- Hi! My name is Ben,
and this is a day in the life of an ethical hacker.
I have my cousin Sean here shadowing,
and we're gonna show you what it's like
to be an ethical hacker.
You ready for this?
- Let's do this!
- I've designed two puzzles for him to follow along.
One is gonna show him how easy it is
for hackers to guess passwords,
and the second one is gonna be based on one
of the most common vulnerabilities
that I find in websites.
Don't go anywhere, because later I'm gonna quiz him to see
if he's learned anything about what I do for a living.
- You ready to do this?
- Yeah.
- Alright.
Before we jump into me telling you what I do,
what do you think it is that I do for a living?
- Uh, don't you, like, hack into companies
and, like, steal stuff?
[record scratching]
- I don't steal stuff. I work as an ethical hacker.
So, instead of stealing things, what I'll do is
I find vulnerabilities in their assets or their products.
I report it to them, and we work with their permission
versus a cyber criminal.
Why don't I show you how it's done?
- Hi Adam, how's it going man?
- How's it going?
- So, I hack companies and then we talk about it,
and him and I designed the exact hack we did
into a puzzle, so other people could also learn.
- Alright, that's cool.
- It's based on a hack that I did
when I hacked into a prison system.
- Jeez, a prison system?
- Yeah, so it's part of it.
We get to hack a bunch of different things.
- How do you know where to go
and what places to hack, exactly?
- So, the hacking that I do,
the ethical hacking bit, is invited-only.
So people tell us, "Hey, this is our product.
Come and hack this product,
and in return,
we'll give you an award if you find something."
- Alright, so I'm 16.
So if I want to get into this,
how would I get into ethical hacking?
- You can go down the traditional way of going
to a school and doing a cybersecurity program,
but honestly, a lot of it is just hands-on learning
on your own.
I went to school and I didn't like the degree
that I was going in.
I did computer science,
and I met some people that were like,
"Hey, you can make money from hacking."
I watched a lot of these puzzles that other people created,
and I just dedicated a lot of time to learn it.
- Oh, that's pretty cool.
So what are the different types of hacking you can do?
- You can do what I did.
I really doubled down on being really good
at web hacking, or you can become a jack of all trades.
You can do mobile hacking, you can do hardware hacking,
you can do social engineering,
you can do network pen testing,
you can go get a job at a company, for example.
- So, you make a pretty good living
based on doing all this stuff.
- It's a good living,
but it's also not consistent, right?
There's months when I make a good amount of money,
and then there's months when I'm sitting at my house.
I'm like, I have nothing to do right now.
Or I find something else when I make content,
or I go teach.
- What's the most money you've made off one single company?
- Forty thousand, but it wasn't all just me.
It was me and two of my other friends.
We hacked a big tech company and the bounty total
was like 41,000 and we split it all
between the three of us.
And that was for eight hours of work.
- So, how do you hacking into companies benefit them?
- We essentially find vulnerabilities
that could prevent a breach, could prevent people
losing access to their stuff or even leaking
people's personal information, like their birthday,
like their address or Social Security number.
All that could cost you money,
and also these companies money if a breach happens.
So, if you're ready to look for jobs,
click the link down below and download the Indeed app.
So I just created a fake website, and what I'm gonna do
is I'm gonna have my cousin pick a password,
and I'm gonna show him based on information online,
social media, and some of the mistakes people make,
how easy it is for hackers to find their password.
- I'm gonna show you how easy it is
to get someone's passwords.
I'm gonna use this tool.
I'm gonna make a bunch of random passwords.
I'm just gonna copy all this and I'm going to pull it
into my tool right here and I'm gonna say,
"Hey, I want you to see
if you can find a successful password.
I'm willing to bet your password is this one."
- No way. Jeez, how did you do that?
- It's obviously not as easy as this,
but I've done this with some companies
when someone's password was just literally "password123."
So what I've done is I've set up a safe environment,
it's a fake website,
and I'm gonna show Sean one of the most easy
and also common bugs that I find on these websites.
And so a lot of times when you log into a website,
if you look at the top,
there's a bunch of information.
You probably ignore half of this stuff,
but I can't ignore it 'cause that's how,
you know, I find bugs.
But, you see sometimes there's numbers up here,
you go "account" and sometimes there's a number, right?
But sometimes, incrementing that number,
it could show me someone else's account.
So, it's just as easy as changing that number.
It shows me this account number, and right here I could see
it has this much money in net.
This is the account number.
Next one, same thing, this much,
and this much. And then, next one.
And I go to the company and say,
"Hey, if I change this number right here,
it shows me another company's information."
It's crazy how you can hack and do these things so easily,
and you can't beat me in a single video game.
[record scratching] [Ben laughing]
[thunder rumbling]
- So based on today, what do you think I actually do?
- You go into companies and look at problems
in their systems and get paid for it,
so nothing bad happens [bell dinging]
to other people that use their websites.
- What is the difference between an ethical hacker
and a cyber criminal?
- A cyber criminal is trying to inflict
as much damage as possible.
Ethical hackers try to prevent it.
[bell dinging]
- What is one of the mistakes you learned that people make,
and that could become an issue
with people who are getting hacked?
- Their passwords are too personal to them,
so people can easily find - make a guess -
based off social media and other websites.
[bell dinging]
- What do you think some of the skills are
to become an ethical hacker?
- Having knowledge of computers and what's going on
in the background, so just looking at a basic website,
and also just having the curiosity and passion for it.
[bell dinging]
- How much money do you know ethical hackers can make?
- As little as one hundred per bounty, or up to 100,000.
[bell dinging]
- If you like this video,
make sure you give us a like and subscribe.
- See ya.
[beeping]
- So I could probably pull up your, I don't know,
your Snapchat, and try to guess your password.
- My Snapchat password's a little bit different,
but you made my password.
- Did I? I don't remember a password.
- Maybe when I was like nine or ten.
- Don't say it, nah, don't say it on camera.
[both Laughing]
- You don't remember it?
- I don't remember it.