MIRROR: fb6a5d5a3eb6aacd.onion/zero-day
Zero Day · cybersecurity, for the curious
Everyone thinks the dark web is full of hackers. Mostly it is full of people who got hacked.
This is the other half of why people go looking. Not to break in, but to understand how it is done. Everything here is real, legal, and slightly embarrassing for the companies involved.
The one rule
Breaking into systems you do not own or have written permission to test is a crime in almost every country, including under the U.S. Computer Fraud and Abuse Act. Everything on this page is for defense, education, and legal practice. The Archive does not help with the other kind. It just tells you stories about the people who tried.
Hall of infamySix hacks that changed everything.
Phone phreaking
Captain Crunch and the 2600 hertz whistle
A toy whistle from a cereal box played the exact tone AT&T's long-distance network used to signal a free line. Phreakers used it to make free calls around the world. Hacking began as a prank on the phone company.1
The first internet worm
The Morris Worm
A graduate student's experiment copied itself out of control and knocked roughly a tenth of the internet offline. He became the first person convicted under the Computer Fraud and Abuse Act. He later became an MIT professor.2
Social engineering
Kevin Mitnick, the most wanted hacker in America
Mitnick's real weapon was the telephone. He talked employees into handing over passwords. Arrested in 1995, he served five years, then spent the rest of his life teaching companies how he did it.3
The first digital weapon
Stuxnet
A worm built to physically destroy uranium centrifuges in Iran by quietly changing how fast they spun, while showing operators that everything was normal. Widely attributed to the United States and Israel. Neither has officially confirmed it.4
Ransomware, worldwide
WannaCry
In one weekend, ransomware hit more than 200,000 computers in 150 countries, including Britain's National Health Service. It spread using EternalBlue, an exploit developed by the NSA and leaked by a group called the Shadow Brokers.5
Ransomware meets gasoline
Colonial Pipeline
One compromised password shut down the largest fuel pipeline in the U.S. East Coast. The company paid about $4.4 million in bitcoin. The Justice Department later clawed back about $2.3 million of it.6
How they actually get inNot like the movies. Worse. More boring.
Phishing
A message that looks real, sent to a lot of people, hoping one clicks. It works because it only has to work once.
DefenseNever log in from a link in a message. Open the app or type the address yourself.
Password reuse
One site gets breached. Attackers try that email and password everywhere else. They call it credential stuffing. It is boring and it works constantly.
DefenseA password manager. One unique password per site. You only remember one.
Social engineering
Calling the help desk pretending to be you. Pretending to be your boss. Pretending to be the help desk. Humans are the easiest system to hack.
DefenseVerify through a second channel. Call back on a number you already have.
SIM swapping
Convincing your phone carrier to move your number to their SIM card, so your text message codes go to them.
DefenseAsk your carrier for a port-out PIN. Prefer an authenticator app or passkey over text codes.
Old software
Most attacks use holes that were already fixed. The victim just never installed the fix.
DefenseTurn on automatic updates. Yes, even that one.
InteractiveHow long would your password survive?
Do not type your real password. We are a dark web themed website. Have some standards. Type something similar instead; nothing leaves this page.
Waiting for something to judge.
Rough estimate based on length, character types, and a short list of famously bad passwords. Real attackers use smarter dictionaries. Assume it is worse.
InteractiveSpot the phish.
Six messages, and some of them are scams. Decide on each one. No pressure. (There is a little pressure.)
GlobeBank Alert: Unusual sign-in detected. Verify within 24 hours or your account will be suspended: globebank-secure-verify.co/login
Urgency plus a lookalike address. GlobeBank's real site would not be globebank-secure-verify.co. Banks do not threaten you by text.
ParcelPost: Your package could not be delivered. Pay a $1.99 redelivery fee: parcelpost.delivery-fee.top
Tiny fee, weird domain. The fee is not the goal. Your card number is.
