Skip to content

navyComputingFund.md

Latest commit

 

History

History
1372 lines (972 loc) · 96.1 KB

navyComputingFund.md

File metadata and controls

1372 lines (972 loc) · 96.1 KB

Site Registration

You must register for the site before your progress can be tracked.

Click here to register: https://navy.hoppersroppers.org/login/signup.php?

Secure Yourself Now

You signed up for this course to improve yourself, to learn how to secure yourself online, and to help others. That's what this section is dedicated to. If you finish this section and don't do anything else, your participation in this course will be a success in my eyes. Maybe not in your chain of command's but that's a completely different story.

Of course, I would prefer you to continue in the course, but I'm glad you are here, and I hope you stick around.

You're working from home, off your personal computer, so first, congratulations on all the bandwidth. You are all security professionals, so I know I don't have to drive this point home too hard, but the computers that you defend and maintain at work are significantly more secure than the one you are accessing this course from. You know everything I am about to tell you, but I'm going to tell you it again.

Your first assignment is to start using a password manager. Read this https://www.howtogeek.com/141500/why-you-should-use-a-password-manager-and-how-to-get-started/ to learn about password managers, and then install one, I recommend https://lastpass.com/. There's plenty of other password managers out there, but I've been using this one forever and that is the only reason I recommend it. Convince your friends and family to use password managers. If you don't want to do this now, skip it, I make sure you do it later in the course.

Your second task, if you do not already have one installed, is to install an ad-blocking extension. Ad-blockers do what they say they do, making your web experience significantly better, but also block trackers and lessen the chance of getting malware laden ads. For Chrome, I recommend uBlock Origin: https://chrome.google.com/webstore/detail/ublock-origin/cjpalhdlnbpafiamejdnhcphjbkeiagm?hl=en. I don't use Firefox, but it has an ad-blocker built in which makes it the best choice for the privacy and security conscious. I also recommend installing Chrome and ad-blockers (or Firefox) on as many computers of friends and family that you do tech support for. If you don't want to do this now, skip it, I make sure you do it later in the course.

I'd like to think you don't already have malware on your computer but if you are working off of a shared family computer, there's a decent chance if you haven't checked recently. First, ensure that Windows Defender is enabled. If it isn't, turn it on. After you've done that, turn on automatic updates and ensure your computer is completely updated. If it isn't, update now. Once again, do this on as many computers as you are responsible for. You do it at work, do it home. If you're not on Windows, good luck not downloading malware you 1337 hardo. You'll probably be fine.

I know this stuff is obvious, but it's easy to be complacent when we get home. We know what best practices are, so do them.

Computer Related Health

You probably spend a ton of time in front of a computer at work, but now that you're at home, your setup might not be what it was. If you're going to be working through this course, competing in our CTF, or binging Netflix, these are a few changes you can constantly put into practice that will make you a happier and healthier person.

Ergonomics

  1. Now fix your setup so that everything aligns properly. This is an investment. If you have a laptop, find a keyboard and mouse and set the laptop up on top of books to get it to the right height when you are sitting down. Try to avoid having a laptop on your lap, get it on a table and sit in a chair.

Blue Light and Brightness

  • Drop the brightness on your computer as far as you can. Just trust me.
  • Are you used to your eyes hurting after too long on the computer? This is mostly from the blue light. There's a ton of research you can read to prove it, or you can download this and it will change your life. https://justgetflux.com/
    • Windows has this option by default now, so check for that before downloading flux.
  • It is also an option to get blue light filtering glasses, they should be pretty cheap (>$30). I swear by mine, but hey, whatever, it keeps my eyes from hurting when I am about to spend 12 hours scrolling packet captures.

General Wellness

Coronavirus

Hydrate Constantly

  • My life motto is "Stay Happy and Stay Hydrated", and it is inscribed in my class ring... so yeah, I take hydration seriously
  • You should be going to the bathroom every 2-4 hours
  • Caffeine, and especially drinks like coffee and energy drinks dehydrate you

Sleep

Nutrition

  • I'm not going to make you read anything, just don't eat cheetos and hot pockets and drink Monsters as your only sustenance for the day. Order in some Chinese or Thai. Not every delivery meal has to be pizza.
  • Cook your own food every once in a while. Instant ramen doesn't count. Cooking is fun as hell. Do it.

Fitness

  • Not going to beat this one to death. Getting your heart rate elevated for a few minutes a day is good for you, full stop. Do it.
  • Even if the PRT is cancelled you should still work out.
  • Looking for great resource for this, please recommend one if you have it.

Neurodiversity

Mental Health

There is a group named the Mental Health Hackers who are pretty cool and worth a look https://twitter.com/hackershealth.

Questions

Alright, you probably didn't expect this line of questioning in this course, and yet, here we are. Serious business time, three quick questions.

  1. Have you wished you were dead or wished you could go to sleep and not wake up?

  2. Have you actually had any thoughts about killing yourself? If so, have you thought about how you might do this?

  3. In the past three months, have you done anything, started to do anything, or prepared to do anything to end your life?

If you answered yes to any of these questions, visit https://suicidepreventionlifeline.org/ or call 1-800-273-8255.

If you don't want to talk to a stranger, my name is Dennis, text or call me at 914-299-7537, email me, or message me on here. As an important note, I am not in your chain of command, so my interpretation is that I am not required to report any conversations I have. If anyone disagrees, let me know.

It's okay to not be okay, talk to someone.

Why?

You thought you were here to learn how to get better at computers so what is all this?

Well, hopefully your end goal of all this is that you become a better person and have a better life. If you want to be good at computers just for the sake of being good at computers that counts for something too, but to me, all this technology is just a way for me to accomplish more than I could by myself.

If you're going to be doing anything in this world, might as well take care of yourself first. Learning security comes far after you and your well-being.

Now, on to the show!

Letter from the Author

Dedication

This training is dedicated to the memories of Aaron Swartz, Bassel Khartabil and those named on the National Cryptologic Memorial.

Letter from the Author

After a decade of teaching myself how to use computers and a few years training others, I went and made the site that I wish had existed when I got into the field back in middle school.

Security is the shield of the modern world, and we need good people on the wall. Thanks for being up there.

Hack the planet

-Dennis

Why Security?

Computer security is the shield of the modern age. Without the constant battle on the frontlines between the people who want to see technology used for good and the people who want to use it for their own gain, or worse, to limit the rights and freedoms of others, the progress that occurs in the real world because of technology would be dramatically slowed. Security allows trust in technology, which leads to adoption, which leads to progress in one direction, or another. The more people able to help out with that fight, the faster we can move as a society, and less things will get broken and less people will be hurt on the way. That?s why this site exists, and hopefully, if you?re here for the right reasons, you?ll be able to jump into the fight with the tools you need to succeed.

This course is designed to give you the mindset and fundamental skills necessary to be successful in the information security field. If you already have some experience - great! But we do not to assume any prior knowledge of security or even information technology in general. At the end of this, you may not be a guru (hint: nobody knows everything), but you should have the mental models and base knowledge to use the Linux operating system, install new programs, and be equipped to find and understand the information you need to learn even more.

While I have tried to do everything in my ability to make this course self-guided, there are hundreds of places where a questioning attitude will identify clear shortfalls in the content. Some of these are intentional, most of them are not. Your questions and feedback will guide the development of this course so that it can become the best resource possible.

