[Faith Connors]

Turn your face to the Sun and the shadows fall behind you.

WANT TO SPONSOR THIS WITH UR GROUP? HMU

This is the new official Notorious Beginner's Hacking Helpdesk.
Use this thread to ask about anything related to hacking that you are unsure of.
Please be aware that normal site rules still apply to here, so we do not discuss blackhat activity or anything associated to the darknet/TOR/onion URLs.

Members of Notorious helping:

Faith connors

Links:

The Absolute Beginner Hacking Tutorial 1.0.1 by Th3PonyWizard

What Language Should You Learn? by Faith Connors

Beginner Hacking Resources by Lante

The Hacker Ethos by True Demon

How to Get Started by Asdethprime

FAQ:

Q: How do I hack Facebook/Instagram/Twitter/etc.?
A: Either buy a cracker from here (not recommended) or use a program like SentryMBA. You will need the email/username and a password list. The larger your password list is, the higher success rate you will have, but it will take much longer to get the password. Alternatively you can look up the email in a reverse database search tool like LeakedSource and find old passwords the user has used in the past and try those.

Q: What if I do want to talk about blackhat stuff?
A: Please contact me off-site. My XMPP is [email protected]

Q: Should I install Kali, run it live or run it in a VM?
A: You will get better performance running Kali Live than in a VM. I would not recommend installing it fully as it is not made to be an every-day distro. It is missing many packages you would use for daily use. Use it only for pentesting, and I recommend running it as a live disk.

Q: How do I stay 100% anonymous online?
A: It is theoretically impossible to remain 100% anonymous, but you can get it infinitely close and even major intelligence organizations like GCHQ and the NSA won't try to crack it all because it would cost them too much time, money, and resources. Read this thread by Previously Known As... for more information.

[Deany]

Wow, this is a very high quality thread. Good work.

[Mi2414]

What is the best use with Kali, Just wondering what you think of it as a distro.

[Faith Connors]

What is the best use with Kali, Just wondering what you think of it as a distro.

It's a good distro to be used for what is was made to do. And that is penetration testing. It has all the packages and dependencies you will need to do all your penetration tests, all in one place. But it still shouldn't be used for everyday life (unless you are a pentester of course, but even then, let me explain.)

What do you usually need to get stuff done on your computer? A good/fast web browser, an office suite, maybe some accessories like a calculator, if you program maybe an IDE or a (good) text editor like Atom, or if you do GFX, maybe GIMP. Kali doesn't have any of these things included with it (except gedit as a text editor). Now, I already know what you're thinking. "But I can just install all these things if I want." Alright, that's fine, but now let's look deeper into the distro.

First of all, Kali boots to root. There is no other user. When you launch the terminal, you are in root. Not good, bad for security in most instances. Second problem is that it has too much. Think about it. Out of the hundreds of tools it has included, you may only end up using about 10% of them regularly. So basically, you may as well install a different distro (like Debian, Elementary, etc.) and install whatever packages you want for pentesting, and you'll struggle a lot less with it.

[Asdethprime]

Hi Faith Connors ,

Excellent work there. Just a question, would you mind if I add my view on how to go about learning hacking as well alongside reference to few free ebooks?

Coz I think this is an excellent start.

[Faith Connors]

Hi Faith Connors ,

Excellent work there. Just a question, would you mind if I add my view on how to go about learning hacking as well alongside reference to few free ebooks?

Coz I think this is an excellent start.

Yeah sure thing, if you make a thread I'll add it to the links or if you wanna PM me it I'll just add it to the OP.

[Sɪɴɴᴇᴅ]

How did you start & learn everything you know?

[Faith Connors]

How did you start & learn everything you know?

It starts with lurking and lots of googling.

Just read threads or blogs or how-to's online or on here and find something you don't understand. Then try to figure out what it is, exactly what it does/its function, and how you can apply it. Use Google, it's your best friend. Sometimes you won't get a direct answer, but find other places where you might get an answer. You can ask questions right on this thread, or maybe try stackexchange/stackoverflow.

