#hacking guide

The Evolution of Hacking: From Cyberpunk Fantasy to Real-World Reality

Hacking has been a part of internet culture for as long as there’s been an internet to hack. For some, it’s a rebellious act—tearing down the walls built by corporations or governments. For others, it’s an artform, a way of playing with systems, seeing how far you can push boundaries. But what does hacking really mean today? And why does it still capture our imagination?

Historically, hacking has been portrayed as a dark art. Think back to movies like The Matrix or Hackers—hackers as antiheroes, taking down the system from the inside. But while these portrayals are often exaggerated, they did reflect a truth: hacking represents a desire to reclaim power and control. In a world where tech companies and governments collect personal data and monitor our every move, hacking is one way to level the playing field.

In the real world, hacking has taken on many forms. There’s ethical hacking, where people are hired to test systems for vulnerabilities, and there’s black-hat hacking, which involves illegal activities. But even those who engage in illegal hacking often see themselves as part of a larger rebellion against control and surveillance.

It’s easy to romanticize hacking, to see it as this cool, underground world of rebellious acts and revolutionary potential. But the reality is more complex. Hacking today isn’t just about taking down the man; it’s about finding flaws, building something new, or even just learning how things work beneath the surface. It’s about pushing boundaries, challenging authority, and questioning the systems that run our world.

And perhaps that’s the real reason hacking still resonates with so many people. It’s not just a skill or a rebellion—it’s a form of empowerment. It’s the ability to break free from the constraints placed on us, even if only for a moment.

Aspiring hackers! I’ve created a guide covering core cybersecurity concepts new hackers should master before tools. I break down networking, OS internals, & hacking tactics. Recognize hacking as lifelong journey—arm yourself with the basics!

Core Concepts for Budding Cybersecurity Enthusiasts The Building Blocks of Ethical Hacking So you want to become an ethical hacker and enter the exciting world of cybersecurity. That’s awesome! However, before you dive headfirst into firing up Kali Linux and hacking everything in sight, it’s vital to build up your foundational knowledge across several InfoSec domains. Mastering the fundamentals…

MultiFactor Authentication (or MFA) is one of the best ways to increase your security. In this post I'm going to discuss what MFA is, some different examples of it, and how it helps security.

What is MFA?

MFA (sometimes known as 2FA for Two Factor Authentication) is any method which requires a secondary method to authenticate a user. To put this in simpler terms: at least two *different* things are needed in order to sign in.

One example you likely use regularly without thinking about it is a bank card. In order to use a bank card you need the card itself and also the PIN. Just having/knowing one of these doesn't give you access (except nowadays with contactless payments... the example stands for chip and pin)

What are Some Examples?

You've probably seen the most common type of MFA: The SMS codes. When you try singing in to some sites, you'll be asked to enter a verification code that has been texted to you. The website then checks that this code is correct and logs you in. This requires you to know your password and also have access to your phone. There are some vulnerabilities with SMS MFA however, so it's not the preferred method and should be swapped for a more secure method if possible.

There is also an email version of the above, where codes are emailed to you when you sign in. This works the same way as the SMS method, but the two things needed are your password for whatever you're logging into and your email password. This is also not the most secure method, as if you follow bad password practices and have the same password for both then there is no second factor: both logins are the same. This can be secured more by following my guide to better password security.

You may have had to install an authenticator app before. These apps use the same algorithm to generate a new number every minute or so on both the server and the users device. When signing in the user puts the code generated on their app and the server checks if it has the same code.

There are all sorts of other methods: keyfobs/cards, biometrics (fingerprint/face recognition/etc.), and even the users location. Anything that requires more than just a password to verify that a user is who they say they are is MFA.

How Does MFA Improve Security?

MFA improves security by increasing the amount of work needed for an attacker to be able to gain access. Instead of just guessing or finding your password, they then need to also find or fake the other method(s). While this may not be impossible (as I discuss later) it will make you a harder target, potentially persuade an attacker not to bother with you, and possibly alert you to the attack. I once learnt someone was trying to take over my Nintendo account when my inbox was filled with authentication requests which allowed me to block the attacker and change my password.

