Learning Type

Skill Level

Role

This path teaches the technical skills needed for responding to security incidents and handling cyber attacks.

Incident Responder Path

This learning path equips students with essential cybersecurity knowledge and helps build their careers in blue team.

Cybersecurity for Students

Learn the technical skills necessary for a career in Security Operations Center (SOC) analysis.

SOC Analyst Learning Path

Sometimes you can not find evidence on disk during analysis. Learn how to do memory analysis and never miss any evidence.

Memory Forensics

/static/img/network-fun-2-avatar-home_8AUR5Df.png

With this course, you'll get deep into the network details.

Network Fundamentals II

/static/img/it-security-basis-homepage_fZFIbad.png

In this course, we will look at the basic questions to help you to evaluate your level of protection against cyber disasters on your infrastructure.

IT Security Basis for Corporates

/static/img/web-server-analysis-avatar_nkXSdKG.png

Learn how to analyze compromised web servers

Hacked Web Server Analysis

Use Splunk as a SOC member and be comfortable to search data.

Splunk

/static/img/malware-lab-avatar_yqo5uog.png

As an Analyst or Incident Responder, during the investigation sometimes we need a malware analysis environment. Let's look at how we can build it.

Building a Malware Analysis Lab

/static/img/job-hunting-avatar_fvYtVZX.png

Find your dream job in the right way. Learn which steps you should follow.

Job Hunting

/static/img/log-analysis-homepage_7nkmHU3.png

SOC Analysts should be able to examine different network log sources during the investigation. Find out how you can do this.

Network Log Analysis

Writing a clear report is really important to understand what you did exactly for other people.

Writing a Report on Security Incident

/static/img/cryptology-homepage_osOv2gN.png

Understand cryptology for a better cybersecurity mindset

Introduction to Cryptology

/static/img/crisis-cover-avatar_p6nT7H3.png

Prepare a crisis management plan for your corporate.

How to Prepare a Cyber Crisis Management Plan?

/static/img/windows-fundamentals_gIpYZIF.png

As a SOC Analyst or an analyst candidate, you should learn Windows operating system fundamentals.

Windows Fundamentals

/static/img/wireshark-homepage_Z8QcWnx.png

Analyze the malware traffic with the most popular network analysis tool.

Malware Traffic Analysis with Wireshark

/static/img/cti-avatar-training_BGOcaPw.png

Start learning CTI types, attack surfaces, gathering TI data, and how to use them as a blue team member

Cyber Threat Intelligence

/static/img/ncident-management-avatar-home_8ejcgvL.png

Learn how to manage incidents and how incident management systems work

Incident Management 101

Linux fundamentals for getting started in cybersecurity

Linux for Blue Team

Malware Analysis Fundamentals

Learn how to detect brute force attacks against applications and systems

Detecting Brute Force Attacks

What do SOC Analysts need to know about SIEM?

SIEM 101

/static/img/web-attacks-avatar_G9YmEAL.png

Investigating web attacks as a SOC Analyst

Detecting Web Attacks

Incident Response steps on Linux machines

Incident Response on Linux

/static/img/windows-ir-avatar_0v4vMlg.png

Incident Response steps on Windows machines

Incident Response on Windows

You can find lots of evidence from Event Logs. Learn how to use event logs during the investigations.

Event Log Analysis

Get familiar with Firewall, IPS/IDS, Antivirus, EDR and more!

Security Solutions

You can find lots of evidence on the Windows Registry. Follow this course and learn how you can do that.

Windows Registry Forensics

If you want to investigate suspicious network activities, you need to know how network protocols work and what evidence you can extract. Learn how it works and how you can use it as an analyst.

Network Protocols

/static/img/soc-fundamentals-avatar_vOeyfJc.png

This training explains how SOC works and which tools we use for investigation. Very good start for beginners.

SOC Fundamentals

The aim of this course is to teach you how to do acquisition and triage infected machines.

Forensic Acquisition and Triage

As an investigator, you should be able to hunt AD attacks.

Hunting AD Attacks

Learn fundamentals of the application level protocols such as FTP, HTTP, SSH, etc.

Network Protocols - 2

If you want to build a SOC Lab with free tools, you should follow this course.

Building a SOC Lab at Home

Learn how to be ready to cyber incidents with NIST Framework.

NIST - Cybersecurity Incident Handling Guide

This course is for security professionals interested in learning how attackers use legitimate Unix binaries to bypass security measures.

This course is for security professionals interested in learning how attackers use legitimate Unix binaries to bypass security measures. Participants will gain hands-on experience with advanced threat detection tools and practical lab exercises to develop skills to detect, respond to, and prevent such attacks. Prior knowledge of Unix-based systems, basic networking, and security principles is recommended.

GTFOBins

/static/img/reverse-engineering-homepage.png

Master the basics of reverse engineering with our practical Reverse Engineering 101 course, suitable for students, cybersecurity pros, and enthusiasts. Gain skills in analyzing software and hardware, assessing vulnerabilities, and detecting malware.

Reverse Engineering

MITRE ATT&CK Framework, an important structure for SOC analysts will be covered. This is an entry-level training that consists mainly of theoretical knowledge.

MITRE ATT&CK Framework, an important structure for SOC analysts will be covered.

MITRE ATT&CK Framework

Malicious document files are really popular nowadays. Generally, attackers use these files to gain initial access and we'll teach you how you can analyze these types of files.

Malicious Document Analysis

Symon is one of the most important log sources on Windows machines. Learn how to find evidence with it.

Log Analysis with Sysmon

/static/img/network-fundamentals-avatar_K7e9UWK.png

Every SOC Analyst needs to understand how the network works. With this strong basic knowledge, other technical stuff will be easier to understand.

Network Fundamentals

Cyber Kill Chain is important for the SOC analyst to have a better understanding of the stages of a cyber attack and to determine which action(s) the cyber attack starts with and which action(s) follows.

The Cyber Kill Chain enables the organization to determine where and how severe the security flaws are.

Cyber Kill Chain

/static/img/vt-for-soc-analysts-avatar.png

Learn how to use VirusTotal to become a better SOC Analyst.

VirusTotal for SOC Analysts

Learn details about how to do dynamic malware analysis during the investigation

Dynamic Malware Analysis

Learn how to analysis of the most common attack vector in the cyber security industry.

Phishing Email Analysis

/static/img/browser-forensics1_NiKfUUk.png

Browser data is important for the investigation process. Learn how you should find evidence and examine it.

Browser Forensics

The course focuses on equipping participants with the necessary skills to detect and prevent web attacks effectively.

Detecting Web Attacks - 2

Memory forensics refers to the analysis of volatile data in a computer’s memory dump. Cyber Security Analysts conduct memory forensics to identify Indicators of Compromise and investigate malicious activities, behaviors and Malicious network traffic on corporate servers and critical computer systems that are in continuous operation.

What is Memory Forensics?

One of the first things we must see is the list of running processes at the time of memory acquisition. Let’s say that a system was infected with malware. In order to do what the malware was designed to do, it must be executed and run.

Memory Analysis Procedures

We have discussed parent-child process relations and how threat actors can masquerade processes to look like legit processes from the service. It’s very important to know common windows genealogy to know what’s normal and what’s out of the ordinary. In our case, we can’t see any process name which looks suspicious from the look of it

Practical Analysis 1: Masqueraded Process

In this case, we are going to discuss process injection. Process injection is a technique in which some piece of code is run in the address space of some other process. Attackers actively use this method to run malicious shellcode in a legitimate process context. This way, they can evade defense mechanisms and hide their tracks.

Practical Analysis 2: Process Injection

In this last case, we will look at DLL injection which is somewhat similar to the process injection which we have already discussed. In this technique, instead of injecting some code in other processes' space, we inject a DLL in the context of the target process. Programs use DLLs (dynamic link libraries) to work dynamically and according to their use cases in different scenarios.

Practical Analysis 3: DLL Injection

The OSI reference model is briefly explained in the first part of the network training series. In this section, the OSI reference model will be discussed in more detail.