Surrounding this site is a community to help you and provide guidance as you move along. This community grows with each student who signs up, and our mentors will be there every step of the way to answer questions, explain difficult concepts, and talk about just about anything to help you along the way. Make sure to take full advantage of the many ways we provide to message other mentors so that we can all be part of this together.

Hopper's ...

We named out team after Grace Hopper because she is our favorite person in Navy computing history. You probably know who she is.

Have you ever heard the quote, ?It's easier to ask forgiveness than it is to get permission.?? That was her.

alt text

This quote comes from an interview in the July 1986 CHIP?s Ahoy Magazine, the Department of the Navy?s Information Technology Magazine. She was at the cutting edge then and it is a testament to her vision how well this interview stands up to the test of time. Her passion for knowledge and innovation is the most important thing you can carry with you.

Read this: http://www.doncio.navy.mil/chips/ArticleDetails.aspx?id=3563

... ROPpers

While there was a chance you knew what Hopper's meant, it is very unlikely that you have had any idea what Roppers meant, mostly because it is a word we made up to define a group of people who ROP. And if you have never heard of ROP, or Return Oriented Programming before, and.... that is not just okay, that is expected, because why on earth would you have known about an obscure programming topic before this exact moment in time. To quote Wikipedia, "Return-oriented programming (ROP) is a computer security exploit technique that allows an attacker to execute code in the presence of security defenses such as non-executable memory (W xor X technique) and code signing by chaining together carefully chosen machine instruction sequences to get control of the stack..."

Don't worry; none of that should have meant anything to you. That would have made zero sense to me when I was sitting where you are sitting. Two years into my journey, I would have understood about half of it. Now at least I know what all the words mean, but I rely on friends who know more than me if I have questions.

While many other sites that attempt to teach this material assume you already know a great deal of knowledge, we take a different approach to make this challenging subject as approachable as possible. For all of the great resources out there, and all of the incredible pieces of training, nothing walks a complete beginner all the way through the process of developing a strong foundation in the fundamentals. Everyone wants to learn how to do stuff, but very quickly they realize that there is no way for them to learn everything. They?re not wrong, the vast and constantly expanding body of knowledge about this field makes it impossible for anyone to keep up. But what is most important for the beginner to realize is that with the proper knowledge of the fundamentals and a firm grasp on the hacker mentality, that irrepressible drive to learn and to do, nothing is too complex for them to learn if they put the time in. By managing your high expectations of yourself, providing constant feedback on your progress, and bringing you into the community, this is designed to minimize dropout rate while providing the best first hundred hours of a cyber security education possible.

Core Tenets

alt text

This site is designed around a series of ideas that we think will make your experience as a learner as good as possible.

  1. No initial expectation of knowledge
  2. Everyone moves at their own pace
  3. Understanding foundational theory comes before building technical skills
  4. Developing fundamental technical skills lays the groundwork for success in any topic
  5. Knowledge must be actionable
  6. The measure of a community is how they treat those who are trying to gain entry
  7. There is no such thing as being done learning

Anytime something on this site doesn't seem to be matching up with our core tenets, let us know so I can fix it. We made as many possible mechanisms for you to help us improve our approach, the content, and the community of this site as possible. This site is a living entity and will change on a regular basis so that we can improve your experience.

So What is ROP?

All you need to know right now is that ROP is an advanced exploitation technique which beats advanced defenses by chaining together code which was already in a program. That definition is good enough for now, but if you stick around with us, soon enough you will know what it means and eventually you will be writing ROP chains of your own. The critical bit to understand is that you take snippets of existing code, chain it back together in a new order, and then use those to jump to where you need to go next. As you go through this course you will do the same thing, rearranging already learned information and skills to jump to new locations.

Nothing in this course is spoonfed, and while we try to give you good resources, there are multiple parts in the course where we tell you to swing by yourself and go find out how to do something. We do this when we know there are plenty of other high quality resources out there for you to learn from and we want you to become comfortable being given no direction other than a couple searchterms and having to rely on your own knowledge and problem solving skills.

Content

This curriculum was created based on inputs from members of the Boat School's Cyber Security Team and various guides scattered throughout the internet on how to break into information security. We put this curriculum together by aggregating all of the guides and tutorials we could find, took what we thought was important and added our own commentary. To say that this is built on the backs of a hundred other people's work would be an understatement, and we am forever grateful that we are part of a community which has created so many amazing resources. All attempts to cite source material have been made, if there is anything we have not properly attributed, let us know. Despite having been in the works for the last four years, this is the first iteration of the curriculum and it should change drastically as we see what does and doesn't work, and the only way we will know is feedback.

Legal

Community Guidelines

Our community guidelines are available here: https://www.hoppersroppers.org/guidelines.html. Please read them over.

Legal Stuff

Unsurprisingly, in this course you will learn some things that could be used to do bad things. You might not think they're bad things at the time, and they might seem like funny pranks, but the laws against hacking are very vague. Even more importantly, you probably have a security clearance, and having a pile of felonies you have to admit to is not a great look and will complicate your paperwork.

In the US, the law that surrounds this stuff is the Computer Fraud and Abuse Act.

Basically, all you need to know is that every computer is a protected computer and that it is a crime to intentionally access a computer or account without authorization or to exceed authorized access.

Exceed authorized access is a real sticky subject, and it has led to a bunch of unfortunate prosecutions.

To stay on the safe side, only access computers you own, or have written consent to access. You're lucky, because we have an entire network of training computers you can do whatever you want on. A lot of people don't, and that's where they get in trouble while trying to learn.

It should also be mentioned that copyright law is also a good way to get in trouble, not to mention that if you see software to pirate on the internet, it is very unlikely that it doesn't contain malware. Just don't steal things, we can almost always get a copy of whatever you want, it just might take some paperwork and some emails.

Classification

Absolutely nothing here is classified, in any way, whatsoever. Nothing is derived from classified information.

Join Us

Slack

Instant group messaging has been a cultural staple of the internet community since its inception, as it is truly one of the most important functions that global interconnectedness can serve.

Slack has become the messaging platform of choice, allowing group collaboration and real time chat along with various plug-ins and file hosting integration. We use it for many of feedback, support, as a forum, and as our primary instant messaging channel. At some point we might migrate to a self-hosted server, but for now, Slack is the easiest to work with.

Join our channel at https://launchpass.com/hoppersroppers and post a hello!

If this is not working for you, it is because you have an ad-blocker installed. If you do, whitelist the site or open it in Incognito mode and enter your email. We'll learn all about ad-blockers and why that broke the site for you later. If you continue having problems, message us here or email us.

Choose a nickname, or what we call online, a "handle" for yourself. Don't worry about it too much, you will come up with something good eventually, and you are not stuck with whatever you start with. As a general rule, don't call yourself something like "Dark Shadow". Unless you want to. In that case, do that. I probably had a dozen or so before settling on my current one, 'deevnull'. I liked mine because it is a nerd joke (that will be explained about halfway through this course) and incorporates my last name. Send me a message with a brief introduction to let me know you joined. We use Slack for just about everything from helping on problems, submitting feedback, or just talking about random things.

Twitter

Unsurprisingly, information security Twitter is a very exciting place. In the modern age, where information flows at the speed of light, Twitter is the place to be if you want to stay informed and on the cutting edge. It is an overwhelming amount of information, so you want to start off following only a few accounts. It is going to be a lot for you right now to actually try to read and understand the firehose, so we will start you slow and with a small number of beginner-friendly follows that really only post news. If you don't want to do Twitter yet, just skip it.

