1. Misunderstandings and pitfalls of self-study network security learning
1. Don't try to become a programmer first (programming-based learning) and then start learning
In my previous answers, I have repeatedly emphasized not to start learning network security based on programming . Generally speaking, learning programming is not only a long learning cycle, but also there are not many key knowledge available after the actual transition to security.
If ordinary people want to learn programming well and start learning network security, it often takes a long time, and it is easy to give up halfway . And learning programming is just a tool, not an end. Our goal is not to become a programmer . It is suggested that in the process of learning network security, what can not be filled , which is more purposeful and less time-consuming.
2. Don’t take deep learning as the first lesson
Many people are aiming to learn network security well and solidly, so it is easy to use too much force and fall into a misunderstanding: it is to learn all the content in depth, but taking deep learning as the first lesson of network security is not good idea. The reasons are as follows:
[1] The black-box nature of deep learning is more obvious, and it is easy to learn and swallow
【2】Deep learning has high requirements on itself, it is not suitable for self-study, and it is easy to enter a dead end
3. Don’t Collect Too Much Data
There are a lot of learning materials about network security on the Internet, and there are several gigabytes of materials that can be downloaded or watched at every turn. And many friends have "collection addiction", buying more than a dozen books at once, or collecting dozens of videos
Many online learning materials are extremely repetitive and most of the content has not been updated a few years ago. During the introductory period, it is recommended to choose "small but refined" materials. Below I will recommend some learning resources that I think are good for Xiaobai. Read on patiently.
2. Some preliminary preparations for learning network security
1. Hardware selection
I am often asked "Do I need a computer with a high configuration to learn network security?" The answer is no, the computer used by hackers does not need any high configuration, as long as it is stable. Because some programs used by hackers, low-end CPUs are also It can run very well, and it doesn’t take up much memory. There is another one, the hacker is done under the DOS command, so the computer can be used in the best condition! So, don’t re-purchase the machine in the name of learning...
2. Software selection
Many people will be entangled in learning hackers whether to use Linux, Windows or Mac system. Although Linux looks cool, it is not friendly to newbies. The Windows system can also use the virtual machine to install the target machine for learning
As for the programming language, Python is the most recommended because of its good expansion support. Of course, many websites on the market are developed by PHP, so it is also possible to choose PHP. Other languages include C++, Java...
Many friends will ask if they want to learn all languages? the answer is negative! To quote my sentence above: Learning programming is just a tool, not an end, our goal is not to become a programmer
(An extra thing to mention here is that although learning programming cannot get you started, it can determine how far you can go on the road of network security, so I recommend you to learn some basic programming knowledge by yourself)
3. Language ability
We know that computers were first invented in the West, and many nouns or codes are in English. Even some existing tutorials were originally translated from English, and it usually takes a week for a bug to be translated into Chinese. Vulnerabilities may have been patched at this time difference. And if you don’t understand some professional terms, you will have obstacles when communicating technology or experience with other hackers, so you need a certain amount of English and hacker professional terms (you don’t need to be particularly proficient, but you must be able to understand the basics)
For example: broiler, hanging horse, shell, WebShell, etc.
3. Network security learning route
The first stage: getting started with basic operations and learning basic knowledge
The first step to getting started is to learn some current mainstream security tool courses and supporting books on basic principles. Generally speaking, this process takes about 1 month.
At this stage, you already have a basic understanding of cybersecurity. If you have finished the first step, I believe you have theoretically understood the above is sql injection, what is xss attack, and you have also mastered the basic operations of security tools such as burp, msf, and cs. The most important thing at this time is to start laying the foundation!
The so-called "foundation" is actually a systematic study of basic computer knowledge. If you want to learn network security well, you must first have 5 basic knowledge modules:
1. Operating system
2. Protocol/network
3. Database
4. Development language
5. Principles of common vulnerabilities
What is the use of learning these basics?
The level of knowledge in various fields of computer determines the upper limit of your penetration level.
[1] For example: if you have a high level of programming, you will be better than others in code auditing, and the exploit tools you write will be easier to use than others;
[2] For example: if you have a high level of database knowledge, then when you are conducting SQL injection attacks, you can write more and better SQL injection statements, which can bypass WAF that others cannot bypass;
【3】For example: if your network level is high, then you can understand the network structure of the target more easily than others when you infiltrate the internal network. You can get a network topology to know where you are, and get the configuration of a router. file, you will know what routes they have made;
【4】For another example, if your operating system is good, your privilege will be enhanced, your information collection efficiency will be higher, and you can efficiently filter out the information you want.
The second stage: practical operation
1. Mining SRC
The purpose of digging SRC is mainly to put the skills into practice. The biggest illusion of learning network security is to feel that you know everything, but when it comes to digging holes, you can’t do anything. SRC is a very good opportunity to apply skills.
2. Learn from technical sharing posts (vulnerability mining type)
Watch and study all the 0day mining posts in the past ten years, and then build an environment to reproduce the loopholes, think and learn the author's digging thinking, and cultivate your own penetrating thinking
3. Range practice
Build a shooting range by yourself or go to a free shooting range website to practice. If you have the conditions, you can buy it or apply to a reliable training institution. Generally, there are supporting shooting range exercises.