 
<h3 style="color:#d9cb30">What is OSI Reference Model?</h3>

The Open Systems Interconnection (OSI) reference model was developed by ISO (International Organization for Standardization) to provide network communication between different operating systems in 1984. OSI reference model makes easier to understand network structures.

 
<h3 style="color:#d9cb30">Data Flow in the OSI Model</h3>

The OSI Model has a hierarchical and layered architecture. The data flow moves in a certain direction between the layers in the OSI model.

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:80%" src="https://letsdefend.io/blog/wp-content/uploads/2022/12/image-12.png" alt=""/>
</figure>
</center>

 
<h2 style="color:#d9cb30">Data Encapsulation and Decapsulation</h2>
 

Some header information of the layers is added to the raw data during the data flow in the OSI model as it is needed on the recipient's side. The process of adding header information for each layer next to the raw data coming out of the application is called “encapsulation”. The opposite of this process, which takes place on the sender's side, is also carried out on the recipient's side. Header information for each layer is included in the total data from the application layer to the physical layer. Therefore, on the recipient's side, in the opposite direction (from the physical layer to the application layer), each layer receives its own header information and transmits it to the upper layer it is responsible for. In this way, raw data is obtained and processed within the application.

This process is called “decapsulation” on the recipient’s side.

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:80%" src="https://letsdefend.io/blog/wp-content/uploads/2022/12/image-13-1024x634.png" alt=""/>
</figure>
</center>

 
<h3 style="color:#d9cb30">Protocol Data Unit (PDU) in OSI Model</h3>

Each layer in the OSI model has a different data set in the encapsulation/decapsulation process. This dataset has special names for some layers as you can see in the image below:&nbsp;

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:50%" src="https://letsdefend.io/blog/wp-content/uploads/2022/12/image-14.png" alt=""/>
</figure>
</center>

<center>(Image Source : https://commons.wikimedia.org/wiki/File:Osi-model-jb.png)</center>
 

 
<h3 style="color:#d9cb30">OSI Layers</h3>

There are a total of 7 layers in the OSI model with separate tasks. There is a hierarchical order between these layers and each layer serves the next layer.

 
<h2 style="color:#d9cb30">1- Physical Layer</h2>

The physical layer is the one that hosts the data transmission task. The data is transmitted in the form of digital (as bits 0 and 1) or analog signals.

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:50%" src="https://letsdefend.io/blog/wp-content/uploads/2022/12/image.jpeg" alt=""/>
</figure>
</center>

<center>(Image Source : https://www.keydence.com/blog/functions-of-the-data-network-cable/)</center>

Examples of physical communication channels are twisted pair cables, coaxial cables, fiber optic cables and wireless communication. The tasks of the physical layer are:
<li>To ensure the sent data to be received as it was sent by the sender.</li>
<li>To start, maintain, and finalize the data movement by making mechanical and electrical definitions between the source and the destination.</li>
<li>To decide whether to send the data in the digital or analog signal form.</li>
</ul>

 
<h2 style="color:#d9cb30">2- Datalink Layer</h2>

Datalink layer is where physical addressing is carried out. “FDDI, SLIP, X.25, ATM, Token Ring, Frame Relay, HDLC, PPP and Ethernet” are some of the protocols used in the transmission of data in this layer. The tasks of the datalink layer are:

<ul>
<li>To ensure the physical addressing (with ARP protocol)</li>
<li>To ensure the error control (with CRC)</li>
<li>To ensure the access to the physical layer and determine the destination of the data to be sent using network units</li>
<li>To ensure reliable data transmission between physical connections using physical addresses (MAC addresses)</li>
</ul>

 
<h2 style="color:#d9cb30">3- Network Layer</h2>

Network layer is where the logical addressing is carried out. This layer processes the data received from the previous layer and transmits the data to the transport layer, which is the upper layer. “IP, IPX, ICMP, IGMP, BGP, OSPF and RIP” are some of the protocols used in this layer. The functions of the network layer are:

<ul>
<li>To ensure data transmission between two logical nodes.</li>
<li>To implement logical addressing that defines each node.</li>
<li>To define the routing mechanism that provides data transmission between computers on different networks.</li>
</ul>

 
<h2 style="color:#d9cb30">4- Transport Layer</h2>

Transport layer is the one that is responsible for data transmission and transmission security. This layer is the last OSI layer for error checking. “TCP, UDP and ATP” are some of the protocols used in this layer. The tasks of the transport layer are:

<ul>
<li>To ensure that the transmission between two nodes is at the appropriate speed for both nodes through the flow control.</li>
<li>To detect corrupted data and prevent its transmission through error control.</li>
</ul>

 
<h2 style="color:#d9cb30">5- Session Layer</h2>

Session Layer is is the one where the installation, management and termination of connections among computers are carried out. In addition, Session Layer controls the data flow in the protocols on its own layer. “RPC, NetBIOS and SQL” are some of the protocols and applications used in this layer.

 
<h2 style="color:#d9cb30">6- Presentation Layer</h2>

Presentation Layer is the layer in which data screening is performed. “ASCII, Binary and EBCDIC” are some of the data display types. This layer may also be responsible for compression and encryption of the data. “GIF, JPEG, TIFF, ASCII, HTML and MPEG” are some of the data formats used in this layer.

 
<h2 style="color:#d9cb30">7- Application Layer</h2>

Application Layer is the first layer in which the applications in front of the users are processed. The operations in the application are usually included in this layer. “FTP, HTTP, TELNET and SMTP” are some of the protocols used in this layer.

 
In this part of our training, we have covered the basics of OSI reference model and the layers included in this model that ensure the healthy communication of systems. We will cover “Media Access Control (MAC) Address” in the next part of the training.

OSI Reference Model

<h3 style="color:#d9cb30">What is Network Interface Card?</h3>

Network Interface Card is a hardware that ensures establishing and maintaining the network connections and communications in computers. The inbound and outbound network packets in network communications are received/transmitted thanks to Network Interface Cards. There are many types of NIC hardware in various sizes and features. For example, there are NICs that provide Wireless communications. Wi-Fi is a feature that “Wireless NIC” hardware makes available. In short, network communications would not be possible without Network Interface Cards.

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:60%" src="https://letsdefend.io/blog/wp-content/uploads/2022/12/image-1-1024x636.jpeg" alt=""/>
</figure>
</center>

 
<h3 style="color:#d9cb30">What is MAC Address?</h3>

The Media Access Control (MAC) address is the physical address required for network communication. IP address and MAC address take part together to provide network communication which cannot be established without either of them available on a device. MAC addresses are placed on NICs during production. Each of the NIC hardware produced has a unique MAC address.

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:70%" src="https://letsdefend.io/blog/wp-content/uploads/2022/12/mac-gif.gif" alt=""/>
</figure>
</center>

<center>(Image Source : https://www.youtube.com/watch?v=TIiQiw7fpsU)</center>
 
The MAC address is “6 Byte” (48 bit) long and is expressed as Hexadecimal. The address below is an example of a MAC address:

MAC Address : 2C:54:91:88:C9:E3

The first 3 Byte of the MAC address is obtained from the relevant organizations specific to vendors. The last 3 bytes are determined by the vendor. In this way, each MAC address becomes a unique one.

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:80%" src="https://letsdefend.io/blog/wp-content/uploads/2022/12/image-22.png" alt=""/>
</figure>
</center>

 
<h3 style="color:#d9cb30">Vendor Detection through MAC Address</h3>

You can determine the vendor that the MAC address belongs to using online services. For example, let's apply it on the following address:

MAC Vendors : <a href="https://macvendors.com/">https://macvendors.com/</a>&nbsp;

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:100%" src="https://letsdefend.io/blog/wp-content/uploads/2022/12/image-21-1024x280.png" alt=""/>
</figure>
</center>

This is how the online application looks upon accessing the site:

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:100%" src="https://letsdefend.io/blog/wp-content/uploads/2022/12/image-20-1024x288.png" alt=""/>
</figure>
</center>

As you can see on the image above, the vendor information for the requested MAC address displayed successfully.

