how to actually start in security (hint: not by downloading 40 tools)

I get the same DM twice a week: "how do I get into hacking". so here is the answer once, properly, and I will just link this from now on.

the mistake everyone makes is starting with tools. they install kali, run thirty programs they cannot read the output of, and give up in a month. you do not need kali to start. you need to understand how the web works, and then practise on things that are built to be broken.

step 1: learn http before anything

open your browser dev tools, network tab, and actually read the requests when you log in somewhere you own. methods, headers, cookies, status codes. a tool like Burp or mitmproxy just shows you the same thing more clearly. if you do not know what a 302 or a Set-Cookie does, no tool will save you.

step 2: picoCTF

picoCTF is free, legal, made for beginners, and the challenges stay up all year. start with the "general skills" and "web" tracks. you will be stuck. being stuck and then unstuck is the entire skill, that feeling is the job.

here is John Hammond walking a complete beginner through the classic picoCTF "Obedient Cat" so you see the mindset, not just the answer:

step 3: one vuln class at a time

do not try to learn "hacking". learn SQL injection this month, how it works, why parameterised queries kill it. then XSS. then access control (IDOR, the one that actually pays). understanding the fix teaches you the bug better than any payload list.

the one rule

only ever test things you own or that explicitly invite it: picoCTF, TryHackMe, HackTheBox, your own VM, a bug bounty program with a scope you have read. "can you teach me to get into my girlfriend's instagram" gets you blocked, not mentored. this is not negotiable and it is also just the law.

that is it. http, picoCTF, one bug class at a time, your own machines. message me when you get your first flag, I actually like those messages.