【サイバーセキュリティ 実践】Boot2Root CTFチャレンジで学ぶハッキングの手口とローカル特権昇格

Master Penetration Testing & Credential Access: A Hands-On CTF Course

This comprehensive course dives deep into the tactical and technical aspects of penetration testing and CTF (Capture The Flag) challenges, specifically focusing on information gathering and credential access. Learn practical techniques to simulate real-world cyberattacks against vulnerable systems, building skills to defend against them.

Who is this course for?

This course is ideal for:

• Beginners exploring ethical hacking with platforms like TryHackMe and Hack The Box.
• Individuals seeking to improve their CTF skills and consistently solve "user.txt" flag challenges.
• Infrastructure and development professionals looking to build in-house security assessment capabilities.
• Those preparing for industry-recognized certifications like OSCP, eCPPT, and eJPT.

What You'll Learn:

This course utilizes Kali Linux as its primary operating system and provides a step-by-step approach to attack methodologies on a variety of virtual machines hosted on:

• TryHackMe: (3 machines - Easy, Medium)
• Hack The Box: (3 machines - Easy, Medium)
• VulnHub: (1 machine)
• VulnUni: (Linux)

Key Penetration Testing Techniques Covered:

• Information Gathering: Master techniques like bash scripting (using cat, grep, awk), port scanning, and file sharing service reconnaissance (SMB, NFS, FTP).
• Credential Access: Learn to exploit vulnerabilities through:
  • Login Form Brute-Forcing (using Hydra)
  • Directory Traversal & Double Slash Attacks
  • Exploit Code Modification (parameter adjustments, Python 2.7x to 3x compatibility)
  • File Upload Filter Bypass
  • HTTP Manipulation with Burp Suite (local proxy)
  • Metasploit Framework utilization
  • PHP/WebShell Deployment
  • Reverse Shell Establishment & Stabilization
  • Meterpreter Reverse Shells
  • SSH with Private Keys
  • Web API Fuzzing
  • SQL Injection (including Time-based Blind SQLi)
  • Website Crawling with OWASP ZAP Spider
  • DirtyCow for Vertical Privilege Escalation
  • PATH Variable Manipulation for Privilege Escalation
• Advanced Topics:
  • Passive & Active Attack Vectors
  • Compilation of Many Breaches (COMB) List
  • Rabbithole Spoiler Techniques
  • Esoteric Programming Language (esolang) Exploitation
  • Forum Utilization
  • Hash Tables & Rainbow Tables

Course Updates:

This course is actively maintained and updated. Recent additions include:

• July 31, 2023: Expanded coverage of file sharing (SMB, NFS, FTP) and privilege escalation techniques on TryHackMe: Kenobi and VulnHub: VulnUni. Includes topics like SetUID file analysis, Kernel Exploit execution and transfer, system version enumeration, and more.
• November 28, 2021: Initial release with foundational modules on VulnHub: VulnUni, covering topics like horizontal and vertical privilege escalation, system version enumeration, user flag file discovery, interactive shell establishment, phpWebShell, SQLi, and more.

Important Disclaimer:

This course is for educational purposes only. The tools and techniques presented are for authorized use only, with explicit permission and consent from system owners. This course does not endorse or encourage illegal activities. Always ensure you have proper authorization before conducting any security assessments.