Another website that can be used for this purpose is “<a href="https://macaddress.io">https://macaddress.io</a>”.

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:100%" src="https://letsdefend.io/blog/wp-content/uploads/2022/12/image-19-1024x368.png" alt=""/>
</figure>
</center>

This is how the online application looks upon accessing to the site. Let’s enter the MAC address:&nbsp;

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:100%" src="https://letsdefend.io/blog/wp-content/uploads/2022/12/image-18-1024x496.png" alt=""/>
</figure>
</center>

As seen in the image above, the information about the MAC address has been successfully displayed.

It is also possible to find the vendor’s information without using these online services, there are lists for this. For example, in the following page, we can query the first 3 Byte of the MAC address and obtain the vendor information:

MAC Vendors List&nbsp; :&nbsp; <a href="https://gist.github.com/aallan/b4bb86db86079509e6159810ae9bd3e4">https://gist.github.com/aallan/b4bb86db86079509e6159810ae9bd3e4</a>

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:100%" src="https://letsdefend.io/blog/wp-content/uploads/2022/12/image-17.png" alt=""/>
</figure>
</center>

Note: Since the list is long, only the first section is shown in the image above.

Vendor information of some MAC addresses may not be found through online services or lists. Therefore, it is always good to check multiple sources instead of a single one which will increase the likelihood of finding vendor information of the MAC address we are looking for.

 
<h3 style="color:#d9cb30">Displaying the MAC addresses of Network Interfaces on Windows</h3>

We can utilize the “ipconfig /all” command over the command line to be able to display the MAC addresses on Windows. For example, let's see the MAC address by applying the command:

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:100%" src="https://letsdefend.io/blog/wp-content/uploads/2022/12/image-16.png" alt=""/>
</figure>
</center>

As seen in the image above, the MAC address of the Windows system has been displayed successfully.

 
<h3 style="color:#d9cb30">Displaying the MAC addresses of Network Interfaces on Linux</h3>

We can utilize the “ifconfig” command over the command line to be able to display the MAC addresses on Linux. For example, let's see the MAC address by applying the command:

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:70%" src="https://letsdefend.io/blog/wp-content/uploads/2022/12/image-15.png" alt=""/>
</figure>
</center>

As seen in the image above, the MAC address of the Linux system has been displayed successfully.

 
In this part of our training, we have covered what the Network Interface Card (NIC) and MAC addresses are and their structures, as well as the vendor information of MAC addresses and how to find the MAC address on Windows &amp; Linux. We will cover “Address Resolution Protocol (ARP)” in the next part of the training.

Media Access Control (MAC) Address

<ol>
<li>What is Virtual Private Network (VPN)?</li>
</ol>

Virtual Private Network (VPN) is a technology that allows connecting to different networks through remote access. In networks connected using VPN, resources belonging to the network can be used just as if they are physically connected to that network. For example, a person working remotely joins the network by using the VPN service of the company in order to be included in the corporate network of the company he works for. In this way, it can benefit from the services offered by the devices that are physically connected to the corporate network. In addition, it can carry out joint activities on the same network with an employee who has a physical connection to the corporate network.

<ol start="2">
<li>The structure of VPN</li>
</ol>

In order to use the VPN, a VPN client application is needed first. The user is included in the remote network by connecting to the VPN server with the VPN client application. While connecting to the VPN server with the VPN client application, authentication processes are applied and a secure connection is ensured. In addition, the network traffic in between is provided in an encrypted way.

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:100%" src="https://letsdefend.io/blog/wp-content/uploads/2022/12/image-10.png" alt=""/>
</figure>
</center>

(Image Source : https://anewdomain.net/what-is-virtual-private-networking-vpn-101/)

We have covered the basics of VPN in this part of our training. We will cover “Network Protocols” in the next part of the training.

Virtual Private Network (VPN)

Unicast

“Unicast” is transmitting network packets to a single destination in the network. If a single system transmits network packets to a single destination it is called Unicast.

Note: Each colored circle in the image below represents a device in the network.

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:40%" src="https://letsdefend.io/blog/wp-content/uploads/2022/12/image.png" alt=""/>
</figure>
</center>

 
Multicast

“Multicast”, is transmitting network packets to a multiple destinations within the same network.

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:40%" src="https://letsdefend.io/blog/wp-content/uploads/2022/12/image-1.png" alt=""/>
</figure>
</center>

 
Broadcast

“Broadcast”, is when a device in the network transmits network packets to all devices in the network.

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:40%" src="https://letsdefend.io/blog/wp-content/uploads/2022/12/image-2.png" alt=""/>
</figure>
</center>

 
Broadcast Domain

“Broadcast domain”, refers to each separate network, usually separated by routers. Broadcast domains refer to the areas that broadcast messages can reach. Switches can also be used with some configurations (VLANs) to specify broadcast domains.

Note: VLAN will be covered later in the training.

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:80%" src="https://letsdefend.io/blog/wp-content/uploads/2022/12/image-3.png" alt=""/>
</figure>
</center>

The image above shows a topology of two separate networks connected to two interfaces of a router. Each interface of the router constitutes the entire broadcast domain. The router above has two interfaces, so there are two different broadcast domains.

 
Collision Domain

“Collision domain”, are usually much smaller domains than broadcast domains. Collision domains are areas that can cause collisions between packets using the same data path. For example, since packets coming from one port of the hub are sent to all other ports, all ports of the hub device as a whole form a collision domain. On the other hand the switches are a little different. Since the switches transmits target-oriented packets each port of the switches creates a separate collision domain.

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:90%" src="https://letsdefend.io/blog/wp-content/uploads/2022/12/image-4.png" alt=""/>
</figure>
</center>

Each green area in the image above represents a separate collision domain.

 
<h3 style="color:#d9cb30">Subnet Mask</h3>
 
What is Subnet Mask?

Subnet mask is an address used to detect network addresses and to separate networks into subnets. While assigning IP address to every single device in the network subnet mask assignment should also be made because devices cannot find network addresses without subnet mask. If the network address cannot be found it is not possible to transmit packets. In short, communication between devices can’t be established. The subnet mask is 4 bytes long, just like the IPv4 address, and is expressed in decimal notation. For example, the following is a subnet mask:

Example Subnet Mask : 255.255.255.0

 
Default Subnet Masks

Subnet masks have a default value for each IP address class:

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:60%" src="https://letsdefend.io/blog/wp-content/uploads/2022/12/image-5.png" alt=""/>
</figure>
</center>

The table above shows the default subnet masks for each IP address class. Another representation of subnet masks is the "prefix" representation. In prefix notation, the number of “1” bits in the subnet mask is specified. These “1” bits are in left-to-right order. In prefix notation, the number of bits is written with the “/” sign. For example, the binary representation of the “/8” subnet mask is as follows:

/8 = 11111111.00000000.00000000.00000000

In this example, the 8 bits from the left of the 32 bits representing the subnet mask shows the "1" bit, and all the remaining bits shows the "0" bit.

All subnet masks and prefix representations are shown in the table below:

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:60%" src="https://letsdefend.io/blog/wp-content/uploads/2022/12/image-6.png" alt=""/>
</figure>
</center>

 
Bitwise AND Operation

AND is one of the operations performed on the bits. The results of AND operations on the bits are shown in the table below:

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:30%" src="https://letsdefend.io/blog/wp-content/uploads/2022/12/image-7.png" alt=""/>
</figure>
</center>

 
Finding the Network Address

Bitwise AND operation is used to determine the network address with the subnet mask. The IP address and the subnet mask are ANDed. The result obtained gives the network address. For example, let's perform an AND operation on an IP address and subnet mask as follows:

IP Address (Decimal) : 192.168.3.100

IP Address (Binary) : 11000000.10101000.00000011.01100100

Subnet Mask (Decimal) : 255.255.255.0

Subnet Mask (Binary) : 11111111.11111111.11111111.00000000

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:80%" src="https://letsdefend.io/blog/wp-content/uploads/2022/12/image-8-1024x443.png" alt=""/>
</figure>
</center>

As seen in the image above, each bit of 32 bits belonging to the IP address and subnet mask was sequentially ANDed and the network address was obtained as "192.168.3.0".