Optional:

Create a "professional" twitter account! Remember, this twitter will be able to be associated with you, even if you want to stay pseudo-anonymous. Always keep it fun and professional. Now subscribe to this list, or just follow them: https://twitter.com/deevnull/lists/cst. This list has been curated to only include must follows with a range of jobs that will provide insight into what is happening around the field.

Follow @HoppersRoppers on twitter so we can follow you. Again, if you don't want to do Twitter yet, just skip it. It is mostly just a giant waste of time, but it is interesting and you learn a ton.

The Team

The 'Competitive' Team

This site is designed for getting you up to speed so you can confidently compete in security competitions. What this site is not is a series of competition problems for you to solve, which while seemingly the obvious way to teach this, winds up discouraging learners early by really kicking the crap out of them. We teach the basics, and the next course will be where you find yourself facing down challenges. Luckily, that is way easier of a course to make, because I just borrow them from old competitions. This course is to prepare you, not to get you experience in competition. It's a different approach philosophically, but it will pay off.

When you sign up for this site, you automatically become a member of our not-at-all competitive team, which also happens to be named Hopper's Roppers. This whole site is grown out of the training I made for my college security team who competed in various cyber security competitions. Now, Hopper's Roppers is a distributed team, open to anyone, but is especially meant to be a place for beginners to learn the ropes in and we will participate in any event we have the numbers for. You will not be ready to compete while you are still working your way through this course... the good news, is you don't need to be ready to compete to do it. All you have to do is sign up, know your brain is going to hurt and you probably won't understand anything, and be ready to learn.

The primary type of security competitions are CTFs, or Capture the Flags. This is a great resource to learn about CTFs. https://ctfd.io/whats-a-ctf/. All of the training here is built around the idea of preparing you for success in the security field, and there is no better measure of ability, grit, and the hacker mentality than playing in a competition. Every CTF requires you to use what you already know to identify what you will need to learn on the spot to solve the problem. As you are now a member of our team, we will let you know when competitions are occuring and we hope to see you there if you have the time. Even if you are new and don't think you have anything to contribute, you will learn more picking someone's brain as you shoulder-surf them (or watch them on Twitch) than you possibly could trying to learn by yourself.

This Stuff is Hard (Hidden)

Doing cool things with computers is hard (have I said that before), and yes there is an aspect that requires technical knowledge, but mostly, it just takes time. Doing cool things with computers is less of a technical challenge and more of an attitude and a willingness to work hard and teach yourself what you need to know in order to succeed in whatever you are trying to do. Our curriculum here is meant to give you the basic tools you will need to understand the challenges you face, but solving them is going to be on you. We'll be honest, this isn't easy. This isn't something that will take you a month or two to get the hang of. One of the primary curses of doing cool shit with computers is that each time you learn something, you immediately realize a new pile of things that you do not know. There's nothing wrong with not knowing things, and no one could ever expect you to. Even "experts" will only know a small slice of the greater field that is doing cool things with computers. Expecting anyone to be good at everything is ridiculous, but it is even more ridiculous for anyone to think a beginner should know everything... or really, anything. There's a lot of acronyms, slang, in-jokes, and domain specific knowledge. One of the promises we will make to you is that we will not ever put in an acronym, slang, or in-joke without explaining it.

If you can stick with and complete this course, you will be armed with the baseline knowledge and attitude you need to be able to learn anything. Probably the most important skill you will learn is how to use all of your resources effectively, whether that is your classmates, teachers, reference pages, or Google. Mostly, Google. It will take a year or two before you get comfortable and stop feeling totally lost every day, but then you'll just start working on harder problems and you'll wind up more confused than you could imagine being now. Being good at computering is a long term process of reinforcing and building on the basic knowledge we will teach you in this course, and it will never end until you decide the computers have won. Don't let the computers win, and keep learning everything you can.

Hacker Attitude

Read this: http://www.catb.org/~esr/faqs/hacker-howto.html#what_is

It isn't perfect, but it will do for now until I write a new one.?The biggest problem with this is that the author, while once a famous hacker and important member of the open source movement, is a total asshole. None of the content is bad, but we are in the process of trying to write something to replace all of his content in this curriculum.

While there is a lot in there that is very interesting, the most important part is the hacker attitude.

  1. The world is full of fascinating problems waiting to be solved.

  2. No problem should ever have to be solved twice.

  3. Boredom and drudgery are evil.

  4. Freedom is good.

  5. Attitude is no substitute for competence.

These 5 statements provide a reasonable framework for how you should approach learning this material. It should be fun, we shouldn't be wasting your time, there should be multiple ways for you to succeed, and we are measuring success by your ability at the end.

Hacker Ethic

From the same site as the Hacker How-To comes this brief description of the hacker ethic. Again, I am in the process of writing something else, but for now this is good enough.?

Read it: http://www.catb.org/jargon/html/H/hacker-ethic.html

It breaks the hacker ethic into two main beliefs that complement one another:?

  1. The belief that information-sharing is a powerful positive good, and that it is an ethical duty of hackers to share their expertise by writing open-source code and facilitating access to information and to computing resources wherever possible.

  2. The belief that system-cracking for fun and exploration is ethically OK as long as the cracker commits no theft, vandalism, or breach of confidentiality.

A longer version of the hacker ethic comes from the famous book Hackers: Heroes of the Computer Revolution that you probably should read someday, but there is no rush. I haven't read the whole thing yet. ?

The Wikipedia article is pretty good so read it:?https://en.wikipedia.org/wiki/Hacker_ethic

They come out to six key beliefs:

  1. Access to computers?and anything which might teach you something about the way the world works?should be unlimited and total. Always yield to the Hands-On Imperative!
  2. All information should be free (Often a topic of debate, he means free as in speech, rather than free as in beer)?
  3. ?Mistrust authority?promote decentralization
  4. ?Hackers should be judged by their hacking, not bogus criteria such as degrees, age, race, or position.
  5. You can create art and beauty on a computer. The concept of "hack value" is doing something that is worth doing because of the "playful cleverness" required.?
  6. ?Computers can change your life for the better

RTFM

One of the key parts of this mindset is sharing knowledge with others. A great quote on the subject is 'There is?nothing noble?in?being superior?to your fellow man; true nobility is?being superior?to your former self.' ?Not to mention, the more you give back to the community, the greater the value you provide. If you're just starting off, you might not think you have anything to provide, but in fact, you're looking at the world with a different perspective than someone who has done it for years. For example, you can provide feedback on when training makes no sense or isn't as effective as it could be, and help make it easier for the next person to go through it. This site is a work in progress and the more feedback we receive the better it will be. ?

With that said, you're definitely going to have questions. There are nearly infinite resources out there, and it is rare that you wind up doing something no one has ever done before. If you think you are there, message someone or make a post in the forum so we can all look for resources, and congratulations. Before that you have google and people here to help you, and we will always try to help in any way that we can. One of the worst things about hacker culture is this idea that someone should ?Read the F-ing Manual? or ?RTFM?. The first recorded use of this was in a user manual for some program in 1979, so it goes way back. On first glance, RTFM is a great response for any question that should have been answered by a casual glance at the manual. The problem with this idea is that a large body of knowledge is usually required to understand the manual, and even before that, you need to know the manual exists. If you are taking this course, there is no possible way you can be expected to understand a manual because you are just getting started.

