HAGAHA DHAMMAYSTIRAN EE ETHICAL HACKING-KA IYO AMNIGA INTERNET-KA (CYBERSECURITY)

Mawduuca amniga internet-ka (Cybersecurity) iyo Ethical Hacking wuxuu maanta ka mid yahay xirfadaha ugu muhiimsan uguna baahida badan adduunka. Qoraalkan wuxuu kuu noqon doonaa buug-gacmeed koooban oo aad mar walba tixraaci karto.

1. Waa Maxay Ethical Hacking?

Ethical Hacking (Hacking-ka Sharciga ah ama Sharafta leh) waa nidaam si sharci ah loogu dhex jaro nidaamyada kumbuyuutarrada, mareegaha (websites), iyo shabakadaha (networks).

• Ujeeddada ugu weyn: Waa in la helo daldaloolada amniga (vulnerabilities) ka hor inta aysan helin kooxaha burcadda ah (Black Hat Hackers), ka dibna la saxo oo la xiro daldalooladaas.

• Farqiga Amniga: Ethical hacker-ku wuxuu leeyahay oggolaansho qoraal ah (permission) iyo heshiis ka hor inta uusan hawsha bilaabin, halka hacker-ka xun uu si sharci darro ah ku galo nidaamyada si uu wax u xado ama u waxyeelleeyo.

Noocyada Hackers-ka

Hackers-ka waxaa loo qaybiyaa dhowr qaybood iyadoo loo eegayo ujeeddadooda iyo sharciga ay ku shaqeeyaan:

2. Shanta Waji ee Ethical Hacking (The 5 Phases)

Hawlgallada ethical hacking-ku iskama dhacaan ee waxay maraan shan tallaabo oo nidaamsan oo midba midka kale ku xiran yahay:

` ` ` steps

1.Reconnaissance (Xog-ururin):Wajiga 1aad.

Waa ururinta macluumaadka ku saabsan bartilmaameedka (target-ka). Waxaa loo qaybiyaa:

• Passive Recon: Ururinta xogta adigoon si toos ah u taaban nidaamka (sida raadinta Google, LinkedIn, ama DNS records).

• Active Recon: La macaamilka tooska ah ee nidaamka si loo helo xog dheeraad ah.

2.Scanning (Baaritaan):Wajiga 2aad.

Halkan waxaa loo adeegsadaa aaladaha (tools) si loo ogaado mashiinnada shaqaynaya (live hosts), dekedaha furan (open ports), iyo adeegyada ku dhex shaqaynaya ee nugul.

3.Gaining Access (Galitaanka Nidaamka):Wajiga 3aad.

Waa marka hacker-ku uu ka faa'iidaysto nugulaanta uu helay (exploit) si uu u dhex galo nidaamka, isagoo helaya mudnaan koontarool (privileges).

4.Maintaining Access (Sii Haynta Galitaanka):Wajiga 4aad.

In la abuuro waddooyin dambe (backdoors ama trojans) si loogu soo laaban karo nidaamka xataa haddii la xiro kombuyuutarka ama la beddelo furayaasha amniga.

5.Clearing Tracks (Masaxidda Raadka):

Wajiga 5aad.

Tirtiridda log-yada (system logs) iyo wixii faylal ah oo uu hacker-ku reebay si aan loo ogaan in nidaamka la soo galay.

3. Ethical Hacking vs Penetration Testing: Farqiga rasmiga ah

In kasta oo labadan erey inta badan loo isticmaalo si isku mid ah, haddana waxa ka dhaxeeya farqi weyn oo dhanka baaxadda iyo ujeeddada ah:

• Ethical Hacking: Waa dallad weyn oo koobaysa dhammaan xeeladaha, weerarada, iyo farsamooyinka amniga lagu difaaco (Software, hardware, social engineering, physical security). Waa geeddi-socod joogto ah (Continuous monitoring).

• Penetration Testing (Pen Testing): Waa mashruuc si gaar ah loo qorsheeyey oo diiradda saara hal nidaam ama hal daldaloolo si loo tijaabiyo awoodda difaaca muddo gaar ah (sida 2 toddobaad ama 1 bil).

Matalaad dabiici ah: Ethical Hacker-ku waa khabiir amniga guriga ka shaqeeya oo maalin walba hubiya darbiyada, qufullada, albaabada iyo daaqadaha si guud. Penetration Tester-ku waa qof loo soo kireeyey hal ujeeddo oo kaliya — inuu isku dayo inuu guriga u jaro asagoo isticmaalaya daaqad gaar ah oo dhabarka dambe ku taal si uu u tuso mulkiilaha in meeshaas laga soo geli karo.