We have covered the basic concepts of the network as well as the subnet mask topics. We have learned how the subnet mask and network address are calculated. We will cover “Virtual Local Area Network (VLAN)” in the next part of the training.

Basic Concepts

<h3 style="color:#d9cb30">What is Address Resolution Protocol (ARP)?</h3>

Address Resolution Protocol (ARP) is a network protocol which works on the datalink layer and has an important role in the communication of devices. The main task of the ARP protocol is to ensure that Logical and Physical addresses are matching with each other and to identify the MAC address of a device with a known IP address.

 
<h3 style="color:#d9cb30">Working Structure of the ARP Protocol</h3>

When two devices in a network start to communicate with each other, the target device’s MAC address and IP address must be known. The ARP protocol helps determine the MAC address of a device with a known IP address. The following image shows how this process takes place:

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:80%" src="https://letsdefend.io/blog/wp-content/uploads/2022/12/image-23.png" alt=""/>
</figure>
</center>

The device A sends the “ARP Request” (Broadcast) packet to all devices in the network. None of the devices replies back to this request except for the device with the IP address in the ARP Request Packet as they all can see that the IP address in the ARP packet does not belong to any of them. Seeing its own IP address, device B sends its own MAC address through an "ARP Reply" packet to the device sending the ARP Request.

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:90%" src="https://letsdefend.io/blog/wp-content/uploads/2022/12/image-24.png" alt=""/>
</figure>
</center>

Note : IP addresses and MAC addresses on the visuals are written as representative ones.

 
<h3 style="color:#d9cb30">ARP Table</h3>

In the previous image, the device A acquired the MAC address of the device C using the ARP protocol. This acquired MAC address is kept in the ARP table on the device A for a certain period of time. Similarly, all devices in the network hold the IP address and MAC address information of other devices in the network in the ARP tables for a certain period of time. Thanks to the ARP tables, it is determined whether the MAC address information of the target device is on the device to send the network packet. As in the examples above, it is a “Dynamic” process to save the MAC address directly in the ARP table by asking the devices in the network directly. Another type of ARP table registration process is the “static” registration process. Necessary values ​​in the ARP table are entered manually via the command line to add a static type of record. You can see the type of records when you display the ARP table of the device.

 
<h2 style="color:#d9cb30">Displaying the ARP Table on Windows</h2>

The “arp -a” command is used to see the ARP table on Windows. For example, let's see by applying the command:

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:60%" src="https://letsdefend.io/blog/wp-content/uploads/2022/12/image-25.png" alt=""/>
</figure>
</center>

As shown in the image above, the command has been applied successfully and the records on the ARP table are displayed.

 
<h2 style="color:#d9cb30">Displaying the ARP Table on Linux</h2>

The “sudo arp” command is used to see the ARP table on Linux. For example, let's see by applying the command:

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:100%" src="https://letsdefend.io/blog/wp-content/uploads/2022/12/image-26.png" alt=""/>
</figure>
</center>

As shown in the image above, the command has been applied successfully and the records on the ARP table are displayed.

 
<h3 style="color:#d9cb30">ARP Protocol Header</h3>

The ARP protocol has its own header structure. As seen in the example below, there are many fields in the header of the protocol. The information of the protocol is included in these fields. The following image shows the header and fields of the ARP protocol:

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:90%" src="https://letsdefend.io/blog/wp-content/uploads/2022/12/image-27.png" alt=""/>
</figure>
</center>

Each Field is briefly explained in the following titles:

 
<h2 style="color:#d9cb30">Hardware Type</h2>


The value in Hardware Type field indicates the network type. In other words, it includes the value that shows the protocol in the datalink layer. It is “2 byte” long. For example, the value “0x0001” here in this field indicates that it has “ethernet”.

Note: The value starting with “0x” means “Hexadecimal”.

 
<h2 style="color:#d9cb30">Protocol Type</h2>

The value in the Protocol Type field indicates the value that shows the protocol in the network layer. It is “2 byte” long. For example, the value “0x0800”&nbsp; here in this field indicates that it is “Internet Protocol” (IP).

 
<h2 style="color:#d9cb30">Hardware Length</h2>


Hardware Length field shows the length of hardware address. It is “1 Byte” long. For example, since the MAC address is used as hardware address for ethernet, the “6” value is included in this field because MAC addresses are 6 byte long.

 
<h2 style="color:#d9cb30">Protocol Length</h2>

Protocol Length field shows the length of the protocol address. It is “1 Byte” long. For example, since the IPv4 address is usually used for the IP protocol, the “4” value is included in this field because IPv4 addresses are “4 byte” long.

 
<h2 style="color:#d9cb30">Operation Code</h2>

Operation Code field is the area where the task of the frame of the ARP protocol. It is “2 byte” long. For example, if there is “1” value in this field, it is an “ARP Request” type and if there is “2” in this field, it is an “ARP Reply” type.

 
<h2 style="color:#d9cb30">Sender Hardware Address</h2>

Sender Hardware is the field with the hardware address of the device that sends the frame. For example, this is the field where the sender’s MAC address is for Ethernet. The length of this area varies according to the protocol. The length of the 'Sender Hardware Address' should be 6 bytes if the Ethernet protocol is used.

 
<h2 style="color:#d9cb30">Sender Protocol Address</h2>

Sender Protocol Address field is where the sender’s protocol address is. For example, it is the field where the sender’s IP address is written for the IP protocol. The length of this area varies according to the protocol. The length of the 'Sender Protocol Address' should be 4 bytes if the IP protocol is used.

 
<h2 style="color:#d9cb30">Target Hardware Address</h2>

Target Hardware is the field where the hardware address of the device that will receive the frame. For example, it is where the recipient's MAC address is written for Ethernet. The length of this area varies according to the protocol.

 
<h2 style="color:#d9cb30">Target Protocol Address</h2>

Target Protocol Address field is where the Protocol address of the device that will receive the frame. For example, it is the area where the IP address of the recipient for the IP protocol is written. The length of this area varies according to the protocol. 

 
<h3 style="color:#d9cb30">Reviewing the ARP Protocol with Wireshark</h3>

There are some tools with a graphical user interface (GUI) that help reviewing network packets in detail. One of these is “Wireshark”. Let's see each field described above through Wireshark:

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:70%" src="https://letsdefend.io/blog/wp-content/uploads/2022/12/image-28.png" alt=""/>
</figure>
</center>

As seen in the image above, the fields of the ARP protocol have been displayed successfully through Wireshark.

Note: You can access the PCAP file in this example in the “Course Files” field at the end of the course.

We have covered the basics of the ARP Protocol in this part of our training. Topics we have covered are what the ARP protocol is, its working structure, table, and header fields of the ARP Protocol. We will cover “Internet Protocol (IP)” in the next part of the training.

Address Resolution Protocol (ARP)

<h3 style="color:#d9cb30">What is Network Protocol?</h3>

Network protocol is a set of rules that determine how to format, transmit and receive data transmitted between devices in order to ensure network communication regardless of the structure of network devices. In other words, network protocol is the common language for a flawless communication used by network devices within same network as well as among different networks. Communication between different network devices can only be carried out through the network protocols.
 
Knowing the structure and operation of network protocols is important in terms of security. For example, knowing the technical details of some important network protocols can be helpful when detecting threats.

 
<h3 style="color:#d9cb30">Types of Network Protocols</h3>

Network protocols can be divided into 3 groups:

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:40%" src="https://letsdefend.io/blog/wp-content/uploads/2022/12/image-11.png" alt=""/>
</figure>
</center>

Note : Some of the protocols mentioned in this section are explained under separate titles in the network training series.

