- Ama-CTF ayizindawo zokufunda ezisebenzayo lapho izinselele zobuchwepheshe zixazululwa khona ukuze kutholakale amafulegi.
- Indlela ekahle iqala kumapulatifomu aqondiswayo njenge-TryHackMe futhi iguqukela ezindaweni eziyinkimbinkimbi njenge-Hack The Box.
- Kubalulekile ukwazi kahle izigaba ezibalulekile ezifana nokuphepha kwewebhu, i-Cryptography, i-Forensics, kanye ne-OSINT.
- Ukuba nelebhu yendawo esekelwe kumishini yeKali Linux neVulnHub kuthuthukisa ukufunda okuzenzakalelayo.
Uma unesifiso sokwazi ngomhlaba wobugebengu bokugebenga ngokwezimiso kodwa ungazi ukuthi uzoqala kuphi, cishe uzizwa ukhungathekile yiwo wonke amathuluzi namagama angajwayelekile. Iqiniso liwukuthi, awudingi ukuba yingcweti yekhompyutha ukuze uqalise; okudingayo nje ukuzimisela ukuzama kanye nesineke esiningi ukuze ugweme ukuyeka lapho inselele iba nzima.
Kulabo bethu abaqala phansi, imidlalo ye-Capture the Flag (CTF) isibe yindlela ethandwayo. Ngokuyisisekelo, yimidlalo lapho kufanele uthole khona amakhodi ayimfihlo abizwa ngokuthi amafulegi ngokuxazulula amaphazili obuchwepheshe. Kuyindlela ejabulisa kakhulu yokufunda ngoba usuka ku-theory eyisicefe uye esenzweni esimsulwa, okukuvumela ukuthi wenze amaphutha ezindaweni eziphephile ngaphandle kokwesaba ukwephula noma yini ebalulekile noma ukungena enkingeni yezomthetho.
Iyini ngempela i-CTF?
I-CTF empeleni iwumncintiswano wokuphepha kwe-inthanethi. Cabanga ngayo njengokuzingela kwedijithali lapho umgomo uwukusebenzisa ubuthakathaka bokufinyelela ifayela noma ucezu oluthile lwedatha (ifulegi). Lezi zinselele zivame ukunikeza amaphuzu ngokusekelwe ebunzimeni bazo nokuthi uzixazulula ngokushesha kangakanani. Kunezinhlobo eziningana eziyinhloko:
- Ingozi: Lena ifomethi evame kakhulu kubaqalayo. Unohlu lwezinselelo ezigabeni ezahlukene futhi uqoqa amaphuzu njengoba uziqeda.
- Ukuzivikela Kokuhlasela: Izinto ziba zimbi lapha. Kufanele uvikele iseva yakho ngenkathi uzama... ukungena ngokunyenya kwabanye abantuKuyi-adrenaline emsulwa kanye nesu.
- Okuxutshiwe: Inhlanganisela yemidlalo yempi, izinselele zehadiwe kanye nezinye izindlela ezimangalisayo.
Izigaba eziyisisekelo okumele uzazi kahle
Ukuze ugweme ukungena ungaboni, kubalulekile ukuqonda ukuthi inselelo ngayinye ikucelani. Ukugenca kuyizwe elikhulu, yingakho lihlukaniswe ngezigaba ezikhethekile:
- Ukuphepha Kwewebhu: Ugxila ekuhlulekeni kwezinhlelo zokusebenza, njengokuhluleka I-SQL injection noma i-XSSYilapho-ke lapho kunezinto eziningi kakhulu ongaqala khona.
- I-Cryptography: Umdlalo lapha uwukuchaza imiyalezo efihliwe usebenzisa ama-algorithms noma Ukwephula ukusetshenziswa okubuthakathaka ukubethela.
- Ukuhlolwa Kwezezimali Kwedijithali: Okuqukethe yenza ukuhlaziywa kwe-forensic ezinhlelweni ukuhlaziya izinsalela zedatha, njengokuthi ukubanjwa kwethrafikhi yenethiwekhi (.pcap) noma ama-dump e-RAM ukuze kwakhiwe kabusha ukuhlaselwa.
- Ubunjiniyela Obubuyela Emuva: Lokhu kuhilela ukuhlaziya ifayela elisebenzisekayo (i-.exe noma i-.apk) ukuze kuqondwe ukuthi lisebenza kanjani ngaphakathi kanye khipha ifulegi ku-binary.
- Ukuxhashazwa (Pwn): Umgomo ukudala i-exploit yangokwezifiso ukuze kulawulwe uhlelo, kudlalwa kakhulu nge- ukuphathwa kwememori kanye ne-stack.
- I-OSINT: Kungubuciko bokucwaninga usebenzisa imithombo evulekile. Ngokuyisisekelo, ukwazi ukusesha ku-Google, ezinkundleni zokuxhumana, kanye nasezinkundleni zokuxhumana ukuze thola ulwazi lomphakathi kodwa kufihliwe.
