![]() |
|
[The Brotherhood]Ultimate Beginner Guide to Hacking - Printable Version +- Hack Forums (https://hackforums.net) +-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45) +--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449) +---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4) +---- Thread: [The Brotherhood]Ultimate Beginner Guide to Hacking (/showthread.php?tid=3771340) |
[The Brotherhood]Ultimate Beginner Guide to Hacking - Zapu - Sep 24, 2013 [img]http://i1.minus.com/iLbdJjhOluAEW.png[/img] Old thread was junked do to misinformation and missed posts. This one will be the same, but just more information. What is a hacker? Quote:hack·er Taken from http://www.wikipedia.org Types of hackers [img]http://mrthaibox123.com/wp-content/uploads/2013/06/Hacker-Hat-Colors-Explained.jpg[/img] Blackhat Hacker The Blackhat hacker, is the bad guy. He's the one who illegally breaks into systems and steals information from people. Most whitehats started off as being blackhat hackers. Greyhat Hacker The greyhat hacker is inbetween of the Black and White. They will illegally break into a computer or a website, but will report the exploit after. Whitehat Hacker These are the good guys, they get permission to hack. It's pretty much their job. They'll test security and if they find an exploit/vulnerability they will tell an admin and in the end result they're payed. Hackers Here's a list of hackers: Spoiler (Click to View) Hacker Groups Milw0rm TeaMp0isoN L0pht Cult Of The Dead Cow CCC-Chaos Computer Club No, Anonymous will NOT be put in this section. ![]() Defense Before we go around hacking the gibson, we should be well hidden. How can we manage to accomplish this? Well, we can with a proxy or a VPN. What's a VPN? [img]http://blog.static.abine.com/blog/wp-content/uploads/2012/11/vpn-diagram.png[/img] Quote:A virtual private network (VPN) extends a private network across a public network, such as the Internet. It enables a computer to send and receive data across shared or public networks as if it were directly connected to the private network, while benefiting from the functionality, security and management policies of the private network. This is done by establishing a virtual point-to-point connection through the use of dedicated connections, encryption, or a combination of the two. What does a VPN do? Well, a VPN helps us mask our IP from attackers. List of VPN's http://www.spotflux.com(Windows/Mac) | Free | http://www.securitykiss.com(Windows/Mac/Linux) | Free | http://www.openvpn.com(Windows/Mac/Linux) | Free | http://#.net(Windows/Mac/Linux) | Not free | http://www.vpnreactor.com(Windows/Mac/Linux) | Not Free | What's a proxy server? [img]http://upload.wikimedia.org/wikipedia/commons/thumb/b/bb/Proxy_concept_en.svg/280px-Proxy_concept_en.svg.png[/img] Quote:In computer networks, a proxy server is a server (a computer system or an application) that acts as an intermediary for requests from clients seeking resources from other servers. A client connects to the proxy server, requesting some service, such as a file, connection, web page, or other resource available from a different server and the proxy server evaluates the request as a way to simplify and control its complexity. Proxies were invented to add structure and encapsulation to distributed systems. Today, most proxies are web proxies, facilitating access to content on the World Wide Web. Source I wouldn't suggest any free proxies, or a proxy at all. I'd recommend a VPN. Private Proxies will suffice, but they will cost. Okay, so you bought your VPN and the owner of the VPN handed you a config file. What now? You'll want to download something like OpenVPN if you're on windows. If you're on MAC download Viscosity or download Tunnelblick If you're on linux open up terminal either from your panel or ctrl alt T and type Quote:su for root privileges then type Quote:sudo apt-get install openvpn The command may differ depending on your linux distro. So you have your OpenVPN client open. If you need help setting it up then please look here: OpenVPN Tutorial(WINDOWS) How to configure OpenVPN on Ubuntu Linux How to setup Viscosity on MAC How to configure Tunnelblick on MAC So you have your VPN set up and you're running it. First thing to check for is a DNS leak. What's a DNS leak? Quote:When using an anonymity or privacy service, it is extremely important that all traffic originating from your computer is routed through the anonymity network. If any traffic leaks outside of the secure connection to the network, any adversary monitoring your traffic will be able to log your activity. Source Here's a diagram of a DNS Leak: ![]() If