Network Security (Self-taught Hacking) Complete Explanation

This tutorial is purely technical sharing! The purpose of this tutorial is in no way to provide and technical support for those with bad motives! Nor does it assume joint and several liability arising from the misuse of technology! The purpose of this tutorial is to maximize everyone's attention to network security and take corresponding security measures to reduce economic losses caused by network security. ! ! !

I. Introduction

If you want to learn network security (hacking technology) by yourself, you must first understand what network security is! What a hacker!

Network security can be classified based on the perspective of attack and defense. The "red team" and "penetration testing" we often hear are research on attack technology, while the "blue team", "security operation" and "security operation and maintenance" are research on defense technology.

Regardless of the field of network, web, mobile, desktop, cloud, etc., there are two sides of attack and defense. For example, web security technology includes both web penetration and web defense technology (WAF). As a qualified network security engineer, you should be both offensive and defensive. After all, you can win every battle if you know yourself and the enemy.

2. Definition

Hackers refer to those who have professional knowledge of computer technology and can break through system security in creative ways, explore and discover loopholes and weaknesses in computer systems. Hackers have a wide range of skills, and they can be computer security experts, network programmers, or information technology enthusiasts.

3. Classification

Depending on how they behave and their motives, hackers can be divided into the following categories:

1. White Hat Hacker

White hat hackers are a group of hackers with a high moral concept. They improve network security by discovering system vulnerabilities and reporting them to relevant parties. Their goal is to protect network systems from attacks and help fix vulnerabilities to ensure that users' data is not lost.

2. Black Hat Hacker

Black hat hackers are those who engage in illegal activities, they use their technical ability to cause damage, steal other people's information or seek improper benefits. They are threats to network security and should be punished by law.

3. Gray Hat Hacker

Gray hat hackers fall in between white hat hackers and black hat hackers, they may find system vulnerabilities and report, or exploit these vulnerabilities for personal gain, but usually do not cause serious damage.

4. Hacker Culture

Hacker culture is a special and scattered cultural group, some hackers advocate the spirit of openness, sharing and exploration. They usually pursue technological innovation and breakthroughs, advocate free access and use of information, and also pay high attention to privacy protection.

V. Ethical Issues

The ethical issues involved in hacking are highly debated. In their behavior, a contradiction exists between legality and morality. It's worth noting that hacker culture is not necessarily associated with crime, although hacking is sometimes viewed as a crime.

6. The role of hackers

Hackers play an important role in the field of information security. By discovering and disclosing system vulnerabilities, they advance the development of software and network security, helping to protect personal privacy and corporate secrets from unauthorized access. In addition, some hackers have made outstanding contributions to technical communities, open source software, and Internet services.

The more familiar one is the Chinese Hongke that everyone calls! It was spontaneously organized by a group of predecessors who were the first to contact with network security in my country!

7. Tips for Hackers

Suggestion 1: Seven Levels of Hackers

Hackers are full of temptation for many people. Many people can find that this field is like any other field. The deeper you go, the more you will be in awe. Knowledge is like an ocean, and hackers also have some levels. Please refer to the sharing of Zhichuangyu CEO ic (a member of the world's top hacker team 0x557) as follows:

Level 1 Lengtouqing [millions of people]: Can use security tools, can only scan and decipher passwords

Level 2 system administrators [tens of thousands]: make good use of security tools, especially familiar with systems and networks

Developers of Level 3 major companies or core security companies Da Niu [thousands of people]: very familiar with the operating system, started to develop codes, and wrote their own scanners

Level 4 can find and exploit vulnerabilities [hundreds of people]: who can find vulnerabilities by themselves, find 0DAY by themselves and write Exp to exploit vulnerabilities, and conduct protocol testing for system mining vulnerabilities

Level 5 high level [less than a hundred people]: people who defend and build systems

Level 6 elite level [dozens to a dozen people]: Deep understanding of the operating system

Level 7 Big Niu Niu [Few]: Mark Zuckerberg, Albert Einstein and other people who changed the world

You can see, what level are you at now? You may be wondering which level I am at, my level is not high, and I am on the way to seek a breakthrough. However, I have also practiced the other two skills, which may allow me to make a more interesting breakthrough. As for what it is, I am sorry, how dare I be presumptuous before I succeed.

Suggestion 2: learn to observe

I often say that the Internet is full of treasures, and observation is the first necessary skill. If you are good at observing and summarizing, you will discover some ways faster, which will make your life easier than others.

Suggestion 3: circle

In the above process, you will definitely become familiar with some IDs. Do you want to make some friends? Show your strengths, sharing is important, no one likes to reach out or troll.

It is especially recommended to understand the classic attributes of all groups in the next circle, and recommend the books "The Selfish Gene" and "The Crowd".

Tip Four: Creativity

I mentioned before that to be creative enough, there are two key points, one is "vision" and the other is "focus". Vision is horizontal, and concentration is vertical. The two need to be balanced, because human energy is limited (the law of energy conservation). As long as either one is out of balance, neither will exist.

For most people, focusing is the most difficult, after all, this is an immediate process of entropy reduction, a process of self-organization of information. Seriously, you accelerated the end of the universe because of your focus. As for why, it will not be expanded here. In short, it is really difficult to focus, and you have to force yourself a lot of times.

Because of selfish genes, human beings are always bursting out their creativity consciously or unconsciously. Some creativity can change the world, some creativity can change the family, and some creativity can change yourself. These are all creativity. How much creativity you need depends on your genes, on who you want to be.

After all, there are "very few" people who can change the world...

Suggestion 5: Some good resources

Open your browser and search for:

i Chunqiu, Wuyun, Zhichuangyu R&D skill table v3.0, FreeBuf, enough!

