How to learn hacking: The (step-by-step) beginner's bible for 2023

Who doesn’t want to learn how to hack? 🤔

Who doesn’t want to learn a skill-based superpower that could be wielded for good…or bad (mwahaha)?

That was my initial reaction to realizing that hacking was officially a “thing” while studying for my Computer Science BSc degree. My first probe of a target system for exploitable information (aka enumeration) marked the point of no return for me. I was all in. 

From then on, all-night hacking events with friends filled many weekends. We even formed an intense cybersecurity study group to learn and share knowledge. And, to cut a long story short, I became an ethical hacker who is now part of a one-of-a-kind community that makes the skill of hacking accessible to anyone willing to learn it.🤘 

In this post, I’m sharing the truth behind the wonderful wizardry that is hacking. You’ll see what it takes to learn hacking from scratch and the necessary steps to get started! 

What is hacking? 

A textbook definition of “hacking” is the act of finding exploitable weaknesses in computer systems, digital devices, or networks to gain unauthorized access to systems and data. Real hacking, however, is more than that. 

It’s a technical discipline and mindset that requires outside-the-box thinking, creativity, and persistence in the face of evolving and unforeseen challenges. What happens when you follow an established path to exposing a vulnerability or flaw, and there’s nothing to find? How do you avoid detection once you’ve infiltrated a secure system? How can defenses be improved for the target you’re hacking? 

This outside-the-box mindset applies to the different types of hacking that even include physical (testing the security of a physical location) and social (exploiting human errors or vulnerabilities). 

Good (ethical) vs. (unethical) bad hacking

Many references to hacking portray it as a malicious activity orchestrated by rogue hoodie-wearing tech wizards. This is not the case. At Hack The Box, we champion ethical hacking because it’s akin to a technical superpower that can be used for the greater good: to help protect modern infrastructure and people. 

Ethical hacking requires the knowledge and permission of the business before infiltration. It’s about finding the weak spots before the bad guys do and fixing any flaws before they become exploitable by malicious hackers. 

Related read: Best entry level cybersecurity jobs for aspiring hackers.

Organizations hire Ethical Hackers or Penetration Testers (the common term used in industry to describe the job description of professional hackers in the corporate world), to proactively simulate attacks against their networks, devices, software, users, applications, and just about anything that could expose them. This allows them to be a step ahead of any nefarious hacker by gaining insight into and improving on weaknesses. 

At the end of the day, these security professionals are there to help businesses and do everything in their power to keep them as protected as possible. Having a set of guidelines distinguishes the good guys from the cybercriminals, and also lets businesses employ hackers with more confidence.  

 

Haris Pylarinos, CEO, Hack The Box

Recommended read: How to become an ethical hacker. 

Different types of hackers

Hacking isn’t innately “good” or “bad.” Like the internet itself, or any digital device available to us all, it could be used for both purposes depending on the user's intention and how they perform their actions. This is why hackers are typically grouped by their intent:

• White hat hackers: White hat or ethical hackers are often described as the “good guys.” They strengthen security by assessing a computer system, network, infrastructure, or application with the intention of finding vulnerabilities and security flaws that developers or other security professionals may overlook.

• Script kiddies: Low-skill hackers who use scripts or programs developed by others to conduct attacks, but do not truly understand how things work. Script kiddies use pre-made exploit kits or separate programs because they are unable to write malicious tools on their own. Their motives for hacking are usually personal, such as to impress friends, get revenge, or have fun.

• Black hat hacker: Black hat hackers are cybercriminals who break into networks and systems with malicious intent. An example of a (former) black hat hacker is Kevin Mitnick, who is notorious for hacking large organizations such as IBM, Motorola, and the US National Defense system. Kevin is now on team white hat, fortunately. 

• Gray hat hacker: In his guide on how to become a pentester, Ben Rolling, our Head of Security shares how a gray hat “friend of a friend” found a major flaw in a big (Fortune 500) company. This friend, with good intentions, reported it to the organization suffering from the flaw, which resulted in him being arrested and sent to prison. This is a cautionary example of gray hat hacking. Gray hat hackers fall somewhere between white and black hat hackers. While their intentions are generally good-natured, their actions are often illegal because infiltrating systems and networks without authorized access is illegal. 

• Fun fact: These terms are inspired by symbolism from Western films in which heroes wore white hats and villains wore black hats. 

Interested in landing a job as a pentester or hacker? Brush up on these 30 critical cybersecurity interview questions and answers! 

Can anyone learn how to hack? 

The short answer is: yes, most people can learn how to hack provided that they give themselves enough time, have the right attitude, and commit to the process ahead. We’ve witnessed stories from the community of hard-working people who took an interest in hacking (despite not having technically-relevant backgrounds) and are now good enough to get paid to hack ethically and professionally: 

• Jeremy Chisamore was hit by layoffs and events outside his control and still carved out a career in cybersecurity; going from struggling poker player to Senior Penetration Tester at Oracle.