Man-Pages

The most common "manual" you will come across in this course and your travels through hackerdom are the man-pages that accompany every single aspect of the Unix operating system, and they are a great resource for people who have spent years learning how to understand them. Right now, you don?t have the knowledge to be expected to understand how they work, and that is fine. There is no pressure to know anything, but there is pressure to learn.?

The comic web site Xkcd is a nerd cultural treasure and you will see it referenced constantly. Read this comic

Alt-Text

You might be thinking to yourself... what is alt-text? Funny you ask that. Depending on your current browser, figure out how to view the web page's source code for https://xkcd.com/1692/. This might require some Googling. What you are looking at is hypertext markup language or HTML for short. HTML is the language that websites are made of. (If you already knew that, good for you, I promise that the rest of the course gets significantly more in depth.) You will learn more later, but for now, look at the code and find where the main picture is stored in the webpage. Now do you understand what alt-text means?

In Defense of RTFM

RTFM gets a bad rap for good reason, because it is usually used as a put down on someone who doesn't know much about a subject... with that said, once you have the knowledge to understand a topic, if you are using that software, you should read the manual. Even if you don't understand the manual, if you are going to ask a question, you might as well reference that you know the manual exists and that what you are asking is referenced, you just need clarification. If you ask questions effectively you will find you understand your initial question and the topic much better than if you had someone explain the answer to just your specific question.

Google

There are very very few questions you are going to ask that Google can't answer. But for right now, you probably don't even know what you should be googling for. Luckily, you have people here who can help you. One of the best questions you can ask people for is for search terms on a subject. That way they don't have to spend time explaining it, and you get all the benefits of doing the research yourself. You might already know some cool google tricks to get better results, but don't worry... we will teach you all of them until you are wise in the ways of Google Fu.

Questions

We expect you to be constantly coming across words, phrases, and entire concepts that you have never seen before and are totally lost in. When you have to get things done, you'll have to learn more about it and one of the best ways to get those holes in your knowledge filled is to ask questions.

Here are some guidelines for asking questions.

  • There is no such thing as a bad question, especially on this site
  • Write up your problem with as much information as possible
  • Describe your problem's symptoms in chronological order
  • Describe the goal, not the step you are on
  • Follow up with a brief note on the solution

You can private message us, post on the forum, throw it on Slack, whatever. No one here will ever get annoyed, because there is really no such thing as a bad question, just one you haven't researched enough.?Even if your question isn't related to our courses, we are happy to help.

If you're in person, just ask. It's faster than Googling and you'll get more out of it.?

We already told you what RTFM stood for, so now we're gonna have you do it.?

Visit this man-page and write down the first three things you don?t understand.?(I don't expect you to make it past the Name, "bash - GNU Bourne-Again SHell", there is so much to unpack in just that).

Then Google one of them and figure out what it is. Submit a sentence or two explaining the thing you didn?t know.??For the love of everything, don?t read any further once you are done with that. Remember Rule 3 of the Hacker Attitude, ?Boredom and Drudgery are evil.? If you're not getting anything out of something at any point in this course, don't do it, and leave us feedback that we are wasting your time. We mean that. You won't hurt our feelings.

Learning

Read this, it is a wonderful intro to the psychology of learning and where you are as a student https://azeria-labs.com/the-process-of-mastering-a-skill/.

We all want to better at learning... but how do we do that?

Relevant Comic: https://xkcd.com/1053/

The most important thing to realize while you are on this journey is that you will never know everything, because nobody knows everything. All you can do is keep working at things and eventually, you will start understanding more because you have a strong foundation to build on. We are here to help you build that foundation.

Brainwashing and Learning

Brainwashing

As we said before, hacking is a mindset, not a skillset. Sure you'll pick up plenty of useful skills along the way, but the primary benefit of the hacker mentality is being able to look at the world, see a problem you've never approached before, and figure out how to solve it. We are trying to cultivate that mindset, and yes, we are going to try to subtly brainwash you. We're not sorry about it. Genuine interest and drive are the two best indicators of success in this field, and we want to encourage it as much as we possibly can. How do we teach that? How do we measure that? We don't know. If we were pretentious losers we might say we're trying to hack your brain into becoming a hacker. But we're not. So lets call it brainwashing. Are you okay with being brainwashed?*

  • Note: This probably is not legally binding.

Continuous Learning

Learning this stuff isn't easy. The content is difficult, the scope of what there is to learn is tremendous, and the rate of innovation and change in this space makes keeping up seemingly impossible. If you are thinking right now that you'll never learn everything; you're right! There is an infinite amount to learn, so choose the stuff that interests you and learn that. This course is intended to give you a general base of knowledge so that you can succeed with anything you do, but if you want to be great you have to love what you're doing and keep getting after it. For the rest of your time computering, maintain a series of lists. I recommend a Google Sheets file with a bunch of tabs. These are just a few I recommend, I'm sure you'll make more.

  • Questions you don't know the search terms for
  • Questions that google can't answer
  • Things you want to learn how to do
  • Things you want to learn more about
  • Things you want to make or help make
  • Things you want to tell other people about or write about
  • Potential future reading material
  • Links to things you want to remember

We will do our absolute best to help you keep these lists short. There will be section in the Slack for random questions, from ELI5 style to "Make me a tutorial", or you can always just private message it.

Goals

"Complete this course, as defined as finishing all the content that applies to me, before____________"

With most of the goal already defined for you, what you need to focus on is the timeline you want to set for yourself.

Answer these questions:

  1. How much time a week do you want to spend working on this?
  2. How much time a week do you think you will actually have to work on this?
  3. When will you complete this course?

Submit your answers to these questions.

Virtualization

Building Your Own Lab

Introduction

Building your own home lab is important for a lot of reasons, but most importantly it is fun and teaches you a bunch of valuable information. In this section we will do some work securing our daily lives and install a virtual machine for us to work on. What you will be making is uniquely yours and will be something that you will work on and refine for the rest of your time doing the computers. This is your new workbench/hangout spot, so take pride in what you are making and make it yours.

Virtualization

Why do we use virtualization?

Read https://www.redhat.com/en/topics/virtualization

Write up a few sentences on the primary benefits of running a virtualized environment inside of your Windows machine.

Install VMWare

Install free virtualization software to run your virtual machine in!

I recommend VMWare player, as that has been what I have always used, however there are many alternatives, primarily VirtualBox and QEMU.

NOTE: If you already have one of these two installed, use them if you don't want to download an extra program to your computer. It will slightly change your experience, but everything that happens inside the VM will remain the same so it will not hurt your ability to learn.

https://www.vmware.com/products/workstation-player/workstation-player-evaluation.html

This should be very straightforward. When you are complete, submit a screenshot of VMWare (or whatever you decided to use). Use the Microsoft 'Snip' tool to forever change your screenshot game. Just type "Snip" into the search bar and it will appear.

Install Ubuntu

Install the Linux operating system Ubuntu using your virtualization software of choice! If you already have a VM with a Linux image on it, you don't need to download a new one just for this course. It will not change any aspect of your experience and there is no need to waste time or space.

