Ethical Hacker Community Forums

Do you need to know programming to be a hacker? That has to be the question I get asked the most. I would say yes and no. It all depends on your view.  The problem is no one agrees what a hacker is! I posted in the past what it takes to be a hacker and every body had their own and different idea, lol!

You can be a fairly good pen tester now without knowing any programming. In fact, the most famous hacker of all time, Kevin Mitnick didn’t know programming. If you understand all the tools and know them well, you can do some effective hacking. I am sure that’s good news to all the script kiddies out there.

My honest feeling is you should learn some programming. At least the basics. It will give you a deeper understanding of what’s going on. Yes it’s true we don’t always breach a system by running an exploit. Sometimes things are just wide open and not configured correctly. Even to this day, Admins use weak passwords. 

If you have never leaned programming I would suggest starting with HTML. Its very easy and you will get results quickly. Actually its fun.  Also, it will help you learn to read the source code on a website.

From there I would say to go into C. C programming is the mother of it all. Most exploits were written in C. Also many hacking tools were also written in C and once you know it, you can make changes to the code to facilitate a tool to do something a little different for you.  Come up with an idea of a program and then write it. My very first program was a simple code to ping all the IPs in a network. Easy to write and I suggest that one if you are stumped.

Don’t settle for being a point and click hacker. Don’t run blind. If you take the time to understand even just the basics of programming, an entire new world will open up for you

I believe that you are correct with your "yes and no" answer.  It really depends on where the individual wants to focus his/her skill set. 

If the focus is assessments then being able to compile exploits and generate quick shell/perl/c programs may not be necessary.  A basic understanding of coding will help but knowing how to use the tools, write reports, mitigate problems, and educate admins and end-users is more important.

To be a penetration tester, however, I believe that it is a necessity to have at least a simple understanding of how to program.  You have to be able to compile exploits.  You have to be able to look at shell scripts, html code, open source code, and other programs to understand how to they work.  (this is my skill level)  As you get better you will begin to move into understanding and generating shell code and exploits. 

To be a security researcher then you definitely have to be a good to outstanding programmer.  Coding is what is required to make and break things.

 Thanks for the reply Cutaway and those are good points you made.
 
Imagine for a moment you’re a black hat cracker and you have discovered a vulnerability that no one else has discovered. It would be a license rape, plunder and pillage. If you had the right connections and knew where to sell the information that you gathered, you would become worth millions. That is the dark temptation for crackers that  have good programming skills. The only thing that would stop you would be if the security was tight enough to react to you quickly once you were “in”. This of course has nothing to do with pen testing, but cracking into systems.

How does one go about learning that kind of programming?  The easiest way is to write a program yourself with lots of flaws. Use the well known poor programming practices. Make sure it’s a program that goes through the entire TCP/IP stack. If it doesn’t then it will have no value.  Once you have done that, write an exploit targeting the flaws you purposely placed in the program.  There are a number of good books that show you how exploits have been written. After that, see if your exploit actually runs and gives you a shell. You might say that’s cheating and you would be correct. But it is a good basic exercise that gets you started and from there you should be able to move to deeper things. The hardest part of exploring is discovering vulnerabilities without being given the source code. Once you know how to deal with that, you are on your way. 

PS- I am using the term "cracker" for lack of a better term. The only problem for me with that term personally speaking is that I grew up in the South. In the South the term cracker meant something totally different and certainly not someone intelligent enough to  break into systems, lol! I am sure some of you know what I mean.

Good example, Kev.  Here is the capper for your last addition: http://milw0rm.com/papers/125 (http://milw0rm.com/papers/125).  It runs through a basic version of what you just covered. 

I just read this yesterday after listening to PaulDotCom's last episode:  http://pauldotcom.com/wiki/index.php/ListenerFeedback5 (http://pauldotcom.com/wiki/index.php/ListenerFeedback5).

It is definitely a good place to start.

Hey Kev... I'm a "Georgia Cracker" and it's not a technical term. :P Just kidding. Anyway I was forced to post by your added comments about the term "Cracker" and how alot of terms can mean alot of different things to people in different areas.

Brian

aka Slimjim100

LOL, no problem.