Read books. Some are geared towards programming, like a good book on C or Python, but others will be more geared towards hacking, like the Hacker's Ethos by True Demon or a hacking course study guide like CEH. Then some books might combine the two, like Violent Python. But these books will not only help you learn about the subject, the hacking ones may also help you develop the mindset for it. Like thinking outside the box.

Once you understand the fundamentals and have the mindset, just jump right into it. Download a vulnerable VM from vulnhub. Try to crack it. If you get stuck and you've tried everything you can think of, look up a guide, figure out how the author solved it, then go and try again. Maybe try a site like hackthissite or leettime to practice web exploitation. Remember to stay legal though.

Also check out other online resources that can help you. There are tons of video tutorials and online courses you can take. Check out cybrary.it for free stuff like that. They also bring in an expert from the field every Sunday for a S3SS10N so you can learn even more. Webinars in general are also invaluable. I've attended some of the AWS ones and they have some neat stuff in them. Cisco also held one a few months ago and they even sent all the participants some free hardware.

[SilentkillarHF]

I've been wondering for a while now. Something I'm unsure about hacking. Might sound stupid, but I'm learning.

Let's say I manage to find a vulnerability on a website. How can I exploit it? And when I've exploited it, how can I use that to fully take control of the website?

[Faith Connors]

I've been wondering for a while now. Something I'm unsure about hacking. Might sound stupid, but I'm learning.

Let's say I manage to find a vulnerability on a website. How can I exploit it? And when I've exploited it, how can I use that to fully take control of the website?

Although I'm expecting all kinds of stupid questions here, this one isn't and is totally valid.

Honestly, it depends on the vulnerability and the way you exploit it, along with maybe a little luck and sweet talking.

Now, first you have to figure out how the site works, why does your vulnerability happen? What is the site doing to process your input? Like, for instance, let's use just a standard SQL injection. You put a username in the username bar that has an apostrophe in it. MySQL takes the input of an apostrophe as magic quotes and when you hit enter, you see that the site says it didn't log you in because there was a SQL error that the other quote wasn't closed. So you know the site is accepting SQL queries on its own.

Another example, let's say you are searching for something code related, and you decide to include HTML tags in your query, like <strong> to make it bold, and when the search is done, you see it returned "Found x results for "keyword" showing your keyword in bold. So if it accepts HTML tags, maybe you can write a script to send to the server.

Now, once you understand what the site is doing, you can start to think of ways to make it do what you want. So for the first example, the SQL injection, you can try to find a list of usernames/passwords and get the admin username and pass so you can log into the site or server and take control of it. Maybe in the script example you would send a script to someone on the other end, an admin or staff member, and try to social engineer them into doing what you want (see, you might need a little luck). But once you figure out exactly what the site does, then you can figure out what you need to do to exploit it. To do that, though, you will probably need some knowledge of languages so you can write your own scripts. I'd suggest having a look at JavaScript and a DBMS. MySQL is really popular.

[Nomox]

thanks man for being so helpful to new ewhorers:)

[Tsunfire]

thanks man for being so helpful to new ewhorers:)

?????

Does private investigation fall under hacking? I never knew.

[Faith Connors]

thanks man for being so helpful to new ewhorers:)

I don't teach people to social engineer.
Because I'm already a sweet talker and don't want people to know my ways ;)

[Tsunfire]

Oh I guess it is. Is there a way to find an exact location from IP without ISP doxing?

[Faith Connors]

Oh I guess it is. Is there a way to find an exact location from IP without ISP doxing?

As far as I know, no. But there is a way that you might have a chance at.

There was a thread a while ago about hacking WAN IPs like the meme hacking we always talk about. It involves calling up the ISP and social engineering them to open a port on the modem for remote administration. So you do have to call up the IP, but it's easier to do this than get them to release a ton of info.

You can read up on the thread, but that aside, let's say you go all the way down the rabbit hole and now you have access to the targets computer through meterpreter or the tool of your choice. Now here are your options:

1. Pray to God that they are running Windows and have location services on, then open up Google Maps on their web browser.

2. Get any info about them saved on their computer or log into their Facebook or whatever, then go through some database searches (LeakedSource, white pages, etc.) and try to get some info.

Like I said, there's no surefire way. It will take a little luck.