If these few clues don't open up your hacker world view and make you creative enough, then it's useless to ask more. I suggest that you really savor some of the knowledge they give, follow the vines, and gradually extend your tentacles to the world. As I said earlier, learn to observe

8. Misunderstandings and pitfalls of self-study network security learning

1. Don’t try to become a programmer first and then start learning

In my previous answers, I have repeatedly emphasized not to start learning network security based on programming. Generally speaking, learning programming is not only a long learning cycle, but also there are not many key knowledge available after the actual transition to security

If ordinary people want to learn programming well and start learning network security, it often takes a long time, and it is easy to give up halfway. And learning programming is just a tool, not an end. Our goal is not to become a programmer. It is suggested that in the process of learning network security, what will not be filled, which is more purposeful and less time-consuming

2. Don’t take deep learning as the first lesson

Many people are aiming to learn network security well and solidly, so it is easy to use too much force and fall into a misunderstanding: it is to learn all the content in depth, but it is not right to use deep learning as the first lesson of network security. good idea. The reasons are as follows:

[1] The black-box nature of deep learning is more obvious, and it is easy to learn and swallow

【2】Deep learning has high requirements on itself, it is not suitable for self-study, and it is easy to enter a dead end

3. Don’t Collect Too Much Data

There are a lot of learning materials about network security on the Internet, and there are several gigabytes of materials that can be downloaded or watched at every turn. And many friends have "collection addiction", buying more than a dozen books at once, or collecting dozens of videos

Many online learning materials are extremely repetitive and most of the content has not been updated a few years ago. During the introductory period, it is recommended to choose "small but fine" materials. Below I will recommend some learning resources that I think are good for Xiaobai. Read on patiently.

9. Some preliminary preparations for learning network security

1. Hardware selection

I am often asked "Do I need a computer with a high configuration to learn network security?" The answer is no, the computer used by hackers does not need any high configuration, as long as it is stable. Because some programs used by hackers, low-end CPUs are also It can run very well, and it doesn’t take up much memory. There is another one, the hacker is done under the DOS command, so the computer can be used in the best condition! So, don’t re-purchase the machine in the name of learning...

2. Software selection

Many people will be entangled in learning hackers whether to use Linux, Windows or Mac system. Although Linux looks cool, it is not friendly to newbies. The Windows system can also use the virtual machine to install the target machine for learning

As for the programming language, Python is the most recommended because of its good expansion support. Of course, many websites on the market are developed by PHP, so it is also possible to choose PHP. Other languages include C++, Java...

Many friends will ask if they want to learn all languages? the answer is negative! To quote my sentence above: Learning programming is just a tool, not an end, our goal is not to become a programmer

(An extra thing to mention here is that although learning programming cannot get you started, it can determine how far you can go on the road of network security, so I recommend you to learn some basic programming knowledge by yourself)

3. Language ability

We know that computers were first invented in the West, and many nouns or codes are in English. Even some existing tutorials were originally translated from English, and it usually takes a week for a bug to be translated into Chinese. Vulnerabilities may have been patched at this time difference. And if you don’t understand some professional terms, you will have obstacles when communicating technology or experience with other hackers, so you need a certain amount of English and hacker professional terms (you don’t need to be particularly proficient, but you must be able to understand the basics)

For example: broiler, hanging horse, shell, WebShell, etc.

10. Network security learning route (2023 latest arrangement)

This part of the content is still relatively far away for students with zero foundation, so I won’t go into details, and attach the learning route.

Image too large! If the upload is not clear and needs a high-definition PDF version, you can leave a message to tell me or kick me! Due to the limited number of private messages from strangers every day! You can also follow me. After following, the background will automatically send a sharing link, and you can pick it up yourself!

Phase 1: Security Basics

Cybersecurity Industry and Regulations

Linux operating system

computer network

HTML PHP Mysql Python basics to practical mastery

Phase Two: Information Gathering

IP information collection

Domain name information collection

Server Information Collection

Web site information collection

Google hacking

Fofa Network Security Mapping

Phase Three: Web Security

SQL injection vulnerability

XSS

CSRF vulnerability

File Upload Vulnerability

file contains bug

SSRF vulnerability

XXE vulnerability

Remote Code Execution Vulnerabilities

Password Brute Force Cracking and Defense

Middleware Parsing Vulnerabilities

Deserialization Vulnerabilities

Stage Four: Penetration Tools

MSF

Cobalt strike

Burp suite

Nessus Appscea AWVS

Goby XRay

Sqlmap

Nmap

Kali

The fifth stage: actual combat digging

Vulnerability mining skills

Src

Cnvd

Crowdtest project

Recurrence of popular CVE vulnerabilities

Shooting Range Combat

Note: The first three stages are the focus of learning

11. Learning materials sharing

The learning framework has been sorted out, and now the resources are missing. I have sorted out the resource documents corresponding to all the knowledge points here. If you don’t want to look for them one by one, you can refer to these materials!

Like, favorite, leave a message in the comment area "Already concerned"! It can be shared with everyone for free! Friends who can't wait can also kick me directly! Or after following me, the background will automatically send it to everyone! After paying attention, please pay attention to the background news!

1. Video Tutorial

2. Hacking tools & SRC technical documents & PDF books & web security, etc.

epilogue

The network security industry is like a river and lake, where people of all colors gather. Compared with many decent families with solid foundations in European and American countries (understand encryption, know how to protect, can dig holes, and are good at engineering), our talents are more heretics (many white hats may not be convinced), so in the future Talent training and In terms of construction, it is necessary to adjust the structure and encourage more people to do "positive" "system and construction" that combines "business" and "data" and "automation" in order to quench the thirst for talents and truly serve the society in an all-round way. Internet provides security.