Is this a forum for hackers or crackers? I know that there is a significant difference, and that most crackers do not seem to have the 'code of honor' hackers tend to portray. And cracking itself is so much easier than it used to be, programs have been written to do almost any dirty work 'needed' with a graphical interface and no skill. How many programs have been written that can hack into a network, find a problem, and fix it? I know that there are not as many as the programs designed to crack. Don't get me wrong, I have used dvd rippers, cd rippers, air snort tools, etc, but never to sell or ruin something, and why/how can a person be considered a cracker if their tool is not their brain, but a USB pen with hundreds of malicious programs?

this a site for security professionals or people that want to be security professionals.  there are plenty of other l33t script kiddie sites out there that can keep the whole hacker/cracker/i wear this color hat crap.

my own opinion though...

Just as clarification, a cracker in ethical hacking terms is not someone who cracks code. A cracker is someone who does the same thing a hacker does but does so illegally. So what's a hacker? In simple terms, a hacker is known as someone with the skill to make something (software, hardware, a car, etc) perform a task it was not originally meant to do.

And ChrisG is absolutely correct. This site is for the security professional. We are all here to help people with their careers. This is how we give back to the community that we feel gave so much to us.

Hope this helps,
Don

I guess my idea of the talent I want to have it the person that is hired to monitor and fix a given network or computer. I want to be IT Security, but to me it only makes sense to learn how to hack so that I know the methods I will be up against. 

by reading you posts i get it that you really are someone who is looking for the right thing and unlike most others you are looking for it at the right place ;) you get what i mean

any ways from what i have read and what i know u need to know and think like a cracker if u are up to securing your network. you need to know how cracking softwares work, how they work on your network what results they display. As by thinking how a cracker thinks you get to know a lot vulnarabilties in you network than you think like the network admin. but the difference between us and the crackers is that we do it the legal and ethical way.

you only need to be able to do programming if you want to write exploits, or programs.

Exploit code can easily be used, as you can easily get hold of the code, copy, past and execute it.

I think a certain level of programming knowledge is required for ethical hacking. Not every engagement will be as straightforward as find hole, run script. If your only tool is a hammer every problem will look like a nail and you'll get quickly frustrated when it doesn't work.

Programming is much more than writing programs. One big bonus is that it enables you to understand code that you find. I am not a PHP coder but I can read PHP scripts and assess them because my programming experience allows me to. Many languages share a common ancestry that knowing one can help you understand another even if you can't code with it.

On the point about exploit code you should always cast a wary eye over it before you execute it. It is now unknown for exploit writers insert deliberate mistakes into exploit so that the reader is force to fix it before it will work. Even worse it may contain malicious code that will end up 0wning you if your not careful.

Jimbob

Jimbob Very good points!

I agree you should understand how to read code at the very minimum and it's always good to know how to code. There are so many areas in the network security field you may not have to worry about coding so I would just say the more you know the better off you will be. There is no check list to becoming a security professional (or a hacker). Any job field in IT now has a security aspect so just pick what interests you and learn to apply a security mindset to that job.

my 2 cents

Brian

(aka Slimjim100)

knowing how to code a bit will help you from making a boo boo and running some evil code like the latest new "Apache 1.X Remote Buffer Overflow getRoot() Exploit"

So is C or C++ most recommended?

It is according to our unscientific poll a couple months back. C/C++/C# won by a landslide.

Don

Sounds stupid, which is the easiest to learn?

Don't think that sounds stupid at all.

I think different languages suit different people.

And it depends on what you're using it for, are you using it just to learn how to program or you've got a x that need to do y to and you want to learn how?

Take a look at a few tutorials for different languages and go with the one you feel most comfortable with till you've got the basics, then look at a more specific/useful one if it doesn't meet your needs.

I would recommend looking at perl at some point as there's tons of tutorials and documentation out there and I find it very useful.

Well, I'll try and make this short. I have been wanting to make a program that when triggered by certain actions opens a given program. (i.e., a cracker is attempting to get into my system while I am out. As he tries one thing, this program recognizes the action and opens another to stop it, that doesn't work and it opens another.) I know that the human mind can outrun the programmed situations, but I think it would be beneficial to network admins and IT security technicians alike.

