Koki.

🛡️ Security Zone

Home turf for an Information Security major: a learning path, practice platforms, and fun crypto tools — all within legal and ethical bounds: CTF competitions, authorized labs and your own sandbox.

🎮 Warm up with a game first: a mini CTF on this site (6 flags to find) →

📍 Beginner's guide: from zero to hero

Six steps from absolute zero to independent security research. Each step defines what to learn, what to practice, and what counts as passing — check them off as you go.

Progress：0/6

0%

Stage 0 · Starting village

⏱ 1 week

Learn

  • ▸What security engineers actually do: offense, research, compliance — three paths
  • ▸Memorize three red lines: the law, unauthorized testing is illegal, white-hat mindset
  • ▸Play this site's 6-level CTF challenge and feel the joy of finding hidden info

Practice

  • ▸Clear all 6 levels of the [mini CTF](/challenge)
  • ▸Open F12 on any website and explore its HTML, requests and responses

🎯 Passing bar：6/6 challenge flags, and you can explain to someone what a flag is

Stage 1 · The three foundations

⏱ 1-2 months

Learn

  • ▸Networking: the TCP handshake, every field of an HTTP request/response
  • ▸Linux: 30 everyday commands (ls/cd/grep/chmod/nc) — install Ubuntu in a VM
  • ▸Python: variables, control flow, functions, requests — security's first language

Practice

  • ▸Chat with a classmate over nc; request a website with curl and explain every response header
  • ▸Write a Python script that downloads the first 10 images from a website

🎯 Passing bar：Explain an HTTP message without notes + a runnable scraper of your own

Stage 2 · Web security basics

⏱ 2-3 months

Learn

  • ▸The OWASP Top 10 vulnerability classes (see the cards below)
  • ▸Burp Suite: intercept, modify, replay
  • ▸Labs: DVWA low→medium, all challenges

Practice

  • ▸Complete this site's SQL injection and XSS hands-on labs
  • ▸PortSwigger Academy free labs — at least 10 per week

🎯 Passing bar：All DVWA low-level challenges solo, and you can explain SQLi and XSS

Stage 3 · CTF practice

⏱ ongoing

Learn

  • ▸The five categories: Web / Reverse / Pwn / Crypto / Misc — start with Web and Misc
  • ▸The toolchain: CyberChef, Wireshark, Ghidra, one at a time
  • ▸Writeups: every stuck challenge gets read AND reproduced

Practice

  • ▸Finish picoCTF's beginner problems, then move to platforms like HackTheBox
  • ▸Join a CTFtime event weekly — goal: 3 challenges solved solo

🎯 Passing bar：3 solo solves in an official competition, with your own writeup

Stage 4 · Pick your specialization

⏱ 3-6 months

Learn

  • ▸Choose one road: Web security / reverse engineering / binary exploitation / pentesting
  • ▸Study systematically: Web→all of PortSwigger; reversing→classic books
  • ▸Reproduce 1-2 historical CVEs locally, following the advisories

Practice

  • ▸Produce a 'signature work': a deep vulnerability analysis or a self-built tool
  • ▸Join authorized SRC (vulnerability response platform) testing programs

🎯 Passing bar：Your first signature work: a report, a tool, or a deep technical article

Stage 5 · Going deep (the grave)

⏱ long-term

Learn

  • ▸Vulnerability discovery: code auditing, fuzzing, protocol analysis
  • ▸Secure development: write code others can't break (SDL)
  • ▸Red-team view: internal networks, evasion, cloud security — always authorized

Practice

  • ▸Find real bugs in open-source projects and disclose responsibly
  • ▸Earn a CVE, or become a top white hat on an SRC platform

🎯 Passing bar：Your first officially confirmed vulnerability — officially 'in the grave'

🗺️ Learning path

  1. 1

    The three foundations

    1-2 months

    Networking basics (be able to explain TCP/IP and HTTP properly), everyday Linux commands, and Python scripting. Everything else is castles in the air without these.

  2. 2

    Web security basics

    2-3 months

    Start from the OWASP Top 10: SQL injection, XSS, CSRF, file upload. Work through the free PortSwigger Academy labs with Burp Suite as your sidekick.

  3. 3

    CTF practice

    ongoing

    Start with picoCTF, then move to platforms like HackTheBox or TryHackMe. Join a competition from CTFtime every week — begin with Web and Misc challenges.

  4. 4

    Pick a specialization

    long-term

    Web security / reverse engineering / binary exploitation (pwn) / cryptography / pentesting — go deep in one. In security, depth beats breadth.

  5. 5

    Stay on the right side

    lifelong

    Practice only on CTF platforms, authorized labs, and your own environments. Technology protects — it doesn't break.

🛡️ OWASP Top 10 at a glance

The ten classic web vulnerability classes: one-line principle + defense. Each pairs with a lab or learning platform.

1SQL Injection

User input is concatenated into SQL — bypass logins, dump databases.

🛡️ Defense：Parameterized queries / prepared statements

2XSS (Cross-Site Scripting)

User input rendered as HTML — steal cookies, phish.

🛡️ Defense：HTML-entity-encode output + CSP

3CSRF

Trick the victim's browser into forged requests acting as them.

🛡️ Defense：CSRF tokens + SameSite cookies

4SSRF

Make the server fetch malicious URLs — probe internals, read metadata.