What you’ll need :

a 3ds on firmware 11.5

a digital copy of RPG Maker Player (free) ver. 1.1.4 on EUR, ver. 1.1.2 on USA/JPN

Preparing SD Card: (new hackers only)

Go here and download the JKSM_3DSXDownload the JKSM ZIP

Find where the “JKSM_3DSX” ZIP downloaded and open it

Open the “3ds” folder

Copy the “JKSM” folder

Go back to your SD card

Paste the folder inside the “3ds” folder of your SD card

Installing: (For all)

Get and install the homebrew starter kit available here and follow instructions. (You will need to download both the “starter kit” & the “otherapp” payload”

Open RPG Player and go to “Download Contents’, hit yes.

Once complete go to “Download Game”, hit yes, it will ask you for a nickname, I just used the code I needed to use.

Once you’ve done that hit “Download Posted Product”, then hit “Search Product ID” and put in the code that you need to use.

The title should be “RPwnG” and download it as the first save.

Once downloaded, go back to the main menu and hit “Play Game” then select the save file.

Homebrew should open, it may take a couple times!

Code I’ve found:

o3ds us -  aczettg8 (the one I used)

n3ds us -  82iykhm0

o3ds eu -  afkgvmk3 /  2z2qx2z6 / csd049qg

n3ds eu -  d1rb2ybu

o3ds jpn -  573hus9i

n3ds jpn -  3ge8lj6l

What to do on Homebrew:

Once on homebrews menu scroll down till you see “JK’s Save Manager”

Select your ACNL Game, I recommend if you have both the physical & downloaded games do not have the physical game in unless that is the one you want to hack.

Click export save and make a back up of your town ( I.E mine is named “Castle B.U” ) then exit homebrew properly.

Once you save it, exit home brew and go to the save editor.

Once you have hacked your town do steps 1 & 2 again.

After doing those steps click import save and exit homebrew properly

You will have to do these steps every time you want to hack your game, unless you still want to hack on the same day.

How to use Save Editor:

Go to Save Editor

Once you are there click “Choose File”

To find the export you just made go to  JKSV > Saves > Animal_Crossing__New_Leaf > then click whatever you name your export file > Then choose the garden_plus

Your town should pop on the screen and you can start editing/hacking!

When saving your hacked town make sure you remove your old “garden_plus” file and save the new on as “garden_plus” , nothing else or it will mess up. (You can also just click your old “garden_plus” file and write over it the new one)

Tips for Save Editor:

Your town should have:

• At least two (2) rocks • At least one (1) pond • Two (2) slopes to the beach • At least one (1) waterfall at the wall of your town • At least one (1) waterfall to the beach • A plaza acre (you CAN remove the recycling shop and town hall acres)

When switching acres, make sure:

• The beaches line up appropriately • To have the appropriate river acre by your waterfall that’s at the wall (they are the bigger ones, NOT the thin ones) NOTE: When changing or switching an acre to just grass, choose the first acre on the list.

What CAN you do? 

• Use any of the experimental functions. If they don’t work, they won’t corrupt your game; they just won’t do anything • Replace the side beach with land/a wall • Get rid of the river (but you MUST have the waterfall pieces of river) • Have river not connected to a waterfall • Have multiple of the same villager • Move the train station, bulletin board, town tree, recycling shop, town hall, and any houses/buildings/PWPs • Place PWPs in the water and on the beach (I don’t recommend moving any other buildings in the water or on the beach, though)

What CAN’T (or SHOULDN’T) you do? 