I admire your desire to learn programming.  That is a path that requires taking “baby steps” and the famous Hello World program really is not a bad place to start even if its over done.  You have taken the first step in programming. What is that? Simply coming up with an idea for a program. Its interesting how many people even with reasonable programming skills get stuck because they cant come up with an idea. It’s a little like trying to write a poem or some music. You might have the skill but not the inspiration.

Once you have your idea, then only experience will tell you if its an idea that will work.
Remember that programs like you suggested are always running in the back of an OS and use up resources.  You have to ask yourself “would that program slow everything down and make the server painful to work with?”  Sometimes its fun just to write a program and see were it takes you even if the results are not what you were hoping.

that's a pretty stout first program.

you should start learning about variable, conditionals, for/while loops (the basics) first.  those 3 things and learning how to string  them together will actually get you going in the right direction.

Is there a way I can start hacking without the programming for now? I am having enough difficulties with my new OS as it is...

yeah buy a copy of hacking exposed and start reading

Kevan, I remember when I was a kid they use to sell these books in comic magazines that promised to teach the easy secret ninja death blows.  All you needed to know was the “secret” and you would be deadly.  I hope you don’t think that hacking is like that. There is no easy secret techniques out there that will make you a monster hacker that can give you the ability to get into any computer in the world if you desire.  So much depends on what level you want to rise to. 
 
True there are some programs you can learn to use that are just point and click or do a few simple command line entries.  Using Nmap to find a target and then scan it for vulnerabilities from Nessus and then see if you have a corresponding exploit in Metasploit is not really that hard.  The problem is, you really are very limited to a few vulnerable targets out there that you can breach with techniques like that. If you want to be a security tester, what good are your skills if you can only penetrate 5 or 10% of the boxes out there? Are you doing your client any good when testing your security?  They trust you that you are hacking at a high level and if you certify their system as well prepared, they need to count on that because there can be millions of dollars at stake.  If you really want to hack for a living and test networks, you need to go way beyond that.
 
So if you want to be really good you are making a life time commitment in my opinion. Perhaps 4 or 5 years down the road you might feel comfortable enough to feel you can do some decent hacking.  One problem is, once you know something well it is already getting outdated, lol!  To this day I see hackers in 3 levels. The script kiddies that only can breach 5% of the boxes and are limited to tools they find on the internet.  The 2nd level are security professional that use similar tools but have such an expertise and knowledge of networks that they can be very effective. And finally the highest and scariest level of hacker that is not only very skilled with common tools, but might have customized them or maybe written his own. He is a high level programmer and can write his own exploits. He can write his own root kits and Trojans that anti virus cant detect. He understands the OS he is attacking and the network on which it is a part. He has a good idea of firewalls and has a good idea of how to pass through it or if its even possible. He or She is very clever and can see things from a totally different and creative way.  Some people call that thinking outside the box. Whatever.  I hope you can see from my post that there is so much to learn to get really good.  Its kind of like wanting to learn the guitar. Sure you could learn 3 chords and that’s it, but if you want to be a master, you will need to spend years practicing and learning. 

To answer your question, no. I do not expect hacking to be easy. However, I have not come to this forum recently as I asked a simple question at one point that was not answered. I simply wanted to know how you (or any other hacker reading this) started. There is a great difference between knowledge, wisdom and experience. I have been directed to a lot of informative sites that are great supplies of knowledge, but if I don't know how to apply it, what good does it do me?

Kevan,
   I was in a mentoring presentation the other day.  One idea that the presenter touched on was delayed satisfaction.  What that means is this:  noticeable results are going to take a while.  Instantaneous satisfaction is only going to happen in a few things and then it is generally limited.  Be patient, keep plugging away, follow the advice that people give you, and explore (test the boundaries) of everything you touch.  Just be conscious of the legal and ethical lines that our society has drawn.  You don't want to go to jail but you do want to push the limits because that is how we grow as individuals and as a society.

Read the advice here.  Seek advice in other places.  Run things so that you make your own mistakes.  And you will find that with time you, and others, will be satisfied with your progress.

Probably a little too deep for here.  But I'll offer it up anyway.
Cutaway

This would be just like a doctor having to learn anatomy before he can see patients. There's a lot he has to learn before he can even fathom all of the ways in which to use that knowledge.

