Εισαγωγή
Το μάθημα «Hacking και Cybersecurity» είναι ένα εκπαιδευτικό πρόγραμμα που επικεντρώνεται στην προστασία από κυβερνοεπιθέσεις, ενώ παράλληλα εισάγει τους μαθητές στις βασικές έννοιες της ψηφιακής εγκληματολογίας και της Τεχνητής Νοημοσύνης.
Οι συμμετέχοντες θα πραγματοποιήσουν ελέγχους ασφαλείας σε διαδικτυακές εφαρμογές, θα εξερευνήσουν ευπάθειες που μπορούν να οδηγήσουν σε μη εξουσιοδοτημένες ενέργειες και θα μάθουν να εφαρμόζουν την Πολιτική Ασφάλειας Περιεχομένου (Content Security Policy – CSP). Επιπλέον, θα γνωρίσουν τους μηχανισμούς ασφαλείας των δημοφιλέστερων προγραμμάτων περιήγησης και έννοιες όπως SSTI, SOP, CORS, Server-Side Request Forgery και Path Traversal.
Πρόγραμμα μαθήματος
1Lesson 1. Introduction, Concepts, CMD, BAT, Virus Overload Memory
An introduction to the world of security, the capabilities of the computer and the operating system
thanks to which we can do more than play and browse the Internet, understanding how the
operating system works.
2Lesson 2. Social enginering, Zip Bomb
Social Engineering is an interesting topic, with a minimum of technical skills, we are able to break
into places and computers by politely asking for it. The master of social engineering in the field of
hacking is Kevin Mitnick, we will learn "how did he make people give him their passwords
themselves"
3Lesson 3. Invisible Mode, Folder and File Floading
A good virus is one that is hidden and hard to find, so it's harder to get rid of. We will discuss the
so-called invisible mode in the operating system so that it is not visible at all that our application is
running! In addition, we will present the Folder and File Flooding attack.
4Lesson 4. DOS, DDOS
Discussion of DoS and DDoS network attacks - from the basics to the consequences of network
attacks. During the lesson, we will learn in practice how to perform such attacks and ways to
defend against DDoS.
5Lesson 5. Phishing
Phishing is a very dangerous attack on the user to steal data. What data is intercepted by the
burglar? This is what the student will learn during the lesson about Phishing and why it is so
dangerous. The students will also prepare a desktop application imitating a phishing attack.
6Lesson 6. HTML
This lesson introduces the HTML language that is used to create web pages. During the course,
we will look at creating websites from the point of view of a person dealing with security and will
use HTML to create a dangerous website.
The lesson is two-part and in the first stage we will focus on HTML, then we will add Javascript and
CSS
7Lesson 7. CSS, JS
Javascript and CSS are an inseparable partner of HTML presented in lesson 6. Today's lesson will
be divided into 2 parts - a shorter one related to CSS where we will try to make copies of the
student's panel and a longer one related to Javascript and its capabilities, the knowledge of which
is very useful in the world of cybersecurity.
8Lesson 8. Phishing part 2
Students will use the knowledge from previous lessons to create a clone page of a selected
website (e.g. Discord) enriched not only with the visual layer (the so-called frontend) but also with
the application logic to attack the unaware user.
9Lesson 9. Proxy, VPN, Tor, Deep Web
A technical lesson on networking topics and how it can be done more consciously and safely, and
an introduction to alternative networks that are hidden.
10Lesson 10. Cryptography and Cryptanalysis. Password security. Brute Force and Dictionary Method
Password security is a key issue - during this lesson, the student will learn in practice why it is so
important and how it is currently implemented.
11Lesson 11. Kali Linux online. Information Gathering
The lesson has two goals - The first is to install the Kali Linux system and show how to virtualize it,
and the second goal is to prepare before an attack and what reconnaissance is, i.e. to learn as
much as possible about our target - we have many techniques for this purpose and also software
that is useful for this.
12Lesson 12. Kali Linux Password Cracking
Cracking passwords is a difficult but interesting job. With appropriate knowledge, technology and
software, we can make this process much easier. During the lesson, we will learn about the
software, various password cracking techniques and additionally use Kali Linux.
13Lesson 13. Kali Linux - DDOS
Overview of a network attack that makes it difficult to use a given computer or server, causing other
users to have problems. During the classes we will learn why this happens and what software,
which can be found in Kali Linux, we can use to do this.