An image is what we refer to an Operating System when packaged into a format that can be run off of a disc, usually having a .iso extension. We can download .iso's and boot off of the disc, but it's generally easier to use a VM.

https://www.ubuntu.com/download/desktop

I could give you more information on what to do for this, but there are a ton of tutorials and youtube videos out there. Should be an easy google, and the information doesn't change too much. Let us know if you have any problems, but I recommend going step by step through a tutorial. This is your first challenge that we are telling you to figure it out yourself.

alt text

Source: https://www.instagram.com/thesquarecomics/

We always try to link to the source of things, even dank memes. It's a weird thing to care about, but the internet makes it so easy to repost images without any way of crediting the author, and they're producing content so might as well throw them a follow.

When you're done, submit a screenshot of you running the Linux VM.

Install VMWare Tools

Your VM might have automatically done this for you, or perhaps your guide had you did this. If not, you need to install VMWare Tools for Ubuntu. If you are not using VMWare, skip this.

You need this for a lot of critical usability things, and it doesn't come pre-installed. You have most likely already seen prompts telling you to do this. Do it. I'll be honest, this can be kinda difficult sometimes, but you gotta figure your own way through this. Again, if you have any trouble, and this takes more than a half hour to figure out, call someone over or message us and we will help you out. There is no shame, I've had VMs before that I gave up trying to install VMWare tools and just sucked it up for a week. You'll be on this VM for a while, so you need to get it installed.

When complete, submit a screenshot that shows VMWaretools installed.

Ubuntu

Using the fantastic site LinuxJourney to learn about Linux history.

Then read, from the same section, Lessons 2 and 5. https://linuxjourney.com/lesson/linux-history

From Linux came Ubuntu, the most common of all Linux operating systems. Read about the OS. https://ubuntu.com/about

Now that this is yours,i it is time to personalize it.

Recommended Tasks:

  1. Change Wallpaper
  2. Install Google Chrome
  3. Install Unity Tweak Tool and do something interesting
  4. Install VLC Media Player
  5. Install GIMP and make me a meme. Post your meme in the Slack.

Linux Journey Command Line

Linux Journey is an amazing site that has the best guides on how to use Linux out there. Complete the class located at this link and submit a screenshot of the completion confirmation when you are done.

When working through all of these classes, do all actions listed on the page in your own browser and play around to see how they work. https://linuxjourney.com

Linux Journey Text-Fu

Complete the class located at this link and submit a screenshot of the completion confirmation when you are done.

https://linuxjourney.com

Linux Journey Advanced Text-Fu

Complete the class located at this link and submit a screenshot of the completion confirmation when you are done.

https://linuxjourney.com

Linux Journey User Management

Complete the class located at this link and submit a screenshot of the completion confirmation when you are done.

https://linuxjourney.com

Linux Journey Permissions

Complete the class located at this link and submit a screenshot of the completion confirmation when you are done.

https://linuxjourney.com

Linux Journey Processes

Complete the class located at this link and submit a screenshot of the completion confirmation when you are done.

https://linuxjourney.com

Linux Journey Packages

Complete the class located at this link and submit a screenshot of the completion confirmation when you are done.

https://linuxjourney.com

Linux Journey Filesystem

Complete the class located at this link and submit a screenshot of the completion confirmation when you are done.

https://linuxjourney.com

Linux Journey Boot the System

Complete the class located at this link and submit a screenshot of the completion confirmation when you are done.

https://linuxjourney.com

Linux Journey Kernel

Complete the class located at this link and submit a screenshot of the completion confirmation when you are done.

https://linuxjourney.com

Linux Journey Devices

Complete the class located at this link and submit a screenshot of the completion confirmation when you are done.

https://linuxjourney.com

Aliases

Create a temporary alias to save some typing on a frequently used command.

https://www.tecmint.com/create-alias-in-linux/

Then use bashrc to build a permanent alias using the same article. Read this article https://medium.com/@tzhenghao/a-guide-to-building-a-great-bashrc-23c52e466b1c to get an idea of some other things you can do with a bashrc. Your bashrc can be as complicated or simple as you like, and there is near endless customization possible. You will be able to carry this around between VMs with you to automatically personalize it as soon as you load in the bashrc so its just like home.

Bashrc is part of a group of files called dotfiles, so named because they have a dot in front of their names. This makes them "hidden" files in the Linux directory system. Dotfiles are almost always used to store configuration settings.

When you are done, submit the text of your bashrc file.

History

Using the history command and all the knowledge you have gained, pipe your command line history into a file and submit it. There should be a lot of things from your time doing LinuxJourney. We are doing this so that we can understand where our curriculum breaks down and where we need to go into greater detail so you don't get as lost.

Man Pages

Read this. https://www.cs.mcgill.ca/~guide/help/man.html Remember, if the man page doesn't help, googling the command and the word "usage" will usually get you where you need to be.

You are going to this for your next challenge!

Over The Wire: Bandit

Here it is: Over the Wire...

You might have heard of this before. It's the big one.

This is a classic set of challenges that every member of our team has fought through, and while it takes some time, you should have had enough experience to figure out what you need to do. It won't be easy, and it might not be the most fun, but completion of this challenge is the single greatest determining factor in whether or now you continue along this journey. This is where you have to grind it out, make things happen, get stuck, learn things, and really spend some quality time with man pages.

Let us know if you get stuck on any challenge for longer than a half hour, we will gladly point you in the right direction. And no cheating, as Hemingway once said, ?There is nothing noble in being superior to your fellow man; true nobility is being superior to your former self.? We like Hemingway. He was a big fan of boats and adventures. We are too.

While there are 25 Bandit levels, at this time we only expect you to be able to complete 1-13. They will be hard, but we know you can do them. The rest of the levels are saved for different places throughout the rest of the course.

Whenever you finish lessons, 1, 5, 10 let us know in chat! When you finish 13, let everyone know in Slack! If you ever get stuck on anything for more than a half hour, message us through whatever format you want and we will help you out! Don't worry, I have no problems giving you very specific instructions to get to the next stage. If your googling keeps popping up Bandit walkthroughs instead of references, use the search operator -"bandit" to clean up the search results.

Good luck!!!! We are not going to let you end your journey here!!!

Complete http://overthewire.org/wargames/bandit/.

History

We have learned about learning and the hacker mindset, and have begun to learn about Linux and set up our new virtual machine. You finished Bandit, and should feel fairly comfortable reading something technical, taking that new information, and then immediately applying it to solve a problem. But now we are at the most important and difficult part of the course, how computers work. Without an in depth understanding of how computers work from a fundamental level, you will not have the low level knowledge required to understand things as they occur. As you read a news article, watch a presentation, or find a new CTF problem, you need the ability to recognize patterns and have the baseline knowledge required to immediately know what is going on.

That doesn't mean you will understand everything, the point is to build your baseline so that you can constantly have a wide breadth of knowledge to draw from. Depth of knowledge will be learned in follow on courses and your own personal path. With a strong base, you will minimize the time you spend backtracking and relearning things, as well as minimize the time required to learn new concepts. Right now, this is your time to rabbit hole and spend some time so you know enough information to move forward and not worry about having to learn fundamental concepts as you go.

History of Computers

  1. How did mechanical computers work?
  2. What is a vacuum tube and how was it important to the development of computing?
  3. What is a transistor and how did it contribute?
  4. What is an integrated circuit?
  5. What is a semi-conductor?
  6. Discuss the rise of the personal computer.