• Chuck Woolson, a former United States Marine changed careers in his 50s and became a Red Team Operator with little prior experience.

• Josiah Beverton started off studying physics, but his passion for cybersecurity lead him to become a professional Penetration Tester with experience in Blue and Red Team roles.

• Gary Ruddell left the military to pursue a cybersecurity career and become the Regional head of Cyber Threat Intelligence at a global financial organization. 

With that said, there are shared traits among successful hackers that indicate how much enjoyment you’ll get from learning how to hack: 

• A passion for problem-solving: A college or recognized training certification certainly helps you acquire the knowledge, skills, and abilities required to work as a pentester; but a great hacker is a tenacious problem-solver at heart! 

• The ability to think outside the box: To defend against an attacker, you must think and act like one. This requires the ability to not only respect, but also think beyond routine practices like firewall reviews and scanning for known vulnerabilities. 

• A love of learning: Most professional hackers I know enjoy learning, which makes sense considering how fast the digital world moves. And that’s one of the many beauties of learning how to hack; there’s always new hardware, applications, concepts, and vulnerabilities to explore. You’re free to specialize, upskill, or pursue a career (it’s no secret that professional hackers/penetration testers are in extremely high demand) in whatever specialty you want. 

When I started, there were fewer publicly available resources than there are now. Most of our learning was done via internet relay chat forums (IRCs) and learning from others in the community. You also had to download your own virtual machine or build a hacking lab at home for target practice. Nowadays, content and training are more accessible with cybersecurity training and upskilling platforms like Hack The Box (HTB). 

Where should beginner hackers start? 

Beginners should start with the fundamental cybersecurity skills one will always need when hacking: Networking, Linux, Windows, and scripting. Regardless of how advanced or basic your exploits become, you’ll always call upon the knowledge and skills related to these core domains. Mastering these fundamentals will also accelerate your ability to learn more advanced hacking concepts, techniques, and tools.

1. Networking

Most things in hacking or cybersecurity revolve around a network. This is why a firm grasp of networking fundamentals is foundational for beginner hackers who are learning the ropes. Understanding how networks are structured and how devices communicate means you can identify, protect, exploit, and of course, remediate weaknesses in networks. With this knowledge, you’ll know what services are running on a server, what ports and protocols they’re using, and how the traffic behaves.

Related read: Learn cybersecurity for free. 

2. Linux

An operating system (OS) is software that manages all of the hardware resources associated with a computer. That means that an OS manages the communication between software and hardware. Learning Linux operating systems is an essential and inevitable step in cybersecurity because Linux covers about two-thirds of the world's servers, including macOS, which is also based on Linux. Linux-based operating systems run on servers, mainframes, desktops, embedded systems such as routers, televisions, video game consoles, and more. 

3. Windows 

It is important to understand how to navigate the Windows file system and command line as it is heavily used across corporate environments of all sizes. During penetration testing (or ethical hacking) engagements, hackers will often need to gain access to a Windows host. Additionally, many servers run on Windows, and most companies deploy Windows workstations to their employees due to the ease of use for individuals and centralized administration that can be leveraged using Active Directory. 

Related read: How to become a cybersecurity analyst.

4. Bash scripting 

Bash is a command-line interface language used to make instructions and requests to operating systems like Linux. As hacker, learning how to create bash scripts (which are a collection of commands) will help you harness the full power of the Linux OS by automating tasks and enabling you to work with tools.

5. A scripting language (like Python)

Python is a powerful entry-level programming language to learn for hacking because it’s versatile, relatively easy to learn, and plays an important part in compromising systems and networks. You’ll use it to:

• Automate tasks

• Write custom scripts

• Scrape data from the web 

• Analyse packets and data

• Identify and develop malware 

Reminder: We have a welcoming community, so if you have more questions about hacking feel free to ask us directly on Discord. 

 

Related read: 7 Powerful pentesting tools (and why you should stop pedestalizing them). 

Learning to hack from scratch: Create a powerful training plan to optimize learning 

Most (normal) humans won’t sufficiently understand all this new information overnight if they learn to hack from scratch. So give yourself enough time to develop a firm grasp of the fundamentals. Continuing the magic analogy, don’t just memorize spells and wave a wand; know why you’re casting the spell, how it works, its weakness, and strengths to adapt it to any scenario and target! 

The importance of this can’t be emphasized enough; you will rely on this base of knowledge and skills repeatedly throughout your hacking journey. 

So while you might be bursting with enthusiasm to get started with the wonderful wizardry of hacking, I’d suggest that you take a little bit of time to develop an organized plan or schedule for studying to master the basics. This will help you:

• Prevent feelings of overwhelm and burnout.

