What you need to know before you do Security 05-27-2016, 10:21 PM
#1
The things you need to know before you do Security
Please look at this before you read the next Tutorial down that teaches you how to do SQL injection, or how XSS works or how to install whatever tool. This is important if you want to know how to break into anything.
If you actually want to learn how to do pentesting or security you need to understand how it works. There is no point in knowing how to do an SQL injection for example if you don't understand what the commands you are entering do. If when I say do this to get access
Code:
"SELECT * FROM Users WHERE UserId = " + txtUserId;What happens when they don’t have a table called "Users"? When you don't know what your doing you are never going to get passed the fact that they just have a tabled called "Players" or "OurUsers" rather than Users. This is not something someone who identifies as a pentester should be stuck with. Its basic 101 databases.
Understanding
Before you Break anything you need to understand how it works. If you want to break into websites you need to know how websites work and what you are manipulating to get your way. A tutorial when you don't know how or why it works that tutorial that you followed will only help you into an extremely small number of websites. Any websites that are vulnerable to the same problem but in a slightly different way are suddenly perfectly secure as far as your concerned and that’s not good. This is the same for everything and anything you want to break into. You need to know how servers or databases or scripting languages work.
Any time I am on a website I need to break into for college or work the 1st thing I do is play with it. What's in the robots.txt, what's in here, what's in there, is it WordPress, when I make an account how are the cookies done, what way are login boxes validating input? etc etc. This is all before I even think about running a single tool. If the 1st thing you do is run your tool's then you have already failed and you can ware the Skid badge with pride.
Operating Systems
At least have a basic understand how to work GNU/Linux and Windows. Use both of them as much as you can for day to day things. Unless your gaming I suggest living in the Linux Operating System. You need to understand the file systems of Windows and Unix. You will never be able to do for example a simple Directory Traversal Attack if you don’t know how the Linux or windows file system works.
If you have never used Linux before try either Ubuntu(Xubuntu Gnome-ubuntu) or Zorin
Either Dualboot (my personal preference for learning the OS and forces you to use it for day to day things)
or Use a VM
Programming
Learn how to do HTML+CSS(Before people complain I know HTML and CSS are not programming languages) and then have at lest a basic understanding of PHP and Javascript
You really should look at learning something Like Java or C++ or .net.
Networking
Learn basic networking and understand how it works and why it works.
Conclusion
When you know how a website is made you can take that understanding and learn how to break it. When you know how MySQL works you can take that and turn your understanding into an SQL injection attack. When you know how to javascript you know how to do xss. I am sorry but I cant emphasize this enough you need to know how and why things work before you can understand how to take it apart
![[+]](https://sinister.ly/images/modern/collapse_collapsed.png)