Storage

Electricity

Storage Density

  1. Write a brief bit about the importance of storage density.
  2. How did Punch Cards work?
  3. How did magnetic tape work?
  4. How do floppy discs work?
  5. How do CDs work?
  6. How does flash memory work?
  7. How do USBs work?
  8. How do SSDs work?

Communication Basics

Telecommunication Basics

  1. Write a brief bit about the importance of bits per second.
  2. Write a couple sentences about what ARPANET was.

Representing Data 1

File formats (and networking protocols, and all sorts of other things on the internet) are defined in documents known as RFCS. Read through the .png format RFC and find where the magic number is defined. Nobody has this content memorized, but when they deep dive into a format or protocol, the RFC has the answers. https://tools.ietf.org/html/rfc2083

Any time you need to deal with a file format, google will provide most of the answers. If you need to dig deeper than that, go to the RFC.

  • Also, hey, what is ascii? This is ascii. https://learn.sparkfun.com/tutorials/ascii

    1. Do this <https://code.tutsplus.com/articles/number-systems-an-introduction-to-binary-hexadecimal-and-more--active-10848. Submit a screenshot showing your completion.>

    2. How many bits are used for each character in ASCII?

    3. "01101000 01100101 01101100 01101100 01101111 00100001" is in binary. Convert it back to ASCII. Do it by hand using the chart.

    4. Alright. Now. Convert 17 in Ascii to Binary and Hex. Do it by hand.

    5. Convert "Go Navy" to Octal, Hex, and Binary. Yes. By hand. Use Google to figure out how.

    6. What does "c2l4dHlmb3Vy" translate to from Base64?

  • It is annoying to do that by hand, but it does help. Here is a tool so that you never have to do that again. https://gchq.github.io/CyberChef/. Fun fact, it is released by GCHQ, Britain's version of the NSA. Great tool and very useful. There are about a thousand uses for this thing, you can find a bunch on GitHub.

Representing Data 2

  1. Submit pictures of the HW.
  2. Use this link to help create the jar file https://github.com/macagua/example.java.helloworld. Then make your own hello world gifar using the information in this Stackoverflow answer. https://security.stackexchange.com/questions/116819/beside-gifar-are-there-any-other-known-polyglot-files.
  3. While you are learning about polyglot files, you should learn about POC || GTFO. https://hackaday.com/2017/08/14/bibles-you-should-read-poc-gtfo/. They are very entertaining, though highly advanced. Download https://www.alchemistowl.org/pocorgtfo/pocorgtfo07.pdf and go read Chapter 6. It will open your mind to what is possible, and like all good pieces of education, will mostly serve to teach you how little you know.

Digital Logic

Processing

  1. Explain the importance of processor density.
  2. What does a 16 bit processor meaning? A 32 bit processor? A 64 bit processor?
  3. What is the difference between a 32 bit and 64 bit operating system? Can a 64 bit OS run on a 32 bit OS? How about vice versa?
  4. What version of Windows are you running? <https://support.microsoft.com/en-us/help/827218/how-to-determine-whether-a-computer-is-running-a-32-bit-version-or-64. This will primarily be relevant when installing programs.>
  5. How does a modern processor work?
  6. What is a CPU?
  7. What is a GPU? What makes it different from a CPU? What benefits does it have?

Hardware Basics

Hardware Basics

  • Using Google, explain all these things. Put it in a text file.
  1. Explain what a motherboard is
  2. PCI Slot
  3. CPU
  4. Why is a fan needed?
  5. RAM
  6. Hard Drive
  7. Optical Hard Drive
  8. Solid State Hard Drive
  9. Graphics Card

Machine Code and Assembly Code

In order to be executed on a CPU, code must be written in a way that is understood by the CPU. This is called 'Machine Code' and consists of 1s and 0s. As a note, there are various families of CPU architectures which require different machine codes to operate properly. Humans don't like 1s and 0s as much as computers so we prefer to abstract ourselves away from the bits as far as possible. The first step of this is something called an "Assembler". You can generally think of an assembler as a piece of code written for a specific type of CPU that does a 1 for 1 exact translation of code into binary that can be executed.

I like this video: https://www.youtube.com/watch?v=wA2oMRmbrfo

Assemblers do a 1 for 1 translation, but what if we are looking for something that can optimize or simplify the work needed to be done by the programmer? In that case we would need something called a compiler. A compiler is a computer program that translates computer code written in one programming language (the source language) into another programming language (the target language). This allows the programmer to save huge amounts of time and spend more time doing and less time working.

Hey, read this about our namesake Grace Hopper and the first compiler: https://history-computer.com/ModernComputer/Software/FirstCompiler.html

Watch this: https://www.youtube.com/watch?v=IhC7sdYe-Jg

Some day, you will probably write a compiler so all of the things you just learned about makes more sense to you. Or you can not. I did it once. Didn't get as much out of it as people told me I would.

What we went over was just the absolute basics of computer hardware. I did not spend any time on Machine Code and Assembly, and you will get destroyed by it the first time you see it. My recommendation, avoid anything involving machine or assembly code until after you have spent some dedicated time on the subject. This means, don't try to jump into any Reverse Engineering problems, for now.

Memory

Memory... where do we start. Few things are harder to wrap our heads around how it all works. This course does not pretend it will teach you everything you will need to know about memory, this is just giving you the tools you need to continue learning. With that said, pay attention here, and refer back to help understand things.

  1. What makes up primary memory and what is it used for?
  2. What is secondary memory and what is it used for?
  3. What do we need a cache for?
  1. What does RAM stand for?
  2. What makes RAM volatile?
  3. What happens when a computer is turned off?
  4. Read about a cold boot attack... how does that work? https://arstechnica.com/gadgets/2018/09/cold-boot-attacks-given-new-life-with-firmware-attack/

Plenty of cyber security purists will lose their mind if I do not acknowledge the existence of virtual memory and "the stack" during the section regarding memory. "The stack" is the region of memory, in RAM, where data is added and removed by processes. That is all you are going to learn in this course. All binary exploitation is dependent on in depth knowledge of "the stack"... and you won't be doing any binary exploitation during this course. Don't worry about it, soon you'll be "Smashing the Stack for Fun and Profit", but for now, you need to learn what an operating system does for you.

  1. What is the stack?
  2. What is the heap?
  3. What does memory allocation mean?
  4. Where is memory allocated?
  5. What does memory de-allocation mean?
  6. What happens when memory is de-allocated?

Operating Systems Part 1.

What is an operating system? From your current understanding, you have a pretty good idea about how to use Windows and Linux. However, what we are about to go over is what is actually occurring under the hood. For the every day user of a computer, there is no need to know just about any of this, but without a strong base in the things that operating systems do for you and how they do them, you'll have a lot of misconceptions and blind spots that will limit your ability to grow. The technical word for this is "abstraction". Operating Systems abstract away the requirement for end users to be able to program or know how to set up a network connection. Everything is handled for the average user by the Operating System... but you are no longer the average user and you are going to need to get everything you can out of the system that you are using. And that is why you need to understand operating systems. At some point you will likely take a class specifically on this, but for now, this gives you enough to be dangerous. In this section we will go over the basics of operating systems as well as work towards becoming a Windows and Linux power user.

