What is hacking?

The word has two meanings. In everyday news, a hacker is someone who breaks into systems. In programming culture, a hack is a clever or unusual way to make something work, and a hacker is someone who enjoys that kind of problem solving. This page is mostly about the first meaning, and how the skills behind it are used to defend systems.

Types of hackers

How hackers get in

Most attacks use a few well-known routes, and many target people rather than technology.

• Phishing and social engineering: tricking someone into giving away a password, opening a malicious file or sending money. See our guide to spear phishing.
• Stolen and weak passwords: passwords leaked from one site are tried on others (credential stuffing), and short passwords can be guessed.
• Unpatched software: attackers use known flaws in software that hasn't been updated.
• Web application flaws: mistakes in a website's code, such as SQL injection or cross-site scripting, let attackers read or change data.
• Malware: harmful software, such as ransomware, which locks files until a payment is made.
• Misconfiguration: a database left open to the internet, or default admin passwords never changed.

Worked example: why password length matters

Suppose an attacker has stolen a database of weakly protected passwords and can test 10 billion guesses a second, which a powerful cracking computer can manage against a fast hash. How long does it take to try every possible password?

Each extra character multiplies the work, so length beats cleverness. A long, unique password for every site, kept in a password manager, plus multi-factor authentication, defeats most password attacks.

Is hacking illegal?

Accessing a computer system without permission is illegal in most countries, even if you don't steal or damage anything. In the UK, the Computer Misuse Act 1990 makes unauthorised access a criminal offence, with tougher penalties for doing it to commit further crimes or to damage systems. In the US, the Computer Fraud and Abuse Act covers similar ground.

Curiosity is not a defence. Testing a school's website, guessing a friend's password or scanning a company's network "to help" can all be crimes. The line is permission: get it in writing before you test anything you don't own.

Try deciding which situations are allowed, then press Mark to check it in our Hack a Website course.

What is ethical hacking?

Ethical hacking is authorised hacking to improve security. Organisations hire ethical hackers, or invite them through bug bounty programmes, to attack their own systems the way a criminal would, then report every weakness so it can be fixed.

• Penetration testing: a planned, agreed test of particular systems, with a written scope saying what may be tested, when and how. The UK NCSC describes it as a way to gain assurance in an organisation's security by trying to breach some or all of it using the same tools and techniques an attacker might.
• Bug bounties: companies publish rules saying which systems may be tested, and pay people who report real vulnerabilities.
• Responsible disclosure: if you find a flaw by accident, report it privately to the owner and give them time to fix it before telling anyone else.
• Red teaming: a longer exercise that tests how well an organisation detects and responds to a realistic attack, people and processes included.

How to learn ethical hacking

Ethical hacking is a real career, and you can start for free. Learn the foundations, then practise only on systems built for practice.

1. Networking: how IP addresses, ports, TCP and DNS work. Our guides to IP addresses and TCP are a good start.
2. Linux and the command line: most security tools run there.
3. Programming: Python for writing tools, plus enough HTML, JavaScript and SQL to understand web apps.
4. How the web works: requests, cookies, sessions and the common web flaws in the OWASP Top 10.
5. Practise legally: deliberately vulnerable apps such as OWASP Juice Shop, free capture-the-flag competitions such as Carnegie Mellon's picoCTF, and online training labs.
6. Write up what you learn and, later, consider recognised certifications.

Our Hack a Website course walks you through real attacks such as SQL injection and cross-site scripting on a practice site, then shows how to fix each one. Our Social Engineering course covers the human side.

How to protect yourself from hackers

• Update everything: phones, computers, apps and routers. Updates fix the flaws attackers use.
• Use long, unique passwords in a password manager, and turn on multi-factor authentication, ideally passkeys.
• Be suspicious of unexpected messages, especially ones that create urgency or ask for passwords, money or codes.
• Back up important files so ransomware can't hold them hostage.
• Lock down accounts: check privacy settings, remove old apps and devices, and change default passwords on smart devices.

These are the same basics CISA, the US cyber security agency, promotes for everyone.

Common mistakes

• Thinking "I didn't break anything" makes it legal. Unauthorised access is itself a crime.
• Thinking hacking is all about clever code. Many breaches start with a phishing email or a reused password.
• Practising on real sites. Use labs and capture-the-flag challenges made for it.
• Assuming you're not a target. Most attacks are automated and hit anyone with a weak password or old software.
• Believing films. Real hacking is slow, methodical and mostly about research and patience.

Read next

Computer Science · CoursesEthical hacking course: web security for beginnersAn ethical hacking course on web security: the law and ethics, how common website weaknesses work, and how developers defend against them, in 26 sections.