Luyện nói tiếng Anh bằng Shadowing qua video: 10 open source tools that feel illegal...
C1
There are three types of computer people in this world.
209 câu
Nếu các câu quá ngắn hoặc quá dài, hãy bấm Edit để chỉnh sửa.
1
There are three types of computer people in this world.
2
Users, programmers, and hackers.
3
The user just wants boring software to make boring spreadsheets to get boring stuff done at work.
4
But in their naivety, users often get penetrated by hackers with high levels of riz,
5
who employ social engineering to steal personal data,
6
intimate photos, and crypto wallets.
7
But then you've got programmers.
8
They're the unsung heroes who make all the software in the world work,
9
but they too get penetrated by hackers.
10
If a programmer leaves the back door open to their mainframe,
11
it could lead to catastrophic consequences that cost them their job and their employer billions of dollars.
12
The lesson to be learned here is that you want to be the one doing the penetrating,
13
not some stranger in a foreign country who doesn't even care about your feelings.
14
In today's video, you'll learn the fundamentals of ethical hacking
15
and pen testing by looking at 10 free and open source tools that you can use right now,
16
all of which are available by default on Kali Linux,
17
a distro optimized for ethical hacking.
18
By the end of this video,
19
you'll be a legit wannabe hacker who can take down entire nations,
20
but if you like to do bad things,
21
you need to turn this video off right now.
22
The tools in this video,
23
if used non-consensually, it could break many international laws that land you in prison.
24
So never do penetration testing on a website or network without permission.
25
But now that all the bad guys have clicked off this video,
26
let's learn how to use some of the most powerful and dangerous hacking tools.
27
To follow along, I would highly recommend installing Kali Linux,
28
and the desktop version is awesome.
29
Although Microsofties can install it via WSL,
30
or if you don't want to use Kali,
31
you can just install each one of these hacking tools individually.
32
But the best way to get started is to spin up your own virtual private server on Hostinger,
33
the sponsor of today's video.
34
Their platform gives you the power
35
and flexibility to run anything you want without locking you into a complicated and expensive cloud platform.
36
You can run a basic Linux server like Arch with powerful hardware like NVMe SSD storage and AMD Epic chips.
37
You can easily manage containers with a Docker VPS and their free Docker manager,
38
or self-host entire back-ends like Supabase with a single click and zero config nightmares.
39
But today, I'm using Hostinger to run Kali Linux,
40
and after launching the VPS with just a few clicks,
41
I can SSH into it with my password,
42
and now our hacking journey begins.
43
The first tool you need to know about is Nmap.
44
It's like the peeping Tom in your neighborhood who looks through all the windows in your house without actually breaking in.
45
On a network, like the one you're connected to right now to watch this video,
46
there's likely multiple hosts connected to it,
47
like your computer, your PlayStation, and your smart lock.
48
And the purpose of Nmap is to map out a network.
49
It does this by sending packets over an IP range,
50
then analyzes their responses to figure out which ports are open,
51
which operating systems they use,
52
to help you find backdoors to exploit.
53
Like if grandpa misconfigured something on his network,
54
you can hack his printer to send him a message.
55
To use it, simply use the nmap command,
56
followed by an IP address you have access to,
57
like your local network, or even a URL that you have permission to penetrate.
58
If we do that on a website,
59
you'll notice we get the IP address back,
60
and it found that ports 80 and 443 were open.
61
That's pretty cool, but we can also do a more aggressive scan,
62
with the A option.
63
This will not only scan the network,
64
but also try to detect the operating systems,
65
and will use something called tracer route to track the path of the packets across the entire network,
66
which can help detect misconfigurations that we can exploit.
67
If you're interested in packets though,
68
another tool you'll need to know about is Wireshark.
69
It's like that guy at a party who tries to eavesdrop on every conversation.
70
It allows you to inspect what's happening on the network at a microscopic level.
71
You'll want to use the GUI on this one because it collects tons of data from hundreds of different protocols,
72
which are all captured in real time and can be analyzed offline.