• Move the entrance acre to the shopping district or change any of those top acres • Switch the side your campground is on • Get rid of the south beach

Python:

Introduction to Variables

User Input and Selection

An Introduction to While Loops

Putting it Together

Introduction to Lists

Website:

Into to HTML

Binary:

Decimal to Binary and Vice Versa

Basic Logic Gates

Hacking:

Securing Kali Against Hacking

Finding Open Ports With Nmap

Finding Exploits

Hacking Metasploitable

Staying Safe Online:

Spotting Phishing Attacks

HTTP vs HTTPS

Good Password Etiquette

Proxies and VPNs

MultiFactor Authentication

Virtual Machines:

Kali for VMWare

Kali for VirtualBox

Creating a Live USB

Linux:

Directory Traversal and File Creation/Deletion

Basic Networking Commands

Remote Access

Finding Files

Blue Team:

Static Malware Analysis 101

General Programming:

So, you’ve set up a Kali VM, you’ve used nmap to find open ports, now what? Well now you need to find a vulnerability you want to exploit. There are many ways to find exploits, so I will go over some.

The first method of finding exploits is with the terminal command ‘searchsploit’. After finding the software we want to exploit, we use ‘searchsploit [name of software]’

In this example from my nmap guide, I searched for exploits in a variety of software running on metasploitable. You could run these exploits from here or by adding it to metasploit, but that can wait till later. Right now we are just finding exploits.

Speaking of metasploit, you can use it to find exploits much like you used searchsploit. Metasploit is started with the command ‘msfconsole’.

Metasploit starts with an ASCII art banner, and a ‘msf5′ prompt. We can search for exploits with the ‘search’ command followed by the name of the software we want to find an exploit for. Searching for vsftpd 2.3.4 again outputs the following:

So out of these 5 exploits shown only number 3 is relevant to us. Metasploit shows us more information than searchsploit. Here we can see when the exploit was disclosed (made public), it’s rank, whether or not it is checked, and a description of it, however right now we are just looking at whether or not it is the right version.

There are also websites you can use to find exploits. The one I personally use the most is the Exploit Database, or exploit-db for short so this is the one I will use in this guide. There are lots of them so if you can’t find any exploits on one site, it may be worth looking on others.

On the home page we can see a list of relevant exploits, the sidebar gives more resources, and there is a search bar in the top right corner.

Searching for vsftpd again gives less results than metasploit. We get more information by clicking on the exploit.

This gives us the most information than the others. We can see the author of the exploit, the type (remote or local), the platform, and at the bottom is the source code of the exploit if you can code and want to learn how it works in better detail. You can also download the exploit, however we don’t meed to because we have seen that we already have it installed on our box.

Recently I was doing some research into a pentesting technique and I stumbled across a blog supposedly containing a tutorial for the particular tool I was looking into. As I read through this "guide" it started to become clear that it was completely generated via an LLM such as ChatGPT - it had the stilted writing style distinctive of "AI" generated text. What's worse is that even the "screenshots" that the piece featured were generated with an "AI" - something like DALLE or whatever it's called. You'll understand immediately why I could recognise this was generated if you've ever seen one of these image generators try to write text, as it can't actually write text well. The screenshots were garbled. They were total gibberish!

(In my shock I forgot to take a screenshot or even take a copy of the site URL, so you will have to use your imagination as to how the so-called "tutorial" in the previous paragraph looked)

The entire "guide" was useless. None of the text was insightful enough to be of any use, and the images were of nothing.

This made me want to make something clear: none of my tutorials have been, or ever will be, generated by an LLM. None of the images I use have been generated by an image model. My original intention when creating this blog was to strengthen the skills I'm learning by writing about it. I carry out the techniques I teach and any screenshots are taken by me during this process. Truth be told I hardly even use autocorrect while writing (I do try to proofread and correct any errors but I'm sure some slip through - sorry!)

Someone somewhere said this more succinctly than me so to paraphrase:

"Why should I take the time to read this, if someone hasn't taken the time to write it?"

I may one day write some tutorials on hacking LLMs and jailbreaking them, but the actually body of my work is still written by me. Otherwise I don't see the point in writing this. My writing skill isn't the best but I do what I do because I enjoy it and it helps me learn as it hopefully helps you too.