[Zapu]

[img]http://i1.minus.com/iLbdJjhOluAEW.png[/img]

Old thread was junked do to misinformation and missed posts. This one will be the same, but just more information.

What is a hacker?

hack·er
/ˈhakər/
Noun
An enthusiastic and skillful computer programmer or user.
A person who uses computers to gain unauthorized access to data.

Taken from http://www.wikipedia.org

Types of hackers

[img]http://mrthaibox123.com/wp-content/uploads/2013/06/Hacker-Hat-Colors-Explained.jpg[/img]

---

Blackhat Hacker

The Blackhat hacker, is the bad guy. He's the one who illegally breaks into systems and steals information from people. Most whitehats started off as being blackhat hackers.

---

Greyhat Hacker

The greyhat hacker is inbetween of the Black and White. They will illegally break into a computer or a website, but will report the exploit after.

---

Whitehat Hacker

These are the good guys, they get permission to hack. It's pretty much their job. They'll test security and if they find an exploit/vulnerability they will tell an admin and in the end result they're payed.

---

Hackers

---

Here's a list of hackers:

Spoiler (Click to View)

Kevin Mitnick

Adrian Lamo

Gary McKinnon

George Hotz

Jonathan James(DECEASED)

Hacker Groups

Milw0rm

TeaMp0isoN

L0pht

Cult Of The Dead Cow

CCC-Chaos Computer Club

No, Anonymous will NOT be put in this section.

---

Defense

Before we go around hacking the gibson, we should be well hidden. How can we manage to accomplish this? Well, we can with a proxy or a VPN.

What's a VPN?


[img]http://blog.static.abine.com/blog/wp-content/uploads/2012/11/vpn-diagram.png[/img]

A virtual private network (VPN) extends a private network across a public network, such as the Internet. It enables a computer to send and receive data across shared or public networks as if it were directly connected to the private network, while benefiting from the functionality, security and management policies of the private network. This is done by establishing a virtual point-to-point connection through the use of dedicated connections, encryption, or a combination of the two.
A VPN connection across the Internet is similar to a wide area network (WAN) link between the sites. From a user perspective, the extended network resources are accessed in the same way as resources available from the private network.
VPNs allow employees to securely access their company's intranet while traveling outside the office. Similarly, VPNs securely and cost-effectively connect geographically disparate offices of an organization, creating one cohesive virtual network. VPN technology is also used by ordinary Internet users to connect to proxy servers for the purpose of protecting one's identity.

Source

What does a VPN do? Well, a VPN helps us mask our IP from attackers.

List of VPN's

http://www.spotflux.com(Windows/Mac) | Free |
http://www.securitykiss.com(Windows/Mac/Linux) | Free |
http://www.openvpn.com(Windows/Mac/Linux) | Free |
http://#.net(Windows/Mac/Linux) | Not free |
http://www.vpnreactor.com(Windows/Mac/Linux) | Not Free |


What's a proxy server?


[img]http://upload.wikimedia.org/wikipedia/commons/thumb/b/bb/Proxy_concept_en.svg/280px-Proxy_concept_en.svg.png[/img]

In computer networks, a proxy server is a server (a computer system or an application) that acts as an intermediary for requests from clients seeking resources from other servers. A client connects to the proxy server, requesting some service, such as a file, connection, web page, or other resource available from a different server and the proxy server evaluates the request as a way to simplify and control its complexity. Proxies were invented to add structure and encapsulation to distributed systems. Today, most proxies are web proxies, facilitating access to content on the World Wide Web.

Source


I wouldn't suggest any free proxies, or a proxy at all. I'd recommend a VPN. Private Proxies will suffice, but they will cost.


Okay, so you bought your VPN and the owner of the VPN handed you a config file. What now?

You'll want to download something like OpenVPN if you're on windows.

If you're on MAC download Viscosity or download Tunnelblick

If you're on linux open up terminal either from your panel or ctrl alt T and type

su

for root privileges then type

sudo apt-get install openvpn

The command may differ depending on your linux distro.

So you have your OpenVPN client open. If you need help setting it up then please look here:

OpenVPN Tutorial(WINDOWS)

How to configure OpenVPN on Ubuntu Linux

How to setup Viscosity on MAC

How to configure Tunnelblick on MAC

So you have your VPN set up and you're running it. First thing to check for is a DNS leak.