🛡️ Defense：Allowlist validation of request targets

5File upload flaws

Lax upload filters — plant a webshell.

🛡️ Defense：Allowlist extension/MIME + rename + isolated storage

6XXE (XML External Entities)

External entities in XML parsing — read files, hit internal networks.

🛡️ Defense：Disable external entity resolution

7Insecure deserialization

Deserializing malicious objects triggers code execution.

🛡️ Defense：Validate sources + type allowlists + signatures

8IDOR (broken access control)

Change an id parameter and read someone else's data.

🛡️ Defense：Server-side object-level authorization

9Command injection

Input concatenated into shell commands — arbitrary execution.

🛡️ Defense：Allowlist parameters + avoid shell concatenation

10Weak auth & brute force

Weak passwords and no rate limits — cracked or credential-stuffed.

🛡️ Defense：Password policy + MFA + login throttling

🧪 Hands-on lab

💉 SQL injection hands-on lab

This is a 'vulnerable' login form: your input is concatenated straight into the SQL query. Click a payload button and watch how the query gets rewritten.

Classic payloads:

Why it works: the app concatenates user input directly into SQL — the quote closes the string early, and the rest is executed as code. The fix: parameterized/prepared statements, which treat input as data, not code. Every web vulnerability shares this root cause: trusting input that shouldn't be trusted.

💥 XSS hands-on lab

This is an 'unfiltered' guestbook: your input is rendered as-is. Try slipping a <script> tag into your message.

Try this payload:

Why XSS works: the page renders user input as HTML, so <script> becomes code. The fix: HTML-entity-encode output (< becomes &lt;) or rely on your framework's escaping. It's a permanent OWASP Top 10 resident — another lesson in 'never trust input'.

🔧 Crypto tools

Tools are neutral technology — use them only in authorized environments: CTFs, labs, your own VMs.

Caesar cipher

The oldest cipher: shift every letter by an offset

Type plaintext or ciphertext…

Base64 codec

The most common mini-challenge in CTFs

Type text or Base64…

SHA-256 hash

One-way digest, used for integrity checks

Type anything…

🎯 Practice platforms

picoCTF

Starter CTF

CMU's beginner-friendly CTF with a gentle difficulty curve.

HackTheBox

Lab

The classic hacker playground — real machines, real skills.

PortSwigger Web Security Academy

Web

Free hands-on web security courses from the makers of Burp Suite.

TryHackMe

Lab

Guided, interactive learning paths with in-browser machines.

OverTheWire

Wargame

The Bandit wargame is the classic first step into Linux and security.

CTFtime

Calendar

The global CTF calendar — competitions, writeups, rankings.

⚠️ Use security skills only in authorized environments: CTF platforms, labs, and VMs you own. Scanning or attacking real systems without permission is illegal. Be a white hat.

📋 Cheatsheets

Stick-on-the-wall material: Linux commands, encoding recognition, tool usage — peek when you forget.

Linux commands

ls -la / cd / pwdList files, move around, where am I
grep -r "flag" .Recursive content search (the flag-finder)
find / -name "*.txt" 2>/dev/nullFind files by name
nc -l -p 4444 / nc host 4444Listen/connect — chat and file transfer
chmod +x file / chmod 755Make a file executable
file / strings / binwalkIdentify file type / extract strings / analyze firmware
ss -tlnp / ps auxOpen ports / running processes
history | grep curlDig through command history (a classic challenge trick)

Encoding recognition

Letters and digits ending with =Probably Base64
Starts with 0x / only 0-9A-FHexadecimal
Contains %20, %2F…URL encoding
Made of dots and dashesMorse code
Letters that look shifted by a few placesCaesar (try 25 offsets) or ROT13
No visible patternTry Caesar/Vigenère, then frequency analysis
PNG header 89 50 4E 47 / ZIP header 50 4BFile magic (the file command is easier)
Short Base64 like QQ==Decode, then look again — encodings nest

Tools

curl -I URLResponse headers only
nmap -sV -p 1-1000 hostPorts and service versions (authorized targets only)
gobuster dir -u URL -w wordlistDirectory brute force
john --wordlist=rockyou.txt hashPassword hash cracking
binwalk -e file / foremost fileExtract hidden files
zsteg image.pngImage steganography (LSB) detection
CyberChef: From Base64 → XOR → …Encoding pipelines
Browser F12 → NetworkThe start of every web challenge

🧰 Toolkit

Burp Suite

Web

The de-facto standard for web pentesting: intercept, modify, replay, scan. Community edition is free.

CyberChef

Encoding

GCHQ's 'Cyber Swiss Army Knife': Base64, Caesar, encodings — hundreds of operations you can chain.

Wireshark

Traffic

The most popular traffic analyzer — essential for forensics and network troubleshooting.

Nmap

Recon

The standard tool for port scanning and host discovery — the first step of recon.

Kali Linux

OS

A pentesting distro with hundreds of tools preinstalled — run it in a VM.

Ghidra

Reversing

NSA's open-source reverse-engineering suite — must-have for reverse challenges.

John the Ripper

Passwords

The classic password cracker — for CTF crypto and password-strength education.

Metasploit

Pentest

An exploitation framework that automates pentest workflows — authorized environments only.

koki.asia bootloader v1.0

0%

CLICK / ESC TO SKIP