Printable View
Howdee all
I wanna get into computer security, and I can get access to some spare PC's, and I'm wondering if I can set up a security lab for me to practise some basic hacking skills on... Be it a few Linux machines and Windows Machines
I'm good at the social engineering side of things, just I would like to pick up on my tech side of things
Thanks :)
Is this considered a really bad or really good attempt at social engineering? It boggles the mind. Too stupid to mask the attempt, or so smart they know to appear un-informed?Quote:
I'm good at the social engineering side of things
If you have the hardware... sure, you can setup a lab. I have 2 desktops running win or *nix and a laptop that can be connected to the network either wirelessly or wired. Not much to it really. I have a Linksys 802.11g wireless router and a cable modem. So I can test my own systems from the inside, or go to a free wap and test from the outside. But you should get the WAP owner's permission before testing from there. (make friends with the local coffee shop owner)
So, setup your network... hit the bookstore, google, this site, etc... Just don't ask "How do I hack into hotmail" or "my friend's ip is xxx.xxx.xxx.xxx can someone here hack it for me?"
And for software, the gnu development tools are a necessity. Nmap, snort, all those tools. pick up a linux distro like slackware and most importantly: read read read
Ok, You can run a wargame on almost any system (and in a few easy steps, too)
Step1) Get a 50 Gig hard drive (for a few OSs and later patches)
Step 2) Clean install the OSs you want to try and 'hack' (may I reccomend Debian[sarge|woody|potato|, *BSD, and possibly Windows)
Step 3) 'hack' into the system, after you do, google for bugs relating to what you did. If they exist, patch, and try again. If not, report them and continue.
It would be awesome if you were willing to do this for the AO community ;)
I would recommend that you take great care setting up any public box where you invite people to play around. They WILL try to do nasty things to it.
Running it directly on physical hardware is a liability in itself, as someone who gains root access and potentially damage the hardware.
Network setup needs to be done very carefully, to prevent unauthorised egress from the systems - even if they are comprimised (as may be the intention). Otherwise you will rapidly finding your systems festering irc-bot bounce servers full of unauthorised proxies and warez dumps.
Finally you need to ensure that denial of service is not easy - otherwise (from my experience), you will get people turning up with the sole purpose of denying you and anybody else who might want a go, any service at all.
Slarty
Just quarantine the system from any other computers in your network. He did say he was going to use old hardware, so I don't think it would matter much if anyone 'damaged' it.
Kez,
Try this PDF on creating a home security lab:
http://www.giac.org/practical/GSEC/R...liott_GSEC.pdf
Also check out this Word document about creating a security lab with virtual machines:
www.giac.org/practical/Edwin_Hart_GSEC.doc
Have fun hacking yourself :D
mjk
How advanced do you want to get?
I would set up 2 boxes, both dual booting Windows and Linux, and a separate box running whatever you want to act as sort of a monitor. Run Ethereal to capture the interactions between the machines. Watch the interactions from all sides. Watch how they talk to each other. Scrutinize the logs from the attacked machine. Make sure you you actually understand what you are reading. Look into more than just basic exploits. Set up anything that would require server based authentication (ex: access a shared (password protected) file on one machine from the other), and watch the interaction as your "legitimate user" accesses something on the network.
Once you've had your fill of this, set up a webserver, have some fun, and move on...
haha, I just realised that, it could be taken either way, but d/w, I'm smart, but I am uninformed about the tech side of things. And no, it wasnt an attempt at social engineering :)Quote:
Originally posted here by annihilator_god
Is this considered a really bad or really good attempt at social engineering? It boggles the mind. Too stupid to mask the attempt, or so smart they know to appear un-informed?
I'm not doing anything illegal by setting up a hacklab in my basement am I?
And it's not going to be hooked up to the net as yet, as I only have 56/k :P, but once i get ADSL, I'm more than happy to allow AO memebers to access it :)
If you're using it by yourself or with those that visit? NoQuote:
I'm not doing anything illegal by setting up a hacklab in my basement am I?
Be careful of this option. Opening it up to those that you don't know can be risky and your goodwill may be used as an opportunity to attack others. There can be some serious legal implications that you'd be responsible for if you do set it up without appropriate "legal mumbo-jumbo". So you may want to reconsider this option. It's not to say that AO members would do it but we have no mechanism to verify the "ethics" of some of the members.Quote:
And it's not going to be hooked up to the net as yet, as I only have 56/k :P, but once i get ADSL, I'm more than happy to allow AO memebers to access it
I would first start by using those few pc`s you have access too to get a firm grip on both penetration testing and securing accordinly.Then Set up a network and have friends take a stab at it. I mean you did say you where just starting out....right?
I mean something like this would require a fair amount of time on your part ya know?
So i would just say pick up on your tech side of things first because if your not knowledgable (fully)on the basic penetration Techinques,exploits,etc... of your chosen OS`s your hacklab will be "owned" in no time.
If you still need more info on seting up your own lab, check out his site, good resources
http://security.itworld.com/4354/031...ab/page_1.html