you want to know if your DNS is leaking then head over to dnsleaktest.com. If you see your ISP's DNS server then your DNS is leaking. If you need help fixing a leak on windows then go here If you're on linux then please open up terminal and type Quote:nano /etc/resolv.conf You should be greeted with this: ![]() You see namersever 127.0.1.1? Comment that out so it looks like #127.0.1.1 Also, go to the last two nameservers and change them to either Google's DNS or OpenDNS. Google: 8.8.8.8 8.8.4.4 OpenDNS: 208.67.222.222 208.67.220.220 Hit ^O(Ctrl O) and then hit enter. Then hit ^X(Ctrl X) Go back to dnsleaktest.com, and it should work. If your IP is grabbed, I would recommend, either calling your ISP and asking them to change it, or buy a new router. [img]http://www.public-domain-photos.com/free-cliparts-1-small/tools/weapons/sword_01.gif[/img] Offense So now that we're nice and cozy in our encrypted tunnel, we can start off on the offense. Now since you're just beginning we'll start off easy. The first things most kids start off with is DoSing and DDoSing. What is a Denial Of Service Attack? Well theres two different types. DDoS= Distributive Denial Of Service Attack, this is where multiple computers/servers are attacking a computer or a website. The stresser sends packets UDP packets to a remote port on a machine, overwhelming the router causing it to shut down which end result is loss of internet. DoS isn't as effective, DoS is when the stressing comes from 1 source and 1 source only, they use programs like LOIC to try to off someone. All you have to do is got into your router settings, go to logs, see the IP that attacked you and report it your ISP or do something back to them. But for DDoSing it's different, the IP's are spoofed so you're pretty much at a dead end. How to DDoS? Get the IP of your victim, whether it's from a IP Logger, or a skype resolver/steam resolver or any other method. Log into your Stresser panel, input the IP and put port 80 and attack type being UDP and stress for the amount of seconds you bought. There are no such things as free booters that have GOOD power that can actually knock someone off. You will have to spare 5 dollars. Here's a section of stressers to choose from: Server Stress Testing Different types of attacks: UDP or also known as User Datagram Protocol is perfect for home connections, XBL and gameservers. What it exactly does is sending packages on a remote host and as result the server will respond with a Unreachable packet, if you keep sending packages the target will respond with even more Unreachable packets and as result it will be unreachable for other people. Spoofing can also be used to avoid that the Unreachable packets reaches your network and get you cought, so by spoofing the attacks you stay anonymous. SSYN basically sends SYN requests in attempt to consume all the target's resources as result the host will be unreachable for legit traffic. RUDY or R U dead yet, uses form field submissions & given urls (Don't know too much about this one never used it.) ARME (Not sure, never used it) GET, uses 3-way TCP handshake this looks like a legit connection and therefore gets passed to the web or app server it then begins to request large amounts of files,.. this will make the system focus on these ones and not on other legit connections that are coming in. POST, submits data content back to the server for example Forms or posts or whatever.. HEAD, pretty much the same as GET the server just doesn't respond with a message-boddy. Credits to OG Kush, the post he/she made can be found here Pictures of DDoS and DoS: DDoS [img]http://www.cisco.com/web/about/ac123/ac147/images/ipj/ipj_7-4/dos_figure_4.gif[/img] [img]http://www.kbradyservice.com/DDOS-Attack.jpg[/img] DoS Imagine the same picture, but only coming from 1 source. [img]http://x.hackforums.net/uploads/awards/rat-expert.png[/img] Remote Administration Tools What's a RAT? Quote: remote access tool (a RAT) is a piece of software that allows a remote "operator" to control a system as if he has physical access to that system. While desktop sharing and remote administration have many legal uses, "RAT" software is usually associated with criminal or malicious activity. Malicious RAT software is typically installed without the victim's knowledge, often as payload of a Trojan horse, and will try to hide its operation from the victim and from security software. RAT photos [img]http://upload.wikimedia.org/wikipedia/commons/2/2c/DarkComet2.png[/img] There are tons of RAT's out there, but the most common are Dark Comet(Windows) jRat(Windows/Mac/Linux) Netwire (Windows/Mac/Linux) Blackshades(Windows) Imminent