Operating Systems

  • Work through this entire guide and answer questions as you go. https://www.tutorialspoint.com/operating_system/index.htm. You will also need to use other resources, I recommend wikipedia, but there are plenty of other amazing resources out there on this topic. During this section, I highly recommend you chat up teachers in order to ask questions and get clarification.
  1. Describe what an operating system (OS) is responsible for. This is a trick question, it's everything.
  2. What are the different types of OS? Which one is most common?
  3. What is a kernel? What does "abstraction" mean?
  4. What is the difference between user level and kernel level?
  5. What does an OS do with memory?
  6. What is process address space?
  7. What is "swapping"?
  8. What is fragmentation?
  9. What does de-fragmentation do? (Fun fact, modern operating systems will do this for you... just another thing abstracted away)
  10. What is multi-programming in regard to CPU execution?
  11. What is the difference between a program and a process?
  12. What is processor management?
  13. How does process scheduling work?
  14. What is a driver?
  15. What is device management?
  16. What is file management?
  17. What is an I/O operation? (Hint I/O stands for input/output)
  18. What is an interrupt?

Operating Systems Part 2.

  1. What is a file system?
  2. What is an API? Why are they useful?
  3. What is a directory?
  4. What is metadata? Why is it important to have metadata?
  5. What is disc partitioning?

History

Alright, that wasn't enough for most of it to make sense, but it's over now. Sorry to bore you with the rough stuff. Now we are on to the stuff that you will be able to immediately put into use, becoming a power user. The more you know about the operating system you work off of, the more efficient you will be, which lets you learn more and do more which makes you better, which makes you more efficient....

What I am trying to say is get really good at Windows and Linux and your life becomes better.

Here is an obligatory comic strip about "The Holy Wars", Windows, vs Linux. https://dilbert.com/strip/1995-06-24. You'll be starting with Windows. You've used it for the last decade or two of your life, but you ain't seen nothing yet.

Windows

Windows Command Line

Windows File Systems

OS CyberAces Tutorials

Processes

  • Services and Processes
    • https://tutorials.cyberaces.org/tutorials/view/1-2-9.html
    • https://www.online-tech-tips.com/windows-10/windows-10-task-manager-overview-part-i/
    • Virtual Memory
    • On Windows, check to see how much RAM you are using with your virtual machine. Google how to do this.
    • Check to see how much RAM is being used by your VM and what the CPU utilization looks like. Google again.
    • Increase RAM allocated to Virtual Machine.... Yep.
    • Check back on your VM to see CPU utilization.
    • Decrease VM RAM to whatever is necessary. Now you can use this whenever you want to prioritize the speed of processing in your VM. Just bump your VM RAM, run your process, then reallocate back to Windows once it is complete. Boom, you are basically an operating system now.

Boot Process

Logs

History

You should already feel fairly comfortable using Linux, time to learn a little bit more about the internals of the OS and continue your progress.

Command Line

Users and Groups

Applications and Services

Files and Permissions

Boot Process

Read this:

Logs

Read this:

Networking 1

Networking is the darkest art... and you may become an expert. Eventually. But all things considered, you will not be, and do not need to be an expert all the time. You become an expert on things when you need to be, when you have a challenge or a job or for whatever reason you need to become one of the world's leading experts in some bit of minutiae. There are people out there who are network wizards who do it for a living. Then there is everybody else who has to relearn everything every time they go in depth. What we will teach you here is scraping the minimum knowledge required to not need to Google everything. You will still Google everything, but this lets you get into the mix faster and will let you bullshit your way through most things. At the end of the day, you will never not need reference material and guides to work with networks.

  1. What is a packet? What is encapsulation and how does it work?
  2. What is a protocol? What are examples of protocols?
  3. What is the OSI model? What is the TCP/IP model? Why are they different?
  4. What is a MAC address? What is an IP address? What is the difference?
  5. Describe the client-server relationship.
  6. What are ports for? How are ports assigned?

Networking 2

  1. What is datagram forwarding? How do forwarding tables work?
  2. In MAC addresses, how can you tell who the manufacturer of the device is?
  3. What are multicast and unicast and what are the differences?
  4. What is a switch?
  5. Who assigns IP addresses?
  6. What is a LAN? How do IPs on a LAN communicate? How do IPs not on the same LAN communicate?
  7. What is packet fragmentation?
  8. What is the difference between IP forwarding and datagram forwarding?
  9. How does the internet backbone work? Use the word BGP in your answer.
  10. What is TCP and UDP, and what are the differences?

DNS

  1. What is DNS?
  2. Why does it exist?
  3. How does it work?

CyberAces Networking

Cyber Aces

Yeah it is CyberAces again. Sorry, I'm working on an alternative but for now it is pretty damn good. When you finish a tutorial, screenshot it and submit.

  1. Introduction and Layer 1 https://tutorials.cyberaces.org/tutorials/view/2-1.html
  2. Layer 2 - Data Link https://tutorials.cyberaces.org/tutorials/view/2-2.html
  3. Layer 3 - Network, Part 1: Addressing & Masking https://tutorials.cyberaces.org/tutorials/view/2-3.html
  4. Layer 3 - Network, Part 2: Routing https://tutorials.cyberaces.org/tutorials/view/2-4.html
  5. Layer 3 - Network, Part 3: Communication https://tutorials.cyberaces.org/tutorials/view/2-5.html
  6. Layer 4 - Transport https://tutorials.cyberaces.org/tutorials/view/2-6.html
  7. Layers 5 & 6 - Session and Presentation https://tutorials.cyberaces.org/tutorials/view/2-7.html
  8. Layer 7 - Application https://tutorials.cyberaces.org/tutorials/view/2-8.html
  9. Inter-Layer Communication & Conclusions https://tutorials.cyberaces.org/tutorials/view/2-9.html

Wireshark

* Work through the NewBoston Wireshark tutorial. No need to watch all of it, or at regular speed. Try 1.5 speed (or 2x) and bounce around to learn as much as you can. *

I'm sorry. This deserves its own thing but I haven't made it yet.

RFCS 1

RFCs or Request for Comments, is the way that the internet develops standards. Read this to learn more: https://www.lifewire.com/what-is-internet-request-for-comments-rfc-4092366

Now the important thing is how to read an RFC.

  1. Is this an official RFC? What RFC did it update?
  2. What does this RFC give guidance on how to do?
  3. What are the 5 families of response status codes?
  4. What is a GET request and what does it look like?
  5. What is a User-Agent?
  6. What RFC guides "cache-control" in a header?

RFCS 2

  • Skim the DNS RFC to answer questions. I won't give you the RFC for this, go find it.
  1. What is the format of a DNS Resource Request (RR) datagram?
  2. What does RDATA do?
  3. How many bytes (not octets) can be placed in an experimental NULL RDATA format?
  4. How many bytes are messages carried by UDP restricted to?
  5. What is the TC bit?
  6. Would you describe the TC bit as... boolean? What is a bool?
  7. In the header of a message, how many bits from the ID field is the TC bit?

Congratulations, you are, at this exact moment in time, the world's 2nd most knowledgeable person about TC bits. Alright, now time to forget that and move on to learning more important things, like reading the "Standard for the Transmission of IP Datagrams on Avian Carriers" for fun. I promise this one is shorter. https://www.rfc-editor.org/rfc/rfc1149.txt

TCP-IP Book

TCP-IP Book

The book TCP-IP Illustrated is the bible. You should buy it at some point. For now, just use this copy. http://www.r-5.org/files/books/computers/internals/net/Richard_Stevens-TCP-IP_Illustrated-EN.pdf. I had a hard copy for a while, but I left it behind with my security team when I graduated. I hope it's getting good use now. Anyway, any time you have a question about a protocol, find it here, and do some Google. Together, you are unstoppable. There are two other books in the series, but this is the book that you will use the most.

