Hello! As the title says, I’m learning all of this from scratch, not a drop of previous IT experience. Whenever I learn a new skill or hobby I always like to make a starter forum thread about my progress. This helps me keep myself accountable and to have a road map as I go along. I also hope by doing this thread that in the future other new hackers can use it as a guide as well.
I’m interested in meeting people on this forum and being active for a long time. So here’s a little bit about me-No previous experience in IT, but I love to game.I wanted to become a game designer when I was younger but I never thought I was “smart enough” to do it. I loved modding games, especially RTS games like Command and Conquer. I’ve always liked the idea of hacking and it has always appeared as a cool “spy” look and feel to me, but again I never thought I would be able to learn it and I didn’t like the unethical side of it. Now about half a year ago I discovered ethical hacking and It sounds awesome! I’ve always had hobbies of taking things apart and putting them back together (Building cars for race tracks, putting together mechanical wrist watches to name a few). So being able to do this ethically is very interesting and I am up for the challenge. So now I made it a goal to find my first bug and report it successfully in 2020.
My experience so far- Nothing. No programming experience, no knowledge of any of it. I have been doing some reading so far such as Web Hacking 101 by Peter Yaworski and Didn’t have a clue of what I read.
Now with lots of free time for a month and a half due to a quarantine from the Corona Virus I figured this is the perfect opportunity to really focus on this idea. So currently I’ve been reading The Web Application Hackers handbook, doing HTML and Javascript coding lessons on code academy and Freecodecamp, and doing CTFs from Hack this Site and Hacker 101.
After gaining a better basic understanding I have a course from Zaid security that I purchased on Udemy that I’ll follow along with. After this I plan on trying to focus on one specific attack/topic at a time and mastering it on bug bounty targets. Hopefully I’ll come across something at that time.
Thank you for reading my long post and I look forward to keeping this updated and meeting people on here :).
From what you wrote, I think you have an aptitude for this. The expertise should follow. I am a beginner, like you. But unlike you, I am trying to reinvent myself after a 35-year career in I.T. in the mainframe era. I spun my wheels for the first couple months trying to find the loose end of the Gordian knot. Finding a good starting place seems to be one of the hardest steps, and I suspect it will be different for each of us. For example, I don’t learn much of anything by watching YouTube videos. I suspect it is possible to do web app hacking without Linux or knowing much programming. That’s where I am for now. Good luck!
I’m going to jump in this thread too since I’m about 1.5 months into this.
I have a fairly strong IT background, but only basic level programming and app development. So this is new to me. I do know operating systems (Windows/Linux), Networking, and Security at decent levels.
I’ve found capture the flags to be helpful. Also, I’m getting really comfortable with Burp.
My main issue seems to be…that I can’t find any actual bugs on websites. I’ve reported several things. Some are already reported. 1 I was sure I had, but my POC didn’t work. I’ve tested about 20 different ones. I look for certain things like XSS and Open Redirects. I’ve found not 1. Now a lot of these sites I go to show that hundreds and in some cases thousands of bugs have been reported and remediated.
Thank you Cyberice for the resources. The try to hack me site looks like a fun way to learn with a lot of info. I’ve looked into pen tester labs a bit but it only seems like the paid version is the way to go, but I’ll give one of the modules a shot sometime.
Thank you Rich for the kind words! So far Linux has been useful with its tools and terminal but I’ve seen especially from hack this site that you can do a lot with the browser bar and other inputs on actual websites.
D3nn I totally agree with you as far as finding actual bugs. My personal issue is when I give it a go at messing around with some sites I’ll see things happen and I’m not entirely sure if it’s an exact bug to report or not. I think that’s what my next goal is to learn what the actual exploit is and what someone could gain, information or financially.
So far I’ve still been doing basic coding lessons still. I have a decent understanding of HTML now and I could code a basic website but have no clue of CSS so far to make it look good.
My next goal is to download atom and mess around coding an HTML site and opening it with my browser. I don’t have a need to make an actual site yet. After I get comfortable with that I’m going to start messing with Javascript, from what I’ve seen this plays a pretty significant role and can be useful to manipulate. After this I’m not entirely sure what I should try to learn the basics of. Should I look into python, MySQL, or something else?
I thought I would share two resources I came across for the brand new new to IT person like me. One’s a blog post that has a great list of resources in order to build a foundation upon, to finding actual bugs.