73
For example, if you record the traffic on your network right now
74
and notice all this weird traffic going to an IP address in North Korea,
75
you can inspect the actual payload and might find out
76
that they have access to those photos that were intended for only you and your future ex-wife to see.
77
And now you might be radicalized and ready to fight back.
78
Metasploit is perhaps the most powerful hacking framework out there.
79
It's like a Swiss army knife with an AK-47 attached to it
80
that allows even the most unskilled script kitty to launch an attack.
81
For example, we might be able to gain access to a Windows machine with a reverse shell,
82
thanks to the EternalBlue vulnerability.
83
Open up the Metasploit console and search for EternalBlue.
84
That should bring up a list of potential Windows targets.
85
We know that Grandpa is still on Windows 7,
86
so let's go ahead and use that exploit.
87
From there, we can set a payload to use a reverse shell,
88
and configure the local host to our own IP address.
89
And then finally, run the exploit command.
90
Congratulations, you just made a successful penetration.
91
You can now access all the files on this computer,
92
change the desktop background, and install even more malware.
93
But Metasploit is almost too powerful,
94
and if you use it,
95
you'll miss out on a lot of cybersecurity learning opportunities.
96
The next tool you need to know about is Aircrack.
97
Like the name implies, it's for hacking those magical invisible packets floating around in the air called Wi-Fi.
98
When you're at Starbucks enjoying a soy latte coding a Node.js app,
99
there could be a guy behind the dumpster using Aircrack who just ran the AirMon command,
100
followed by AirDump, to find your network as the perfect target.
101
He then proceeded to run AirCrack to crack the Wi-Fi protected access key
102
and can now pull all the packets out of thin air floating on this network.
103
If you're connected to a regular unencrypted HTTP website,
104
your sensitive data could be intercepted.
105
That's why you always want to make sure to use HTTPS when submitting forms with personal data,
106
because even if a hacker intercepts those packets, they'll be encrypted.
107
Luckily, though, the cops just arrested this guy,
108
because using aircrack on a network without permission is highly illegal.
109
But now, it's time to talk about passwords.
110
Normies who watch Hollywood movies think that hackers get access to the mainframe by running some program that cracks their password.
111
I could launch a cyber nuke,
112
but it'll completely fry his system.
113
And believe it or not,
114
Hollywood movies about hacking are 100% accurate.
115
Kali Linux has multiple password cracking tools,
116
like John the Ripper and Hydra,
117
but the easiest tool to learn in my opinion is Hashcat.
118
First though, it's crucial to understand that nobody in their right mind stores a plain text password in a database.
119
Instead, passwords get hashed with a one-way algorithm,
120
like SHA or bcrypt, then salt them with another random string to make them even more difficult to crack.
121
Now, even if somebody steals the database,
122
it's still almost impossible to reverse engineer the hash back to the original password.
123
The key word here, though, is almost.
124
Let's imagine I found this hash for the president's login credentials to access the Nuclear Armageddon launch button website.
125
Hashcat allows us to run a variety of different strategies to figure out the original text value of this hash.
126
Like, we could try to brute force every possible string combination,
127
but a more common technique is to use a file like rocku.txt,
128
which contains over 14 million common passwords.
129
Once we have that, we can then use Hashcat and specify a hashing algorithm,
130
which in this example is MD5 because it can be cracked in just a few seconds,
131
but in real life with a hashing algorithm like bcrypt,
132
it might take multiple days to go through the rocky file.
133
In any case, it looks like President Camacho used a weak password and forgot to enable 2FA,
134
which means it's finally time to kick off Armageddon.
135
But you might be wondering how I even found this top secret website.
136
Skipfish is a tool for finding vulnerabilities on websites.
137
It will recursively crawl an entire website,
138
and in the process, scan for vulnerabilities like cross-site scripting,
139
SQL injection, and other web application screw-ups.
140
It provides this nice HTML report,
141
and what's awesome about it is that if you've already hacked a username and password,
142
you can provide those credentials to also crawl the deep web beyond what's available to the public.
