims network.
Permanent denial-of-service attacks
PDos attacks are, in noob terms, attacks which ruin the victims server so bad that in results in having to replace hardware. These attacks are done by using exploits in security flaws on the server.
Application-level floods
Types of Application-level floods such as buffer overflow use the software on the server, the make the software confused and fill all disk space.
Nuke
In simple terms, the nuke method sends "invalid" packets to a computer network, these packets cause the computers to slow down until they come to a complete halt.
R-U-Dead-Yet? (RUDY)
Rudy attacks deprive a web server of current sessions, this means it stops all sessions with never ending HTTP post exchanges.

* - Monte Cristo - Sep 13, 2013

All rules should be followed at all times on HF. The rules make certain that there's a nice atmosphere for all users . If you're unaware of the rules, then it is suggested you take the time to read the Help Docs. If you see another member breaking any of the rules outlined in the Help Docs, then you should report the specific post accordingly;

Code 
https://hackforums.net/misc.php?action=help

The following rules are simply rules to which I feel are being broken here in the Beginner Hacking section. Please, I must stress, these are not official;

1. Use the search function before posting
This is by far the most problematic rule for this section, as many new users are unable to simply use the search function. I do understand threads being reposted, if let's say you feel the given responses on other threads are outdated, but when there's one on the next page, that's no excuse! You can find the search by clicking here.

2. No low quality posting
This is my major pet hate. Look. If you're posting under the character limit, your thread in my eyes is not worthy of being posted, rather than doing shit like this;

Code 
How do I h4(k this fb page

charactersapsmsapsmsaps

How about elaborate on your point, and give some more details

Code 
How do I hack this facebook page. I've got the email of the admin, and would just like some tips on how to get started.

This will not only thus increase your chances of getting a serious reply, but also get you rolling on your future HF career!

3. Stop Leeching!
I completely understand that you'd like to be noticed by posting "good" threads, but if you're not even going to bother giving credits, or at least changing some slight features. Don't bother.

Rather than just writing what's already been said, I've constructed a list of great FAQ threads which have been posted in the beginner hacking section. Please do take time to reach each thread thoroughly before posting your question, as 9 times out of 10, I guarantee your questions has already been asked.

[TUT] The Beginners' FAQ [TUT] by T@kU

☆☆☆☆ ♛ FAQ - PLEASE READ THIS BEFORE POSTING A BASIC QUESTION! ♛ ☆☆☆☆ by Turtle™

[FAQ / Help] The Beginners Thread / Questions? Ask here! by Origina|

I've chosen just a few out of the many to which have been posted. If you're in fact an author of a FAQ thread, and you deem it worthy, please just post, and I'll have no problem in updating the OP and adding you to the list! Once again, refer to error section

What is this? Originally taking the idea from the HF News, this is just my corner where I offer some experiences, and some advice.

So let's start. If you're new to start, please note that regardless to how arrogant members are on here, they started from the exact position you did. You'll in due time, reach your milestones, and be knowledgeable in the areas to which you're interested in. Just stick to it.

I also made numerous mistakes in posting in the wrong area, so I presume a lot of you do to! If your thread is about the following areas, make sure to post it there;

Remote Administration Tools (RATS) - Remote Administration Tools
Keyloggers - Keyloggers
Proxies - VPN, Proxies, and Socks
Crypting - Cryptography, Encryption, and Decryption
Hacking websites questions - Website Hacking
Request for a hack - https://hackforums.net/forumdisplay.php?fid=48

My last final tip is to just show members respect. Please. If you're asking the question, and potentially didn't get your answer, don't bother snapping at the answerer, just elaborate further in what you want to know. If it's vice versa, and you're answering the question, and in your eyes it's easy, for some it may not. Just answer it, and try to pass on as much knowledge as you possibly can! At least then, you'll know you're bettering the HF community

Just to sum the whole thread up. If I was to state what are the major parts within this little handbook, I'd have to say the rules. If you're able to bide by them, mark my words your HF career will be long and successful. I've been in the exact situation you're, and it may feel that learning to h4(k is endless, and just generally too hard, but once you've learnt all you need to know, heck the feeling is great! Never give up. I like to think of Aaron C to be a huge role model to me when learning new things, be it about hacking or just general day to day activities;

This handbook all though is brief, should kick start you! Make sure to read it carefully, as well as the linked threads, because in the long it'll be worth it. Trust me.

I guess this is a good luck, and a good bye. I'm always available to talk on various teamspeaks and PM, so just hit me up. I'll happily answer any problems you may have!

If you've found any errors, or like anything to be added, please reply with the following forms.

Code 
[b][u]For errors:[/u][/b]

[b]What is the problem:[/b]

[b]How can it be fixed:[/b]

Code 
For anything to be added:

[b]What would you like added:[/b]

[b]Necessary links:[/b]

Lastly I would like to give a MASSIVE thank you to my boy Accident, he has made this thread possible by supplying me with his content from his old beginner hacking hand book, without him this thread wouldn't be possible. Thank you very much Accident!

Spoiler (Click to View)

* - TwigX - Sep 13, 2013

Only reason why this kid hakkzz is because he is afraid of girls.

OT: It is very nice and easy to follow. I'd divert new hekkurr here.

* - Thrydon - Sep 13, 2013

Can we please sticky this? This would remove about 3/4 of the threads in this section if everyone read this before posting here. Thank you for the High Quality guide man.

* - I Am JT - Sep 13, 2013

Dope thread bro. Wouldn't be surprised if this gets stickied.

* - prottottype - Sep 13, 2013

Hmm are there any resources where i can actualy LEARN form?

* - Monte Cristo - Sep 13, 2013

(Sep 13, 2013 10:33 AM)prottottype Wrote: Hmm are there any resources where i can actualy LEARN form?

There are many links to threads on basic hacking method guides, also this thread explains alot of the fundamentals of hacking. I hope you do learn from this thread, I can't see why you wouldn't.

* - En1gma - Sep 13, 2013

Very nice thread mate, great work :D.

* - Im gone brah - Sep 13, 2013

To bad that this will be on the last page soon and the newcommers don't bother reading either.

* - JaggarN™ - Sep 13, 2013

Great work Max, will be helpful to noobs like you 🤝

* - Zapu - Sep 13, 2013

Nice thread Jon Snow. Well done. Will scan through it momentarily.

You should hyper link the SQL, LFI, RFI, etc etc to tutorials on here.

* - Frohe - Sep 13, 2013

Wow this is a fantastic, and very informative thread.

This will help many beginner hackers, great job!

* - Elegant - Sep 13, 2013

Very good and high quality thread. This should help all the noobies.

* - Soccer - Sep 13, 2013

Amazing job Jon Snow. Great guide for new comers.

* - Mac - Sep 13, 2013

Thanks for this amazing thread Jon Snow, I'm sure this will help many people. 🙂