What's a DNS leak?

When using an anonymity or privacy service, it is extremely important that all traffic originating from your computer is routed through the anonymity network. If any traffic leaks outside of the secure connection to the network, any adversary monitoring your traffic will be able to log your activity.

DNS or the domain name system is used to translate domain names such as www.privacyinternational.org into numerical IP addresses e.g. 123.123.123.123 which are required to route packets of data on the Internet. Whenever your computer needs to contact a server on the Internet, such as when you enter a URL into your browser, your computer contacts a DNS server and requests the IP address. Most Internet service providers assign their customers a DNS server which they control and use for logging and recording your Internet activities.

Under certain conditions, even when connected to the anonymity network, the operating system will continue to use its default DNS servers instead of the anonymous DNS servers assigned to your computer by the anonymity network. DNS leaks are a major privacy threat since the anonymity network may be providing a false sense of security while private data is leaking.

If you are concerned about DNS leaks, you should also understand transparent DNS proxy technology to ensure that the solution you choose will stop the dns leak.

Source

Here's a diagram of a DNS Leak:



If you want to know if your DNS is leaking then head over to dnsleaktest.com. If you see your ISP's DNS server then your DNS is leaking.


If you need help fixing a leak on windows then go here

If you're on linux then please open up terminal and type

nano /etc/resolv.conf

You should be greeted with this:



You see namersever 127.0.1.1?
Comment that out so it looks like #127.0.1.1

Also, go to the last two nameservers and change them to either Google's DNS or OpenDNS.

Google:
8.8.8.8
8.8.4.4

OpenDNS:
208.67.222.222
208.67.220.220


Hit ^O(Ctrl O) and then hit enter. Then hit ^X(Ctrl X)

Go back to dnsleaktest.com, and it should work.



If your IP is grabbed, I would recommend, either calling your ISP and asking them to change it, or buy a new router.

---

[img]http://www.public-domain-photos.com/free-cliparts-1-small/tools/weapons/sword_01.gif[/img]

Offense

So now that we're nice and cozy in our encrypted tunnel, we can start off on the offense.

Now since you're just beginning we'll start off easy.

The first things most kids start off with is DoSing and DDoSing.

What is a Denial Of Service Attack?

Well theres two different types.

DDoS= Distributive Denial Of Service Attack, this is where multiple computers/servers are attacking a computer or a website.

The stresser sends packets UDP packets to a remote port on a machine, overwhelming the router causing it to shut down which end result is loss of internet.

DoS isn't as effective, DoS is when the stressing comes from 1 source and 1 source only, they use programs like LOIC to try to off someone. All you have to do is got into your router settings, go to logs, see the IP that attacked you and report it your ISP or do something back to them.

But for DDoSing it's different, the IP's are spoofed so you're pretty much at a dead end.

How to DDoS? Get the IP of your victim, whether it's from a IP Logger, or a skype resolver/steam resolver or any other method. Log into your Stresser panel, input the IP and put port 80 and attack type being UDP and stress for the amount of seconds you bought.

There are no such things as free booters that have GOOD power that can actually knock someone off. You will have to spare 5 dollars.

Here's a section of stressers to choose from: Server Stress Testing

Different types of attacks:

UDP or also known as User Datagram Protocol is perfect for home connections, XBL and gameservers.
What it exactly does is sending packages on a remote host and as result the server will respond with a Unreachable packet,
if you keep sending packages the target will respond with even more Unreachable packets and as result it will be unreachable for other people.
Spoofing can also be used to avoid that the Unreachable packets reaches your network and get you cought,
so by spoofing the attacks you stay anonymous.

SSYN basically sends SYN requests in attempt to consume all the target's resources as result the host will be unreachable for legit traffic.

RUDY or R U dead yet, uses form field submissions & given urls (Don't know too much about this one never used it.)

ARME (Not sure, never used it)

GET, uses 3-way TCP handshake this looks like a legit connection and therefore gets passed to the web or app server it then begins to request large amounts of files,..
this will make the system focus on these ones and not on other legit connections that are coming in.

POST, submits data content back to the server for example Forms or posts or whatever..

HEAD, pretty much the same as GET the server just doesn't respond with a message-boddy.