143
Then when you find vulnerabilities,
144
you can use tools like cross-site scriptor to install worms,
145
just like my hero Sammy did to MySpace back in 2005.
146
Now, in order to be a successful cyber criminal,
147
you need to think like law enforcement,
148
and use their tools like Foremost,
149
a forensic data recovery tool built on a process called file carving.
150
Imagine you got access to a hard drive in Area 51 somehow,
151
but all the data is gone.
152
Well, if they did a quick format and didn't overwrite the data,
153
it can likely be recovered with Foremost.
154
It doesn't even need a file system,
155
and will scan the entire disk image byte by byte,
156
looking for unique patterns like the bytes at the beginning of a header to identify a JPEG.
157
When it finds the corresponding footer,
158
it can then reconstruct an image that you were never supposed to see.
159
And that's why when you end up with two shots to the back of the head,
160
it'll be ruled a suicide.
161
At this point, we know how to map networks,
162
websites, and hard drives, but the golden goose for any hacker is a database,
163
which can be sold form an arrow on the dark web.
164
A SQL map allows you to scan a website
165
or server to find all the databases and map out their schemas with all the tables and columns.
166
Once you have that information,
167
you can start launching SQL injection attacks,
168
where you submit forms with raw SQL statements in them to try to trick their server into running that code.
169
Or better yet, print that code out
170
and paste it on the front of your car and blow through a bunch of speed cameras.
171
But a more common attack nowadays is denial of service.
172
You probably know how to ping a website in Linux,
173
but in Kali Linux, you can use HPing3,
174
along with the flood option,
175
to send packets as fast as possible to an IP address,
176
without waiting for replies.
177
This can flood a server with traffic and grind it to a halt,
178
or cost the developer millions of dollars if they host on a serverless platform.
179
When used on one machine,
180
it's just a basic DOS attack,
181
but if you distribute it across a botnet of all the machines that you've hacked already,
182
it then becomes a DDoS attack,
183
yet another great way to embark on a magical journey to prison.
184
But the sad reality of hacking is that most people are victimized by those they trust.
185
Like, I trusted Prince Hyman Cholo to transfer my inheritance after I gave him my checking account password,
186
but he took all my money and went to a phish concert.
187
The social engineering toolkit in Kali Linux allows you to create
188
your own sophisticated phishing attacks using a variety of attack vectors like email,
189
QR codes, SMS text messages,
190
Arduino IoT devices, and of course websites.
191
In fact, the tool can even clone a website,
192
which you can then host on your server,
193
and when someone finds it and enters their email and password,
194
it goes directly to you instead of PayPal.
195
But that entire attack was accomplished without writing any JavaScript code.
196
And with that, we've looked at 10 dangerously powerful tools for hackers in Kali Linux.
197
But we've barely scratched the surface,
198
and you'll also want to learn about John the Ripper,
199
Nikto, Burp Suite, just to name a few.
200
Actually, you know what?
201
Forget I ever said anything.
202
Nobody should know about any of these tools,
203
so go ahead and look into this device real quick.
204
I am just a figment of your imagination.
205
All right, guys, you just watched a tutorial about Enterprise Oracle Forms with Microsoft Silverlight.
206
Make sure to smash that like button and subscribe for more benign and totally not illegal programming content.
207
Huge thanks to Hostinger for sponsoring,
208
and make sure to check out their platform to get the best deal on your own virtual private server in the industry.
209
Thanks for watching, and I will see you in the next one.
Tải Ứng Dụng
Có tính năng chấm điểm câu của bạn bằng AI
TRENDING
Phổ biến
Tại sao nên luyện nói với video này?
