[randomFunParty]

I have always had a passion for hacking and the hacker mentality and personality.

I want to learn as my hacking skills the following + required programming languages to do so:

primary skils:
web exploitation/database exploitation
social engineering
OSINT
browser hacking

secondary skills:
wifi/network hacking
server/OS exploitation
basic reverse engineering

But I want to have the necessary knowledge to know how this stuff works before I exploit it. I have been learning web development to try and get the necessary skills to learn web exploitation. I want to learn the programming behind it. As for the secondary skills, I want to still be proficient but not emphasized as much. I want to know how that stuff works as well but its the first four things I really like the most, especially web exploitation. That's what I want as my primary specialty more than anything else there.

How long should it take me to do this minimum if you include the time it takes to get the prerequisites done in order to do so?

Thanks.

[CyberStrike]

Are you starting from zero already? If that is the case with 12-18 hour days you might be able to do it in 3 - 4 months absolute minimum.

[Asdethprime]

Learning 1 discipline is hard and you wanna learn everything ?

Possible but not very practice.

Stick with 1 and try and master it. Web app hacking is probably the most doable one here with Reverse Engineering being the hardest.

[randomFunParty]

Learning 1 discipline is hard and you wanna learn everything ?

Possible but not very practice.

Stick with 1 and try and master it. Web app hacking is probably the most doable one here with Reverse Engineering being the hardest.

What if I want to know one the best and the basics of the rest?

Like what if I want to be especially good at web hacking and know the basics of everything else but not have the same level of skill?

Could that be done in two or three years?

If I specialize in web hacking, which is what I want most, I should study full-stack web dev right?

[Asdethprime]

What if I want to know one the best and the basics of the rest?

Like what if I want to be especially good at web hacking and know the basics of everything else but not have the same level of skill?

Could that be done in two or three years?

If I specialize in web hacking, which is what I want most, I should study full-stack web dev right?

Honestly bro ; the amount of time and dedication you would need just to master web app hacking will take forever. The better u get at this the more gaps in the knowledge you will find.

But do you have to be a full stack developer ? Not really.

From a hackers perspective you can’t do much with HTML and CSS to break into the website and that’s a huge part of web front end.

After all front end is HTML + CSS + Javascript.

So you will mostly be working on the backend but not the whole part of it. You will not really care how to render it on server ; how to optimised the code ; how to scale the app etc which is again a big part.

You are most focused on what data comes from the server ; what data goes back and how is it processed. That’s the main basis for web hacking. Things like token manipulation , code injection , session spoofing / hijacking , TOCTOU weakness are all based on this.

[randomFunParty]

Honestly bro ; the amount of time and dedication you would need just to master web app hacking will take forever. The better u get at this the more gaps in the knowledge you will find.

But do you have to be a full stack developer ? Not really.

From a hackers perspective you can’t do much with HTML and CSS to break into the website and that’s a huge part of web front end.

After all front end is HTML + CSS + Javascript.

So you will mostly be working on the backend but not the whole part of it. You will not really care how to render it on server ; how to optimised the code ; how to scale the app etc which is again a big part.

You are most focused on what data comes from the server ; what data goes back and how is it processed. That’s the main basis for web hacking. Things like token manipulation , code injection , session spoofing / hijacking , TOCTOU weakness are all based on this.

Right. Obviously I don't have to be a professional full-stack web developer. But it probably would help to make a network-based application or a cilent-server web app right?

[Asdethprime]

Right. Obviously I don't have to be a professional full-stack web developer. But it probably would help to make a network-based application or a cilent-server web app right?

Certainly.

The main aim is to figure out how things work under the hood.
How you go about learning it is up to you.

It definitely helps to actually build the whole thing ; gives you understanding of how it work, and you get to see what are the pain points for developer ( i.e. where are the most weakness that you can hijack is going to lie).

But being able to develop something does not necessarily mean you can hack it.

[randomFunParty]

Certainly.

The main aim is to figure out how things work under the hood.
How you go about learning it is up to you.

It definitely helps to actually build the whole thing ; gives you understanding of how it work, and you get to see what are the pain points for developer  ( i.e. where are the most weakness that you can hijack is going to lie).

But being able to develop something does not necessarily mean you can hack it.

I know but wouldn't be ideal to take a web development course first? I mean I am taking a full-stack web development course right now and its going really well.

Yeah, I mean I agree with you. Obviously, i need to get to the point where I can actually hack it.

Thanks for the advice.

[Noodlez_]

Realistically.

Social Engineering:
Become a good liar/story maker and start studying up on the art form of Human Manipulation.
Time: You can start immediately. This skill is meant to build over time.

Basic Reverse Engineering:
I recommend you start building on this skill first. It will help you in the long run. Depending on what your trying to achieve search for things that aren't obfuscated that you find interest in and find out how it works. Google would be your friend. I'll expand on this in this in browser hacking. But you also got reading machine code and so on and so forth. Really getting the basics is just identifying what language its using and acquiring the appropriate tools.
Time: It's kind of a concurrent thing. Security experts learn something new every day when reverse engineering. Just the basics will take you about a week to have yourself gathered up.

