No Stupid Questions

Even though programming is also known as hacking, I'm going to assume you're using hacker to mean red teaming in general, i.e. offensive cyber security, as that's what most people have in mind when they think of "hackers".

We're about to enter a golden age for that profession, the reason is LLMs, AI, vibe-coding, etc. See, a long time ago things were very insecure, no one was worried about security as it was all just so new, that was the era when you could sniff on network traffic very easily, crack your neighbor password in a few minutes or login to most things using admin/admin. Over time people started to realize that security mattered, that there were enough malicious people out there that you had to at least make some effort to secure things. This brought us to today, where things are fairly secure, your router has a preconfigured long random password and uses at least WPA for security, most companies no longer store passwords in their databases so it diminishes the risk of leaks, etc, etc. A lot of thought is put into security by serious companies, but there were some cracks starting to show because small devs wouldn't take security as seriously, be it for lack of resources or care, so while large stuff would be safe, smaller apps and sites are still very vulnerable, and people being people they use the same password for both and don't enable 2fa, so once you grab credentials somewhere you can try the in other places.

What changed now? Well, recently people started to vibe-code, i.e. give prompts to an LLM to generate some code. The problem with that is that in the database of things an LLM is trained in it might have lots of bad examples, be it because the code was insecure, or because it was exactly an example of insecure code. Asking the LLM to make it secure is not going to work, as it lacks the comprehension to understand what security is. It's possible to make things better in an iterative process where you feed the output code to itself and ask it to check for security vulnerabilities, but it might introduce new ones while fixing the existing ones, because the majority of examples online are incomplete as they're meant to be small examples of small parts of a system to showcase how to do that in a secure manner (but they leave other parts insecure as that's not the purpose of the example). For example, a login example code might use a simple text comparison for the password field, because it's trying to show you the structure of the API, not the content, and assumes you will know now to do that, but an LLM doesn't know that.

And with many people vibe-coding apps and sites it'll become more and more easy to find those serious security holes in the wild.

And how to learn it? Well, the short version is doing. You don't need to buy expensive books, or anything of the sort, just start reading online, and poke around stuff. I used to play around with https://www.hackthebox.com/ and found that very interesting way to learn, however you might need to read on some stuff first before you're capable of logging in there (although I just gave it a quick look and I think they removed the most interesting part about it which was you had to hack the website to create an account).