해킹과 보안에 대한 여정 탐색하기

### 해킹으로 가는 길 탐색하기: 학습의 여정 수용하기
* 🤔 많은 사람들이 보안 분야에서 시작하는 방법에 대한 지침을 구하지만, 사실 경험과 노출이 제한되어 있어 **정확한 경로를 '잘 모르겠다'는 것**이 사실입니다.
* 🛤 보안 분야에서 성공의 지름길을 찾는다는 오해가 있지만, 실제로는 **간단한 단계별 가이드가 아니라 다년간의 경험**이 필요합니다.
* 🎢 저 역시 어렸을 때 HTML로 시작해 웹 프로그래밍을 거쳐 궁극적으로 현재의 보안 분야 프리랜서 경력을 쌓게 된 **CTF(Capture The Flag) 대회**를 발견하는 등 다양한 전환점을 거쳤습니다.
* 📚 '해킹'은 기본적으로 시스템의 작동 방식과 이를 악용할 수 있는 방법을 이해하는 것이므로 **프로그래밍 언어, 데이터 구조, 네트워킹 등 다양한 분야에 대한 지식**을 습득하는 것이 중요합니다.
* 🌍 학습 과정은 선형적이지 않으며, **모든 프로젝트, 튜토리얼 또는 실패가 전체 경험에 기여하는 상호 연결된 주제의 웹**과 유사합니다.
* 🔍 버그 바운티와 같은 특정 영역으로 들어가려면 **웹 보안과 같은 기초적인 주제**에 집중하여 한 번에 하나의 프로그래밍 언어부터 시작하여 점차적으로 취약점을 살펴보세요.
* 학습을 위한 리소스는 풍부하지만 전문 해킹 튜토리얼이 아닌 일반 문서에서 제공되는 경우가 많으므로 **자기 주도적 연구와 탐구의 중요성**을 강조합니다.
* ⏳ 궁극적으로 학습 과정에서 인내심과 즐거움이 핵심이며, **"호기심을 갖고 다양한 새로운 것을 계속 탐구하다 보면 몇 년 안에 완전히 도달할 수 있을 것"**이라고 말합니다.

해킹에는 다양한 지식과 다년간의 경험이 필요하므로 지름길을 찾지 말고 학습 여정을 즐기세요.

“Where should I start? Can you guide me? What resources can you recommend me?” I get this asked a lot. TLDR: I don’t know. I genuinely don’t know. Before I tell you my thoughts I have to mention
that I’m young.

I have very limited exposure to the industry,
I have not had different jobs in this field. And so I really don’t know how to transition
from another job into it. What certifications to get, how to balance
a full-time job and a family.

Anything country-specific. I really can’t help you with that because
I have 0 experience. All I can look at is my life and tell you
my thoughts about it. If you disagree with what I will say, or it
doesn’t help you, then you need to ask somebody

else. I don’t have the answer. But I think there are a lot of misconceptions
about how to get into the security field. And I try to explain now why. Maybe you think there is some kind of shortcut. Or at least a very efficient path.

You hope a professional or experienced person
can easily tell you about a clear path to success. I certainly had exactly those thoughts several
years ago. I got frustrated why nobody would write down
a clear guide. I felt somewhat entitled that I have good
experience already, I just need some guidance

or mentoring. But the truth is: there is no efficient path
Truth is: it just takes years of experience. So if you think that somehow it would be easier
with a study plan, it’s not. So forget it. I’m sure you know this interview question:
“what advice would you give your younger

self?” And for me, I don’t know. While certainly thinking differently at the
time, in retrospect, I don’t think there was anything bad or inefficient about the
path I took. Of course I could help my younger self understand
certain concepts better and faster, and that’s

what I try to do with the videos, the videos
cover exactly what I would tell my past self, but I couldn’t lay out a path of do X, Y,
Z. There is no secret step-by-step guide! It’s not a straight path, but a web of interconnected
topics, layers and dependencies and you are

free to walk and jump between stuff however
you want. Truth is: anything you do. Any tutorial you follow. Any project you start and never finish. Any dead-end you head down. It’s not wasted. It’s all experience that is accumulating
over time.

If I learned anything about hacking. What it means, what it is, then at least to
me, it’s not really something I can get a hold on. It’s an abstract artistic and broad term
for many different things. Truth is: Hacking is just learning IT stuff,
but kinda in an artistic weird creative way.

