Man, what books are your cousin looking for for hacking that are 3k? There are tons of programming resources and tools available for free

For example Ghidra is FOSS and readily available (https://github.com/nationalsecurityagency/ghidra)

Same deal with something like Kali (https://www.kali.org/docs/) just the process of bringing a Kali install up and dorking around can be hugely educational

I’d argue that information has never been more available

Even though programming is also known as hacking, I’m going to assume you’re using hacker to mean red teaming in general, i.e. offensive cyber security, as that’s what most people have in mind when they think of “hackers”.

We’re about to enter a golden age for that profession, the reason is LLMs, AI, vibe-coding, etc. See, a long time ago things were very insecure, no one was worried about security as it was all just so new, that was the era when you could sniff on network traffic very easily, crack your neighbor password in a few minutes or login to most things using admin/admin. Over time people started to realize that security mattered, that there were enough malicious people out there that you had to at least make some effort to secure things. This brought us to today, where things are fairly secure, your router has a preconfigured long random password and uses at least WPA for security, most companies no longer store passwords in their databases so it diminishes the risk of leaks, etc, etc. A lot of thought is put into security by serious companies, but there were some cracks starting to show because small devs wouldn’t take security as seriously, be it for lack of resources or care, so while large stuff would be safe, smaller apps and sites are still very vulnerable, and people being people they use the same password for both and don’t enable 2fa, so once you grab credentials somewhere you can try the in other places.

What changed now? Well, recently people started to vibe-code, i.e. give prompts to an LLM to generate some code. The problem with that is that in the database of things an LLM is trained in it might have lots of bad examples, be it because the code was insecure, or because it was exactly an example of insecure code. Asking the LLM to make it secure is not going to work, as it lacks the comprehension to understand what security is. It’s possible to make things better in an iterative process where you feed the output code to itself and ask it to check for security vulnerabilities, but it might introduce new ones while fixing the existing ones, because the majority of examples online are incomplete as they’re meant to be small examples of small parts of a system to showcase how to do that in a secure manner (but they leave other parts insecure as that’s not the purpose of the example). For example, a login example code might use a simple text comparison for the password field, because it’s trying to show you the structure of the API, not the content, and assumes you will know now to do that, but an LLM doesn’t know that.

And with many people vibe-coding apps and sites it’ll become more and more easy to find those serious security holes in the wild.

And how to learn it? Well, the short version is doing. You don’t need to buy expensive books, or anything of the sort, just start reading online, and poke around stuff. I used to play around with https://www.hackthebox.com/ and found that very interesting way to learn, however you might need to read on some stuff first before you’re capable of logging in there (although I just gave it a quick look and I think they removed the most interesting part about it which was you had to hack the website to create an account).

I’m confused about what’s being asked here.

Are you asking how to become tech savvy on the cheap, how to become a maker/modder, how to get into computer reverse engineering, or how to crack other people’s stuff?

The answer to all of those I guess is: practice taking stuff apart and putting it back together. Start small and work your way up. Learn techniques that work for you, ask others when you need help.

Once you’re comfortable with that, start taking stuff apart, changing it slightly, and putting it back together. Over time, expand on the modifications. Document everything and build up a toolkit. Eventually, you’ll be able to analyze a situation and know where to look to tweak something to make things work the way you want.

All of that takes time and patience, and often things break or don’t work as well as they did when you started. Growing from that is the important bit.

Expensive books? Not necessary until you’re looking for very specific information that’s a trade secret. At that point you can evaluate whether they’re worth the cost for the result.

Side note, orientated is an unnecessary conjugation of oriented.

Please just use oriented.

It is both harder and easier.

In the early days, many network protocols and information systems were developed without any thought given to security. The original email protocol stored and transmitted every message in plaintext. Devices were shipped with default credentials like admin/admin, some of them with no actual process for changing those credentials and no way to update the firmware, leaving them permanently vulnerable.

Later, people started realizing that some way to prevent unwanted access was necessary, but many of the new security features were just bolted on to existing products without much testing, and frequently there were ways to simply bypass the security without having to actually break it.

In the present most serious products have at least some thought given to security implementations during development. There are entire companies that specialize in security products, software, hardware and middleware. There are professionals whose entire careers have been spent thinking about these problems, and government agencies and laws focused on them. There is more investment and more scrutiny on information security that there ever has been at any point in human history.

At the same time, the amount of things plugged into the global information network has exploded. There is orders of magnitude more information storage connected now than there was in the 90s, and higher consequences for unauthorized access (things like public water and electricity systems are connected now).

In the 60s the number of people who had a grasp of computer networking could be counted on your fingers, for the entire planet. In the 80s, that community was still small enough that everybody knew each other. In the present the community and the networks are so large and complex that no one has any idea what is going on. There is a lot of confusion that didn’t exist in the past, and that creates gaps in systems because products get connected to each other in ways that they were never designed for, so even if two things have their own well-implemented security features, the point where they share information with each other often doesn’t.

In short, security is a lot tighter now than it used to be. People are paying attention, taking it seriously. On the other hand, there is a lot more opportunity for security vulnerabilities to be found in systems, and everything is too complicated for anybody to really understand all of it.

It’s a curve. At one point you could hack the global phone network with a plastic whistle. At some point running scripts other people wrote was looked down upon.

I predict that William Gibson is going to be proven more prophetic by the day.

First, you need to be smart. At least average IQ.