14Lesson 14. Keylogger
Do you know what a Keylogger is or can you guess what it might be? During this lesson, you will
write your own! We will discuss how and why it works and present some of the history of the
keylogger (interesting!). In more detail, how the keylogger was created, how it developed, and we
will also present some interesting ideas for using the keylogger.
15Lesson 15. Remote computer access, SSH
During the classes, we will learn about access to computers that are far away from us or we simply
do not have a keyboard and mouse for them. There are several ways to get to such a machine and
in today's lesson we will discuss this topic and solve the problem of gaining access.
16Lesson 16. Miscellaneous or a cat in a sack
There is a saying not to buy a cat in a bag, because we never know what we will get and it is a
mystery to us, just like hacking, which is always a surprise for us and we can find a lot of
interesting things - this lesson is an invitation for a deeper dive into attacks, especially on web
applications and preparing to solve hacking exercises.
17Lesson 17. Wireshark expert
In modern websites, apart from classic communication via the HTTP protocol, there is
something else. In fact, few people know that many websites use an additional mechanism
called WebSocket. What will we use it for and how can it be hacked? This is what you will
learn in today's lesson. We will also show a real Pentester recruitment task.
18Lesson 18. Real Hacker Tasks
It's time to use the knowledge you have acquired, but also to learn something new and invite you to continue your adventure as an ethical hacker! In today's lesson, we will face the challenge of pages with tasks that are... different and from many very interesting topics.
19Lesson 19. Hiding viruses in other applications (Binders)
During the lesson, we will discuss technical aspects of how to hide applications in other
applications, how it works and how such software is written. We will write an application
that will be hidden, for example, in a popular PDF reader.
20Lesson 20. Code obfuscation
The topic seems very complicated at first glance and the word probably doesn’t tell you anything.
This is one of the methods of optimizing and accelerating the operation of code written by
programmers, but unfortunately also used by criminals to complicate the analysis of the virus code
and make it unreadable (obfuscated) for anti-virus software.
21Lesson 21. My First Ransomware
Ransomware is one of the most dangerous threats for IT security. In this lesson, we will
present why it is the most dangerous and write the mechanism that is hidden in every
ransomware.
22Lesson 22. DNS, Hosting and publishing websites on the Internet
The Internet is the largest network of computers ever created and is constantly growing.
During the classes, you will learn how it works that after typing the website
www.codinggiants.com you can get to the appropriate page. You will learn the entire path
of your request to view the page and how criminals try to modify and attack various
elements of this process.
23Lesson 23. Cookies and cookie stealing
"This website uses cookies..." In this lesson, we will discuss why each website informs us
that it uses cookies, why such a message appears on the website, and whether cookies are
really so dangerous. Spoiler: cookies are safe... unless someone knows how to steal them
and knows what to do with them, and this will be shown in the lesson.
24Lesson 24. Web Hacking - DVWA Installation. Command Injection
“A very vulnerable web application” - Presentation of an application for practicing
(safe!) attacks on web applications. Application of knowledge in practice and
discussion of various vulnerabilities that may be detected in websites and web
applications.
25Lesson 25. Web Hacking – XSS
Every programmer makes mistakes sometimes, some of them are costly, such as
XSS. Today, we will exploit a hole in the software
26Lesson 26. Web Hacking – SQL Injection
Advanced websites use databases to store content, and programmers make
mistakes that allow access to the database directly, and thus to things that should
remain hidden from the average user.
27Lesson 27. Web Hacking – CSRF and File Uploader
In web applications, the above vulnerability is rated 10 out of 10 on the
"problematicness" scale, i.e. Remote code execution (on the server) is the worst
error that can occur in an application - students will practice how it works and why.
28Lesson 28. Kali Linux - Password Security. Dictionary Attacks. Attacks with Rainbow Table
Can you come up with a secure password that's easy to remember? Which
password is more secure - DifficultPasswordToRemember or maybe
P@ssw0rd1!@# ? From this lesson you will learn and understand how passwords
are cracked using various methods and thus how to use and manage passwords
safely.
29Lesson 29. Kali Linux - ARP Spoofing
Let’s listen to what is happening on the network, i.e. eavesdropping on computer
networks and various Sniffing and Spoofing techniques, so that we can receive
information that is not intended for us.
30Lesson 30. DNS Spoofing
The aim of the lesson is to show what a DNS Spoofing attack is and how to perform
it in internal Wifi networks.
