Table of contents
white hat black hat
White Hat and Black Hat are often used to describe two different roles in the field of computer security. White hat hackers are generally considered legitimate security experts who help businesses and individuals protect their systems by finding and fixing security holes through legitimate means. Black hat hackers are criminals who illegally break into computer systems, steal data , distribute malware, and more.
(1) White Hat (White Hat):
White hats are ethical cybersecurity professionals who use their skills to protect systems and data. White hat hackers are usually employed by companies or government agencies to find and fix security holes and prevent hackers from attacking. When they conduct penetration testing or vulnerability scanning, they will be authorized in advance, and report to the relevant responsible person in time after discovering the problem, helping the organization improve its security protection capabilities.
Example: A company hires a white hat hacker and asks him to conduct penetration tests on the company's network systems. After obtaining authorization, the white hat hacker managed to find a vulnerable server. He immediately reported the issue to the company and helped them fix the vulnerability, thus avoiding a potential hack.
(2) Black Hat:
Black hats refer to hackers who illegally intrude into computer systems without authorization, usually for malicious purposes, such as stealing data, launching ransomware attacks, and destroying systems. Black hat hackers usually use techniques such as penetration testing and vulnerability scanning to find the weaknesses of the target system, and then use these weaknesses to attack and gain profits. Their actions violate laws and ethics and can cause serious losses to individuals and organizations.
Example: A black hat hacker discovers a vulnerability in a bank's network system. He exploited this loophole to hack into the system illegally and stole a large number of customers' bank account information and funds. This behavior has seriously violated the property and privacy rights of others, and brought heavy losses to banks and customers.
for example
White Hat - Penetration Testing
Simulate a hacking attack to evaluate the security of the system. The process of penetration testing includes collecting target system information, finding vulnerabilities, attempting to exploit them, and reporting problems found.
Black hat—SQL injection, CSRF attack, etc. Violation of WEB security samples:
username: ' OR 1=1 --
password: any_passwordLinux security
A set of measures taken in the Linux operating system to protect systems and data from the threat of unauthorized access, tampering, or destruction. As a popular open-source operating system, Linux is widely used in fields such as servers, desktop computers, and embedded devices. Therefore, securing your Linux system is critical to maintaining the security of your network and data.
-
Keep your system updated: Regularly update your system and software packages to ensure that security vulnerabilities are fixed.
-
Use the principle of least privilege : Assign the least privileges to users and services to reduce potential security risks. For example, avoid using the root user for day-to-day operations, and instead use a normal user and use sudo to elevate privileges when needed.
-
Configure your firewall : Use tools such as iptables, ufw, or firewalld to configure your firewall to limit unauthorized network access.
-
Disable unnecessary services: Checks for running services on the system and disables unnecessary services to reduce the attack surface.
-
Hardened SSH: Use key authentication instead of password authentication, disable root login, and change the default port to improve SSH security.
-
Periodic Auditing: Periodically check system logs for any suspicious activity.
-
Use security tools: Use tools such as SELinux, AppArmor, etc. to enhance system security.
-
Data Encryption : Encrypt sensitive data to prevent data leakage.
-
Backup and Recovery : Regularly back up important data and make sure you can restore it quickly if something goes wrong.
-
Security Scanning and Monitoring: Regularly scan your system with tools like ClamAV, Chkrootkit, etc. to detect malware and intrusions.
Commonly used simple Linux check process and port development commands:
(1) View open ports
use netstat
sudo netstat -tuln
# 也可以用 ss -tulnWill display TCP (-t) and UDP (-u) ports, and their corresponding listening status (-l) and number format (-n).
netstat shows data similar to:
ss shows data similar to:
(2) View running processes
ps auxDisplay the detailed process list (-x) of all users (-a), including information such as the user of the process, CPU usage, memory usage, etc.
Display data similar to:
(3) To obtain more detailed real-time process information, use top
top