Credits to OG Kush, the post he/she made can be found here

---

Pictures of DDoS and DoS:



DDoS


[img]http://www.cisco.com/web/about/ac123/ac147/images/ipj/ipj_7-4/dos_figure_4.gif[/img]

[img]http://www.kbradyservice.com/DDOS-Attack.jpg[/img]

DoS

Imagine the same picture, but only coming from 1 source.

---

---

[img]http://x.hackforums.net/uploads/awards/rat-expert.png[/img]

Remote Administration Tools

---

What's a RAT?

remote access tool (a RAT) is a piece of software that allows a remote "operator" to control a system as if he has physical access to that system. While desktop sharing and remote administration have many legal uses, "RAT" software is usually associated with criminal or malicious activity. Malicious RAT software is typically installed without the victim's knowledge, often as payload of a Trojan horse, and will try to hide its operation from the victim and from security software.
The operator controls the RAT through a network connection. Such tools provide an operator the following capabilities:[1]
Screen/camera capture or image control[2]
File management (download/upload/execute/etc.)[3]
Shell control (from command prompt)[4]
Computer control (power off/on/log off if remote feature is supported)
Registry management (query/add/delete/modify)[5]
Hardware Destroyer (overclocker)[6]
Other software product-specific functions
Its primary function is for one computer operator to gain access to remote PCs. One computer will run the "client" software application, while the other computer(s) operate as the "host(s)".

RAT photos

[img]http://upload.wikimedia.org/wikipedia/commons/2/2c/DarkComet2.png[/img]

There are tons of RAT's out there, but the most common are Dark Comet(Windows)

jRat(Windows/Mac/Linux)

Netwire (Windows/Mac/Linux)

Blackshades(Windows)

Imminent Monitor(Windows/Mac/Linux)

Darkcomet is free
Jrat, Blackshades, Netwire, Imminent Mintor cost money.

If you need help setting up a RAT go over to the Remote Administration Tool Section

I'm not going to explain keylogging, since keylogging is RATing with less features pretty much.

---

---

[img]http://x.hackforums.net/uploads/awards/gumshoe_24.png[/img]

Pentesting

---

[img]http://www.offensive-security.com/wp-content/uploads/2012/05/IMG_1002.png[/img]

What is Metasploit?

The Metasploit Project is a computer security project that provides information about security vulnerabilities and aids in penetration testing and IDS signature development.
Its best-known sub-project is the open source[1] Metasploit Framework, a tool for developing and executing exploit code against a remote target machine. Other important sub-projects include the Opcode Database, shellcode archive and related research.
The Metasploit Project is well known for its anti-forensic and evasion tools, some of which are built into the Metasploit Framework.

Metasploit can be downloaded from here

---

Backtrack Linux

What is Backtrack?

BackTrack is a distribution designed by Jason Dennis based on the Ubuntu Linux distribution aimed at digital forensics and penetration testing use

[img]http://upload.wikimedia.org/wikipedia/commons/thumb/e/e4/BackTrack_5_R1.png/799px-BackTrack_5_R1.png[/img]

Backtrack has tons of features, like SET (Social Engineer Toolkit)

and reverse engineering tools as well.

---

NMap

What is NMap?

Nmap ("Network Mapper") is a free and open source (license) utility for network discovery and security auditing. Many systems and network administrators also find it useful for tasks such as network inventory, managing service upgrade schedules, and monitoring host or service uptime. Nmap uses raw IP packets in novel ways to determine what hosts are available on the network, what services (application name and version) those hosts are offering, what operating systems (and OS versions) they are running, what type of packet filters/firewalls are in use, and dozens of other characteristics. It was designed to rapidly scan large networks, but works fine against single hosts. Nmap runs on all major computer operating systems, and official binary packages are available for Linux, Windows, and Mac OS X. In addition to the classic command-line Nmap executable, the Nmap suite includes an advanced GUI and results viewer (Zenmap), a flexible data transfer, redirection, and debugging tool (Ncat), a utility for comparing scan results (Ndiff), and a packet generation and response analysis tool (Nping).

[img]http://nmap.org/images/nmap-401-demoscan-798x774.gif[/img]

---

Wireshark

What is Wireshark?

