assitance please

[CTRLS]

what knowledge do you need to know to start hacking websites

[impelse]

httml, php and some knowledge of SQL transactions (query), just to begin

[CTRLS]

Well I know most of that but isnt there more to it

[MaXe]

And legal issues  😉 If you’re a total newbie, you can A) Search forums (and blogs) for tutorials on Web Application Security; B) Read The Web Application Hackers Handbook.

Both things are worth doing, even though I didn’t read the second one, it certainly did look interesting  😉 I think reading that book will probably be a shortcut to most, to get most of the basics and even some more advanced stuff.

When you’re ready to dive into the more advanced stuff, with or without programming knowledge, you need to find some good resources for web app sec like ha.ckers.org, etc.  😉 (Find them yourself, you should. If you’re going to become a real hardcore web app hacker.)

And last but not least, learn how to spot coding errors in e.g. PHP scripts so you can find 0days yourself as well. Sometimes, it’s boring to look through a billion lines of code, but then you can alternatively grab a copy of the web app, install it on your own server, test it for vulnerabilities  😉 (With your own methods, NO automated scanners. In most popular web app’s they wouldn’t do any good except waste your time. This doesn’t apply to addons for popular web apps, as the addons are often vulnerable.)

PS:
@CTRLS wrote:

Well I know most of that but isnt there more to it

There’s A LOT more to it thank you think!  ;D
Create something like this: http://www.exploit-db.com/vbseo-from-xss-to-reverse-php-shell/
Video: http://www.youtube.com/watch?v=B6QAjB3kYec

That’s pretty much when I go in-depth with my skills, to prove that even XSS can be deadly if you just use your knowledge (and imagination) right.

Reference: http://www.exploit-db.com/category/maxe/

[CTRLS]

Is it neccesary to learn reverse enigeneering (my bad abou the speling im at school)

[CTRLS]

Thank you once again MaXe (you’ve been a bigg help)

[cd1zz]

When I think of RE I think of compiled code. If you’re trying to test a specific web application, it wont help. If you’re trying to find 0 days in the web server that the web app is running on, you could RE the binaries of the webserver.

[CTRLS]

Is CSS required to know while hacking???
i havn’t really looked at it :/

[cd1zz]

Yes, if you want to “hack”, you need to know every thing about whatever you’re testing. So, go learn that too.

[rattis]

@MaXe wrote:

Read The Web Application Hackers Handbook.

I want to read that book. Looks and sounds better than Hacking Exposed: Web Applications 3rd Edition (granted I’ve only thumbed the other one and going on what I’ve heard here). Not that I’m knocking HE:WA3E.

Anyway the new edition of The Web Application Hackers Handbook is due out in September. I’m waiting til then to order.

[tturner]

You can port scan intranets with CSS 🙂

[CTRLS]

ok cause i was just going to move onto .ASP and the rest of PHP

[cd1zz]

That’s a great place to start.

[MaXe]

@CTRLS wrote:

Is it neccesary to learn reverse enigeneering (my bad abou the speling im at school)

It’s good to learn about, but don’t start with this unless you want to go deep straight ahead. Reverse engineering PHP applications is not really necessary, but reverse engineering flash scripts may become useful in some cases, including java applications as well. (With PHP scripts you either have the source and search through it for errors, or you fuzz all possible user-input fields, or combine both!)

@CTRLS wrote:

Is CSS required to know while hacking???
i havn’t really looked at it :/

Cascading Style Sheets I presume you’re referring to, and not XSS (Cross-Site Scripting). You won’t use it that much, but for XSS it can prove very useful to know about. Sometimes, a CSS file may contain hidden directories as well and generally it is very easy to learn, as the CSS language is very easy.

JavaScript on the other hand, which is not the same as Java at all, may take some time to learn.  😉

[ShadowReaper]

@MaXe wrote:

When you’re ready to dive into the more advanced stuff, with or without programming knowledge, you need to find some good resources for web app sec like ha.ckers.org, etc.  😉 (Find them yourself, you should. If you’re going to become a real hardcore web app hacker.)

maxe, could you provide more links for resources?

thank you

[MatP]

@CTRLS wrote:

(my bad abou the speling im at school)

Am I the only one who found this ironic? 🙂

[lorddicranius]

@MatP wrote:

@CTRLS wrote:

(my bad abou the speling im at school)

Am I the only one who found this ironic? 🙂

Nope, I LOL’d when I read it 😛

[Author]

Posts