Here are the most common protocols in these 3 groups:

 
Communication Protocols

<ul>
<li>Address Resolution Protocol (ARP)</li>
<li>Internet Protocol (IP)</li>
<li>Transmission Control Protocol (TCP)</li>
<li>User Datagram Protocol (UDP)</li>
<li>Border Gateway Protocol (BGP)</li>
<li>Dynamic Host Control Protocol (DHCP)</li>
</ul>

 
Management Protocols

<ul>
<li>Internet Control Message Protocol (ICMP)</li>
<li>Simple Network Management Protocol (SNMP)</li>
<li>File Transfer Protocol (FTP)</li>
<li>Post Office Protocol 3 (POP3)</li>
<li>Teletype Network (Telnet)</li>
</ul>

 
Security Protocols

<ul>
<li>Secure Sockets Layer (SSL)</li>
<li>Transport Layer Security (TLS)</li>
</ul>

You can find all the network protocols at the following link:

List of Network Protocols : <a href="https://en.wikipedia.org/wiki/List_of_network_protocols_(OSI_model)" target="_blank" rel="noreferrer noopener">https://en.wikipedia.org/wiki/List_of_network_protocols_(OSI_model)</a> 

We have covered the network protocols and their types in this part of our training. We will cover “OSI Reference Model” in the next part of the training.

<h3 style="color:#d9cb30">What is Internet Control Message Protocol (ICMP)?</h3>

The ICMP is the protocol that sends the errors, warnings, and control messages during the transmission of packets to the sender device.

 
<h3 style="color:#d9cb30">Features of the ICMP Protocol</h3>

<ul>
<li>Works with the IP protocol.</li>
<li>The ICMP messages are usually created in the following cases:<ul><li>When the IP packets cannot reach their target.</li>
<li>When the gateway devices are too busy to transmit packets.</li>
<li>When there is a shorter way for the packets to go.</li>
</ul>
</li>
<li>The ICMP protocol does not make the IP protocol more secure.</li>
<li>All applications using the IP protocol must support the ICMP protocol.</li>
<li>Not all of the ICMP messages provide information about error control. Some ICMP messages are used to obtain computer network tests and network information.</li>
<li>The ICMP protocol produces error messages only for the IP packets. The ICMP protocol does not produce error messages in case of errors related to transmission of ICMP messages.</li>
<li>ICMP messages do not contain information about what to do to fix the error even though they show the error messages. This is a situation that is determined by the computer that receives the error message.</li>
</ul>

 
<h3 style="color:#d9cb30">ICMP Applications</h3>

<ol><li>Ping:&nbsp;</li>
</ol>
</li>
</ol>

Ping is an application used to find out if the device in the network is communicated by using ICMP messages. For example, let's apply the ping command on Windows:

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:60%" src="https://letsdefend.io/blog/wp-content/uploads/2022/12/image-30.png" alt=""/>
</figure>
</center>

As shown in the image above, ICMP Ping Request was sent with “1” Packet with the parameter “-n”. As we see the reply packet comes back to the sent packet there is a network communication with the target address.

Note: In some networks, ICMP messages are blocked through the firewall configurations in terms of security. Therefore, there will be no response to the Ping command in such a network, but the network communication should still be ongoing with the target device.

<ol start="2">
<li>Traceroute</li>
</ol>

Traceroute is an application used to determine the route that the packets follow until they reach to their destinations. All the details of the roadmap that the packets follow are revealed through this application. For example, let's see the application on Windows:

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:80%" src="https://letsdefend.io/blog/wp-content/uploads/2022/12/image-31.png" alt=""/>
</figure>
</center>

As shown in the image above, the IP addresses of the network devices which are passed until reaching to “Google.com”have been displayed successfully through the “Tracert” command.

We have covered the basics of ICMP Protocol in this part of our training. We will cover “Routing” in the next part of the training.

Internet Control Message Protocol (ICMP)

<ol>
<li>What is the “IP Protocol”?</li>
</ol>

Internet Protocol is the protocol that ensures the packet transmissions between different networks. It prepares the data to be sent to a top transmission layer.

<ol start="2">
<li>Features of the IP Protocol</li>
</ol>

<ul>
<li>It performs the process of dividing large packets to be sent under data transmission into smaller pieces (IP Fragmentation).</li>
<li>There is no flow control mechanism required for reliable transmission.</li>
<li>It is the most functional structure in the OSI layers.</li>
<li>The control and security mechanisms belong to the upper layers as the packets it transmit to the upper layer can be easily imitated.</li>
<li>The Internet Protocol (IP) works using logical addresses.</li>
</ul>

<ol start="3">
<li>IP Protocol Header</li>
</ol>

The IP Protocol includes many fields within the header. The following image shows the Header and Fields of the IP protocol:

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:100%" src="https://letsdefend.io/blog/wp-content/uploads/2022/12/image-29.png" alt=""/>
</figure>
</center>

Version

The Version Field is where the type of IP packet is defined. It shows whether the IP packet is IPV4 or IPV6 according to the value in this Field. It is “4 bit” long.

Internet Header Length (IHL)

It is the field where the length of the IP header, which may be variable is shown. The smallest IP Packet Header is 20 bytes. It is “4 bit” long.

Types of Service

It is the field where the Quality of Service (QoS) is. It is “8 bit” long.

Total Length

Total Length field refers to IP header and the total length of the data. It is “16 bit” long.

Identification

Identification Field shows the ID number of each IP packet. It is “16 bit” long.

IP Flags

IP Flags is the field that indicates whether IP Fragmentation is implemented on the packet or not. It is “3 bit” long.

Fragmentation offset

Fragmentation Offset field indicates how many bytes is the shredded packet is. It is “13 bit” long.

Time to Live (TTL)

Time to Live (TTL) indicates the number of hops that the packet can take. The transmission of the packet from one device to another means “1 hop” and the value in TTL in each hop is reduced by “1”. Packet, which reaches the “0” value, can no longer be transmitted. TTL Field is “8 bit” long.

Protocol

The value in the Protocol Field indicates the protocol in which the packet is associated in an upper layer. It is “8 bit” long.

Header checksum

It is the control value calculated to see whether the IP header has been transmitted intact. This value calculated by a specific algorithm is used for verification purposes. It is “16 bit” long.

Source Address

Source Address field is where the IP address that sends the Packet. It is “32 bit” long.

Destination Address

Destination Address field is where the recipient's IP address is located. It is “32 bit” long.

Data

Data Field is the Field where the total data from the lower layer is located.

In this part of the training, we have covered what the Internet Protocol (IP) is. We will cover the “Internet Control Message Protocol (ICMP)” topic in the next part of our training.

Internet Protocol (IP)

The transmission of network to different networks and the determination of the transmission path is named “routing”. Routers are the devices with the main task of routing. There are at least 2 network interfaces on router devices.

Routing

As mentioned in the previous part of the network training series, networking is a very comprehensive topic. There are many different types of networks today. There may be a wide variety of devices within these networks, depending on the structure of the network. The technologies in these devices may contain different technical information.

This part of the network training series is a continuation of the previous section and covers the basic networking topics a SOC analyst should know from the security perspective. If you have not completed the previous network training course, you can access it from the link below.

<a href="https://app.letsdefend.io/training/lessons/network-fundamentals" target="_blank">Network Fundamentals I</a>

We recommend to complete the topics in this training without skipping any parts to be able to master the fundamentals of networking.

