Starter Guide on Hacking and Information Security: The Two Paths

Are you looking to break into the world of ethical hacking and cybersecurity? This comprehensive guide will show you the best ways to develop real hacking skills that can lead to a rewarding career in information security. Before we dive into the methods and resources, let’s be clear: ethical behaviour is non-negotiable in this field. This guide isn’t about gaining notoriety or impressing your friends—it’s about making a positive contribution to information security and, ultimately, to society.

The Fork in the Road: Choose Your Hacking Path Wisely

When it comes to learning “hacking” (a term I’ll use loosely here), there are two distinct paths you can take. Let me walk you through both so you can make an informed decision.

Path 1: The Quick Fix (Script Kiddie Approach)

The first path is what I call the “Quick Fix” approach. It’s characterised by:

• Watching YouTube tutorials with flashy green-and-black thumbnails
• Downloading pre-made tools from Kali Linux
• Copy-pasting commands without understanding what they do
• Getting quick results with minimal effort

This path might give you some quick wins and impress people who don’t know any better, but here’s the catch: anyone with genuine knowledge will see through your façade. You’ll be what’s often referred to as a “script kiddie”—someone who uses existing tools without understanding how they work.

Path 2: The Skill Builder (Professional Hacker Approach)

The second path is more demanding but infinitely more rewarding. This approach involves:

• Learning computer systems from the ground up
• Understanding how memory interacts with machine code
• Getting to grips with networking principles
• Actively participating in Capture The Flag (CTF) competitions

This path requires commitment and mental effort, but it’s the one that builds genuine expertise. Through CTF competitions, you’ll learn about the digital world in a practical, hands-on way that no textbook can match.

What is CTF? Understanding Capture The Flag Competitions in Cybersecurity

Capture The Flag (CTF) is essentially competitive hacking. Participants compete to exploit vulnerabilities in systems to find a string of text (the flag), which they submit for points. These competitions range from beginner-friendly to mind-bendingly difficult.

The CTF community is full of genuinely knowledgeable people who are passionate about understanding systems, not just breaking them. It’s a place where you’ll find mentors, friends, and possibly even future colleagues.

Getting Started with CTF: Top Resources for Beginner Hackers

If you’re keen to explore the CTF path, here are some resources to get you started:

1. LiveOverflow – An excellent YouTube channel and website (liveoverflow.com) that explains complex concepts in an accessible way.
2. CTF101 – A compact guide at ctf101.org that covers the basics.
3. CTFtime – Visit ctftime.org to find upcoming CTF events and live team scores.
4. Practice Platforms – Here’s a comprehensive list of CTF and practice platforms to build your skills:

• PicoCTF – Designed for high school students while the event is usually new every year, it’s left online and has a great difficulty progression
• OverTheWire – Offers various wargames for different skill levels
• HackThisSite – Classic platform with challenges of increasing difficulty
• Pwnable.tw – A newer set of high-quality pwnable challenges
• Pwnable.kr – One of the more popular recent wargamming sets of challenges
• MicroCorruption – One of the best interfaces, a good difficulty curve and introduction to low-level reverse engineering, specifically on an MSP430
• CTFlearn – A CTF-based learning platform with user-contributed challenges
• Reversing.kr – Focused on reverse engineering challenges
• Hax.tor.hu – Various hacking challenges
• W3Challs – Web security focused challenges
• Pwn0 – Variety of security challenges
• IO.Netgarage – Classic wargames
• RingZer0Team – Security challenges across multiple domains
• HellboundHackers – Community-based security learning platform
• CounterHack – Security challenges from a respected team
• VulnHub – Vulnerable virtual machines for practicing penetration testing
• Komodo CTF – Security challenges from Komodo Security
• Binary Analysis Course – A practical binary analysis course
• PwnAdventure – A hackable MMORPG for security professionals

For complete beginners, PicoCTF is particularly recommended as it eases you into the concepts gently. As you progress, try different platforms to expand your skills across various security domains.

Essential Tips for Learning Ethical Hacking:

Learning information security isn’t easy if you’re starting from scratch. Be prepared to:

• Google everything you don’t understand
• Question assumptions
• Face frustration (it’s part of the process!)
• Persist even when challenges seem impossible

The more you learn, the more you’ll realise there is to learn—and that’s part of the joy. Remember that the best cybersecurity professionals are those who never stop learning and adapting to new technologies and threats.

Final Thoughts: Making Your Mark in Cybersecurity

The path you choose will determine not just what you learn, but also how you learn and who you become in the information security community. While the “Quick Fix” path might seem tempting, the “Skill Builder” approach will give you a deeper understanding and more meaningful connections.

Information security isn’t just about breaking things—it’s about understanding how they work and making them better. Choose the path that aligns with this philosophy, and you’ll find yourself part of a community that’s making the digital world safer for everyone.