Wireshark is a free and open-source packet analyzer. It is used for network troubleshooting, analysis, software and communications protocol development, and education. Originally named Ethereal, in May 2006 the project was renamed Wireshark due to trademark issues.[3]
Wireshark is cross-platform, using the GTK+ widget toolkit to implement its user interface, and using pcap to capture packets; it runs on various Unix-like operating systems including Linux, OS X, BSD, and Solaris, and on Microsoft Windows. There is also a terminal-based (non-GUI) version called TShark. Wireshark, and the other programs distributed with it such as TShark, are free software, released under the terms of the GNU General Public License.

A complete list for Pentesting tools can be found here

Pentesting Tutorials

You can find a list of tutorials in the pentesting section which can be found here

---

[img]http://x.hackforums.net/uploads/ficons/website-hacking.png[/img]

Website and Forum Hacking

Maybe you're not interested in computers but more interested in websites. Hackforums has a section devoted to hacking websites which can be found here

Website attacks:

SQL Injection

SQL injection is a code injection technique, used to attack data driven applications, in which malicious SQL statements are inserted into an entry field for execution (e.g. to dump the database contents to the attacker).[1] SQL injection must exploit a security vulnerability in an application's software, for example, when user input is either incorrectly filtered for string literal escape characters embedded in SQL statements or user input is not strongly typed and unexpectedly executed. SQL injection is mostly known as an attack vector for websites but can be used to attack any type of SQL database.
Classification of SQL injection attack vectors in 2010

A Classification of SQL injection attacking vector until 2010.
In a 2012 study, security company Imperva observed that the average web application received 4 attack campaigns per month, and retailers received twice as many attacks as other industries

List of SQL injection tutorials:

Website Hacking: SQL Injection - |3orne

[Tutorial] MsSQL Injection- Usploit

---

LFI(Local File Inclusion)

Local File Inclusion (also known as LFI) is the process of including files on a server through the web browser. This vulnerability occurs when a page include is not properly sanitized, and allows directory traversal characters to be injected

LFI Tutorial(s):

LFI Tutorial -Downfall

---

Remote File Inclusion(RFI)

Remote File Inclusion (RFI) is a type of vulnerability most often found on websites. It allows an attacker to include a remote file, usually through a script on the web server. The vulnerability occurs due to the use of user-supplied input without proper validation. This can lead to something as minimal as outputting the contents of the file, but depending on the severity, to list a few it can lead to:
Code execution on the web server
Code execution on the client-side such as JavaScript which can lead to other attacks such as cross site scripting (XSS).
Denial of Service (DoS)
Data Theft/Manipulation

RFI Tutorial(s)

RFI tutorial -Downfall

Exploiting Remote File Inclusion

RFI(Remote File Inclusion)

---

---

[img]http://x.hackforums.net/uploads/ficons/console.png[/img]

Programming

What's Computer Programming?

Computer programming (often shortened to programming) is the comprehensive process that leads from an original formulation of a computing problem to executable programs. It involves activities such as analysis, understanding, and generically solving such problems resulting in an algorithm, verification of requirements of the algorithm including its correctness and its resource consumption, implementation (or coding) of the algorithm in a target programming language, testing, debugging, and maintaining the source code, implementation of the build system and management of derived artefacts such as machine code of computer programs. The algorithm is often only represented in human-parseable form and reasoned about using logic. Source code is written in one or more programming languages (such as C++, C#, Java, Python, Smalltalk, JavaScript,etc.). The purpose of programming is to find a sequence of instructions that will automate performing a specific task or solve a given problem. The process of programming thus often requires expertise in many different subjects, including knowledge of the application domain, specialized algorithms and formal logic.

Source

HF's computer programming section can be found here

List of computer programming languages:

Visual Basic

Visual Basic is a third-generation event-driven programming language and integrated development environment (IDE) from Microsoft for its COM programming model first released in 1991. Microsoft intends Visual Basic to be relatively easy to learn and use.[1][2] Visual Basic was derived from BASIC and enables the rapid application development (RAD) of graphical user interface (GUI) applications, access to databases using Data Access Objects, Remote Data Objects, or ActiveX Data Objects, and creation of ActiveX controls and objects. The scripting language VBScript is a subset of Visual Basic

Created by Microsoft

C/C++/Obj-C

C++ (pronounced "see plus plus") is a programming language that is general purpose, statically typed, free-form, multi-paradigm and compiled. It is regarded as an intermediate-level language, as it comprises both high-level and low-level language features.[3] Developed by Bjarne Stroustrup starting in 1979 at Bell Labs, C++ was originally named C with Classes, adding object oriented features, such as classes, and other enhancements to the C programming language. The language was renamed C++ in 1983,[4] as a pun involving the increment operator.

