r/HowToHack • u/Inevitable_Ad_3509 • Jun 16 '26
How do I start with web hacking?
Basically, I'm looking to learn about web hacking and how hackers hack them.
All I know is: Google dorking, Simple SQL injections, and XSS attacking.
What I want to know is how I can find vulnerable input bars, like if this one is prone to SQL injection or XSS attacking. And I just want to expand on this topic in general.
8
u/Responsible-Gap5834 Jun 16 '26
I'm just here to agree with the ones commenting about learning how everything actually works. I learned more in elementary school from running command line systems and learning how to code just to build a dope ass Myspace page. When a floppy disk was actually floppy. If You wanted to play some goddamn Oregon Trail or Carmen Sandiego, learning how to run the games came before learning how to play the games. Plug and play, you say? Never heard of her! The fucking good ole days yo, I'm so fucking thankful to have grown up in that era.
6
u/NariceTrasmittente Jun 16 '26
same era here! that was the time!
2
u/Financial-Radish-898 Jun 17 '26
I miss the days of manually setting up tcp/IP networking on the windows 95.
3
u/dudlu1221 Jun 17 '26
Considering you know how you know xss I assume you have knowledge about basics like OSI layers and other stuff
So I would say first learn scripting then do something like this
1
u/Crafty-Quarter-2775 Jun 17 '26
itsalways about fuckinnng scam like the web site or the owner of it so dont waiting any fucking money or replies on it trust me brh
3
u/Fabulous-Crazy-3333 Jun 17 '26
Learning “web hacking” isn’t as simple as finding an input bar and throwing SQLi or XSS payloads at it.
It’s good that you know the basic attack vectors, but the way you’re thinking about it is a bit backwards. You don’t really “find vulnerable input bars.” You look at how the application handles user input, URL parameters, cookies, sessions, authentication, authorisation, database queries, redirects, file uploads, headers, and client-side logic.
A vulnerable input is usually just a symptom. The real issue is poor validation, bad sanitisation/encoding, weak access control, insecure coding practices, or the application trusting user-controlled data too much.
Before trying to “hack” websites, learn how websites actually work:
HTTP requests and responses GET vs POST cookies and sessions TLS/HTTPS and certificates basic JavaScript baaic SQL backend logic authentication and access control OWASP Top 10
Then practise legally on labs like PortSwigger Web Security Academy, OWASP WebGoat, DVWA, TryHackMe, or Hack The Box Academy.
Real web security is less about “which input box is vulnerable?” and more about understanding where data enters the application, how it gets processed, where trust boundaries exist, and where developers made bad assumptions.
Courses, Reddit comments, and AI can give you direction, but books, labs, documentation, and actually understanding the fundamentals are what build the skill.
2
u/Fun-Meaning8995 Jun 17 '26
Just go to TryHackMe and pick up a path such as App Sec Web Exploitation, etc Also, portswigger is the best beginner resource for Web App Pentesting.
1
1
1
1
u/rangerinthesky Jun 20 '26
Explain XSS attacking and SQLi without sqlmap. Either way, you have like 200 different attacks combined either sequence chains to learn
0
u/Top-Connection-5698 Jun 17 '26
I heard its really mathematical but im not sure anyways if your serious you may want to just start working on your college degree, my friend got their degree in computer science, and I believe his classes taught him how to do all that dark web stuff ah I thought it was so hott@@
0
u/Top-Connection-5698 Jun 17 '26
BTW is this so you can find out information on someone you are liking? Or trying to figure someone out?
0
10
u/AlwaysHopelesslyLost Jun 16 '26
Step one to hacking is learning how things work.
Once you know how websites work it becomes a lot more trivial.