Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am interested in learning ethical hacking or penetration testing to head towards a career in that direction.

I have a strong knowledge of linux and unix, basic computer theory and practice and basic programming knowledge (arrays, methods, loops).

I have looked at gruyere and webgoat, however I find these to be too advanced for me. They ask to solve a problem without sufficiently explaining the problem, why it can be used to attack and giving examples.

Are there any courses or interactive programs, for free, that I can do from home that I can teach myself this information?

A bonus would be giving programming lessons useful in this area, for example teaching JavaScript to demonstrate cookie attacks and manipulations.

share|improve this question
2  
start from Basics.. you can learn and understand vulnerabilities/exploits. but they are already patched! as a pentester you have to find new vulnerabilities before bad guys. for that you need very strong basics.. system level/network level basics –  Karthik Feb 7 '12 at 10:16
3  
I agree that you need to start from basics, but I do not agree that in order to be a pen tester you have to find 0-day exploits. Being able to show and explain the risks of not patching absolutely everything on a network is part of the job. That means knowing how to exploit known vulnerabilities and being able to find the holes a network didn't know it had. Enumeration is more important than exploitation ... –  schroeder Feb 7 '12 at 16:23

13 Answers 13

Free options are few, but there are tons of videos and tutorials on specific attack vectors or products/tools. They will NOT make you a Penetration Tester, but they are free learning resources.

Some decent options to start you off:

Do some searching on this site for other people offering opinions on free learning resources. But, the only way to learn is to get your hands dirty.

Keep working at it, and keep asking questions!

share|improve this answer

In addition to the links to tools, vulnerable practice apps etc., the Penetration Testing Execution Standard aims to be the definitive standard on how to approach testing: http://www.pentest-standard.org/index.php/Main_Page

share|improve this answer

You can put these on a virtual machine using VM Player and play around.

Damn Vulnerable Linux (http://sourceforge.jp/projects/sfnet_virtualhacking/downloads/os/dvl/DVL_1.5_Infectious_Disease.iso/)

De-Ice/Hackerdemia (http://forums.heorot.net/)

For learning I would look at different penetration testing methodologies like Open-Source Security Testing Methodology Manual (http://isecom.securenetltd.com/osstmm.en.2.1.pdf). These commonly give a list of things to check for. You can then take these checklists and look up various tutorials on the web on how to defeat the various technologies.

One of the better books I've read recently was Writing Security Tools and Exploits (http://www.amazon.com/Writing-Security-Tools-Exploits-Foster/dp/159749997/ref=sr_1_1?ie=UTF8&qid=1328592753&sr=8-1). It covers basic assembly, creating shellcode, tips on finding and writing buffer overflows, format strings, heap attacks and more. The book is a little dated and doesn't cover things like ASLR and NX, but gives a solid foundation with numerous examples with great explanations.

share|improve this answer

Most of the suggestions here point to some great resources and ideas. I recommend using VirtualBox for your VM test environment. Also, if you have the spare funds, get a TechNet Subscription so that you can build plenty of test boxes. I believe CERT or another organization also puts out some Windows-based VM images that you can download, but I can't remember for sure who does it or where to find them.

While I do prefer and recommend VirtualBox for running VMs, it should be noted that testing works best when all your VMs are running on the same virtualization platform. So, if you're looking to hack systems running in VMWare Player, you should also have your attack system in VMWare Player.

share|improve this answer

Information Security is a very wide field, it consists of various sub-fields: infrastructure security, application security, network security and so on. From your question I believe the field you are interested in is Web Application Security - WebGoat and Gruyeres are two vulnerable applications dedicated to teach the most common vulnerabilities in Web Application Security. This is the only subject they mention and explain on.

In my honest opinion, the best way to start in web application security, is reading the OWASP top 10 list and explanations, and then continue to test web applications for vulnerabilities (of course only against your own QA machines or with the administrators written consent) . As mentioned, the Fundstone (now Mcafee) Hacme series is very good, comes in many languages (so you might find a language you are familiar with) and comes with detailed tutorials on how to manipulate and break the Hacme applications.

For more complete list of vulnerable applications and virtual machines, you may want to try the Vulnerable Applications Market

Another excellent way to learn, although it is a bit old, is to pass the MSDN Security Labs which are free and teach a wide variety of subjects:

  • Developer Starter Kit: Buffer Overflows
  • Developer Starter Kit: Code Analysis
  • Developer Starter Kit: Compiler Defenses
  • Developer Starter Kit: Fuzz Testing
  • Developer Starter Kit: Security Code Review Developer Starter Kit: SQL Injection Vulnerabilities

Good Luck!

share|improve this answer

To add a bit to schroeder's excellent (+1) answer.

http://exploit-exercises.com are interesting; its a couple virtual machines with challenges to escalate somehow. Nebula teaches how to escalate from a normal account to root in flawed environments -- many of the solutions are standard tricks (don't trust environmental variables or running eval on user input or make assumptions that the executable will be run as suggested).

Protostar/fusion are more advanced (e.g., buffer overflows).

Also recommend reading WAHH (it's not free; but its cheap) and Secure Programming in Linux/Unix.

share|improve this answer

Download various PHP applications in initial period host them on your local server and then try to find vulnerabilities in that using 2 different methdologies whichever you like

  1. OWASP testing methodology - https://www.owasp.org/images/5/56/OWASP_Testing_Guide_v3.pdf 2.WATC - http://projects.webappsec.org/f/WASC-TC-v1_0.pdf

If you do not have much knowledge about manual pentesting then, run acunetix and nessus against your hosted application on localhost see the results generated by them and then try to exploit them manually using BURP suite. That will give you boost and confident.

