I want to learn sql injection, xss and other web attacks. I am new to all this, just a beginner. I want to know which software to use. Can I use Windows for these attacks and which software do I use? I came to know about some software like Nessus and Burp suite.

  • You can do SQL injection and XSS with any browser, you don't need special software. Beyond that, this question is far too broad. – AJ Henderson Jul 9 '14 at 16:46
  • Are there websites that are not prone to both sql injection and xss? – kishan keswani Jul 9 '14 at 16:52
  • A static page is not vulnerable to those things. – schroeder Jul 9 '14 at 17:09

You need to move away from Windows if you really want to learn anything about "hacking". Yes, you can do some stuff with Cain and Abel and some GUI tools, but that isn't the right way to learn about computer security.

This is where I started. First, become familiar with a beginner Linux distribution, the command line, and how it differs from Windows. There are great books as well as online resources available. One of my personal favorites is http://explainshell.com, plug in a command and it will explain the command and any included arguments. Once you feel okay with this, dual boot Kali Linux on your computer and experiment! There is a huge catalog of pentesting tools to be explored and many tutorials online.

Learn how the tools work, instead of using them to achieve an ends. "Look I can see people's passwords!" vs "That HTTP post form is unencrypted so if I ARP poison and inspect the packets, I can see everyone's plaintext credentials". That kind of understanding will go a long way.

  • i have kali linux but cannot dual boot it . It shows that some processor problem . My laptop's ram is 2 gb but the installed os is win 7 64 bit – kishan keswani Jul 10 '14 at 6:23
  • Kali Linux comes in 32 bit and 64 bit, you should be able to install it. Or if you don't want to resize partitions on your computer and dual boot, boot it from a USB. Don't worry about Kali now, do the first stuff I mentioned and then post a new question later about any installation problems. – chubby_monky Jul 10 '14 at 15:34

In short, you don't need SOFTWARE, you need KNOWLEDGE. Seek that first, then the tools can help.

  • How to gain knowledge?Which tools to use for practise and which books? – kishan keswani Jul 9 '14 at 16:50
  • +1 because, despite the the original question being far too broad, i think schroeders answer is a core value for security work in any domain. – AlexH Jul 9 '14 at 16:54
  • 1
    Google has a education site for XSS, SecurityTube has tutorials, books are plentiful. You are beginning so pick one thing and move forward with that until you know where you want to go to next. – schroeder Jul 9 '14 at 16:55
  • Can all websites be hacked through sql injection and xss? – kishan keswani Jul 9 '14 at 17:00
  • 1
    No, of course not. They need to be VULNERABLE to those things, first. Listen, you need to go do some very basic learning first before you do anything else. Go spend an hour reading on xss, for instance. Ask questions after you have a foundation for them. – schroeder Jul 9 '14 at 17:04

First - Nessus checks for vulnerabilities.

There's a massive array of places to get educated. If you're wanting to learn for illegal activities, you're on your own. If it's for ethical hacking aka penetration testing then check these out:

The Basics of Hacking and Penetration Testing, Second Edition [Book]

Sans.org [Classes, free white papers]

OWASP [A-Z on how to perform tests]

Securitytube.net [Videos on hacking]


There are no specific tool to hack. If you want to "hack" on the web , you will generally use technology that are available on the web; example Javascript. First, I would start by learning how things work in general on a website and then you will see some possible vulnerability and understand why we do certain things to block them.

Owasp is a very good site to learn more about web security.

A fun game to learn XSS


Another game for SQL Injection


Not the answer you're looking for? Browse other questions tagged or ask your own question.