CTF entry route (personal suggestion)
Based on my little entry experience in learning ctf (a little bit, I have just started), I will guide some friends who want to get started with some resources.
Basic theoretical knowledge
First of all, the basic theory needless to say, it is very important. I watched some videos on this to learn. As long as you search for the keyword "CTF" on station B, you can get a lot of related videos. I followed the video of "Antscape Network Security", which I think is quite good, but it seems that there is no direct ready-made one on the Internet. At this time, use our almighty treasure to search for "CTF", and you will be able to master a lot of good quality learning resources.
These resources include videos, CTF tool suites, and PDFs of some books. I suggest that you can watch the video directly (of course, since you have all gone to CTF, I believe it will not be a little basic, but it is actually okay, just go back and learn in time if you encounter basic knowledge that you don’t know), CTF’s Remember to put the tool in the win10 virtual machine , otherwise your computer will directly kill QAQ and may affect your daily operations. Kali is a virtual machine, which also needs to be installed. Personally, I always have two virtual machines, win10 and kali.
As for those books, you can read them, but I don’t think they are very clear and boring at the basic stage. Anyway, I don’t like to read them very much.
Basic hands-on exercises
Want to practice after reading the theory? That must be the choice of shooting range to play! Here I recommend a few ranges that I have come into contact with.
getting Started:
These two are built on the local shooting range based on phpstudy, and pikachu is easier. I suggest that novice Xiaobai has no brains to play pikachu.
This one is the online shooting range of the network security laboratory. The content is relatively simple, and it is also very suitable for beginners to get started, and does not require cumbersome operations such as configuration.
The order of difficulty suggested by me is: pikachu->hackinglab->DVWA
Advanced:
When you think you can practice a slightly more difficult shooting range, I will recommend BUUCTF to you
BUUCTF online evaluation (buuoj.cn)
This is also an online shooting range environment. In addition to the basic questions, there are also many competition real questions. It is especially suitable for advanced exercises, and the number of questions is also very rich.
Online Shooting Range_Mozhe Academy (mozhe.cn)
The last one is also a good shooting range, but it takes a little points to practice the exercises in it, and it will give you some points. Of course, if you practice more, it may also cost a little bit of garden. Overall it's pretty good.
This is amazing, it is a shooting range on Kali, emmm, if you are interested, you can try it.
Well, I don't know much about it, but it's famous
How to brush questions:
If you are a pure novice Xiaobai, you must be confused when you get the title, (Ah! What is this thing? Why is it just a frame, why didn’t the title tell me what to do. Ah? What should I do, I You can’t set up a fake shooting range, what the hell? -----cough cough, the above is not me) At this time, you need to first look at how others solved it. Generally, after you write too much, you will see the title The name and content will know what the content of the test is . You don't have to worry about this, you just need a little experience.
When you can't do it or need some help, I suggest you look at other people's answers, just search for the name of this level on CSDN. For the convenience of everyone, I also give some solutions to the big guys:
pikachu: (98 messages) Pikachu Vulnerability Platform Clearance Series Guide (all levels have been completed)_Fairy Elephant's Blog-CSDN Blog_Pikachu Vulnerability Platform dvwa
: (98 Messages) DVWA Complete Level Tutorial Manual_Wei Zizi's Blog -CSDN blog_dvwa customs clearance tutorial
Why do I only recommend these two, because this is a collection of all, and there are many other shooting ranges, but most of them are fragmented, and each has its own advantages, so everyone might as well write a question and search for this question separately good. I like this problem solution of pikachu very much, and I strongly recommend it to everyone.
There is also this big guy:
His blogs are full of treasures: from java to python to security tools, many blogs are of extremely high quality. I recommend it to everyone.
(98 messages) Tr0e's blog_CSDN blog-penetration testing, terminal security, bloggers in the field of programming development
Be sure to read his blog from the beginning! Can gain a lot.
Utilities
Speaking of some tools, there are too many, each has its own advantages, and there are many, many commonly used ones. Here I pick a little introduction.
Online Site Classes
Decryption tool website:
This is used for encryption and decryption. It is a large collection. If you encounter any decryption, you can find him. Of course, not all of them are available, and there are still problems that it can't help.
md5 online decryption crack, md5 decryption encryption (cmd5.com) MD5 decryption does not explain
HexEd.it - Browser-based Online and Offline Hex Editing emm, this is an online hex viewer, but I rarely use it. I use 010Editor.
CyberChef is so awesome! But I didn't understand it, I recommend everyone to search for this game on csdn by yourself.
Resource information website:
Security circle info - Do down-to-earth information security navigation (anquanquan.info)
FreeBuf Network Security Industry Portal
Penetrator Network Security Practitioner Security Navigation (shentoshi.top)
Well, for beginners, just take a look...
CTF Resource Library|CTF Tool Download|CTF Toolkit|CTF Tool Collection (ctftools.com)
There are many downloads of tools that you need to use, so you can focus on it.
Software tools:
-
burpsuite
It is used to capture packets, and more introductions are as follows:
Burp Suite is an integrated penetration testing tool, which integrates a variety of penetration testing components, so that we can better complete the penetration testing and penetration testing of web applications automatically or
manually attack. In penetration testing, we use Burp Suite to make
the testing work easier and more convenient. Even if we do not need skilled skills, only we are familiar with the
use of Burp Suite, which makes the penetration testing work easier and more efficient.(98 messages) Burpsuite super detailed installation tutorial_Oriental r0se's blog-CSDN blog_burp
(98 messages) BurpSuite use Daquan (detailed)_A slacker's blog-CSDN blog_burpsuite use
This can be said to be a must-have software for every beginner in network security. There is nothing to say, it must be used and must be understood!
- sqlmap
[(98 messages) tool usage] SqlMap
This is, an automated SQL injection tool whose main function is to scan, find and exploit SQL injection vulnerabilities of a given URL.
- Wireshark
It is also used to capture packets, which I rarely use. WireShark is a very popular network packet analysis tool, which can intercept various network packets and display the detailed information of the packets. It is often used to locate various problems in the development and testing process.
- 010Editor
Essential, (98 messages) 010editor installation and use tutorial_Honghuanggirl66's blog-CSDN blog_010editor
- Edgeworth
(98 messages) 55w Yujian dictionary collected for many years_weixin_33966095's blog-CSDN blog
Remember to change the dictionary for Yujian, the dictionary that comes with it is really not enough
- Ant Sword/Chinese Kitchen Knife/Ice Scorpion
(98 messages) Website Control Tool: Ice Scorpion 3.0 User Experience
- exeinfope
This is used to operate on exe files
(98 messages) Exeinfo PE shell checking tool_Several 89 blogs-CSDN blog_How to see if there is a shell in exeinfo pe
- Stegesolve
This is for image files
- Ziperello
This is a brute force cracking of zip compressed files
(98 messages) Ziperello——Introduction, Installation_Starzkg's Blog-CSDN Blog_ziperello
- QR_Research
- hackbar (browser plugin)
(98 messages) hackbar tool installation tutorial_julien_qiao's blog-CSDN blog_hackbar
related books
This one... There are quite a few, different people have different opinions, just search for ctf on a certain treasure and you will find it. As for the PDF version or if you want to buy it cheaper, you can choose salted fish.