IIT Kanpur Hacking Case: Ek Student Ne Kaise Dikhaya Hacking ka jalwa?
Ek student IIT Kanpur jaise premier institute ke internal system (Admin level) mein ghus jaata hai — normally aisi khabar sunte hi lagta hai ki jail hone waali hai. Lekin yahaan ulta hua। Us student ko punishment ki jagah internship aur research mentorship mil gayi।
Aaiye samajhte hain ki ek ethical hacker koi vulnerability kaise dhoondta hai, verify karta hai aur report karta hai।
Step 1: Reconnaissance — Pehle Information Collect Karo
Direct attack karne se pehle researcher target ke baare mein jaankari jama karta hai — jaise koi bhoola hua subdomain ya purana unpatched page।
- Subdomains Dhoondhna: Tools (Subfinder, Amass) se active subdomains ki list banayi jaati hai
- Port Scanning: Nmap jaise tools se pata chalta hai kaunse ports open hain aur server ka version kya hai
- Technology Check: Wappalyzer jaisi tools se pata chalta hai website Apache, PHP ya kisi purane CMS par chal rahi hai
Step 2: Kamzori (Vulnerability) Dhoondhna
Institutional websites mein aksar teen tarah ki kamzoriyan milti hain:
- Weak Login System: Agar login page mein rate-limiting nahi hai, to hacker password guess karke ya session cookie churakar andar aa sakta hai
- SQL Injection: Agar search bar ya form properly check nahi karta, to malicious code seedha database tak pahunch sakta hai
- IDOR (Data Leak Bug): URL mein sirf ID number change karke (jaise profile?id=101 se 102) kisi aur ka data dikh sakta hai
Step 3: Proof Banana, Nuksan Nahi
Yahi par ethical hacker aur cybercriminal mein farak dikhta hai। Ek criminal data churata hai ya system kharab karta hai। Ek ethical hacker sirf itna karta hai:
- ✅ Temporary access lekar bug confirm karta hai
- ✅ Ek safe screenshot ya proof le leta hai (koi sensitive data touch nahi karta)
- ✅ Database delete, download ya website ka look kabhi change nahi karta
Step 4: Responsible Disclosure — Sabse Zaroori Step
Yahi step ek "hacking incident" ko career-defining moment bana deta hai। Researcher poori report bana kar institute ki security team (CISO/IT Cell) ko chupke se bhej deta hai — kya bug hai, kaisa risk hai, aur kaise fix karein। Team fix karti hai, aur researcher dobara test karke confirm karta hai ki bug band ho gaya।
Punishment Ki Jagah Internship Kyun Mili?
India ke IT Act (Section 66) ke tehat bina permission access lena crime hai। Lekin saza ke liye galat niyat (mens rea) saabit karna padta hai — jaise chori, nuksan ya blackmail।
Is student ne dikha diya ki uske paas gehri technical knowledge bhi hai aur high ethics bhi। Isi wajah se IIT Kanpur jaisi institute, apne C3iHub jaise security hub ke zariye, aise talent ko punish karne ki jagah aage badhaana behtar samajhti hai।
Conclusion
Hacking aur ethical hacking ke beech farak sirf ek cheez tay karti hai — intent। Agar aapko bhi cybersecurity mein career banana hai, to yehi responsible approach seekhna sabse zaroori step hai।
Stay safe online with ScamDisable.com
Comments