Created by Bjarne Stroustrup

Batch

In DOS, OS/2, and also Microsoft Windows, batch file is the name given to a type of script file, a text file containing a series of commands to be executed by the command interpreter.
A batch file may contain any command the interpreter accepts interactively at the command prompt. A batch file may also have constructs (IF, GOTO, Labels, CALL, etc.) that enable conditional branching and looping within the batch file.
Similar to job control language and other systems on mainframe and minicomputer systems, batch files were added to ease the work required for certain regular tasks by allowing the user to set up a script to automate them. When a batch file is run, the shell program (usually COMMAND.COM or cmd.exe) reads the file and executes its commands, normally line-by-line.[1] Unix-like operating systems (such as Linux) have a similar, but more flexible, type of file called a shell script.[2]

Java

Java is a general-purpose, concurrent, class-based, object-oriented computer programming language that is specifically designed to have as few implementation dependencies as possible. It is intended to let application developers "write once, run anywhere" (WORA), meaning that code that runs on one platform does not need to be recompiled to run on another. Java applications are typically compiled to bytecode (class file) that can run on any Java virtual machine (JVM) regardless of computer architecture. Java is, as of 2012, one of the most popular programming languages in use, particularly for client-server web applications, with a reported 10 million users.[10][11] Java was originally developed by James Gosling at Sun Microsystems (which has since merged into Oracle Corporation) and released in 1995 as a core component of Sun Microsystems' Java platform. The language derives much of its syntax from C and C++, but it has fewer low-level facilities than either of them.

Created by James Gosling

and Sun Microsystems

PHP

PHP is a server-side scripting language designed for web development but also used as a general-purpose programming language. PHP is now installed on more than 244 million websites and 2.1 million web servers.[2] Originally created by Rasmus Lerdorf in 1995, the reference implementation of PHP is now produced by The PHP Group.[3] While PHP originally stood for Personal Home Page,[4] it now stands for PHP: Hypertext Preprocessor, a recursive acronym.[5]

Created by Rasmus Lerdorf

Python

Python is a widely used general-purpose, high-level programming language.[11][12][13] Its design philosophy emphasizes code readability, and its syntax allows programmers to express concepts in fewer lines of code than would be possible in languages such as C.[14][15] The language provides constructs intended to enable clear programs on both a small and large scale.[16]
Python supports multiple programming paradigms, including object-oriented, imperative and functional programming or procedural styles. It features a dynamic type system and automatic memory management and has a large and comprehensive standard library.[17]
Like other dynamic languages, Python is often used as a scripting language, but is also used in a wide range of non-scripting contexts. Using third-party tools, Python code can be packaged into standalone executable programs (such as Py2exe, or Pyinstaller[18]). Python interpreters are available for many operating systems.
CPython, the reference implementation of Python, is free and open source software and has a community-based development model, as do nearly all of its alternative implementations. CPython is managed by the non-profit Python Software Foundation.

Created by Python Software Foundation

AutoIT

AutoIt (pronounced aw-toe-it)[2] is a freeware automation language for Microsoft Windows. In its earliest release, the software was primarily intended to create automation scripts (sometimes called macros) for Microsoft Windows programs[3] but has since grown to include enhancements in both programming language design and overall functionality.
With the release of Version 3, the syntax of AutoIt has been restructured to be more like the BASIC family of languages. It is a third-generation programming language using a classical data model, using a variant data type that can store several types of data, including arrays. It is compatible with Windows 95, 98, ME, NT4, 2000, XP, 2003, Vista and Windows 7 (however, support for operating systems older than Windows 2000 was discontinued with the release of v3.3.0).

Created by Jonathan Bennett & AutoIt Team.