- I-Steganography: Inselele ukuthola idatha efihliwe ngaphakathi kwamanye amafayela, njengombhalo ofihliwe esithombeni.
Amapulatifomu anconyiwe asekelwe ezingeni lakho
Akuwona wonke ama-lab afanayo. Uma ungena emshinini othuthukile ngosuku lwakho lokuqala, uzokhungatheka. Yingakho kungcono ukulandela indlela yokufunda eqhubekayo.
Kulabo abangazi lutho (Abaqalayo)
Uma uqala kusukela ekuqaleni, khetha amapulatifomu aqondiswayo. I-TryHackMe iyigugu eliyinhloko ngoba ikuthatha isinyathelo ngesinyathelo ngemizila yemfundo. Kukhona ne -picoCTF , eyenzelwe ngqo abafundi, kanye ne -OverTheWire (ikakhulukazi inselelo ye-Bandit) , okuyinto enhle kakhulu yokufunda indlela yokuhamba nge-terminal ye-Linux ngaphandle kokulahleka ngokuphelele.
Ukukhuphula izinga (Okuphakathi)
Uma usukhululekile nge-console, sekuyisikhathi sokuzama i-Hack The Box , indinganiso yemboni enikeza izindawo ezingokoqobo kakhulu. Enye inketho enhle kakhulu yi -Root-Me , enamakhulu ezinselele zamahhala nezihlukahlukene, noma i-PortSwigger Academy , iBhayibheli lamahhala lokufunda ukugenca kuwebhu, njengoba bengabadali be-Burp Suite.
Izindawo zasendaweni kanye nemishini esengozini
Ngezinye izikhathi kungcono ukuba nelebhu yakho ekhaya. I-VulnHub ikuvumela ukuthi ulande imishini ebonakalayo (.ova) ukuze isebenze ku-VirtualBox. Ngaphakathi kwale ndawo, i-Metasploitable (efanele ukuzijwayeza ne-Metasploit), i-OWASP Juice Shop (isitolo esiku-inthanethi esigcwele ubuthakathaka), kanye ne -DVWA kuyagqama. I-DVWA inhle ngoba ikuvumela ukuthi ulungise izinga lobunzima bezinselelo.
Izinsiza ezinamandla ngesiSpanishi
Uma isiNgisi siyinselele kuwe, sinomphakathi omangalisayo okhuluma iSpanishi. I-Hack4u (kusukela ku-S4vitar) cishe iyinsiza ebanzi kakhulu olimini lwethu, enikeza ukuqeqeshwa kwezinga le-OSCP. Kulabo abathanda into elula, i-Docker Labs inikeza imishini efakwe emathinini engasetshenziswa ngokushesha. Kukhona nemiphakathi efana ne -Vulnyx ne-TheHackerLabs ebelana ngemibhalo nezinselelo ngesiSpanishi ukuze ungazizwa ulahlekile.
Indlela yokusetha ilabhorethri yakho yokugenca
Ukuze uzijwayeze ngaphandle kokuphula ikhompyutha yakho, inketho engcono kakhulu ukusebenzisa i-virtualization noma izitsha . Uzodinga okungenani i-RAM engu-8 GB (yize i-16 GB ingcono kakhulu) kanye nesofthiwe efana ne-VMware noma i-VirtualBox. Ukusatshalaliswa okujwayelekile yi -Kali Linux , eza nazo zonke amathuluzi adingekayo asevele efakiwe. Uma ufuna into yesimanje futhi esheshayo, funda ukusebenzisa i-Docker ukuze usebenzise izinsizakalo ezisengozini ngaphandle kokusebenzisa izinsiza eziningi ngangokunokwenzeka.
Indlela yokuxazulula izinselele ngaphandle kokuyeka
Imfihlo yabaduni abahle kakhulu akukhona ukwazi konke, kodwa ukwazi ukuthi bangakuthola kanjani. Ukuhamba komsebenzi kuvame ukuba: funda isitatimende senkinga ngokucophelela, wenze ukuskena okuphelele nge-Nmap , wakhe umbono mayelana nokuba sengozini, bese uwuhlola. Uma ubhajwa, ungakhathazeki; funa umbhalo (isixazululo esichaziwe) , kodwa ungasikopishi. Hlaziya ukucabanga kombhali bese uzama ukukuphinda ngokwakho ukuze ulwazi lunamathele.
Ukuqala ukuphepha kwe-inthanethi kudinga ukuhlanganisa ilukuluku nokuzijwayeza okuqhubekayo kumalebhu afana ne-TryHackMe noma i-Hack The Box, kusetshenziswa umphakathi wamaHispanic namathuluzi afana ne-Kali Linux. Ngokwazi izigaba ezahlukahlukene, kusukela ekuphepheni kwewebhu kuya kubunjiniyela obubuyela emuva, kanye nokubhala phansi isinyathelo ngasinye ngokuya phambili ngokubhala, noma yimuphi umuntu oqalayo angaguqula ilukuluku lakhe libe umsebenzi oqinile nofunwa kakhulu.