Browser Hacking:
Getting into this is really just finding something you're interested in. I believe when I was 14 I had to take an online driver's school. Driving is pretty simple and where I was living they didn't have any weird questions like what minimum does your auto policy need to be or some bullshit like that. The problem was is I needed to spend 10 minutes on each page of the lesson. Regardless of the content amount that was actually on the page. Did some research and tested many types of timers and found out it was a javascript timer. Bypassed the 10 minutes and finished 2 months of courses in 2 days. I built my way up from hacking facebook games and other odd things. Soon enough when CLEP was still fairly new with moving from scantron to computer based testing the test was actually sent locally to the machine and the machine would grade it and send a score back to the server (not the answers) You used to be able just to send a score back to the server and be done with it. Fuck English. Now I can comfortably do my continuing education on many LMS's in a few minutes. If we're talking about XSS I believe it's just mainly finding that vuln which I guess would also tie into this.
Time: Once you start flying through on your reverse engineering it should honestly be a breeze. I'd say 3 months until you feel comfortable on what you're actually looking at/working on.

And not that I don't have any experience on the other topics, it's just if you want to start somewhere these are the best three to start on when starting from zero.

[randomFunParty]

Realistically.

Social Engineering:
Become a good liar/story maker and start studying up on the art form of Human Manipulation.
Time: You can start immediately. This skill is meant to build over time.

Basic Reverse Engineering:
I recommend you start building on this skill first. It will help you in the long run. Depending on what your trying to achieve search for things that aren't obfuscated that you find interest in and find out how it works. Google would be your friend. I'll expand on this in this in browser hacking. But you also got reading machine code and so on and so forth. Really getting the basics is just identifying what language its using and acquiring the appropriate tools.
Time: It's kind of a concurrent thing. Security experts learn something new every day when reverse engineering. Just the basics will take you about a week to have yourself gathered up.

Browser Hacking:
Getting into this is really just finding something you're interested in. I believe when I was 14 I had to take an online driver's school. Driving is pretty simple and where I was living they didn't have any weird questions like what minimum does your auto policy need to be or some bullsnap like that. The problem was is I needed to spend 10 minutes on each page of the lesson. Regardless of the content amount that was actually on the page. Did some research and tested many types of timers and found out it was a javascript timer. Bypassed the 10 minutes and finished 2 months of courses in 2 days. I built my way up from hacking facebook games and other odd things. Soon enough when CLEP was still fairly new with moving from scantron to computer based testing the test was actually sent locally to the machine and the machine would grade it and send a score back to the server (not the answers) You used to be able just to send a score back to the server and be done with it. fugg English. Now I can comfortably do my continuing education on many LMS's in a few minutes. If we're talking about XSS I believe it's just mainly finding that vuln which I guess would also tie into this.
Time: Once you start flying through on your reverse engineering it should honestly be a breeze. I'd say 3 months until you feel comfortable on what you're actually looking at/working on.

And not that I don't have any experience on the other topics, it's just if you want to start somewhere these are the best three to start on when starting from zero.

You seem to think of browser hacking as web exploitation. Browser hacking is using software exploitation to exploit the browser of the victim, Like hacking Google Chrome or Firefox.

Not necessarily the same as hacking Facebook using Google Chrome or Firefox though. Finding exploits in the browser is not exploits in the website.

Regardless, I think web hacking is what I'm gonna focus on first. Just learning web development and other stuff first so I can know what I'm doing.

---

Learning 1 discipline is hard and you wanna learn everything ?

Possible but not very practice.

Stick with 1 and try and master it. Web app hacking is probably the most doable one here with Reverse Engineering being the hardest.

Question, but don't most people know basics of multiple skills but one skill in depth?

I think I see what your saying though.

I am gonna get good at web exploitation primarily but I see what your saying I guess.

i'm probably gonna learn web exploitation first and spend the most time on that.

But I see where your going with this.

I will probably spend a year or two just on web exploitation before I get to anything else. For everything else, if I do it at all I will probably just learn the basics of it.

Does that make it more doable?

My favorite one of all of these is web hacking.

[Noodlez_]

You seem to think of browser hacking as web exploitation. Browser hacking is using software exploitation to exploit the browser of the victim, Like hacking Google Chrome or Firefox.

Not necessarily the same as hacking Facebook using Google Chrome or Firefox though. Finding exploits in the browser is not exploits in the website.

Regardless, I think web hacking is what I'm gonna focus on first. Just learning web development and other stuff first so I can know what I'm doing.

Sorry! Misunderstood what you said then. Kind of still don't understand. Unless you're talking about something as finding exploits to bypass popup blockers

[randomFunParty]

Sorry! Misunderstood what you said then. Kind of still don't understand. Unless you're talking about something as finding exploits to bypass popup blockers

Browser hacking is reverse engineering and software exploitation of web browsers. Like trying to steal your victim's browser sessions for example, etc.

[randomFunParty]

Certainly.

The main aim is to figure out how things work under the hood.
How you go about learning it is up to you.

It definitely helps to actually build the whole thing ; gives you understanding of how it work, and you get to see what are the pain points for developer  ( i.e. where are the most weakness that you can hijack is going to lie).

But being able to develop something does not necessarily mean you can hack it.

So would you say that most expert hackers don't have basic well-rounded hacking skill?

And I want to know web application hacking the most so I would pick that above all else.

But don't most hackers have more than one thing they know how to do? I mean, I thought that for example most hackers can crack WPA2, do basic SQLi, etc.

I am all for picking one thing and mastering it. It actually would be a good exercise for me because I generally have a problem being scattered with things.

But I am curious so do most really good hackers in web hacking just not know the first thing about anything else?

That's just my question.

And how well-rounded is the average skilled hacker in your view?