Learning to hack for kids!

[AtariJaguar]

BLUF / TL;DR:  For the 8-10 year old range, what is the best way to teach a kid about / how to hack? Any video series? Online subscription? A "kids-KALI," anything?

 

LONG ASS STORY NO ONE WANTS TO READ: Hey guys, thought I'd put this out there. My child has the unfortunate circumstance of being an offspring of mine. I'm trying to prepare her "technically" as much as I can, in any way that I can. I got her a computer when she could barely talk. She started on Windows XP, and got her started in Gamestar Mechanic about 3 years ago at the age of 6. At 8, I got her into "Scratch," which is also an online game design program. For the past Summer, she's been using Code Monkey (which is pretty excellent for teaching programming basics), and I bought her a separate computer which she installed Ubuntu on, and she uses that for doing most internet things, and using her Windows 10 machine for things like Scratch. She's pretty sharp, and has picked up a lot. But I'm wondering how I can involve her in learning hacking concepts? I've done some things with her as time permits, but I would love to know if there's any kind of formal training program... like Code Monkey for software development? Bonus question (bonus for me), any good learning programs / routines to teach kids how to use Linux? Like with Windows 10, she can do a lot... but doesn't even know what PowerShell or DOS is... and I'd like for her to learn BASH and such in Linux too. Thanks!!! 

[Dave-ee Jones]

That's pretty cool. Having being brought up in a techy-fam I can appreciate it.

The answer to your question depends on what you want them to learn. For example, if they're more interested in programming (Scratch being the beginner-side) then you could teach them neat little scripts using specific programming languages. A more specific example might be a network-scanning Javascript script. Or you could teach them about how people abuse their use in certain areas (memory-leaking to crash a computer, abusing the "Notepad Loop" in batch/cmd).

Keep in mind that "hacks" are..realised?..from learning something. So if you learn enough about networks you can know what they're restricted to and what they can't do, and you can work out ways around certain things to do something that another person wouldn't think possible.

You could teach them workarounds for Windows security, like the classic sticky-keys method to get an elevated command prompt as well. Linux is probably the funnest to work with, though.

I would recommend teaching her how to make a website, though. For me it's surprisingly useful and teaches you a fair bit about multiple languages at once (CSS, HTML, JS, and if you go deeper potentially C++, PHP etc.), and the difference between server-side and client-side script.

Keep in mind that if she's not brought up to respect other people's belongings she may abuse this privilege. (I'm not questioning your parenting here, just giving a fore-warning). I know that's one of the things that restricted my learning from my own parents. What you teach them is your responsibility, and while their responsibility is not abusing that privilege it still has potential to cause damage.

She sounds like a very bright child though ? And with that much of a headstart, too!

Yes, I read the story. ?

Edited August 21, 2018 by Dave-ee Jones

[AtariJaguar]

21 hours ago, Dave-ee Jones said:

That's pretty cool. Having being brought up in a techy-fam I can appreciate it.

The answer to your question depends on what you want them to learn. For example, if they're more interested in programming (Scratch being the beginner-side) then you could teach them neat little scripts using specific programming languages. A more specific example might be a network-scanning Javascript script. Or you could teach them about how people abuse their use in certain areas (memory-leaking to crash a computer, abusing the "Notepad Loop" in batch/cmd).

Keep in mind that "hacks" are..realised?..from learning something. So if you learn enough about networks you can know what they're restricted to and what they can't do, and you can work out ways around certain things to do something that another person wouldn't think possible.

You could teach them workarounds for Windows security, like the classic sticky-keys method to get an elevated command prompt as well. Linux is probably the funnest to work with, though.

I would recommend teaching her how to make a website, though. For me it's surprisingly useful and teaches you a fair bit about multiple languages at once (CSS, HTML, JS, and if you go deeper potentially C++, PHP etc.), and the difference between server-side and client-side script.

Keep in mind that if she's not brought up to respect other people's belongings she may abuse this privilege. (I'm not questioning your parenting here, just giving a fore-warning). I know that's one of the things that restricted my learning from my own parents. What you teach them is your responsibility, and while their responsibility is not abusing that privilege it still has potential to cause damage.

She sounds like a very bright child though ? And with that much of a headstart, too!

Yes, I read the story. ?

 

 

Thanks Davee! I appreciate the comments. I started off as a programmer, but got into Cyber Security from a defensive standpoint. As a programmer, I got head-on into writing programs to pull back Windows forensics artifacts, without any concept on whether they would be useful or not. I'm not sure if this is right, but having done this for almost a decade now, I'm thinking the best way to learn defense, is to learn offense first. I didn't always agree with that. But it seems to make sense.

