Even though programming is also known as hacking, I’m going to assume you’re using hacker to mean red teaming in general, i.e. offensive cyber security, as that’s what most people have in mind when they think of “hackers”.

We’re about to enter a golden age for that profession, the reason is LLMs, AI, vibe-coding, etc. See, a long time ago things were very insecure, no one was worried about security as it was all just so new, that was the era when you could sniff on network traffic very easily, crack your neighbor password in a few minutes or login to most things using admin/admin. Over time people started to realize that security mattered, that there were enough malicious people out there that you had to at least make some effort to secure things. This brought us to today, where things are fairly secure, your router has a preconfigured long random password and uses at least WPA for security, most companies no longer store passwords in their databases so it diminishes the risk of leaks, etc, etc. A lot of thought is put into security by serious companies, but there were some cracks starting to show because small devs wouldn’t take security as seriously, be it for lack of resources or care, so while large stuff would be safe, smaller apps and sites are still very vulnerable, and people being people they use the same password for both and don’t enable 2fa, so once you grab credentials somewhere you can try the in other places.

What changed now? Well, recently people started to vibe-code, i.e. give prompts to an LLM to generate some code. The problem with that is that in the database of things an LLM is trained in it might have lots of bad examples, be it because the code was insecure, or because it was exactly an example of insecure code. Asking the LLM to make it secure is not going to work, as it lacks the comprehension to understand what security is. It’s possible to make things better in an iterative process where you feed the output code to itself and ask it to check for security vulnerabilities, but it might introduce new ones while fixing the existing ones, because the majority of examples online are incomplete as they’re meant to be small examples of small parts of a system to showcase how to do that in a secure manner (but they leave other parts insecure as that’s not the purpose of the example). For example, a login example code might use a simple text comparison for the password field, because it’s trying to show you the structure of the API, not the content, and assumes you will know now to do that, but an LLM doesn’t know that.

And with many people vibe-coding apps and sites it’ll become more and more easy to find those serious security holes in the wild.

And how to learn it? Well, the short version is doing. You don’t need to buy expensive books, or anything of the sort, just start reading online, and poke around stuff. I used to play around with https://www.hackthebox.com/ and found that very interesting way to learn, however you might need to read on some stuff first before you’re capable of logging in there (although I just gave it a quick look and I think they removed the most interesting part about it which was you had to hack the website to create an account).

Man, what books are your cousin looking for for hacking that are 3k? There are tons of programming resources and tools available for free

For example Ghidra is FOSS and readily available (https://github.com/nationalsecurityagency/ghidra)

Same deal with something like Kali (https://www.kali.org/docs/) just the process of bringing a Kali install up and dorking around can be hugely educational

I’d argue that information has never been more available

I’m confused about what’s being asked here.

Are you asking how to become tech savvy on the cheap, how to become a maker/modder, how to get into computer reverse engineering, or how to crack other people’s stuff?

The answer to all of those I guess is: practice taking stuff apart and putting it back together. Start small and work your way up. Learn techniques that work for you, ask others when you need help.

Once you’re comfortable with that, start taking stuff apart, changing it slightly, and putting it back together. Over time, expand on the modifications. Document everything and build up a toolkit. Eventually, you’ll be able to analyze a situation and know where to look to tweak something to make things work the way you want.

All of that takes time and patience, and often things break or don’t work as well as they did when you started. Growing from that is the important bit.

Expensive books? Not necessary until you’re looking for very specific information that’s a trade secret. At that point you can evaluate whether they’re worth the cost for the result.

It’s a curve. At one point you could hack the global phone network with a plastic whistle. At some point running scripts other people wrote was looked down upon.

I predict that William Gibson is going to be proven more prophetic by the day.