[Tɦɛ Gʀiɱ]

I suggest all the members to make use of this thread.

Keep up the good work :)

[devc0de]

Helpful thread. Motivation for those who wants to learn.

Keep it up man!

[Mαxim]

I suggest all the members to make use of this thread.

Keep up the good work :)

Grim you done good with this guy. Good pick.

Nice thread.

[Faith Connors]

Grim you done good with this guy. Good pick.

Nice thread.

Oh he didn't pick me. I picked his group to join. B)
I still wear riptide userbar bc riptide gvng or die fam

[VeloCityMods]

Great work on the HQ Thread. :) Very nice help desk.

[Asdethprime]

Since Faith Conners was kind enough to let me add stuffs to the thread I would like to take the opportunity.

The first thing you want to do in order to learn hacking is get a Linux distribution. The reason we advise you get on is because:
1) Windows spies on you
2) Windows has restriction on what you can and can’t do
3) One of the hackers resolution is not to let a single organization (Microsoft) control what you can and can’t do on your PC. The only way to do that is to stop using Windows. Insofar as you are using Windows there is really no way you can hide your information from Microsoft company. Think of it this way a simple meterpeter program can gain any information on your computer, Windows is so much more complex than that; what makes you think it can’t get your information?

Secondly don’t rely overtly on tutorial, read book as they are excellent guide to get you started.

Before you begin hacking learn how to use the Linux terminal because every hacker uses to terminal for hacking. The reason is simple, while graphical user interfaces make easy task easier, terminal makes difficult task possible =)
https://sourceforge.net/projects/linuxco...-16.07.pdf

It's written in simple terms and is very detailed.

Then learn about hacking. The book I would highly recommend is Pentesting: A Hands on Introduction to Hacking by Georgia Weidman
https://repo.zenk-security.com/Magazine%...acking.pdf

This will give you the idea of how to hack, will introduce you to tool and techniques.

Now what you want to do is, after you read the book make a list of tools they used. Find documentation on the tool you have and learn to use them. Master using the tool. For example one of the tool you are no doubt going to come across is Nmap. Get a book on it "Fat free guide to nmap" and it will let you understand the tool in detail.

Always remember you need to know three things:
1) What does it do
2) How does it do it
3) What information I can get and what each of them means

Now start using the tool, everything you get google to try and understand what they mean. If you come across protocols learn what they are. Essentially any protocol you come acros you want to learn
1) What is it?
2) When is it used?
3) What vulnerabilities you have.

By the time you are done with the book you will have a good idea of complete list of tools to use. Don't bound yourself to these tool, look for other tools online. The question you want to ask is, I am using this tool (for example nmap) what other tools are out that are like this that can give me some new information other than this tool.

Once you know how to use tools to hack you have merely become a script kiddie. There is nothing wrong with that but DON'T STOP THERE.

You want to expand your knoweledge so go around and look at various databases that have vulnerability and exploits written. Some common ones are:
www.securityfocus.com
www.packetstormsecurity.org
www.exploit-db.org
www.cve.mitre.org
www.osvdb.com

Now's the time to learn programming. In order to understand these vulnerabilities in detail you need to know programming. Look at what programming language is used, make a list of commands used in the exploit and understand how to use those command. This way you are limiting things. By the time you are done reading all the vulnerabilities you are going to know just about all the commands but don't rush things. Learn things on a need to know basis.

By the time you've done all this you will automatically know what to do next.

And if you get stuck somewhere let us know and maybe we can help you.

Hope this helps,

[THC]

Nice to see a help desk coming back to the beginner hacking section.
I'll be dropping by to help out :P

[SilentkillarHF]

Although I'm expecting all kinds of stupid questions here, this one isn't and is totally valid.

Honestly, it depends on the vulnerability and the way you exploit it, along with maybe a little luck and sweet talking.

Now, first you have to figure out how the site works, why does your vulnerability happen? What is the site doing to process your input? Like, for instance, let's use just a standard SQL injection. You put a username in the username bar that has an apostrophe in it. MySQL takes the input of an apostrophe as magic quotes and when you hit enter, you see that the site says it didn't log you in because there was a SQL error that the other quote wasn't closed. So you know the site is accepting SQL queries on its own.

Another example, let's say you are searching for something code related, and you decide to include HTML tags in your query, like <strong> to make it bold, and when the search is done, you see it returned "Found x results for "keyword" showing your keyword in bold. So if it accepts HTML tags, maybe you can write a script to send to the server.

Now, once you understand what the site is doing, you can start to think of ways to make it do what you want. So for the first example, the SQL injection, you can try to find a list of usernames/passwords and get the admin username and pass so you can log into the site or server and take control of it. Maybe in the script example you would send a script to someone on the other end, an admin or staff member, and try to social engineer them into doing what you want (see, you might need a little luck). But once you figure out exactly what the site does, then you can figure out what you need to do to exploit it. To do that, though, you will probably need some knowledge of languages so you can write your own scripts. I'd suggest having a look at JavaScript and a DBMS. MySQL is really popular.

Thanks man!

[Faith Connors]

Snip

Just added a link to this post in the OP. Thanks!

[Asdethprime]

Just added a link to this post in the OP. Thanks!

You are most welcome =)

[Faith Connors]

Bumping back up to page one.
Shoot us some questions and we'll do our best to answer!

[skelly76]

I think these would be a good addition to the links:
https://hackforums.net/showthread.php?tid=4178212
https://hackforums.net/showthread.php?tid=4329505

[Mimzie5]

Hello, im a beginner to all of this and id like to know a bit more about keyloggers and RAT's. I'm a little worried about downloading them and getting a virus on my computer. When downloading a RAT do some programs put encrypted viruses inside of them?

[Faith Connors]

Hello, im a beginner to all of this and id like to know a bit more about keyloggers and RAT's. I'm a little worried about downloading them and getting a virus on my computer. When downloading a RAT do some programs put encrypted viruses inside of them?

Yeah, a lot of free RAT programs have infected copies all over the internet because it's a pretty hot topic and that allows RAT users to try and get even more infected people. Try to find a clean copy of Darkcomet and you'll see what I mean. (Don't actually use Darkcomet, though.)

The safest way to go about it is to get a RAT from here, where you can see the thread and replies to the download and you can see whether it's safe or not. Or, you can also view the source code of the RAT if it's written in a .NET language (for native languages it's a lot harder to disassemble but still possible if there is no obfuscation.) Of course, this will require some programming knowledge, but you'll know exactly how it's built and if it's going to infect you.

Now, if you really want to be on the safe side, I'd suggest buying a RAT/keylogger because not only will they have more features, they will be stable, generally higher quality, and some are also cross platform.

[Rubixa]

What would you say would be the best method to do a vulnerability test on a site? and once tested, if there are any XSS vulnerabilities found, how can I go about exploiting them?