4. Kala Shubaalnaanta Aaladaha (Tools Comparison)

Aaladaha loo isticmaalo garoonkan waxay u kala bixi karaan labo qaybood oo waaweyn marka loo eego ujeeddada shaqada:

A. Aaladaha Penetration Testing (Weerar toos ah iyo Jebin)

• Metasploit Framework: Waa aaladda ugu caansan adduunka ee loo isticmaalo in lagu fuliyo weerarada (exploitation) marka nugulaan la helo.

• John the Ripper / Hashcat: Aalado loo isticmaalo in lagu jebiyo furayaasha sirta ah (Password Cracking).

• Sqlmap: Aalad si otomaatig ah u baarta oo u fulisa weerarada nooca SQL Injection ah ee lagu khalkhalgeliyo xog-kaydiyayaasha (databases).

• Social-Engineer Toolkit (SET): Qalab loo isticmaalo in lagu sameeyo weerarada fekerka dadka lagu khiyaaneeyo (Phishing).

B. Aaladaha Ethical Hacking (Difaac, Baaris, iyo Maareyn Guud)

• Nessus / OpenVAS: Aaladaha noocan ah waxaa loo yaqaannaa Vulnerability Scanners. Waxay baaritaan guud ku sameeyaan boqolaal kumbuyuutar si ay u soo saaraan liiska daldaloolada amniga ee u baahan in la tirtiro (Patching).

• Splunk / Wireshark: Aaladaha lagu falanqeeyo xogta dhex maraysa shabakada (Network Traffic) iyo ururinta log-yada amniga si loo ogaado haddii weerar uu socdo.

• Checkmarx / SonarQube: Aaladaha lagu baaro nidaamka software-ka inta ay injineeradu dhisayaan (Code Analysis) si loo hubiyo in software-ka shirkaddu leedahay uusan ku dhalan wax daldaloolo ah.

5. Master Roadmap: Guriga ka billow (Self-Taught Path)

Si aad adigu gurigaaga kaga barato xirfaddan adoo adeegsanaya kombuyuutarkaaga, raac afartan weji ee habaysan:

Wejiga 1aad: Aasaaska IT-ga (The Foundations)

• Baro Shabakadaha (Networking): Faham IP Addresses, Subnetting, OSI Model, iyo protocols-ka caanka ah (HTTP, DNS, TCP/IP).

• Baro Linux CLI: Linux waa nidaamka ay ku dhex shaqeeyaan inta badan aaladaha hacking-ka. Baro basic commands-ka iyo Bash scripting.

• Aasaaska Amniga: Faham sir-goynta (Encryption), hashing, iyo firewalls.

Wejiga 2aad: Dhisidda Laboratiri-gaaga (Home Lab)

• Virtualization: Soo degso VirtualBox ama VMware.

• Attacking OS: Ku dhex rakib mashiinnadaas Kali Linux ama Parrot OS (oo ay ku diyaarsan yihiin aaladaha sida Nmap, Burp Suite, iyo Metasploit).

• Targets: Soo degso mashiinno ula kac ah loo jebiyey si aad ugu tababartato, sida Metasploitable.

Wejiga 3aad: Ku Tababaro Platform-yada Gamified

• TryHackMe: Waa meesha ugu fiican ee qof bilow ah ka bilaabo, waxay leedahay hage tilaabo-tilaabo ah.

• Hack The Box (HTB): Markaad TryHackMe ka soo qalin-jabiso, HTB waxay kuu dhisaysaa fekerkaaga xal-raadinta (real-world labs).

• PortSwigger Web Security Academy: Meesha ugu fiican ee lagu barto hacking-ka mareegaha (Web Application Hacking) 100% bilaash.

Wejiga 4aad: Codeynta & Shahaadooyinka

• Python: Baro si aad u qorato scripts otomaatig ka dhigaya baarista ama ka faa'iidaysiga daldaloolada.

• Shahaadooyinka Caanka ah: Ku billow CompTIA Security+ (Aqoonta guud), ka dibna u soco CEH, eJPT, ama tan ugu ixtiraamka badan ee OSCP (Offensive Security Certified Professional).

Xusuusin Dahabi ah: Farqiga kaliya ee u dhexeeya ethical hacking iyo hacking-ka dambiga ah waa Oggolaanshaha (Authorization) iyo Anshaxa (Ethics). Waligaa ha isku dayin inaad tijaabiso aaladahan adigoon oggolaansho cad ka haysan mulkiilaha nidaamka.