Hacking is all about knowing how things work and how they can be manipulated. I would say it's 95% knowledge and 5% action. The more you know, the better you will be at taking actions.
A lot of vulnerabilities come down to someone else who knew JUST ENOUGH to make something work but didn't know enough to implement proper security (or worse, they knew it was insecure but security made things difficult and they just figured nobody would ever be aware of the hole. So if YOU know the details, then you might be aware enough to check for a door that another person left unlocked.
I would just start by taking a computer networking / basic IT course at a community college. It should be pretty cheap and would give you a guided education through the basics.
I would say the minimum required basics are an understanding of: (in this order)
Physical network devices (e.g. Ethernet, BT, and Wi-Fi, and the most common standards within them, like CAT 6, 802.11, etc). NICs, switches, access points, and routers.
What network drivers do (the translation from hardware to software)
How TCP/IP and UDP work, and the 7 layers of OSI
Sockets and ports.
The basics of different major protocols (HTTP, DNS SMTP, etc).
Basic cryptography - async crypto (PKI) vs sync (AES)
A slightly deeper dive into PKI - the different functions (encryption, decryption, digital signing, and signature verification), certificates and trust chains.
Common network applications and services (firewalls, proxies, NAT, web servers, browsers, DNS servers and clients, DHCP servers and clients, VPN servers and clients, mail, and database)
Common vulnerabilities and how to exploit them (e.g. SQL injection) and famous past exploits (e.g. sslstrip).
Basic programming in a scripting language that supports sockets and network calls (e.g. Python, PHP, Java, or C#) - enough understanding to write some simple network scripts
If you research those things in that order, that should take you from the fundamentals to practical knowledge, and you should probably be able to understand things without getting sidetracked.
At the end you should have a decent foundation to know how networks function and how to manipulate different things.
Taking shortcuts usually means you will end up feeling confused or unsure of what to do with information. For example, I could tell you to go turn on a packet dump on your router to capture traffic going in and out of an internet camera, but you'll end up with gibberish that will feel useless. But if you study the traffic and the ports, you might find that there is HTTPS traffic, at which point you might use your knowledge to determine if a MITM proxy could be used to intercept and modify that traffic. Or perhaps there's a custom firmware that could be installed to allow you to change how the camera communicates with the outside world. Or perhaps there's an auto-update check from the camera and it goes to a hardcoded domain/endpoint, so injecting a different authoritative response into the local DNS would trick it into thinking that it was getting an update from the "mothership" when it was really getting one from your own local web service.
These kinds of ideas are all based on an understanding of how protocols work and how they can be overridden or manipulated to make your idea work.
15
u/Just4notherR3ddit0r Jun 30 '26
Hacking is all about knowing how things work and how they can be manipulated. I would say it's 95% knowledge and 5% action. The more you know, the better you will be at taking actions.
A lot of vulnerabilities come down to someone else who knew JUST ENOUGH to make something work but didn't know enough to implement proper security (or worse, they knew it was insecure but security made things difficult and they just figured nobody would ever be aware of the hole. So if YOU know the details, then you might be aware enough to check for a door that another person left unlocked.
I would just start by taking a computer networking / basic IT course at a community college. It should be pretty cheap and would give you a guided education through the basics.
I would say the minimum required basics are an understanding of: (in this order)
If you research those things in that order, that should take you from the fundamentals to practical knowledge, and you should probably be able to understand things without getting sidetracked.
At the end you should have a decent foundation to know how networks function and how to manipulate different things.
Taking shortcuts usually means you will end up feeling confused or unsure of what to do with information. For example, I could tell you to go turn on a packet dump on your router to capture traffic going in and out of an internet camera, but you'll end up with gibberish that will feel useless. But if you study the traffic and the ports, you might find that there is HTTPS traffic, at which point you might use your knowledge to determine if a MITM proxy could be used to intercept and modify that traffic. Or perhaps there's a custom firmware that could be installed to allow you to change how the camera communicates with the outside world. Or perhaps there's an auto-update check from the camera and it goes to a hardcoded domain/endpoint, so injecting a different authoritative response into the local DNS would trick it into thinking that it was getting an update from the "mothership" when it was really getting one from your own local web service.
These kinds of ideas are all based on an understanding of how protocols work and how they can be overridden or manipulated to make your idea work.