Monitor(Windows/Mac/Linux) Darkcomet is free Jrat, Blackshades, Netwire, Imminent Mintor cost money. If you need help setting up a RAT go over to the Remote Administration Tool Section I'm not going to explain keylogging, since keylogging is RATing with less features pretty much. [img]http://x.hackforums.net/uploads/awards/gumshoe_24.png[/img] Pentesting [img]http://www.offensive-security.com/wp-content/uploads/2012/05/IMG_1002.png[/img] What is Metasploit? Quote:The Metasploit Project is a computer security project that provides information about security vulnerabilities and aids in penetration testing and IDS signature development. Metasploit can be downloaded from here Backtrack Linux What is Backtrack? Quote:BackTrack is a distribution designed by Jason Dennis based on the Ubuntu Linux distribution aimed at digital forensics and penetration testing use [img]http://upload.wikimedia.org/wikipedia/commons/thumb/e/e4/BackTrack_5_R1.png/799px-BackTrack_5_R1.png[/img] Backtrack has tons of features, like SET (Social Engineer Toolkit) and reverse engineering tools as well. NMap What is NMap? Quote:Nmap ("Network Mapper") is a free and open source (license) utility for network discovery and security auditing. Many systems and network administrators also find it useful for tasks such as network inventory, managing service upgrade schedules, and monitoring host or service uptime. Nmap uses raw IP packets in novel ways to determine what hosts are available on the network, what services (application name and version) those hosts are offering, what operating systems (and OS versions) they are running, what type of packet filters/firewalls are in use, and dozens of other characteristics. It was designed to rapidly scan large networks, but works fine against single hosts. Nmap runs on all major computer operating systems, and official binary packages are available for Linux, Windows, and Mac OS X. In addition to the classic command-line Nmap executable, the Nmap suite includes an advanced GUI and results viewer (Zenmap), a flexible data transfer, redirection, and debugging tool (Ncat), a utility for comparing scan results (Ndiff), and a packet generation and response analysis tool (Nping). [img]http://nmap.org/images/nmap-401-demoscan-798x774.gif[/img] Wireshark What is Wireshark? Quote:Wireshark is a free and open-source packet analyzer. It is used for network troubleshooting, analysis, software and communications protocol development, and education. Originally named Ethereal, in May 2006 the project was renamed Wireshark due to trademark issues.[3] A complete list for Pentesting tools can be found here Pentesting Tutorials You can find a list of tutorials in the pentesting section which can be found here [img]http://x.hackforums.net/uploads/ficons/website-hacking.png[/img] Website and Forum Hacking Maybe you're not interested in computers but more interested in websites. Hackforums has a section devoted to hacking websites which can be found here Website attacks: SQL Injection Quote:SQL injection is a code injection technique, used to attack data driven applications, in which malicious SQL statements are inserted into an entry field for execution (e.g. to dump the database contents to the attacker).[1] SQL injection must exploit a security vulnerability in an application's software, for example, when user input is either incorrectly filtered for string literal escape characters embedded in SQL statements or user input is not strongly typed and unexpectedly executed. SQL injection is mostly known as an attack vector for websites but can be used to attack any type of SQL database. List of SQL injection tutorials: Website Hacking: SQL Injection - |3orne [Tutorial] MsSQL Injection- Usploit LFI(Local File Inclusion) Quote:Local File Inclusion (also known as LFI) is the process of including files on a server through the web browser. This vulnerability occurs when a page include is not properly sanitized, and allows directory traversal characters to be injected LFI Tutorial(s): LFI Tutorial -Downfall Remote File Inclusion(RFI) Quote:Remote File Inclusion (RFI) is a type of vulnerability most often found on websites. It allows an attacker to include a remote file, usually through a script on the web server. The vulnerability occurs due to the use of user-supplied input without proper validation. This can lead to something as minimal as outputting the contents of the file, but depending on the severity, to list a few it can lead to: RFI Tutorial(s) RFI tutorial -Downfall Exploiting Remote File Inclusion RFI(Remote File Inclusion) [img]http://x.hackforums.net/uploads/ficons/console.png[/img] Programming