Websites are basically just a program on a different computer somewhere. Think of it like passing notes back and forth.
User sends a note using their computer requesting the website content, that note gets passed to someone elses computer. That computer looks at the note and sends back a different note with some different information on it i.e. the website content. Then they keep sending notes back and forth as the user takes actions. The main two categories of “taking over a website” is to either catch the notes while they are being passed and change what it says (MITM attack) or to convince the other computer to send different notes to begin with.
But of course, the owners of the website have layers and layers and layers of protection to make it really hard to ‘convince’ their computer to do something unless you have all their special keys/passwords. That’s why you need to find some defect that lets you in anyways, or somehow get their keys/passwords.
Nah, it isn’t that simple. You need a deep, fundamental understanding of computing to do it yourself. The clankers can do it now for you pretty easily if you know how to whisper to them in the right way. That’s a lower barrier to entry and at that point, knowing just the nomenclature from the cybersecurity sphere in addition to having a solid software engineering understanding, it is enough. Lots of the proofs-of-concept for the PHP vulnerability assumed insecure defaults, for example. This is the clanker cheating and the humans not really being experts enough to recognize that.
Hacking any software is first finding a condition in how the software is written that allows you to subvert an expectation. This can be as simple as providing a buffer and lying about how big that buffer is. It could allow you to read or write arbitrary data somewhere the original developer never expected. That data can be instructions that give the attacker full control. I am giving you a little bit of “the rest of the fucking owl” here because it gets pretty technical.
As for taking credit, this is why they come up with groups with names or they pick pseudonyms. They are seeking status among their own peer group mostly. It is enough to get their name dropped on the news somewhere. Reputation, clout, all the things boring humans desire.
I’m gonna dumb this down for people like me: if a user does unexpected things in a program, sometimes it can abuse the program so that it allows the user to do what it shouldn’t.
Most software nowadays is incredibly attuned to this so there’s truckloads of things that have already been brushed over in a software but software always has remaining holes in it.
When you develop a software, you have to make it work in the right way, and then you have to stop it from crashing when used in the wrong way. But if you “hack” some software, you only need to find out how to use it the wrong way. That’s why software development and red teaming are very very different fields. Though generally cybersecurity (at least in my eyes) is considered one of the most difficult fields in computer science because of the broad base knowledge required.
