Websites are basically just a program on a different computer somewhere. Think of it like passing notes back and forth.
User sends a note using their computer requesting the website content, that note gets passed to someone elses computer. That computer looks at the note and sends back a different note with some different information on it i.e. the website content. Then they keep sending notes back and forth as the user takes actions. The main two categories of “taking over a website” is to either catch the notes while they are being passed and change what it says (MITM attack) or to convince the other computer to send different notes to begin with.
But of course, the owners of the website have layers and layers and layers of protection to make it really hard to ‘convince’ their computer to do something unless you have all their special keys/passwords. That’s why you need to find some defect that lets you in anyways, or somehow get their keys/passwords.
Nah, it isn’t that simple. You need a deep, fundamental understanding of computing to do it yourself. The clankers can do it now for you pretty easily if you know how to whisper to them in the right way. That’s a lower barrier to entry and at that point, knowing just the nomenclature from the cybersecurity sphere in addition to having a solid software engineering understanding, it is enough. Lots of the proofs-of-concept for the PHP vulnerability assumed insecure defaults, for example. This is the clanker cheating and the humans not really being experts enough to recognize that.
Hacking any software is first finding a condition in how the software is written that allows you to subvert an expectation. This can be as simple as providing a buffer and lying about how big that buffer is. It could allow you to read or write arbitrary data somewhere the original developer never expected. That data can be instructions that give the attacker full control. I am giving you a little bit of “the rest of the fucking owl” here because it gets pretty technical.
As for taking credit, this is why they come up with groups with names or they pick pseudonyms. They are seeking status among their own peer group mostly. It is enough to get their name dropped on the news somewhere. Reputation, clout, all the things boring humans desire.
I’m gonna dumb this down for people like me: if a user does unexpected things in a program, sometimes it can abuse the program so that it allows the user to do what it shouldn’t.
Most software nowadays is incredibly attuned to this so there’s truckloads of things that have already been brushed over in a software but software always has remaining holes in it.
When you develop a software, you have to make it work in the right way, and then you have to stop it from crashing when used in the wrong way. But if you “hack” some software, you only need to find out how to use it the wrong way. That’s why software development and red teaming are very very different fields. Though generally cybersecurity (at least in my eyes) is considered one of the most difficult fields in computer science because of the broad base knowledge required.
most sites getting pwned are for really simple things, like the number 4. It’s usually human error and slipups
This is a good place to start for the first part of your question :
https://inst.eecs.berkeley.edu/~cs161/archive/fa08/papers/stack_smashing.pdf
For the second part, you will in fact be arrested if you attack other people’s websites, don’t do it.
It’s a different skillset, although knowing programming (especially website programming so that’s mostly JavaScript for frontend, while backend is commonly JavaScript or Python) can be helpful, having some idea of the type of errors people usually make when programming is the thing that’s helpful.
This short version for how what most people call hack websites is that they figure out a security bug somewhere on that server and exploit it to gain access to that computer, and then they can take down the site or modify the contents. Doing this is very specific to the site in question and the vulnerabilities it might have, asking how people do this is kinda like asking how people break into houses, there are a million and one ways to do it and it depends on both the attacker and the target.
However a very common tactic is to point a bunch of computers towards that site so that the amount of traffic is high enough that legitimate users can’t get through, that’s not hacking the website though, it’s the equivalent of calling a phone number nonstop so no one else can reach it, this is called a Denial Of Service (DoS) attack, and it’s usually Distributed across several attacking machines as nowadays if a single IP hits you too hard you block it and carry on serving users, which is why this is known as a Distributed DoS or DDoS attack.
Finally, how can people claim to do that with impunity? The short version is they can’t. These people usually take pseudonyms so as to not be traceable, and claim authorship under those, not their real names.
Try a beginner CTF like huntress CTF. It will start slow, with basic skills, and slowly build them up.
I’ve been standing in the base next to the flag guarding and waiting, for like 4 hours now and nobody showed up. Worst game of capture the flag, ever.
You’re supposed to be capturing, not guarding.
Nobody tells me nothin’ around here
It is simple, and you should read The Hacker’s Manifesto
DDOSing stuff is simple. Just get a sizeable botnet and direct all your bots to visit the site. And basic opsec