 

In defending a network, you are looking for the adversary. But how can you defend against an adversary if you don't know what an adversary does? In being an adversary first, you know the process. I mean, I could flip this, but I still think you learn "what to look for" from a defensive standpoint, having done it offensively.

Me personally, I find defense to be far more exciting and entertaining than offense.... that's just me. I will Blue Team all day long rather than Red Team. But I'm in the minority there, as everyone else would rather Red Team. Since it's fun for people, it's easier to learn... and like you said, learning the fundamentals is easier when you're having fun. 

 

I thought I might start her off with some basic wireless stuff... understand the purpose of encryption. I think you're right about web development too... she's actually mentioned that. Do you know of any kid-friendly web development sites? Is there like a "GeoCities" for kids or something?

Quick question... and I think I may have asked this a few years ago. Is there anywhere that I can maybe get a list of what's legal and what's not in terms of hacking/pentesting? I'd say "common sense," but it seems there's a lot of grey area. It also seems to change day by day? I'd like if there were some laws/guidelines that were laid out simply on "does and don'ts?"

 

Yeah, she'll respect others property. She's the only kid her age I know that carefully opens the door to the car so she doesn't ding the car next to her when she gets out.

 

 

Thanks for your response!!!

[Bigbiz]

Try coding programs for females. Too!

[Dave-ee Jones]

54 minutes ago, AtariJaguar said:

In defending a network, you are looking for the adversary. But how can you defend against an adversary if you don't know what an adversary does? In being an adversary first, you know the process. I mean, I could flip this, but I still think you learn "what to look for" from a defensive standpoint, having done it offensively.

Yeah, that makes sense.

55 minutes ago, AtariJaguar said:

I thought I might start her off with some basic wireless stuff... understand the purpose of encryption. I think you're right about web development too... she's actually mentioned that. Do you know of any kid-friendly web development sites? Is there like a "GeoCities" for kids or something?

Yeah you could make a test environment with an old AP that isn't configured to encrypt data and show her how to see traffic and identify what kind of traffic it is. Obviously, that can get quite in-depth as you need to know different kinds of traffic and how to read (sometimes) at the bit-level.

But yeah, that's definitely an option.

In terms of web development sites, I usually use w3schools for quick Googles. They have exercises and quizzes as well which could be useful.

59 minutes ago, AtariJaguar said:

Quick question... and I think I may have asked this a few years ago. Is there anywhere that I can maybe get a list of what's legal and what's not in terms of hacking/pentesting? I'd say "common sense," but it seems there's a lot of grey area. It also seems to change day by day? I'd like if there were some laws/guidelines that were laid out simply on "does and don'ts?"

Not sure about that one. But I would say whatever you hack into make sure it's not someone else's - unless they give permission, of course.

1 hour ago, AtariJaguar said:

Yeah, she'll respect others property. She's the only kid her age I know that carefully opens the door to the car so she doesn't ding the car next to her when she gets out.

Good parenting ?

[AtariJaguar]

13 hours ago, Dave-ee Jones said:

Yeah, that makes sense.

Yeah you could make a test environment with an old AP that isn't configured to encrypt data and show her how to see traffic and identify what kind of traffic it is. Obviously, that can get quite in-depth as you need to know different kinds of traffic and how to read (sometimes) at the bit-level.

But yeah, that's definitely an option.

In terms of web development sites, I usually use w3schools for quick Googles. They have exercises and quizzes as well which could be useful.

Not sure about that one. But I would say whatever you hack into make sure it's not someone else's - unless they give permission, of course.

Good parenting ?

 

Thanks, gotta remember though that she's 9. W3SCHOOLs is really for someone who's much older... maybe a teenager, that has the patience and attention span. That's why I was hoping maybe there's something we can subscribe to. If I find something, I'll post it back here.

 

Bigbiz! Are you talking about this? https://girlswhocode.com

Just checking it out now... that looks pretty awesome!

[AtariJaguar]

Someone posted this in another thread, and thought I'd post it here too... looks like an awesome option also.

http://overthewire.org/wargames/bandit/bandit0.html

 

[Dave-ee Jones]

On 8/22/2018 at 10:44 PM, AtariJaguar said:

Thanks, gotta remember though that she's 9. W3SCHOOLs is really for someone who's much older... maybe a teenager, that has the patience and attention span. That's why I was hoping maybe there's something we can subscribe to.

Fair enough. I've found most are like that. Having a quick Google there was one with the name that went something like "Learning HTML for kids" and it was just a wall of text for eons down the page...Not quite what you'd want.