I think one of the best ways to become a competent black-hat hacker/pen-tester would be to know the white-hat techniques inside out. To become knowledgeable about a system's security (including vulnerabilities) would allow you to identify and exploit vectors a lot more efficiently. In fact, it's probably pretty critical.

If you were to look at MOST of the questions on security.SE you could interpret them as belonging to some black-hat origin. Take mine for example: Testing a black-box for sound authentication session config I've asked how I can interrogate a session which could then lead me to exploiting a poorly designed authentication system.

For the record, this is purely for ethical pen-testing reasons, but what if it isn't? Is it up to the user of security.SE to judge this if there were a more blatant attempt at learning for the wrong reasons? Or is that not our responsibility here?

1 Answer 1


No. We have various posts here on meta regarding White Hat / Black Hat, and whether or not we should make a judgement, and the consensus was overwhelmingly no, as any question of benefit to a Black Hat will also be of benefit to a White Hat and vice versa. This is pretty much the case for almost all concepts and activities of interest to the ethical or unethical hacker.

In actual fact, all the Black Hat questions I have been aware of have actually been closed due to low quality (they have been script kiddy level questions, so not useful in any case) and some that were marginal have been reworded to focus more on protection.

  • 4
    And don't forget the malware author who weighed in with an answer. Useful info is useful info.
    – schroeder Mod
    Commented Nov 2, 2016 at 17:41

You must log in to answer this question.