Now we're not suggesting that you blindly follow our advice and visit a bunch of links, but at the same time, many of the suggestions are there to push you towards learning the "anatomy" of a network or the "anatomy" of a program.

So as many things in life, you may not know "what good it does you" until you get a stronger foundation underneath you.

But let me ask you this... if hacking networks is your thing and the accepted standard for networking is TCP/IP, wouldn't you want to know everything there is to know about TCP/IP? As you begin to study, new questions arise and you start to understand "how to apply it" that never occured to you before you started. And no one can ever list for you all of the ways to apply any type of knowledge.

As for not getting a response to your simple question, I think the EH-Net community has been very open and giving to you. You even mentioned yourself that you got flamed on other sites for newbie questions. I also see the amount of help you've gotten with Fluxbox. This site is not dedicated to that topic, yet you got more help here than you did from linuxquestions.org.

So you want a starting point, you've been given it. Most of us started on the networking side, but you've been given many responses on the programming side here in this thread. Whether you take that advice is your choice and how you use our advice is up to you.

Free will brother! It can be your best friend or your biggest excuse.

Hope this helps,
Don

  Hacking is about making programs/software/protocols ( or people, but we'll stick to software for now) do things they werent designed or intended to do.

so how do you make something do something it isnt supposed to do?  9/10 times you need to be really familiar with the thing you are trying to  break. wether it be TCP/IP, routers, PC's, operating systems, etc.  If you want to break it; you need to know everything (or alot at least) about it.

can you fire up nmap with little knowledge and do a port scan, yes of course.  can  you probably get some exploit code compiled and launch it against some IP's and maybe pop a shell, yes of course.   script kidz do it all the time it doesnt mean they know what they are doing or that they are professionals.

becoming a good security professional is about being well rounded in the disciplines of information security.  How do  you do that?  you start with the  basics; hardware (A+), networking (Network+), Operating Systems (Linux+, MS exams), Basic Security (Security+), routers (Cisco), etc.

A good security professional is also (usually) one or more of the following: Help Desk, SysAdmin, Mail guy, router guy, IA guy, database guy, webmaster guy, etc.

you can spend years on all that stuff above but you'll find that those building blocks help you understand what is going on with security and with exploits and that's really the ultimate goal; understanding how things break and then learning how to break them yourself.

what Cutaway said has some real value and i hope you read and take heed

"One idea that the presenter touched on was delayed satisfaction.  What that means is this:  noticeable results are going to take a while."

this is sooo much the case in Security and IT in general.  you keep plugging away and putting information into your brain and experience under your belt and then one day you'll wake up and realize you know more that half the people in the room about X, then later you'll realize you know more that 90% of the people in the room about Y.  it takes YEARS for this.

If you want instant gratificaiton go try another hobby, because you wont get it in IT or Security.

so to answer your question of how i started...

i have a computer science bachelors degreee so i learned the basics of programing and networking, i then started working thru Certifications.  Not to get the certs but more to learn the material (certs vs actual knowledge is whole other discussion). I got  bit by the security bug after going to DEFCON out of sheer luck, after that i had found what i wanted to do with myself.   i built a lab and started learning how to work some of the tools in hacking exposed or in tutorials i read online.  And after making an ass of myslef on forums and asking stupid questions i eventually learned, like we are all hinting to you, that if you ask a good question, you will most likely get a good answer back.  if you ask the question you could have just typed into google you'll probably just get flamed and rightly so. 

most people dont give up what they have learned thru their own hard work easily.  dont expect them to.  ask a good question and you may get a hint on where to look for the answer.  that's probably more than most of us got when we were learning.

sorry if it sounds harsh but that's just the way it is.