What's Computer Programming? Quote:Computer programming (often shortened to programming) is the comprehensive process that leads from an original formulation of a computing problem to executable programs. It involves activities such as analysis, understanding, and generically solving such problems resulting in an algorithm, verification of requirements of the algorithm including its correctness and its resource consumption, implementation (or coding) of the algorithm in a target programming language, testing, debugging, and maintaining the source code, implementation of the build system and management of derived artefacts such as machine code of computer programs. The algorithm is often only represented in human-parseable form and reasoned about using logic. Source code is written in one or more programming languages (such as C++, C#, Java, Python, Smalltalk, JavaScript,etc.). The purpose of programming is to find a sequence of instructions that will automate performing a specific task or solve a given problem. The process of programming thus often requires expertise in many different subjects, including knowledge of the application domain, specialized algorithms and formal logic. Source HF's computer programming section can be found here List of computer programming languages: Visual Basic Quote:Visual Basic is a third-generation event-driven programming language and integrated development environment (IDE) from Microsoft for its COM programming model first released in 1991. Microsoft intends Visual Basic to be relatively easy to learn and use.[1][2] Visual Basic was derived from BASIC and enables the rapid application development (RAD) of graphical user interface (GUI) applications, access to databases using Data Access Objects, Remote Data Objects, or ActiveX Data Objects, and creation of ActiveX controls and objects. The scripting language VBScript is a subset of Visual Basic Created by Microsoft C/C++/Obj-C Quote:C++ (pronounced "see plus plus") is a programming language that is general purpose, statically typed, free-form, multi-paradigm and compiled. It is regarded as an intermediate-level language, as it comprises both high-level and low-level language features.[3] Developed by Bjarne Stroustrup starting in 1979 at Bell Labs, C++ was originally named C with Classes, adding object oriented features, such as classes, and other enhancements to the C programming language. The language was renamed C++ in 1983,[4] as a pun involving the increment operator. Created by Bjarne Stroustrup Batch Quote:In DOS, OS/2, and also Microsoft Windows, batch file is the name given to a type of script file, a text file containing a series of commands to be executed by the command interpreter. Java Quote:Java is a general-purpose, concurrent, class-based, object-oriented computer programming language that is specifically designed to have as few implementation dependencies as possible. It is intended to let application developers "write once, run anywhere" (WORA), meaning that code that runs on one platform does not need to be recompiled to run on another. Java applications are typically compiled to bytecode (class file) that can run on any Java virtual machine (JVM) regardless of computer architecture. Java is, as of 2012, one of the most popular programming languages in use, particularly for client-server web applications, with a reported 10 million users.[10][11] Java was originally developed by James Gosling at Sun Microsystems (which has since merged into Oracle Corporation) and released in 1995 as a core component of Sun Microsystems' Java platform. The language derives much of its syntax from C and C++, but it has fewer low-level facilities than either of them. Created by James Gosling and Sun Microsystems PHP Quote:PHP is a server-side scripting language designed for web development but also used as a general-purpose programming language. PHP is now installed on more than 244 million websites and 2.1 million web servers.[2] Originally created by Rasmus Lerdorf in 1995, the reference implementation of PHP is now produced by The PHP Group.[3] While PHP originally stood for Personal Home Page,[4] it now stands for PHP: Hypertext Preprocessor, a recursive acronym.[5] Created by Rasmus Lerdorf Python Quote:Python is a widely used general-purpose, high-level programming language.[11][12][13] Its design philosophy emphasizes code readability, and its syntax allows programmers to express concepts in fewer lines of code than would be possible in languages such as C.[14][15] The language provides constructs intended to enable clear programs on both a small and large scale.