Conclusion

Networking is really hard, but hopefully this exposure gave you enough. The biggest takeaway you can have is using Google and RFCs effectively to solve your problems. The good news is that when it comes to network problems, someone has already seen it before and asked the question. And, as the joke goes, it is always a DNS problem.

History

Read all of this.

  1. Should I have questions for this? Yes? Did I make them yet? No.
  2. For your response, submit 5 questions that you think would do a good job of assessing someone's knowledge.

How it Works Hosting

  1. Should I have questions for this? Yes? Did I make them yet? No.

  2. For your response, submit 5 questions that you think would do a good job of assessing someone's knowledge.

  3. Submit IP, then the domain of all IPs associated, and the owner.

How it Works Registrars

How it Works- Internets

How it Works- Websites

  1. Should I have questions for this? Yes? Did I make them yet? No.
  2. For your response, submit 5 questions that you think would do a good job of assessing someone's knowledge.
  1. What is a 404 response?

Chrome Power User

  1. What is a 404 response?

Internet Power User

Privacy and Security

Privacy vs Security

I should go more into this, but for now, I have two articles for you to read.

Tracking

Search Engines and Tracking

We just taught you about Google hacking, immediately followed by tracking. Go to Google, search for "learn how to hack" and click on the UBlock symbols and look at how much tracking is going on at a single page.

Now go to https://duckduckgo.com/ and search for "learn how to hack". Now click the Ghostery and UBlock extensions? You should notice a difference.

Duck Duck Go cares a lot about privacy. It doesn't have as good search results as Google, but they're not bad. Some people swear by it. Me, I don't really care about Google selling my soul for better advertising. Sorry internet purists. Use Duck Duck Go if you want to be more private, as well as any time Google's algorithms decide that the thing you are searching for is wrong and you should be searching for some slightly related topic that is in the news at the time and shares search terms.

Wireshark

  • What is a packet capture?

A packet capture is the recording of all information that goes across your network. Preferably before you take this course you have some sort of networking experience, but what you really need to know is that it is possible to record all information that crosses a specific point in the path and then play it back so that an investigator can see everything that happened. If you don't have any networking experience, you can get away with learning as you go for the basics, but eventually you might want to become an expert so that you can crush these problems. Packet captures usually have the file extension .pcap or .pcapng, and are primarily opened with a tool named Wireshark.

  • Work through the NewBoston Wireshark tutorial. No need to watch all of it, or at regular speed. Try 1.5 speed (or 2x) and bounce around to learn as much as you can.

https://www.youtube.com/playlist?list=PL6gx4Cwl9DGBI2ZFuyZOl5Q7sptR7PwYN

I'm sorry. This deserves its own thing but I haven't made it yet.

Wireshark is an amazing tool, install it in both your native Windows and your VM.

Databases

I don't know how I want to teach databases in the long term, but for now, just know that when we need to store information, most of the time the best way to do that is using a database using a structured query language. Here is a tutorial that does a good job of teaching the basics of this language.

https://mystery.knightlab.com/walkthrough.html

When complete, submit a screenshot.

How to Type

This is not required... but you should learn how to do it.

This is an investment in your productivity, the faster you can type, the better your life will be. This goes for everything you will ever do on a computer. I'm still learning how to do this. So many hours wasted.

  1. Submit a screenshot of the completion for this, and work to continue doing this for the rest of your damn life.

I'll be honest. I don't do this. I have a very fast words per minute hunting and pecking with all fingers. My hands look like demented spiders when I type. It's not great. I know I should force myself and someday I will.

Programming Languages

There are plenty of people out there who say you can be good at computers and cyber security without knowing how to program. Those people are wrong. Sorry for being a jerk about it.

If you can't program, you are going to spend a horrible amount of time clicking things and manually doing things that should be automated. Of course, there are exceptions for people with very specific skillsets, but for everyone else, a working knowledge of programming and the ability to script anything will carry you as far as you need to go. You will always be learning and forgetting basic parts of the languages you work with, but it becomes easier to get back into an old language or learn a new one every time. But before you can start writing your own malware and machine learning pipelines, it's time to learn the basics of programming, Git, HTML, and get proficient with Python.

Programming Languages

This is important. Try to really understand the breadth of what programming languages are.

  1. In your own words, describe what a program is.
  2. In your own words describe what a programming language is.

Git Hello World

Open Source

You might have heard of Open Source before, as there has been an infinite amount written about the subject, but this is a good place to learn about it. Open source and hacking go hand in hand. You might not feel strongly about it now, but you will eventually.

  1. Explain what open source is

Github

Github is an amazing website build around an old tool named 'git'. Git is used for version control during software development, allowing collaboration and the merging of changes in a safe and easy manner. It is used by just about everyone and is amazing. If you want to build large pieces of software, you need to use version control. Github is a website that wraps git and allows you to share your code via their website, as well as letting you download other people's code.

  1. Send us a link to your github.io site.
  2. Send us a link to your first project.

Python

There are hundreds of languages out there, but the language we are going to start with is Python. Python is a fairly simple and easy to learn language, but more importantly, is fast to write and allows advanced you to throw together scripts whenever you need them. There are a ton of great security references and plugins to the language and it allows you to accomplish just about anything you could need to do using just one language. In the future you will learn plenty other languages, but for right now, Python will suffice.

This is going to take a while, but Codeacademy Python is the best way I've found to learn a first programming language. It is all done in an online editor and will let you progress with the appropriate hints.

NOTE: If you already know a programming language and don't need to re-learn what a tuple is, or are already learning Python using a different site or course, let us know. We can customize your experience here, there is no hard rule you have to use Code Academy.

Keep us updated in chat on your progress, we will be reaching out to you too. When you are done, submit a screenshot of your completion certificate!!

So you know a language now, right? Congratulations! The thing to remember is that all skills, if not used, will slowly atrophy. My recommendation is to constantly challenge yourself to maintain your skill level so when you have to write a program, you can whip something up immediately without having to relearn the syntax... or you can just ignore it completely and when the need arises, spend a half hour fumbling until you remember enough to get it working. Both of those are completely valid ways to maintain proficiency in a language. This course won't teach you any more languages, but if you continue in this pipeline you will learn C and some low level assembly.

Python from the Terminal

You are a big bad programmer now, but it has all been done in your browser! Time to learn how to do it from the terminal on your computer(s). This might require some googling..... don't worry, that is literally how programming works. You find something you need to do, and google how to do it. Then you forget how to do it, and you go and google it again the next time you do it. The next bit will help you set up your python environment in your OS's. Setting up environments is very time consuming, no matter what it is, but you will have to do this for basically every language, and every version of each language, so you will have to get good at it.

Windows

  1. What is a path? You might have to google around to understand it. Hint: If you mess this up, things get interesting.
  2. Submit a screenshot of you running a .py file from the command line in Windows!

Linux

  1. Submit a screenshot of you running a .py file from the command line in Linux!
  1. Submit a screenshot of you running a bash command from inside a python script.

Programming and scripting are different, but share most of the same principles, and these principles will be shared between all languages. Once you can program well in one language, you can learn any language, it just will take a bit to learn.