• Measure your progress and keep track of your journey. 

• Overcome the inevitable frustration and hurdles that are perfectly normal when learning new skills. 

Let’s say you have two hours per day to study, I would say spend at least four-eight months on the fundamentals while watching some retired content videos on YT. Give yourself two months for each domain: Networking, Linux, Windows, and Python plus any scripting like bash/powershell (optional) to build a strong foundation. This realistic approach combined with guided cybersecurity courses and practical cybersecurity exercises means you’ll hit the ground running!

(A scan of the open ports on a network. Executed on a live practice target via our Academy's in-browser tool, Pwnbox. Click here to try it yourself.)

Example training plans to learn hacking 

Below are two different potential training plans from two hackers and content creators here at HTB, IppSec, and 0xdf. The purpose of showing both is to demonstrate there is no absolute answer that applies to everyone. Find what works for you and adapt as you go!

Ippsec’s recommendations

1. Establish your methodology: Use the guided step-by-step learning, read write-ups (tutorials), or watch videos and work alongside them. Don’t worry about “spoilers” ruining your learning experience, there will always be more challenges and opportunities to learn.

2. Validate the methodology: Watch a video in its entirety, then immediately do a challenge. If you are short on time, then divide the machines parts, for example watching up to the user flag and then solving the machine.

3. Work on memory retention: Add some time between watching the video and solving the machine. Start off with a few hour break between the video and solving the machine. Eventually, graduate up to waiting a day between. Don’t be afraid to go back and watch the video when you are stuck on a part for 20-30 minutes.

4. Make hacking muscle memory: Watch multiple videos but solve the machine yourself days later. Having watched multiple videos or read write-ups before solving the box will really test your skills.

0xdf’s recommendations

1. Note-taking is key. Writing something down is a great way to lock in information. Create some key sections in a way that works for you. I use markdown files in Typora, but find what works best for you.

2. When you first start, you are missing a lot of the information needed to complete a machine. Work alongside write-ups / video solutions, but don’t copy and paste. Type commands in, and make sure you understand what they do. Quiz yourself about what would happen if you changed various arguments in the commands, and then check if you are correct. Record the tools and syntax you learned in your notes for future reference.

3. Once you start being able to predict what the write-up author will do next, start working out ahead of the write-up/video. Try the various techniques from your notes, and you may start to see vectors to explore. When you get stuck, go back to the write-up and read/watch up to the point where you’re stuck and get a nudge forward. Make sure to update your notes with the new techniques you’ve learned.

4. Over time, you’ll find your notes contain more and more of what you need to explore a box. The secret is to find the balance. The more you practice, the less you want to rely on walkthroughs. That said, even the most talented hackers will often work in teams because anyone can get stuck.

How to learn hacking with HTB (step-by-step)

Step 0: Start with your immediate learning needs 

From absolute beginners to high-level cybersecurity professionals, Hack The Box makes learning how to hack a fun, gamified experience for millions of hackers around the globe. You can start by learning the foundational fundamentals, transition into hands-on training that forces you to compromise realistic environments, compete in Capture The Flag events, and even land your first cybersecurity job. (I got my first ethical hacking job thanks to my public HTB rank.) 

But where should you start based on all the different options that we offer? 

1. HTB Academy: If you’re starting from scratch, the Academy will get you upto speed with step-by-step training on different hacking skills and topics. So if for example you have zero knowledge of networking, or want to master a specific network reconnaissance tool, like Nmap, the Academy will provide you with guided theoretical training and interactive exercises on live targets to reinforce your skills. 

2. HTB Labs: Test, grow, and prove your practical skills with a massive pool of hackable environments that simulate up-to-date security vulnerabilities and misconfigurations. New labs are added every week, ensuring the content is always up-to-date and the fun unlimited. Players can learn all the latest attack paths and exploit techniques. (If you’re new to HTB Labs, use the Starting Point Labs to familiarize yourself with our platform and the Machines they contain. 

3. HTB CTFs: Compete with other hackers around the globe. Capture the flag events are gamified competitive hacking events that are based on different challenges or aspects of information security. They are excellent for experienced hackers looking to develop, test, and prove their skills because they gamify hacking concepts. 

   

Step 1: Join the HTB community

Our community is the core purpose of everything we do! We are hackers at heart.

• 1.8M+ Members Around The World

• 195 Countries & Territories

• 3.5k Discord Messages Every Day

• 5.1k Forum Threads - For Any Box

First of all, here is the Community Manifesto, how hackers behave with each other. 

We believe in making an inclusive, equal-opportunity, and diverse community. We try our best to provide a safe and happy place to all of our hackers, where the only thing that matters is a passion for cyber!

To enjoy Hack The Box to the fullest, you certainly cannot miss our main communication channels, where the real magic is happening! Join our Discord and forum. We normally disclose the latest updates and new features on Discord first, so…you better be part of it. 