Hi, it's Dana (CEO). In a meeting, can't talk. Need you to buy five $100 gift cards for a client and send me the codes. Thanks!!
Gift cards are the currency of scammers because they cannot be reversed. No CEO has ever needed this.
Your monthly statement is ready. Open the app you normally use to view it. We will never ask for your password by email or text.
No link, no urgency, tells you to use your own app. This is what legitimate messages look like. Boring.
WARNING! SystemShield detected 5 viruses on your computer. Call Certified Support NOW at 1-888-555-0199 to avoid data loss.
Tech support scam. Real security software does not ask you to call a phone number. Close the tab.
Your login code is 482913. Don't share this code with anyone. We will never call to ask for it.
Legitimate, if you just tried to log in. If you did not, someone has your password. Change it now.
The 10-minute lockdownDo these and you are harder to hack than most people you know.
0 of 8
Your checkmarks are saved only in this browser.
Learn it legallyWhere curious people become professionals.
Practice, legally
TryHackMe
Browser-based hacking labs for beginners. Break things you are allowed to break.
Open ↗Practice, legally
Hack The Box
Harder machines and real-world style challenges. Where hobbyists become professionals.
Open ↗Practice, legally
OverTheWire Wargames
Free command-line puzzles. Start with Bandit. You will learn more Linux than in any class.
Open ↗Practice, legally
picoCTF
Carnegie Mellon University
A free capture-the-flag competition designed for students. Cryptography, forensics, web.
Open ↗Learn the web
PortSwigger Web Security Academy
Free, deep training on how websites actually get broken.
Open ↗Learn the web
OWASP Top 10
Open Worldwide Application Security Project
The ten most critical web application security risks. Every developer should read it once.
Open ↗Stories
Darknet Diaries
Podcast by Jack Rhysider
True stories from the dark side of the internet, told by the people who were there.
Open ↗Stories
Krebs on Security
Brian Krebs
Investigative reporting on cybercrime. Several criminals have tried to frame him. It did not work.
Open ↗Defend
Have I Been Pwned
Troy Hunt
Check whether your email appears in known data breaches. It probably does. Everyone's does.
Open ↗Defend
Surveillance Self-Defense
Electronic Frontier Foundation
Plain-language guides to protecting yourself online, from the people who sue the government about it.
Open ↗Defend
Secure Our World
CISA
The U.S. government's own four-step basics. Short, boring, effective.
Open ↗Culture
DEF CON
Since 1993
The world's most famous hacker convention, held in Las Vegas every summer. Federal agents attend. There used to be a game called Spot the Fed.
Open ↗Sources
- 1John Draper, known as Captain Crunch, used a toy whistle that produced a 2600 Hz tone to control AT&T long-distance switching.Phil Lapsley, Exploding the Phone (Grove Press, 2013)
- 2The Morris Worm, released November 2, 1988, infected an estimated 6,000 machines, about 10 percent of the internet; Robert Tappan Morris was the first person convicted under the Computer Fraud and Abuse Act.FBI, “The Morris Worm: 30 Years Since First Major Attack on the Internet” (2018)
- 3Kevin Mitnick was arrested in February 1995 and served five years in prison; he relied heavily on social engineering. He died in 2023.Kevin Mitnick, Ghost in the Wires (Little, Brown, 2011)
- 4Stuxnet, discovered in 2010, damaged centrifuges at Iran's Natanz enrichment facility; it is widely attributed to the U.S. and Israel.Kim Zetter, Countdown to Zero Day (Crown, 2014)
- 5WannaCry (May 2017) infected more than 200,000 computers in about 150 countries, including NHS systems, using the EternalBlue exploit leaked by the Shadow Brokers.UK National Audit Office, “Investigation: WannaCry cyber attack and the NHS” (2017)
- 6Colonial Pipeline paid about $4.4 million in ransom in May 2021; the Justice Department recovered about $2.3 million.U.S. Department of Justice press release, June 7, 2021