Introduction to Network Fundamentals 2

<ol>
<li>What is VLAN?</li>
</ol>

VLAN is a part of the network structure that provides logical grouping of devices in the network, regardless of the physical state of the devices in the network. With VLAN, each department within the organization can be separated into a separate subnet, and in this way, the devices of each department are located in a different network. For example, we can think of each VLAN in the image below as a separate department:

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:100%" src="https://letsdefend.io/blog/wp-content/uploads/2022/12/image-9.png" alt=""/>
</figure>
</center>

Network segmentation through VLANs can be implemented in many different ways. For example, as you can see in the image above, network segmentation can be implemented by using many switches in large companies. In organizations with fewer devices and departments, network segmentation can be done by configuring VLANs with a single switch as follows:

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:100%" src="https://letsdefend.io/blog/wp-content/uploads/2022/12/Untitled-min-1.gif" alt=""/>
</figure>
</center>

(Image Source : https://www.youtube.com/watch?v=jC6MJTh9fRE)

<ol start="2">
<li>Features of VLANs</li>
</ol>

<ul>
<li>Since each VLAN is a separate broadcast domain, it contributes positively to network performance.</li>
<li>Because VLANs provide network segmentation, it brings an additional layer to network security.</li>
<li>It helps the creation of a flexible and modular network structure.</li>
<li>Besides the advantages it brings to the network, it is also easy to configure.</li>
<li>It can reduce network traffic and prevent congestion.</li>
<li>As it can be configured with only one single switch, there is also support for configuration with multiple switches.</li>
<li>It saves costs as it does not require additional hardware.</li>
<li>It simplifies the management of physical devices.</li>
<li>If the VLAN configurations are not done correctly on the switch, the network may become vulnerable to some attacks (VLAN hopping attacks).</li>
</ul>

We have covered what VLAN is and its features in this part of our training. We will cover “Virtual Private Network (VPN)” in the next part.

Virtual Local Area Network (VLAN)

Implement policies, processes and technologies that ensure that only authorized users are granted the least privileges necessary. There is no magic bullet here that works for everyone, you need to adapt, take it step by step.

 
<h3 style="color:#d9cb30">Password &amp; MFA</h3>

The lowest level of protection is the implementation of a password policy within your environment. In the case of a Windows environment, this policy should be set in the "Default Domain Policy" to ensure that it applies to all computers.&nbsp;

Whenever possible, use stronger mechanisms than password authentication, such as biometrics, one-time passwords and application tokens. Multi-factor authentication, via SMS or application authenticator, is highly recommended, starting with privileged users and extending to all users.

 
<h3 style="color:#d9cb30">Zero Trust</h3>

Identify and disable unused accounts, eliminate shared accounts, remove unnecessary privileges and enforce strong password policies.

 
<h3 style="color:#d9cb30">Audit of Account Usage</h3>

Monitor and analyze user activity for anomalous behavior such as access attempts outside of normal business hours or from unusual locations. Your fleet should not contain more than 15% of accounts with the "domain administrator" privilege.

Access Control

Use risk assessments to prioritize the allocation of resources and investments.

 
<h3 style="color:#d9cb30">Return to Service</h3>

Has your company conducted a study to define which resources should be recovered first? This analysis can also be used to estimate the impact of disruptions and identify allowable downtime.

 
<h3 style="color:#d9cb30">Review of Risks on Connected Networks</h3>

Every connection to your company is a risk to it. Whether it's within an entity of your company or a partner. Keep in mind that each of these parties may not have the same security requirements as you do.&nbsp;

Are your partners committed to the same level of security as you, do you know how quickly they update when a vulnerability is disclosed? Are they committed to not using default certificates on VPNs? If they use online solutions, are you sure that their configuration is in line with your security needs?

Risk Analysis

Monitor your organization's incoming and outgoing Internet traffic.

 
<h3 style="color:#d9cb30">PCAP</h3>

Use the SPAN ports of your network equipment to capture your network activities. This capture will allow you to detect abnormal behavior (increased use of a protocol, abnormal destination addresses, etc.) as well as to perform a post-mortem in case of compromise.

 
<h3 style="color:#d9cb30">Segmentation</h3>

Segmentation divides a computer network into smaller parts. Network segmentation improves network performance and security by reducing the attack surface and limiting the range of an attack. The use of VLAN, PVLAN allows you to separate your different networks.&nbsp;

Are the administration interfaces of your network equipment available from Alice's (or whoever) accounting station? Is the remote office service only available on a dedicated network?

 
<h3 style="color:#d9cb30">Review of Blocked Flows</h3>

Now that your corporate network is segmented, and flows are prohibited, the next step is to set up a review to identify the origin of the requests that get blocked with your new policy. It could be a compromised workstation, an application that went under your radar in the inventory, etc.

 
<h3 style="color:#d9cb30">Alert Outside of Standard Use</h3>

Once all this is in place, you can generate alerts in case of abnormal network usage. Besides the security gain, these alerts could allow you to identify weak points in your organization, for example when your backup tools saturate the network.

Network

Backups are not a mechanism for fighting Ransomwarebut they are your last line of defense. A non-operational backup system following an attack could jeopardize the survival of your business.

Rule 3-2-1
As a basic rule and the minimum expected for an infrastructure, the 3-2-1 rule states that you must:

Have at least three copies of your data 
Store on two different media
One of which must be an offsite external backup

Three Copies 
The principle is to have your data on the server and two backups. This is to avoid that a failure makes your backups inoperative.

Two Different Media 
Here, two media should not be understood as necessarily two different physical formats (hard disk and LTO tape) but as having one's backup on two different and unrelated points. Thus, it is possible to have two copies of the backup on hard disks if the two are not stored in the same datacenter, not linked via the same software RAID, etc.

One Offsite External Backup 
The idea behind this request is to have a backup stored outside your building that contains the main data to protect against risks such as fire.

Rule 3-2-1-1-0
This rule is to be applied at least on the critical resources of your company. Identical to the 3-2-1 rule, it adds two conditions: 

1 offline copy
0 errors during the restoration

One Offline Copy 
This is about having a backup that is not connected to your network and any IT infrastructure. The goal is to avoid that if an attacker has compromised your network, he can intervene on this backup

Zero Errors During The Restoration 
This point seems logical, but it is advisable to regularly test the backups made and check that they can be restored without errors. It would be a shame if once restored, it is discovered that a file on the database server is actually damaged.

Minimum Storage Time
It is important that the backups allow to restore at least 30 days old data. Why 30 days? Because the average time between the intrusion in the park and the detection by the company is about this time.

Backup Tests
Now that your data is backed up according to best practices, it is important to ensure that your test restores are tracked and that each server is restored at least once a year.

Backups

Make sure you have clear processes in place and known to your staff regarding escalation of major incidents. A major incident that is quickly escalated to the experts can allow you to mitigate the impact of a cyber attack.

You can find a tutorial on how to create an incident response plan at the link below:

<a href="https://app.letsdefend.io/training/lesson_detail/how-create-incident-response-plan-windows" target="_blank">Windows Incident Response Course</a>

Incident Response for IT Security

This course will include the subjects below:

<ul>
<li>Inventory</li>
<li>Backups</li>
<li>Phishing Prevention</li>
<li>Internet Browsing Protection</li>
<li>Patching</li>
<li>Access Control</li>
<li>Risk Analysis</li>
<li>Network</li>
<li>Incident Response for IT Security</li>
</ul>

This course was written by Julien Garcia. You can find his social media accounts below.

Twitter: <a href="https://twitter.com/geekmunity_FR" target="_blank" rel="noreferrer noopener">geekmunity_FR</a>

LinkedIn: <a href="https://www.linkedin.com/in/jgarcia-cybersec/" target="_blank" rel="noreferrer noopener">Julien G.</a>

Introduction to IT Security Basis for Corporates

Protecting your infrastructure requires knowing what devices are connected to your network, what applications are being used, who has access to them, and what security measures are in place.

 
<h2 style="color:#d9cb30; text-align:center;">What should your inventory contain and why?</h2>

As with all IT security issues, you will need a complete inventory. This inventory should include at least the following information:

<ul>
<li>the hardware of each workstation and server&nbsp;</li>
<li>the software installed with the exact version&nbsp;</li>
<li>the date of the last report</li>
</ul>

 
<h2 style="color:#d9cb30; text-align:center;">End-of-Life Equipment</h2>

Thanks to your inventory, you have been able to isolate all the equipment (hardware and software) at the end of their support. Equipment that is no longer maintained is equipment that will no longer receive security patches. It is then necessary to exclude from your network all the equipment that cannot be maintained. In case of extreme necessity, a risk acceptance by a CISO must be performed and traced in your inventory. This analysis must be reviewed at regular intervals, ideally at each new vulnerability discovered.