The other is an actual book that looks like it explains the basics of TCP/IP, HTTP, and all the other names and acronyms I have no clue about. I placed an order for a copy and will report back on the usefulness of it.
as I am also begginer to bug bounty the solution your problem is first to concentrate on one vulnerability and master in that and try to report some bugs on that vulnerability and move on to other vulnerabilities read as many articles in medium related to bug bounty they are really helpful and also start reading different books related to bug bounty (google it)…and also read various articles related to bug bounty on the internet
Been taking this advice and I’ve started looking into XSS now and doing CTFS. I’ve finished all the HTML and website builder courses on Codecademy. Also been doing JavaScript now.
One question I have if anyone can help about XSS, how do I determine or come up with a payload? They seem very random when reading bug reports
Figured out my previous question on payloads. It’s all about how the java script code is being executed and trial and error of what get’s filtered and what doesn’t.
Anyone have any free XSS lab/Tutorial recommendations? I’ve done hack this site and the Google XSS game. I’ve looked into pentester labs but it has to be paid for monthly.
Well I’ve been continuing my focus on xss bugs so far. For some reason I like the challenge of trying to see what’s filtered and what isn’t to come up with a creative bypass. So far I don’t think I’ve come close to actually finding anything. I have one target I’ve been working on this week and my heart jumped today when I inputted a payload into a url bar and got a prompt, but it said “are you sure you want to leave this page?” Didn’t notice I left a form unfilled lol.
So far my current questions are (if anyone can help)- is there a way I can see the result of a submitted payload? I’ve been using firefox developer with the console to view requests. But I would like to see the filled in html code if possible.
Also a few programs state “Use of automated scanners are prohibited” but I see a lot of people using burp suite for examples to do recon and scan for xss with a payload list. I’m a little confused of what is allowed and isn’t? Why do some programs restrict this anyways?
Thank you guys again for the support. Just browsing the forum has been a great help
@HE5150 you really should get yourself familiarized with Burp Suite. It’s designed to help you craft and track payloads like you want. That’s what the ‘Repeater’ and ‘Intruder’ tabs are all about.
Thank you for that! I actually messed with that yesterday and did some of the xss challenges. I was blown away at what Information is received and what ones able to do. I’m Definitely going to try to master this tool
Hello my name is David and I’m also a beginner in bug hunting as well, I been working in IT for almost 4 years. I’m going back to school for my Masters of Science in Cyber Security. I been reading some of the threads for the starter zone and found a lot of the information helpful. I have not started to use any of the sites or software cause I’m waiting on a new laptop to be delivered once its back in stock. But I’m very interested in starting to start building some new skills to use to gain a new job in the Cyber Security field. I have a class in Pen testing this fall, the information provided helps me get a head start.
Welcome! Nice to meet you! Hopefully this threads been a little useful, literally starting at the bottom with no experience. You definitely have the advantage on me with you’re background!
So I thought I throw another post up with some links that might be helpful for a straight up newbie like me.
I’ve been staying in the XSS realm and this Udemy course was by far the most useful tool so far. Great explanations on everything and it is 2 hours of material dedicated solely to xss. It was on sale the other day and I was able to grab it for 12$
Also the TCP/IP book has been very great at explaining concepts as well. Highly recommend it.
Last night I downloaded the OWASP ZAP app and it also has been a great tool. The UX is not as good as Burp has but the HUD tool that puts an overlay on ones browser is really cool and makes it feel very user friendly. Makes it almost like a video game
Hi there! I’m a beginner to bug bounty hunting as well. I’ve just got my hands on The Web Application Hacker’s Handbook and read the introduction. How useful has it been for you? Will you continue using it as you learn more? Also, have you installed the Kali Linux OS on whatever pc you will be using to hack? I’m wondering if I should install it right now on virtualbox or maybe do a little more research first.
Hey everyone, been awhile!
I’ve been reading the hackers hand book but I think the most useful book so far has been the tcp/ip book that actually explains everything and has been giving me an understanding. I’ve had a VM installed for awhile and have been using Kali Linux for about a year now, been great practice for sure.
Haven’t actually been hacking for awhile now! Got into studying for my Comptia a+ certification so I can actually get an entry level job and start a career. Been very enjoyable so far and has actually helped me understand everything a little more
Hello! I am a beginner in bug bounty hunting as well. I have submitted several reports on hackerone, but none of them have been valid. Does anyone have some advice on finding my first bug?
Hi @numaN! I will try to remember that when hunting for bugs. Currently though, I have yet to submit a valid report. Do you have any idea of what could be holding me back from finding a bug?