learn to HACK (the best way) // ft. John Hammond

Hacking is best learned as a hands-on discipline—especially through capture-the-flag (CTF) competitions—then reinforced with practical Linux and scripting skills, rather than through buzzword-heavy theory. John Hammond, a security researcher at Huntress and a long-time CTF and penetration-testing educator, framed hacking as something that gets harder over time but becomes manageable when learners keep their curiosity alive and practice in real environments.

Hammond’s core learning path starts with getting comfortable at the keyboard: explore, tinker, and “get in the weeds” by writing code and probing real vulnerabilities. He recommends beginning with Linux fundamentals and command-line navigation, pointing learners to OverTheWire’s war games as a structured way to build those basics. From there, he pushes learners toward a scripting language—Python as a common “hacker’s language” due to readability and extensive libraries—then into CTFs as the fastest route to practical experience.

CTFs aren’t treated as “toy hacking.” Hammond argues they closely mirror real-world techniques because they expose competitors to the same kinds of vulnerabilities, exploitation patterns, and sometimes even zero-day-like surprises. For finding competitions and events, he highlights ctftime.org and encourages learners to play online when in-person options are limited. He also praises TryHackMe for being beginner-friendly, including guided hints and write-ups when learners get stuck for too long.

A key theme was how much programming is actually required. Hammond said learners don’t need to become full software architects, but they do need programming logic: understanding variables, functions, and control flow well enough to reason about how inputs change outcomes. He used blind SQL injection as an example of where logic and scripting matter—when an application doesn’t return full results, code can automate inference character-by-character by interpreting true/false responses.

On certifications, Hammond emphasized that practical, hands-on exams tend to validate skills better than rote multiple-choice tests. He described his own progression: Security+ as a high-level requirement for DoD contracting, then OSCP as the “crown jewel” offensive-security rite of passage, followed by additional offensive-focused training such as OSWE and eLearnSecurity options (including EJPT and later OSCE/OSCE3-style material). He also warned against becoming a “script kiddie,” arguing that tool use is fine only when paired with understanding and adaptation—reading code, tweaking it for the environment, and building intuition about why an exploit works.

The conversation also pivoted to the SolarWinds Orion supply-chain compromise, using it as a real-time example of why defensive hygiene and deep analysis still matter. Hammond described how attackers used a seemingly legitimate Orion update containing a malicious backdoor DLL, blending into normal network activity and leveraging operational security. He noted that at least initially, detection could fail even across major scanning engines—illustrating how signature-based defenses can miss novel payloads—before more engines began flagging it.

Finally, Hammond connected the dots between learning, careers, and the modern security landscape: DevOps and CI/CD increase deployment speed but also expand the surface area for mistakes, while automation can reduce some manual work yet can’t eliminate the need for human judgment due to false negatives. His advice to beginners was blunt but encouraging: keep trying, expect failure, and switch from “try harder” to “try again,” using persistence and curiosity as the real differentiators.