 
<h2 style="color:#d9cb30; text-align:center;">Secure boot</h2>

The secure boot must be enabled on all your compatible devices. This feature ensures that the computer boots using only manufacturer-approved software. This is a feature that has been available for 10 years, so it is unlikely that a problem will occur if you have standard usage.

 
<h2 style="color:#d9cb30; text-align:center;">Softwares List</h2>

In order to limit the attack surface, it is important that your company has a strict policy regarding authorized and unauthorized software.

 
<h3 style="color:#d9cb30">Allowed Softwares</h3>

To do so, the use of GPO or Intune allows you to provide your users with a quickly available software library without the need for administrative rights to its stations. This avoids that your users have to download the installation programs themselves and therefore limits the risk of downloading a malicious program.

 
<h3 style="color:#d9cb30">Forbidden Softwares</h3>

In the same way, whether via Intune or AppLocker, it is necessary to block software identified as forbidden (either because you do not legitimize the application or because its version is subject to a CVE that is dangerous for you). Each use of a prohibited application must be reported to your company's IT team.

 
<h2 style="color:#d9cb30; text-align:center;">Hardening</h2>

Does your company rely on proven hardening guides to define the configuration of your devices? These hardening guidelines can cover different levels such as:

<ul>
<li>Station handover procedures with prerequisite checklist</li>
<li>Audit of the secure configuration of the devices&nbsp;</li>
<li>Alert in case of configuration modification</li>
</ul>

This hardening can be done in several ways, such as Ansible, GPO, or Intune.

 
<h2 style="color:#d9cb30; text-align:center;">Antivirus / EDR</h2>

Make sure that your company deploys an antivirus, or even an EDR on the entire fleet, starting with the devices that are critical to your business. Do not forget to set up a follow-up of the generated alerts.

Inventory

Phishing attacks represent one of the biggest initial attack vectors along with the exploitation of vulnerabilities on your online servers.

 
<h3 style="color:#d9cb30">Antispam and Email Protection</h3>

Do all emails received by your employees pass through a spam filter? Does your AntiVirus software analyze the attachment in the mail?Is this configuration reviewed and kept up to date with new threats?

 
<h3 style="color:#d9cb30">Analysis Procedure</h3>

When one of your employees receives an email and has a doubt, she/he should have the possibility to contact someone to perform an analysis of the email.

 
<h3 style="color:#d9cb30">Phishing Drill</h3>

It is often experienced as an attack on the staff, it may be worthwhile to conduct a test to ensure that your staff is properly aware.

Phishing Prevention

Filter connections to unauthorized websites, suspicious domain names and known malicious domain names.

 
<h3 style="color:#d9cb30">DNS Filtering</h3>

Block dangerous sites and filter unwanted content through your firewalls. In addition to "unprofessional" categories like +18 adult content, there is one category that is rarely blocked, URL shorteners. This service is massively used, especially for phishing. Once the blocking is configured, it is necessary to control the blocked sites that your employees have tried to visit.

 
<h3 style="color:#d9cb30">Centralized Management of Browsers</h3>

Updating browser security settings can make it harder for malware to install. For example, to reduce the ability to install plug-ins or to disable the automatic execution of certain types of content.

Internet Browsing Protection

Deploy patches to your software and firmware as quickly as possible. Enable automatic updates whenever possible.

 
<h3 style="color:#d9cb30">SLA for Patching According to CVE</h3>

Have you set up a maximum update time for your workstations/servers/softwares? If yes, do you take into account criteria such as the CVSS score, the fact that the server to be patched is on the Internet-facing or not, that the flaw is known to be exploited (0-day)?

Patching

<h2 style="color:#d9cb30; text-align:center;">PHP</h2>
 

The mail() function of PHP and the "Phpmailer" library that uses it is used by millions of people. Remote code execution vulnerability occurs due to the use of the "mail()" function without fully checking the extra parameter sending feature. The code for the relevant vulnerability is “CVE-2016-10033”.

 
<h3 style="color:#d9cb30">CVE-2016-10033 Vulnerability Attack Sample</h3>
 

As an example, an application with a security vulnerability is installed.

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:30%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-66.png" alt=""/>
</figure>
</center>

Then the exploit prepared for this vulnerability is run. The relevant exploit can be downloaded from the link given below:

<ul>
<li><a href="https://github.com/opsxcq/exploit-CVE-2016-10033">https://github.com/opsxcq/exploit-CVE-2016-10033</a></li>
</ul>

The screenshot of the exploit process performed at the target address is given below:

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:70%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-67.png" alt=""/>
</figure>
</center>

After the exploit is performed, the system is waiting for the remote command to be executed.

Below is a screenshot of the vulnerability being exploited and running a remote command.

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:70%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-68.png" alt=""/>
</figure>
</center>

<h3 style="color:#d9cb30">Log Records</h3>
 

When the network traffic of the vulnerability is examined, it is noticed that GET requests are sent to the “backdoor.php” path.

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:70%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-69.png" alt=""/>
</figure>
</center>

When the sent commands are decoded with base64, the commands executed by the attacker are exposed. To access detailed information about <a href="https://app.letsdefend.io/training/lesson_detail/base64-encodingdecoding" target="_blank">base64</a>, you can click <a href="https://app.letsdefend.io/training/lesson_detail/base64-encodingdecoding" target="_blank">here.</a>

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:70%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-70.png" alt=""/>
</figure>
</center>

<h3 style="color:#d9cb30">Protection Methods</h3>
 

- The vulnerability affects versions 5.2.18 and below. The vulnerability can be avoided by updating.

 
<h2 style="color:#d9cb30; text-align:center;">Java</h2>
 

Under this title, the "Session Injection" vulnerability that occurs in the Java Play Framework will be discussed. The vulnerability is due to session encode.

 
<h3 style="color:#d9cb30">Attack Sample</h3>
 

The target application tells the screen whether the user has admin rights. Here, the attacker's goal will be to gain admin rights.

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:50%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-77.png" alt=""/>
</figure>
</center>

First, registration is made under the user name in a normal way and the submitted requests are examined using <a href="https://portswigger.net/burp" target="_blank">Burp Suite</a> software.

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:100%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-71.png" alt=""/>
</figure>
</center>

Here, assuming the admin user exists, null bytes are used to switch to the admin user.

A new record is created and the "%00%00admin%3a1%00" parameter is added after the user name and the injection is completed. The new session to be created here is misinterpreted by the server with the "admin:1" parameter and access to admin rights. By using empty characters, the "admin:1" parameter is set to the previous parameter. separated from the username.

The user interface of the registration screen is given below:

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:50%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-72.png" alt=""/>
</figure>
</center>

The parameter 00%00admin%3a1%00 is added to the end of the username on the sent request.

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:100%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-73.png" alt=""/>
</figure>
</center>

The screenshot showing access to admin rights on the application after the request is made is given below:

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:50%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-74.png" alt=""/>
</figure>
</center>

<h3 style="color:#d9cb30">Log Records</h3>
 

When the log records are examined, it is seen that the "test" user seems to have registered normally, but when the cookie value is examined, an injection attack occurs.

The screenshot of the POST request sent to the Register page is given below:

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:80%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-75.png" alt=""/>
</figure>
</center>

The screenshot of the post-registration request and the server's response are given below:

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:85%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-76-1024x434.png" alt=""/>
</figure>
</center>

<h3 style="color:#d9cb30">Protection Methods</h3>
 


- This vulnerability has been fixed with the update. The vulnerability can be mitigated by updating.

Vulnerabilities in Programming Language

<h2 style="color:#d9cb30; text-align:center;">Injection</h2>
 

Injection is manipulation by adding various parameters to the query sent to the server.

SQL Injection is sending the desired query to the database by manipulating SQL queries. This article is described as assuming a basic knowledge of SQL injection attacks. For detailed information about SQL injection, you can look at our lesson.