Maybe now you say, well tell us about your
path then? Clearly it got me somewhere right, maybe that’s
the ultimate guide. While there are a few things I can mention,
my path is also full of just luck. Opportunities I have never planned for.

So it’s also somewhat not applicable to
anybody else. Nevertheless, here are a few checkpoints that
maybe give you some idea. As a kid I started with some HTML
Then I got a book about Visual Basic Script. And I wanted to write an operating system
in it.

If you have ever written Visual Basic Script, it’s a bit like Javascript, so you know how ridiculous that idea was. But that didn’t hold me back, I asked this question in a forum and was called a dumb TROLL. I was really sad that day, because I was just a kid trying to learn something and I had

no idea what it means to have an OS. Anyway, at some point I got into web programming with php. So I had to learn actual HTML, CSS, javascript, php and mysql. I started and abandoned several browser games projects.

Then I heard about SQL injection and did a school project on it. Here, I wrote a test application and explained how injections work. I started to learn java and got into android app programming. Did some C++ and a bit of game programming.

Made a shitty monopoly clone. Then I did some Google Wave gadgets, does anybody remember that? I was just a dumb kid and my code was ugly but my poll gadget got some attention from professionals. That was cool. I learned more computer science fundamentals in university.

Data structures and algorithms. Learned about Linux because I started to use it at work. Joined a hackerspace and learned about Arduinos and soldering. And then I guess the major turning point, I discovered my first CTF, the Stripe CTF,

got hooked on wargames and other challenge sites. And essentially here I am now. And now I’m a freelancer doing security code audits, pentesting, application security and that kind of stuff. And please don’t ask me how to get into freelancing. I have no clue how to do it.

I met a guy, who knew a guy, who recommended
me, and here I am. So that was not planned at all. And looking at my history, imagine that these
are just large checkpoints. It's not on a straight path.

It's traversing through a jungle of different
topics. It's kind of like a fractal or the coastline
paradox, if you zoom in, you uncover even more complex lines. There is a lot of stuff I did not mention
in this high-level view.

Like making RPG Maker games, where I was first
exposed to if-else logic blocks. Or modding my calculator with a window and
LEDs. One of my first exposures to electronics. If you ask me where to start, where should
I point you to?

Is the start the first HTML line written as a
young kid? Or is the start when I had already years of
programming experience and discovered CTFs? I have no answer for you, you have to figure
that out yourself.

But one truth is, I didn't discover any
secrets. There is no anonymous secret hacker organization
with forbidden knowledge. I simply apply the knowledge that I gained
about computers over the years. You know, programmers use the same knowledge
but just think differently.

They think: "How can I make it work?"
And a hacker thinks: "How should you implement it, so that it's secure, and what could
a lazy programmer do wrong?" Truth is: the more you understand how something
is built, you can also think about how it

could break
So I’d say 95% of what I’m doing is just learning about how computers work. And by that I mean learning a ton of different
programming languages, frameworks, concepts, and so forth. Over the years I gained a very good broad
basic understanding from low-level logic gates, 

over simple circuits, to PCBs and chips, microcontrollers,
low-level programming, assembler, C, firmware, operating systems, higher-level languages,
language and programming concepts, data structures, file structures, 3D programming, networking,
cryptography, servers, server administration, 

websites, frameworks, databases, web apps,
mobile apps, math, machine learning, the list is endless. And you see, nothing on this list screams
“hacking” or “security”. Because this knowledge is just the base requirement,
the tool that I use to do my job as a “professional 

hacker”. Like I said, it’s not secret knowledge. It’s everything a programmer, sysadmin or
whoever would learn, just applied a bit differently. So I’m thinking: “what could go wrong. How can files be exposed. 

How could I gain access without a password. How could I modify something that shouldn’t be
modifiable, how can I manipulate the output” and so forth. And maybe it’s surprising to you, but that’s
not different from what a programmer or IT 

architect would do. They use the exact same technology just have
different thinking patterns. Different problems they try to solve: So they
think “how could I use these things to build a social network, how could I build a time-lapse
camera, how could I make a fun game”. 

Different problems, different goals, but based
on the same knowledge. And the security focused stuff, like conference
talks, CTF writeups, trainings, academic papers, blog posts, are essentially just sharing cool
ideas how to apply this knowledge in a security

focused way. And that is not different to a programmer
sharing techniques on how to handle huge datasets efficiently, or how to implement a game AI. Don’t think of hacking as anything crazy
or special. It is based on exactly the same thing just
with a bit different angle.