Luyện nghe nói qua video là một phương pháp hiệu quả giúp bạn cải thiện kỹ năng giao tiếp tiếng Anh. Video này cung cấp nội dung hấp dẫn về việc hack không gian mạng, giúp bạn hiểu rõ về những công cụ mã nguồn mở. Qua đó, bạn có cơ hội thực hành mô phỏng cách diễn đạt và từ vựng liên quan đến công nghệ thông tin, điều này rất có ích trong bối cảnh giao tiếp chuyên nghiệp. Việc luyện nói sẽ giúp bạn tự tin hơn khi thảo luận về chủ đề công nghệ và hack, giúp bạn nâng cao khả năng sử dụng tiếng Anh trong các tình huống thực tế.
Ngữ pháp & Cách diễn đạt trong ngữ cảnh
Trong video này, người nói sử dụng một số cấu trúc ngữ pháp và cách diễn đạt thú vị. Dưới đây là một số điểm nổi bật mà bạn có thể lưu ý:
- Imperative sentences (Câu mệnh lệnh): Những câu như "install Kali Linux" và "never do penetration testing without permission" thể hiện cách yêu cầu hành động một cách rõ ràng và mạnh mẽ. Điều này rất quan trọng trong giao tiếp khi bạn muốn truyền đạt sự khẩn cấp hoặc cảnh báo.
- Complex sentences (Câu phức): Nhiều câu có cấu trúc phức tạp được sử dụng để giải thích ý tưởng một cách chi tiết, như "if used non-consensually, it could break many international laws." Điều này giúp người học thấy được cách kết nối các ý tưởng và thông tin khác nhau trong một câu.
- Colloquial expressions (Cách diễn đạt thân mật): Người nói cũng dùng một số cách diễn đạt thân mật, như "take down entire nations," giúp mang lại sự sinh động và gần gũi cho nội dung. Cách này rất hữu ích trong việc cải thiện phát âm tiếng Anh chuẩn và khả năng nghe hiểu của bạn.
Các bẫy phát âm thường gặp
Khi luyện nói tiếng Anh, bạn có thể gặp một số từ hoặc cụm từ phát âm khó trong video này. Dưới đây là một số điểm cần chú ý:
- Penetrated vs. Penetrating: Hai từ này dễ bị nhầm lẫn khi phát âm. Người học cần chú ý đến âm tiết và cách nhấn âm để tránh nhầm lẫn.
- Network và Nmap: Từ "network" có âm đầu 'n' nhẹ và không nhấn mạnh, trong khi "Nmap" lại cần được nhấn mạnh hơn. Điều này giúp người nghe dễ dàng nhận biết được bạn đang nói về gì.
- Consent: Từ này có thể dễ khiến người học phát âm sai nếu không chú ý. Hãy luyện tập phát âm đúng âm đầu 'c' để âm thanh nghe rõ ràng hơn.
Việc luyện nghe nói qua video không chỉ giúp bạn tăng cường từ vựng mà còn hứa hẹn sẽ mang lại những trải nghiệm thực tế trong việc ứng dụng tiếng Anh. Hãy bắt đầu luyện nói ngay hôm nay để trở thành một người nói tiếng Anh tự tin.
Phương Pháp Shadowing Là Gì?
Shadowing là kỹ thuật học ngôn ngữ có cơ sở khoa học, ban đầu được phát triển cho chương trình đào tạo phiên dịch viên chuyên nghiệp và được phổ biến rộng rãi bởi nhà đa ngôn ngữ học Dr. Alexander Arguelles. Nguyên lý cốt lõi đơn giản nhưng cực kỳ hiệu quả: bạn nghe tiếng Anh của người bản xứ và lặp lại to ngay lập tức — như một "cái bóng" (shadow) đuổi theo người nói với độ trễ chỉ 1–2 giây. Khác với luyện ngữ pháp hay học từ vựng bị động, Shadowing buộc não bộ và cơ miệng phải đồng thời xử lý và tái tạo ngôn ngữ thực tế. Các nghiên cứu khoa học xác nhận phương pháp này cải thiện đáng kể phát âm, ngữ điệu, nhịp điệu, nối âm, kỹ năng nghe và độ lưu loát khi nói — đặc biệt hiệu quả cho người luyện IELTS Speaking và muốn giao tiếp tiếng Anh tự nhiên như người bản ngữ.