Then go for any of these methodology.

Once you are expertise in this methodology try to make your own checklist of testing and add new test cases every time when you find.

Once you do all these go for bug bounty program.

BUGCROWD is very reputed bug bounty program and here you can find the list of vendors on whom you can do pentest. https://bugcrowd.com/list-of-bug-bounty-programs

This is how whole process should go like.

share|improve this answer

For Web App Security you might want to try

I might be biased but it's the only free virtual lab on the subject ;)

share|improve this answer
1  
It isn't the only free virtual lab. There are various ones online with varying degrees of training, info etc. –  Rory Alsop Feb 11 '13 at 15:41
    
Sorry to disagree here. It's the only FREE virtual lab where you have your own sandboxed vulnerable web application. If a series of vulnerable web apps accessible by many at the same time is what you consider a virtual lab, then yes, it's not the only. –  Armando Feb 22 '13 at 14:44
    
@Armando Please indicate that you are the Founder and Project Manager for hack.me. And I think you might mean that it might be the only ONLINE free virtual lab. There are many VMs available with vulnerable web apps for download. –  schroeder May 7 at 15:26

First of all you should consider which kind or area of pentesting would you like to start. For example you may start looking for vulnerabilities in webs (OWASP, CTF's), you may start looking for open ports and analyzing which services are running (seeking information about exploits for the current version), etc.

I recommend the first one. First because is easiest to understand, second because is most common find a vulnerability in a bad coded web than in a system, and third because there are a lot of material about the subject and free challenges where you can test your knowledge (CTF's)

share|improve this answer

Though I am no expert, I did spend quite some time with Foundstone's Hacme Bank (just thought it would be nice to add this one too).

share|improve this answer

I have not read all the answers, but in order to learn about penetration testing and to do this for free you could try this set of tutorials by irongeek.com here: http://www.irongeek.com/i.php?page=videos/web-application-pen-testing-tutorials-with-mutillidae

This is instructions on downloading an intentionally vulnerable web application called mutillidae that you can use to practice pen-testing on. The application, mutillidae, has hints that you can enable to learn from. If you have some sort of LAMP server you can just drop the folder into your server's www folder and access it on your local loopback address, 127.0.0.1. You also have to create some database tables in MySQL server though so this pen-test tool maybe more advanced for you at the present time. Populating tables is not that tough though. Nor is creating the necessary database. :D

This would be great to run on a virtual machine running Kali Linux or Ubuntu. Especially, if your machine has enough RAM and CPU power.

You can learn all sorts of things from this such as SQL Injection, Cross Site Scripting, and other types of attacks you can educate yourself on to be able to defend against through secure coding practices, etc.

share|improve this answer

You want to start from the basics? Jump to 0:57

Nearly all exploitation exists because we exploit Von Neumann architecture. Any time you can possibly treat data as code, you have an attack vector. It doesn't matter what the architecture is, what the platform is, what the technology stack is... modern web applications cross multiple contexts: HTML/Javascript in the browser. (Attack vector!)

Exploitation means you're getting your target to execute your code. That's the point behind SQL injection, XSS, shellcodes -- about everything! If you want to learn to be a pentester... get the "Pentester's Open-Source toolkit." (There's free versions legally obtainable.)

Defcon lectures are available freely, and they're some of the best overall classes I've ever taken. But more than anything else: you have to get your hands dirty. You mentioned webgoat. Did you install Tamperdata on firefox? Did you install wireshark? Hacking is about having as many tools as possible collecting data so you know what's going on. This video talks a lot about monitoring... everything...

https://www.youtube.com/watch?v=Jwot7S6NmLE

share|improve this answer

The best way to learn is by doing. I am not suggesting anything illegal mind you, but see if you can get a pen-testing gig. Find a local small business and do it pro-bono. Find a church and offer your services to them. Just a few suggestions if you go this route:

  • Have them back up before you do anything!
  • Just start out by doing passive and active recon.

I know port scanning isn't necessarily the glamour of pen testing, but it's a good place to start.

share|improve this answer
    
So, for the second part of your question, download backtrack and learn all those tools. Youtube has some examples for each tool. –  Jeff Feb 7 '12 at 5:02
7  
I would not at all suggest an amateur to do penetration testing on any systems he does not own, whether having permission or not. That's like going to your local NRA chapter and recruiting a volunteer SWAT team to help resolve a hostage situation happening right down the road. –  Iszi Feb 7 '12 at 16:32
11  
You may have a problem with this Jeff. Because this type of service can cause damage, organisations will often require you to "deliver services professionally" and if you fail to do this (because you are learning), you could cause 'wilful damage' - or the equivalent in your jurisdiction and be held liable for all damages! –  Rory Alsop Feb 7 '12 at 17:12
    
True. I get the following before starting: Written expressed approval from the owner, an outlined (and signed) exact specification of what you are going to do, and notification (signed) that the organization has backed everything up. I agree with Rory, this could cause damage. My situation was a friend of mine had a network he setup and wanted me to just do scans on it. I got what I needed and gave him a report. I also want to add that I am working on a network that could be down for a month and it would not matter. No loss of revenue. –  Jeff Feb 7 '12 at 18:08

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.