Kevan,

Just to drop my two cents into the bucket here:

Definately heed what Chris, Don and Cutaway have said, they really know their stuff. Honestly I would give it a couple years (maybe less depending on your previous experience) before you start making some serious headway in the subject of computer security. But just to give you a light at the end of the tunnel:

When I began learning about computers it was for the specific purpose of learning about computer security. At first I looked for those quick fixes, but soon realized that the "d00d, t3ln3t int0 p0rt 80 and h4x0r them!!!" tutorials just weren't going to cut it. So, I started learning the basics (as Chris suggested above) and got my A+ cert. During that time I also printed out what must have been about 1000 pages worth of tutorials and information about programming, TCP/IP, and Linux/Windows. I was in a unique position at the time where during my free hours I had little distractions and also got a lot of free computer books; I learned quite a bit and must say that I have yet to find a subject related to computing that wasn't fascinating. I've done the tech support gig, LAMP administration, Web design/development and just now am starting to get some security-specific jobs. If you don't focus on just learning security-specific subjects, you can achieve almost instant gratification and will be building yourself up for success later down the road. So you learned to write the simplest 'hello world' program today? Awesome! That's more than most people will learn about computers in a lifetime. Just enjoy what you're learning and let it lead you to bigger and better things.

The best way to learn things is to just do it. Learning about computers is great, because unlike learning some other professions like open heart surgery, you can fool around with things on your own and create your own experiences. Go register a domain name from yahoo for $4 and set up a Linux server (runs great on old hardware for small sites and such) to host a Web site. Maybe even offer to host some simple sites for some friends. This alone will force you to learn about things like DNS, HTTP, and Apache configuration.

And to answer the $60 question (kind of): no, you don't NEED to learn how to program in order to learn about computer security. But when ./scan && ./exploit fails, it's an invaluable skill to have.

P.S. - FYI, I don't think this tunnel ever gets any shorter... :D

Thank you all for your responses. I have read each post throughly. I don't really know what I had expected, but this is pretty close. Unfortunately my only resource is the net as my school library refrains from having any computer oriented books. I just hope that at some point I can print off some of that TCP/IP guide. Please realize that being in highschool with absolutly not spare time between homework and projects I have to do at home, I don't have a lot of time to read. Hopefully my schedule for my senior year will be more flexible. I am hoping to order the TCP/IP guide off the net at some point to read it on my spare time.

wait till you get married and have a kid...then try to find time for computer stuff.  be prepared for late nites! ;)

Ah, if I only had a nickel for every time my wife has threatened to toss my computers out into the street....

I recommend bidding on three computers at eBay to make sure you get one at a great price.  What a fun it is to have a conversation standing over three brand new used computers  :o

Of course I have put them to good use   ;D

Don’t be discouraged if there is so much to learn. That is the cool part of it. That is what makes you elite.   Start studying the books recommended. If you get stumped, ask questions on here.  Get those free programs I mentioned and scan your own box or network.  Become a master of Nmap and Nessus and Metasploit to get your feet wet.  Try hacking Dons pay pal account, JUST KIDDING!!!!  I better stop before I get kicked off this board. One thing I can totally promise you is if you get the “bug” you will have a hobby or profession that that keeps you intrigued for the rest of your life!  Can you put a value on that and how many old people at the end of the day have something like that? Most are looking to get to their next pottery class, LOL!  In time you will see that is the ultimate reward from all of this. A lifetime journey.  If you have the right make up, you will keep on no matter what, if not you will stop and go on to something else that catches your eye with its quick glitter.

This forum is awesome and I feel a little cheated that I didn’t have it when I was starting out years ago. Most hackers had to go through hell to get accepted and got less knowledge than what is presented here! Ok, I better stop before I go into how I used to walk through 2 feet of snow to school every day, Ha Ha!

LOL-I like the responses. If I had a nickel for everytime my parents, grandparent, aunts and uncles tell me I spent too much time on the computer, I'd be up there with Bill Gates. Now, a programming question if I may...I would like to write a simple program compatible with Fluxbox to look in a specified folder and allow the user to select a background. Nothing fancy-no previews, text only. The command in Flux for setting a bg is: "fbsetbg -f <pathname>". I don't want the whole script-I would like a URL to where I can learn it myself (you guys seem to be good at that  ;) ). Any thoughts?

Well said. This was an ok post except for that maybe yes , maybe no pc crap at the beginning.  If you cant program then you are one of the many script kiddies out there.  I didnt make that rule. It is the opinion of every real hacker out there. Wikipedia says it best "It is generally assumed that script kiddies are kids who lack the ability to write sophisticated hacking programs on their own". 

If you cant program and you spend most of your time on windows, then call yourself anything but dont call yourself a hacker.  Hackers like to change things  to do what they want.  You can do that if you program and you can do that if you use linux.