[16] Created by Python Software Foundation AutoIT Quote:AutoIt (pronounced aw-toe-it)[2] is a freeware automation language for Microsoft Windows. In its earliest release, the software was primarily intended to create automation scripts (sometimes called macros) for Microsoft Windows programs[3] but has since grown to include enhancements in both programming language design and overall functionality. Created by Jonathan Bennett & AutoIt Team. Assembly Quote:An assembly language is a low-level programming language for a computer, or other programmable device, in which there is a very strong (generally one-to-one) correspondence between the language and the architecture's machine code instructions. Each assembly language is specific to a particular computer architecture, in contrast to most high-level programming languages, which are generally portable across multiple architectures, but require interpreters or compiling. Innovated by Nathanial Rochester and Stan Poley Perl Quote:Perl is a family of high-level, general-purpose, interpreted, dynamic programming languages. The languages in this family include Perl 5 and Perl 6.[4] Created by Larry Wall Delphi Lua Quote:Lua is a lightweight multi-paradigm programming language designed as a scripting language with "extensible semantics" as a primary goal. Lua is cross-platform since it is written in ISO C.[1] Lua has a relatively simple C API, thus "Lua is especially useful for providing end users with an easy way to program the behavior of a software product without getting too far into its innards".[2] Created by Roberto Ierusalimschy, Waldemar Celes, Luiz Henrique de Figueiredo It's good to learn a programming language, if you want to learn the mechanics of things and how they work then programming is right up your alley. Also, if you program, kids can't really call you a skid. You'll be able to make your own programs. Hope you all enjoyed reading this thread, took me quite sometime. * - Zapu - Sep 24, 2013 (Sep 24, 2013 03:37 PM)Connected Wrote: Holy shit. This is huge. Good job on making it! :D Haha yeah, the longer the better(That sounded awful). Thanks for the comment. 🤝 * - DoIReallyCare - Sep 24, 2013 A huge thanks to you and the brotherhood. Very informative. 🤝 * - Zapu - Sep 24, 2013 (Sep 24, 2013 04:07 PM)DoIReallyCare Wrote: A huge thanks to you and the brotherhood. Very informative. 🤝 Thank you for your nice comment DoIReallyCare 🤝 * - PhantomElite - Sep 24, 2013 This one's even better. Good work on it. * - Zapu - Sep 24, 2013 (Sep 24, 2013 04:13 PM)PhantomElite Wrote: This one's even better. Thank you PhantomElite, I tried to make it a lot better, thanks for the feedback 🤝 * - PhantomElite - Sep 24, 2013 Since this is the beginner guide to hacking, maybe you should add a little section on Anonymous and how it is a concept more than anything else. Just a suggestion. * - Zapu - Sep 24, 2013 (Sep 24, 2013 04:19 PM)PhantomElite Wrote: Since this is the beginner guide to hacking, maybe you should add a little section on Anonymous and how it is a concept more than anything else. To be completely honest, I did, but I ended up deleting it because I didn't want to argue with anyone. I'll just leave the opinion up to them. * - Black Shadow - Sep 24, 2013 Why have you had to repost the thread again ? * - Zapu - Sep 24, 2013 (Sep 24, 2013 04:21 PM)Black Shadow Wrote: Why have you had to repost the thread again ? I missed a section of the tutorial, and I missed out on a few things, and people already posted in the comments and I didn't want to have to message them asking to remove. I'm more happy with this thread though, I might try to save up for a sticky if the thread is good enough.(I've never seen a thread get stickied in this section) * - Daxe - Sep 24, 2013 Thanks this is probably the best hacking thread for beginners i've ever seen. I wish I had this when I first started looking into this world. * - Zapu - Sep 25, 2013 (Sep 24, 2013 04:34 PM)Daxe Wrote: Thanks this is probably the best hacking thread for beginners i've ever seen. I wish I had this when I first started looking into this world. Thanks for the feedback. Gonna see if I can get the first post deleted to add a new section which will be about which OS is appropriate for hacking(even though ALL are appropriate) 🤝 * - Antigen - Sep 25, 2013 wow that's a large thread, nice thread with detailed info. I really like to appreciate your willingness to help noobs here. A index may help to overlook the content. * - #R00T~ - Sep 25, 2013 Very useful guide, will help alot of users gain knowledge of hacking :Blackhat: * - Trojan Squid - Sep 25, 2013 very good for noobs like me! very in-depth. |