Also on Discord, we have targeted channels per topic or skill level. Plus we are the biggest InfoSec Server with more than 200K members from all around the world. Join the discussions, ask any questions, find a study buddy, and get inspired.

HTB Team Tip: Make sure to verify your Discord account. To do that, check the #welcome channel. For the forum, you must already have an active HTB account to join.

Learn more about the HTB Community.

Step 2: Build your own hacking VM (or use Pwnbox) 

In order to begin your hacking journey with the platform, let’s start by setting up your own hacking machine. It will be a virtual environment running on top of your base operating system to be able to play and practice with Hack The Box. (This is the most important step for every hacker in the making.)

You can make it quick and easy by installing one of the following virtualization applications:

• VMWare Workstation Player

• Oracle VirtualBox

After installing your preferred virtualization software, select your operating system of choice. Here, you can learn everything about Parrot OS.

HTB Team Tip: Always install a stable version! 

How to install Parrot on Virtual Box - Are you having difficulties with the installation process, or don’t have the necessary hardware or networking capabilities to run a virtual machine? Don’t give up, there is a solution. The answer is Pwnbox! Pwnbox is a Hack The Box customized ParrotOS VM hosted in the cloud. It can be accessed via any web browser, 24/7. It’s HTB customized and maintained, and you can hack all HTB labs directly. Intro to Pwnbox

Wanna see how others use Pwnbox?

How to play machines with Pwnbox by HackerSploit  

How to play Pwnbox video by STÖK 

Step 3: Visit our knowledge base

Now if you still have questions we got you covered! For 99.99% of your HTB questions we have an answer and you can find them all in our Knowledge Base. This is a must visit resource for anyone who’s getting started with our platform.

Here are some friendly suggestions for something that might be crucial for you at this point:

• Getting started - Introduction to HTB

• Getting started - Setting up your account

• Getting started - VPN access

• Getting started - How to play machines

Step 4: Tools, tools, tools

These are the must-have tools you will need to master before you dive into hacking! 

• Nmap: Scan the network like a pro! Add your target IP, range of ports, type of scan and hit enter!

Recommended: Free Academy Module Network Enumeration with Nmap

• Metasploit: A framework that makes hacking simple. Set your target, pick an exploit and payload and hit run! 

Recommended: HTB Track Pwn With Metasploit

• Curl/Burp: Inspect, modify and interact with web requests like an expert. 

Recommended: Free Academy Module Web Requests

• Ffuf/GoBuster/Seclists: Web application fuzzing to find hidden directories, files and more is a must. 

Recommended: Free Academy Module Attacking Web Applications with Ffuf

• Windows OS: Popular operating system for personal and corporate use. Learn the fundamentals to hack it.

Recommended: Free Academy Module Windows Fundamentals 

• Linux OS: Popular operating system in the security/InfoSec scene but also for many sysadmins. 

Recommended: Free Academy Module Linux Fundamentals

Step 5: Discover starting point

Starting Point is a series of free beginner-friendly Machines paired with write-ups that give you a strong base of cybersecurity knowledge and introduce you to the HTB app. You’ll train on operating systems, networking, and all the juicy fundamentals of hacking.

Try Starting Point Machines

Step 6: Complete the beginner track

It is time for the classics! Pwn the following list of machines, capture the user and root flags, and complete the Beginner Track today! You’ll be feeling like a hacker. You’re almost there! Click here to get started.

Step 7: Study, study, study

The Beginner Track was a nice first hands-on taste, right? The best is coming now. There are plenty of additional resources to explore and engage before getting the 100% out of all HTB training. 

• Write-ups & Video Walkthroughs

• Active & Retired Boxes

• Other cool Tracks including: Intro to Dante, The Classics, OWASP TOP 10 

HTB Team Tip: Start on your own, explore the tools, watch the videos below and then level up your hacking with our subscriptions!

HTB Watch List 🍿

Some recommended video walkthroughs to get started:

• Active: Watch Video | Play Machine

• Forest: Watch Video | Play Machine

• Access: Watch Video | Play Machine 

• Traceback: Watch Video | Play Machine 

• OpenAdmin: Watch Video | Play Machine 

• Writeup: Watch Video | Play Machine 

Author bio: Author Bio: Sotiria Giannitsari (r0adrunn3r), Head of Community, Hack The Box Sotiria is an experienced Cybersecurity Professional and a successful Community Manager, having created engaged communities over 1 million members. Driven by technology, hacking, and growth, she has earned a BSc in Computer Science, an MSc in Cybersecurity, and is a devoted Hack The Box CTF player for over 6 years. Her past work experience includes penetration testing at Ernest and Young for 2 years, and she has been leading community efforts at Hack The Box for 3.5 years.