Breaking, not building. So to summarise: hacking requires a lot of
knowledge about computers. And I say generic computers, because it could
literally mean anything IT related. And learning a wide variety of technologies
and gaining experience and knowledge to draw

from, just takes time. It takes years. So any game you develop, any Minecraft redstone
circuits you build, any boring sorting algorithm, any math class, any mobile app you start and
abandon, anything you do is knowledge you

accumulate and eventually can use. So one general advice I give is, it takes
a lot of time, so make sure you have fun! Enjoy learning about computers. Enjoy programming. Enjoy following tutorials. Enjoy learning a new language. Whatever it is that you have fun with, it
will keep you motivated over the years.

Don’t get me wrong. You don’t have to first program for years
and then get into security. You can do it in parallel. When you write an Android app, look into the
official Android security tips. Think about what could go wrong.

What happens if you don’t follow it. Play around with that. Maybe at some point you want to build a web
api to be used by the app, and suddenly you learn web development and server administration. Then you have to debug your connection, you
look into web proxies and how that can be used

to analyze and test stuff. This is essentially the process you will be
doing for the next few years. And that’s what I do all the time. You know the thought of being able to hack
an iPhone, a gaming console or banking terminal

is motivating, but good chance is that you
are just very, very far away from that. I’m at least not there yet. I failed with my Nintendo Switch hack attempt. I barely understood the surface. But that’s fine, I keep learning.

And I have a ton of fun with learning basics
and learning a new programming language and learning new technologies. And in a few years, in two more console generations,
maybe I know enough to join one of those teams. I know you might still feel frustrated, where
to start.

But if you feel frustrated, then that’s
probably because you picked a target way too large for you. If you don’t know the steps you need to
take, it’s too far away to see how to get there. So try to break that goal up.

For example, if you want to get into bug bounties
and you have no clue how to do that. Analyze it. Sit down and try to uncover the underlying
topics. For example, bug bounties are usually web security. Web security means hacking websites.

Websites can be written in a ton of different
languages. So start with one, learn PHP, learn what can
go wrong with PHP. Learn about different PHP frameworks. Learn about different databases. And with “learn about” I mean, write your
own test websites, use the frameworks, just

play around with it and gain experience. When you get bored with PHP, look into Python. Learn about Python Flask and Django. What can go wrong with Python websites? What can go wrong with Ruby websites. Do you see how the typical Ruby, Python and
PHP web security issues are super different,

because they are different languages? Learn about JavaScript, learn about HTML and
then try to understand what XSS means. You see how that single topic just immediately
exploded into so many subcategories, and here you have a list of stuff you can spend years
on.

And it’s not a step-by-step path. It’s a collection of topics and you basically
jump around between them, and slowly understand them deeper and better. Over the years I have revisited the security
of PHP websites and I always learn a bit more.

And you can even go so deep to look into the
actual PHP C source code. So this is what you have to do. Break it up, try to understand the layers
that build up whatever you want to do, and learn these layers.

It’s a bit of research, but that’s part
of it. And another thing I want to make clear, you
won’t find these things when searching for “hacking tutorials”. That’s something I had to learn. Truth is: most resources hackers use are regular
documentation and programming resources.

Hacking tutorials, like what I show you in
videos, are just showing you how to apply that stuff to security. You don't need to rely on me or any other
person to write it up for you, you can do it yourself.

In many, many videos, I'm not referencing
any secret hacking book. I just simply open the official AVR assembler reference, or look
into the PHP function documentation, or look at the official Linux manual pages. So let me summarize:
No! There is no clear, easy path to learn this
stuff and I can't help you.

There is no secret book or website to learn
it. The more you understand computers, the more
ideas and understanding you have about what can go wrong. Programming, abstract theory, and so forth
is important to understand computers. And just have fun. If making games sounds fun, make games.

It takes years to accumulate this knowledge,
so make sure you enjoy the ride. And one last thing I want to say. I make the videos in a way I would have loved
to watch them some years ago. Which means I already had experience with
programming.