Phase 3: Participate in CTF competitions or HVV operations
Recommended: CTF Competition
CTF has three points:
【1】A chance close to actual combat. Now the network security law is very strict, unlike before, everyone can mess around
[2] Topics keep up with the frontiers of technology, but many books lag behind
【3】If you are a college student, it will be very helpful for finding a job in the future
If you want to play a CTF competition, go directly to the competition questions, if you don’t understand the competition questions, go to the information according to what you don’t understand
Recommended: HVV (network protection)
HVV has four points:
[1] It can also greatly exercise you and improve your own skills. It is best to participate in the HVV action held every year
【2】Be able to meet many bigwigs in the circle and expand your network
【3】The salary of HVV is also very high, so you can earn a lot of money if you participate
[4] Like the CTF competition, if you are a college student, it will also be very helpful for finding a job in the future
Fourth, the recommendation of learning materials
Common Internet Security and Forums
Kanxue Forum
Safety Class
Safety Niu
Safety Internal Reference
Green League
Prophet Community
XCTF Alliance
4. Seven levels of hackers
Hackers are full of temptation for many people. Many people can find that this field is like any other field. The deeper you go, the more you will be in awe. Knowledge is like an ocean, and hackers also have some levels. Please refer to the sharing of Chuangyu CEO ic (a member of the world's top hacker team 0x557) as follows:
Level 1 Lengtouqing [millions of people]: know how to use security tools, can only scan and decipher passwords easily
Level 2 system administrators [tens of thousands of people]: make good use of security tools, especially familiar with
the development of systems and networks Level 3 large companies Personnel or core security company Da Niu [thousands of people]: very familiar with the operating system, started to develop codes, wrote their own scanner
Level 4 can find and exploit vulnerabilities [hundreds of people]: can find loopholes by themselves, find 0DAY by themselves and Write Exp to exploit loopholes, do protocol testing for exploiting loopholes in the system
Level 5 high level [less than a hundred people]: people who defend and build systems
Level 6 elite level [dozens to a dozen people]: have a good understanding of the operating system In-depth
Level 7 Big Niu Niu [Few]: Mark Zuckerberg, Albert Einstein and other people who changed the world
You can see, what level are you at now? You may be wondering which level I am at, my level is not high, and I am on the way to seek a breakthrough. However, I have also practiced the other two skills, which may allow me to make a more interesting breakthrough. As for what it is, I am sorry, how dare I be presumptuous before I succeed.
learn to observe
I often say that the Internet is full of treasures, and observation is the first necessary skill. If you are good at observing and summarizing, you will discover some ways faster, which will make your life easier than others.
circle
In the above process, you will definitely become familiar with some IDs. Do you want to make some friends? Show your strengths, sharing is important, no one likes to reach out or troll.
It is especially recommended to understand the classic attributes of all groups in the next circle, and recommend the books "The Selfish Gene" and "The Crowd".
creativity
I mentioned before that to be creative enough, there are two key points, one is "vision" and the other is "focus". Vision is horizontal, and concentration is vertical. The two need to be balanced, because human energy is limited (the law of energy conservation). As long as either one is out of balance, neither will exist.
For most people, focusing is the most difficult, after all, this is an immediate process of entropy reduction, a process of self-organization of information. Seriously, you accelerated the end of the universe because of your focus. As for why, it will not be expanded here. In short, it is really difficult to focus, and you have to force yourself a lot of times.
Because of selfish genes, human beings are always bursting out their creativity consciously or unconsciously. Some creativity can change the world, some creativity can change the family, and some creativity can change yourself. These are all creativity. How much creativity you need depends on your genes, on who you want to be.
After all, there are "very few" people who can change the world...
Attached is the learning route
If the picture is too large and can't be seen clearly due to the compression of the platform, you can follow me and send it automatically in the background
Video supporting materials & domestic and foreign cybersecurity books, notes & tools
Of course, in addition to supporting videos, we also organize various documents, books, materials & tools for you
If you want to get into hacking & network security, you can find me to get the above information, follow me and send it automatically in the background~
epilogue
The network security industry is like a river and lake, where people of all colors gather. Compared with many decent families with solid foundations in European and American countries (understand encryption, know how to protect, can dig holes, and are good at engineering), our talents are more heretics (many white hats may not be convinced), so in the future Talent training and In terms of construction, it is necessary to adjust the structure and encourage more people to do "positive" "system and construction" that combines "business" and "data" and "automation" in order to quench the thirst for talents and truly serve the society in an all-round way. Internet provides security.
Special statement:
This tutorial is purely technical sharing! The purpose of this tutorial is in no way to provide and technical support for those with bad motives! Nor does it assume joint and several liability arising from the misuse of technology! The purpose of this tutorial is to maximize everyone's attention to network security and take corresponding security measures to reduce economic losses caused by network security. ! ! !