Assembly

An assembly language is a low-level programming language for a computer, or other programmable device, in which there is a very strong (generally one-to-one) correspondence between the language and the architecture's machine code instructions. Each assembly language is specific to a particular computer architecture, in contrast to most high-level programming languages, which are generally portable across multiple architectures, but require interpreters or compiling.
Assembly language is converted into executable machine code by a utility program referred to as an assembler; the conversion process is referred to as assembly, or assembling the code.

Innovated by Nathanial Rochester and Stan Poley

Perl

Perl is a family of high-level, general-purpose, interpreted, dynamic programming languages. The languages in this family include Perl 5 and Perl 6.[4]
Though Perl is not officially an acronym,[5] there are various backronyms in use, such as: Practical Extraction and Reporting Language.[6] Perl was originally developed by Larry Wall in 1987 as a general-purpose Unix scripting language to make report processing easier.[7] Since then, it has undergone many changes and revisions. The latest major stable revision of Perl 5 is 5.18, released in May 2013. Perl 6, which began as a redesign of Perl 5 in 2000, eventually evolved into a separate language. Both languages continue to be developed independently by different development teams and liberally borrow ideas from one another.
The Perl languages borrow features from other programming languages including C, shell scripting (sh), AWK, and sed.[8] They provide powerful text processing facilities without the arbitrary data-length limits of many contemporary Unix commandline tools,[9] facilitating easy manipulation of text files. Perl 5 gained widespread popularity in the late 1990s as a CGI scripting language, in part due to its parsing abilities.[10]

Created by Larry Wall

Delphi

Lua

Lua is a lightweight multi-paradigm programming language designed as a scripting language with "extensible semantics" as a primary goal. Lua is cross-platform since it is written in ISO C.[1] Lua has a relatively simple C API, thus "Lua is especially useful for providing end users with an easy way to program the behavior of a software product without getting too far into its innards".[2]

Created by Roberto Ierusalimschy, Waldemar Celes, Luiz Henrique de Figueiredo

It's good to learn a programming language, if you want to learn the mechanics of things and how they work then programming is right up your alley. Also, if you program, kids can't really call you a skid. You'll be able to make your own programs.

---

Hope you all enjoyed reading this thread, took me quite sometime.

[Zapu]

Holy shit. This is huge. Good job on making it! :D

Haha yeah, the longer the better(That sounded awful).

Thanks for the comment. 🤝

[DoIReallyCare]

A huge thanks to you and the brotherhood. Very informative. 🤝

[Zapu]

A huge thanks to you and the brotherhood. Very informative. 🤝

Thank you for your nice comment DoIReallyCare 🤝

[PhantomElite]

This one's even better.
Good work on it.

[Zapu]

This one's even better.
Good work on it.

Thank you PhantomElite, I tried to make it a lot better, thanks for the feedback 🤝

[PhantomElite]

Since this is the beginner guide to hacking, maybe you should add a little section on Anonymous and how it is a concept more than anything else.

Just a suggestion.

[Zapu]

Since this is the beginner guide to hacking, maybe you should add a little section on Anonymous and how it is a concept more than anything else.

Just a suggestion.

To be completely honest, I did, but I ended up deleting it because I didn't want to argue with anyone. I'll just leave the opinion up to them.

[Black Shadow]

Why have you had to repost the thread again ?

[Zapu]

Why have you had to repost the thread again ?

I missed a section of the tutorial, and I missed out on a few things, and people already posted in the comments and I didn't want to have to message them asking to remove. I'm more happy with this thread though, I might try to save up for a sticky if the thread is good enough.(I've never seen a thread get stickied in this section)

[Daxe]

Thanks this is probably the best hacking thread for beginners i've ever seen. I wish I had this when I first started looking into this world.

[Zapu]

Thanks this is probably the best hacking thread for beginners i've ever seen. I wish I had this when I first started looking into this world.

Thanks for the feedback. Gonna see if I can get the first post deleted to add a new section which will be about which OS is appropriate for hacking(even though ALL are appropriate) 🤝

[Antigen]

wow that's a large thread, nice thread with detailed info. I really like to appreciate your willingness to help noobs here.

A index may help to overlook the content.

[#R00T~]

Very useful guide, will help alot of users gain knowledge of hacking :Blackhat:

[Trojan Squid]

very good for noobs like me! very in-depth.