🔐 نقشه راه امنیت سایبری و هک اخلاقی
مسیر جامع از مبتدی تا Penetration Tester حرفهای
⚠️ هشدار قانونی: تمام تکنیکهای آموزش داده شده فقط برای اهداف آموزشی و تست امنیت سیستمهای مجاز است. هک غیرقانونی جرم است و پیگرد قانونی دارد. همیشه مجوز کتبی داشته باشید!
🎯 پیشنیازهای ضروری: شبکه (TCP/IP، پروتکلها)، سیستمعاملها (Linux/Windows)، برنامهنویسی (Python, Bash)، مفاهیم وب (HTTP, DNS). بدون این پایهها، یادگیری امنیت دشوار است.
سطح 1
مبتدی
مبانی شبکه
- TCP/IP Model
- OSI Model
- IP Addressing & Subnetting
- پروتکلها (HTTP, DNS, FTP)
- Wireshark Basics
- Packet Analysis
لینوکس پایه
- Command Line Basics
- File System Navigation
- Permissions & Users
- Package Management
- Bash Scripting Intro
- Kali Linux Setup
مفاهیم امنیتی پایه
- CIA Triad
- Threat, Vulnerability, Risk
- Authentication & Authorization
- Encryption Basics
- Social Engineering Awareness
- Security Policies
برنامهنویسی پایه
- Python Basics
- Bash Scripting
- Regular Expressions
- File I/O
- Network Programming Intro
- Automation Scripts
سطح 2
متوسط
Reconnaissance
- Information Gathering
- OSINT Techniques
- Google Dorking
- Subdomain Enumeration
- DNS Reconnaissance
- Shodan & Censys
Scanning & Enumeration
- Nmap Port Scanning
- Service Detection
- Version Detection
- Vulnerability Scanning
- NetBIOS Enumeration
- SNMP Enumeration
Web Application Security
- OWASP Top 10
- SQL Injection
- XSS (Cross-Site Scripting)
- CSRF
- Directory Traversal
- Burp Suite Basics
Network Security
- Firewall Concepts
- IDS/IPS
- VPN
- Network Segmentation
- Wireless Security (WPA/WPA2)
- Man-in-the-Middle Attacks
سطح 3
پیشرفته
Exploitation
- Metasploit Framework
- Exploit Development Basics
- Buffer Overflow
- Shellcode
- Return-Oriented Programming
- Privilege Escalation
Web Exploitation پیشرفته
- Advanced SQL Injection
- Blind SQL Injection
- XXE (XML External Entity)
- SSRF
- Deserialization Attacks
- Authentication Bypass
Post-Exploitation
- Maintaining Access
- Lateral Movement
- Credential Dumping
- Pass-the-Hash
- Pivoting
- Data Exfiltration
Wireless Hacking
- WiFi Cracking (WEP/WPA/WPA2)
- Evil Twin Attacks
- Bluetooth Attacks
- Rogue Access Points
- Aircrack-ng Suite
- WiFi Deauthentication
سطح 4
تخصصی
Active Directory Attacks
- AD Enumeration
- Kerberos Attacks
- Golden/Silver Ticket
- DCSync Attack
- Pass-the-Ticket
- Bloodhound
Mobile Security
- Android Security
- iOS Security
- Mobile App Pentesting
- Reverse Engineering Apps
- API Security Testing
- Mobile Malware Analysis
Malware Analysis
- Static Analysis
- Dynamic Analysis
- Debuggers (GDB, x64dbg)
- Reverse Engineering
- Sandbox Analysis
- Indicators of Compromise
Cloud Security
- AWS Security
- Azure Security
- S3 Bucket Misconfigurations
- IAM Attacks
- Container Security
- Serverless Security
سطح 5
حرفهای
Red Team Operations
- Advanced Evasion Techniques
- C2 (Command & Control)
- Cobalt Strike
- Living off the Land
- APT Simulation
- Purple Team Exercises
Exploit Development
- Assembly Language
- Advanced Buffer Overflows
- Heap Exploitation
- Kernel Exploitation
- 0-day Development
- Exploit Mitigation Bypass
Threat Intelligence
- Threat Hunting
- MITRE ATT&CK Framework
- Cyber Kill Chain
- IOCs & TTPs
- SIEM & Log Analysis
- Incident Response
تخصصهای پیشرفته
- Binary Exploitation
- IoT Security
- ICS/SCADA Security
- Blockchain Security
- Bug Bounty Hunting
- Security Research