So I guess my channel is not intended for
complete programming beginners, but I still hope that what I just described helps you
to get somehow started. And if you have some experience, just keep
watching my videos and take them as inspiration

to look deeper or into different topics. You absolutely don't have to understand
everything, but catching one thought, or seeing one tool I use, can be all the difference. And I hope the videos at least give you a
rough idea how stuff works, and you can research

it once you actually need it. If you want some more guidance, you can also
check out my playlists. I have a fairly long binary exploitation playlist,
mostly based on exploit-exercises.com. But I also have some web security videos. Or just my CTF write-ups.

Like I said, it's not a clear path so just
keep jumping between topics and just have fun. Look into stuff, get frustrated, and then
look into other stuff. And otherwise, maybe look at overthewire,
picoCTF, ctftime.org, try out some bug bounties

or just look at other programming YouTube
channels and learn about something new. Make sure to check the description for links
to stuff I can recommend. Anyway, always try to learn something new. And trust me, if you just stay curious and
keep looking into many different new things,

in a few years, you will totally get there. Be patient.

The Secret step-by-step Guide to learn Hacking

LiveOverflow

사이버 보안 경력 경로에 대한 초기 면책 조항 및 오해

발표자는 업계 경험이 부족하여 구체적인 전환 조언을 제공할 수 없습니다.

연사는 자격증, 일과 삶의 균형, 국가별 정보에 대한 조언을 제공하는 데 있어 한계에 대해 설명합니다.

연사는 사이버 보안에 대한 빠르고 쉬운 경로가 없다는 점을 강조합니다.

연사는 사이버 보안에서 성공으로 가는 길은 쉽게 구할 수 있고 효율적이라는 잘못된 생각에 도전합니다.

연사는 명확한 가이드에 대한 자신의 과거 기대와 폭넓은 경험이 중요하다는 깨달음에 대해 이야기합니다.

연사의 개인적인 여정과 사이버 보안 학습의 본질

연사는 자신의 커리어 경로를 되돌아보며 체계적인 계획의 부재와 시간이 지남에 따른 경험의 축적을 강조합니다.

발표자는 학습 과정을 상호 연결된 주제를 통한 비선형적 여정으로 설명하며 모든 경험이 전체 지식에 기여한다는 점을 강조합니다.

연사는 해킹을 특정 기술이 아닌 창의적이고 예술적인 방식으로 IT를 배우는 것으로 정의합니다.

연사의 길은 운과 계획되지 않은 기회가 수반되기 때문에 쉽게 복제할 수 없습니다.

연사는 다양한 프로젝트와 경험을 강조하면서 여정의 주요 체크포인트를 공유합니다.

사이버 보안의 핵심 지식과 기술

연사는 다양한 프로그래밍 언어, 프레임워크, 개념을 아우르며 컴퓨터 작동 방식을 이해하는 것이 중요하다고 강조합니다.

연사는 오랜 시간 동안 축적된 광범위한 기술 지식을 나열하며 이러한 지식의 기초적인 특성을 강조합니다.

연사는 자신의 업무가 프로그래머나 IT 설계자와 비슷한 사고방식으로 시스템이 어떻게 고장날 수 있는지 분석하는 일이라고 설명합니다.

발표자는 보안에 초점을 맞춘 리소스는 비밀 정보가 아닌 일반적인 IT 지식을 응용한 것임을 명확히 합니다.

사이버 보안 전문가 지망생을 위한 조언과 전략

연사는 필요한 지식을 습득하는 데는 수년이 걸리며 학습 과정을 즐기라고 강조합니다.

발표자는 다른 프로그래밍 프로젝트와 병행하여 보안 개념을 학습하고 적용할 것을 제안합니다.

연사는 큰 목표를 관리 가능한 작은 단계로 세분화하라고 조언합니다.

발표자는 버그 현상금의 예를 들어 광범위한 목표를 구체적인 학습 영역으로 세분화할 수 있는 방법을 설명합니다.

연사는 학습의 반복적인 특성을 강조하며, 시간이 지남에 따라 주제를 다시 살펴보고 이해를 심화시킵니다.

연사는 쉬운 길은 존재하지 않는다, 컴퓨터를 이해하는 데 집중한다, 학습 여정을 즐긴다 등 핵심 사항을 요약합니다.

발표자는 콘텐츠가 프로그래밍 경험이 있는 사용자를 대상으로 한다는 점을 명확히 합니다.

스피커가 추가 학습을 위해 특정 재생 목록과 리소스를 추천합니다.

발표자는 다양한 리소스를 탐색하고 호기심을 유지하도록 권장합니다.