31Lesson 31. HTTP vs HTTPS. SSL Strip
The Internet is keeping up with the modern world. Now, it secures and encrypts
communication between the computer and the server, so that intermediaries cannot
find out what is currently being sent. In the previous lesson, we discussed
techniques for intercepting network traffic, but now how to decrypt it? The MITM
attack will help us with this, but more about that during the lesson...
32Lesson 32. Attacking Wifi, Wep and Wpa Networks, Twin Evil 2.0 Attack
Wifi is an interesting example of the development of technology and the method of
delivering the Internet. This also creates new opportunities for attacks and
eavesdropping. During the classes, methods of securing the network and how to
prevent unauthorized access will be discussed in detail. We will present an error in
the implementation of a certain function that allows access to the network in a
maximum of 10 minutes.
33Lesson 33. Hacking Mobile applications
Do you use your smartphone a lot? During the classes, we will analyze how to get to the mobile
application and check what is inside and how it works - we will look at the source code of the
Android application and try to familiarize ourselves with various tools in order to disassemble such
an application into its first parts.
34Lesson 34. Break in!
There is work to be done - today we will use our knowledge of networks, virtual machines, and
password cracking to gain access to the computer which is waiting to be conquered. We will go
through the process of analyzing the virtual machine that has been delivered and check what can
be done to gain access.
35Lesson 35. Metasploit
Kali Linux has many interesting built-in tools that are used by pentesters, but the most
interesting ones are always left for the end and this is the metasploit package (framework),
which has a lot of possibilities and at one time was absolutely enough to do practically
everything with the computer - Windows, Linux or MacOS were not a problem for it...
36Lesson 36. Metasploit and friends - Msfvenom and Armitage
The Metasploit package is very extensive and contains a lot of interesting facts, but also
add-ons written by the community. Today, during classes, we will learn two new elements of
metasploit - msfvenom, which allows us to easily prepare payloads for easy hacking, and
armitage, which will allow us to more easily manage the attack process.
37Lesson 37. First steps in forensic section
During the classes, we will familiarize ourselves with the concept of "Capture the Flag". Students will learn where they can practice and develop their knowledge on prepared tasks safely and most importantly, LEGALLY.
38Lesson 38. Burp Suite Community
Introducing a tool to facilitate analysis and vulnerability discovery. With it, we can identify vulnerabilities that may allow us to carry out unauthorized operations. All this can be done using Burp Suite Community.
39Lesson 39. Burp Suite Community part 2
We will conduct a real web application security test. We will identify vulnerabilities that may allow us to carry out unauthorized operations. All this can be done using Burp Suite Community
40Lesson 40. Chrome Dev Tools
Students will analyze the source code of an application using only the browser and its built-in
tools.
41Lesson 41. Content Security Policy (CSP)
Students will learn about the security mechanism present in popular web browsers.
Additionally, they will explore how to implement CSP in HTTP headers and directly in HTML
code.
42Lesson 42. Same-Origin Policy i Cross-Origin Resource Sharing (CORS)
Students will familiarize themselves with the basic defense mechanism of browsers
(SOP) and understand why CORS is needed. They will also attempt to bypass these
security measures.
43 Lesson 43. Web Application Reconnaissance
During the lesson, we will explore methods for gathering various types of information about a given system.
44 Lesson 44. Cross-Site Scripting (XSS) Vulnerability
During this lesson, knowledge of XSS will be expanded as we delve into XSS DOM. We will practice real-life examples of reflected, stored, and DOM XSS vulnerabilities.
45Lesson 45. SQL Injection Vulnerability
The goal of the lesson is to review and extend knowledge of SQL Injection, and to learn new techniques for detecting this vulnerability in web applications. We will utilize the training platform PortSwigger during the classes.
46Lesson 46. Code Injection i Command Injection
In lesson, students will be introduced to another security learning platform called
bWAPP and expand their knowledge of injection vulnerabilities. This will include a
review of command injection and an introduction to code injection in PHP as well as
blind injection.
47Lesson 47. Path Traversal Vulnerability
The goal of this lesson is to practically use terminal and command line skills to test the
security of web applications, specifically focusing on path traversal.
48Lesson 48. OAuth 2.0
This lesson focuses on securing access to resources (e.g., files or web pages) from
unauthorized access or inappropriate access rights. The second goal of the lesson is to
learn about OAuth 2.0 and explain how login systems, such as "login with Google,"
work.