<ul>
<li><a href="https://app.letsdefend.io/training/lesson_detail/detecting-sql-injection-attacks-web-attacks-101">Detecting SQL Injection Attacks</a></li>
</ul>

Here, we will briefly touch on which steps a person should try to detect a SQL injection attack. Our main purpose in the detection stages is to receive error messages. Database information used in the error messages we receive, etc. We will get the details.

For this;

<ul>
<li>The most basic payload used is the ' (single quote) character.</li>
<li>The number of columns can be determined. For this, the payload given below can be used.</li>
</ul>

?id=6 ORDER BY 6--

<ul>
<li>All data in a column must have the same data type. For this, the column type can be determined using the payload below.</li>
</ul>

?id=6 UNION SELECT 1,null,null--

<ul>
<li>The following payloads can be used to detect logic-based SQL injection vulnerability.</li>
</ul>

test.php?id=6
test.php?id=7-1
test.php?id=6 OR 1=1
test.php?id=6 OR 11-5=6

<ul>
<li>The following payloads can be used to detect time-based SQL injection vulnerability.</li>
</ul>

SLEEP(25)--
SELECT BENCHMARK(1000000,MD5('A')); userID=1 OR SLEEP(25)=0 LIMIT 1--&nbsp;userID=1) OR SLEEP(25)=0 LIMIT 1--&nbsp;userID=1' OR SLEEP(25)=0 LIMIT 1--&nbsp;userID=1') OR SLEEP(25)=0 LIMIT 1--&nbsp;userID=1)) OR SLEEP(25)=0 LIMIT 1--&nbsp;userID=SELECT SLEEP(25)--

 
<h3 style="color:#d9cb30">Example of SQL Injection Attack</h3>

In this example, we will consider a web application that simply asks the user for the user id number.

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:100%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-29.png" alt=""/>
</figure>
</center>

When the ID number is entered, the name and surname information of the user of the entered number is returned.

Details of the information of the user whose ID is 2 are given in the screenshot below:

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:70%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-30.png" alt=""/>
</figure>
</center>

However, if a manipulated query is sent that the application does not expect, the unsecured web application will be exposed to an injection attack.

For example, the database version is drawn with the query ' or 0=0 union select null, version() # below. While the previous query is completed with quotation marks in this query, the result is always correct with the expression “or 0=0”.” union select null , version()”, version information is also retrieved. Lastly, the "#" sign ensures that the rest of the query remains as a comment line.

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:65%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-31.png" alt=""/>
</figure>
</center>

As above, it was manipulated by a sql injection attack with a sql query, which was waiting for id information, and caused data leakage.

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:100%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-32.png" alt=""/>
</figure>
</center>

The following image shows the response returned by the query run.

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:55%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-33.png" alt=""/>
</figure>
</center>

 
<h3 style="color:#d9cb30">Log Records</h3>

It has been determined that the most used characters and words in SQL Injection attacks are ' , -- , union , select , from , or , @ , version , char , varchar , exec .

When the relevant characters are encoded in the URL, a Linux command as follows is generated for attack detection.

 
cat access.log | grep -E “%27|--|union|select|from|or|@|version|char|varchar|exec

As a result of the search made in the "access.log" file with the relevant command, the following result is obtained.

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:80%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-34.png" alt=""/>
</figure>
</center>

It appears that the query ' or 0=0 union select null, version() # is sent when the record URL in the acces.log file is decoded.

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:100%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-35.png" alt=""/>
</figure>
</center>

 
<h3 style="color:#d9cb30">Protection Methods</h3>

<ul>
<li>Using prepared query statements</li>
<li>Checking the sent data</li>
<li>Filtering the sent data</li>
<li>Restricting user privileges</li>
</ul>

measures that can be taken.

 
<h2 style="color:#d9cb30; text-align:center;">Broken Authentication and Session Management</h2>
 

It is a security weakness caused by not providing full session security.

 
<h3 style="color:#d9cb30">Attack Sample</h3>

The purpose of this attack will be to change the cookie information and switch to the desired user account without any authentication mechanism.

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:100%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-36.png" alt=""/>
</figure>
</center>

Login to the system as "user1".

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:30%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-37.png" alt=""/>
</figure>
</center>

Then the cookie value is checked. The screenshot of the cookie value of the user "user1" is given below:

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:60%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-38.png" alt=""/>
</figure>
</center>

As you can see, the cookie value is the same as the username. When the cookie value is changed to admin, if there is an admin user in the system, it will be switched to the admin user.

The screenshot of changing the cookie data is given below:

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:60%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-39.png" alt=""/>
</figure>
</center>

The screenshot showing the switch to the admin user is given below:

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:30%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-40.png" alt=""/>
</figure>
</center>

As a result, without using any password, only the cookie value was changed and the admin user was switched.

 

<h3 style="color:#d9cb30">Log Records</h3>

When the log records are examined, it is seen that there is no remarkable situation.

The screenshot showing that the user "user1" is logged in the analyzed log records is given below:

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:100%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-41.png" alt=""/>
</figure>
</center>

However, when the details of the requests sent with the network traffic were examined, it was seen that there was an abnormality in the cookie values.

A screenshot of the cookie value of the user entering the system from the 192.168.68.1 IP address is given below:

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:50%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-42.png" alt=""/>
</figure>
</center>

The screenshot of the cookie value in the second request sent to the system from the same IP address is given below:

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:50%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-43.png" alt=""/>
</figure>
</center>

As seen in the screenshots, the person connecting to the system from the same IP address has changed the cookie values ​​and switched to the "admin" user.

 
<h3 style="color:#d9cb30">Protection Methods</h3>


<ul>
<li>Providing strong authentication and session management</li>
<li>Preventing XSS attacks so that cookie information is not stolen</li>
</ul>

<h2 style="color:#d9cb30; text-align:center;">Cross-Site Scripting (XSS)</h2>
 

XSS is a type of attack that allows the client to run code on a site with the help of HTML and JavaScript. In addition, attacks such as cookie stealing and page redirection can also be organized.

XSS is usually found in sections where GET and POST methods are used. It is found in fields that take input such as search boxes, galleries, messages, and memberships. The payload used for detection is usually in the form of given below. Of course, this payload is a very classic example. Different event handlers (onclick, onload, onmouseover, etc.) can be used depending on the filtering situation. For detailed information about XSS and for examples, you can visit the website.

 
Example Payload: "&gt;&lt;script&gt;alert(1)&lt;/script&gt;

<ul>
<li><a href="https://app.letsdefend.io/training/lesson_detail/detecting-cross-site-scripting-xss-attacks-web-att" target="_blank">Detecting Cross Site Scripting (XSS) Attacks</a></li>
</ul>

 
<h3 style="color:#d9cb30">Attack Sample</h3>

In this sample attack, the vulnerability will be exploited by adding JavaScript code to the section where a message should be written for the guestbook.

For this, the appropriate JavaScript code is written and sent to the message section first. If the vulnerability is exploited with the code written as an example, "1" will be written on the screen as a pop-up message.

The application is tried to be exploited by writing JS code outside of the expected message in the guestbook.

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:80%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-44.png" alt=""/>
</figure>
</center>

Users who visit the page after the message is sent are affected by the code written.

Below is a screenshot showing that the user visiting the page is affected by the JavaScript code.

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:80%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-45.png" alt=""/>
</figure>
</center>

Looking at the source code of the page, it is seen that the javascript code has been added.

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:70%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-46.png" alt=""/>
</figure>
</center>

 
<h3 style="color:#d9cb30">Log Records</h3>


When the log records are examined, it is seen that data is sent to the page related to the POST method.

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:100%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-47.png" alt=""/>
</figure>
</center>

Network traffic is inspected to see the details.

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:80%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-48.png" alt=""/>
</figure>
</center>

As can be seen in the records of the examined traffic, JavaScript code was injected into the attacker message section.

In order to detect XSS attacks performed with the GET method, it is necessary to filter some keywords in the log files. The most used characters and words in XSS attacks are &lt;, &gt;, alert, script, src, cookie, onerror, document. While filtering the search with the grep command, it is necessary to search for the URL encoded version of the '&lt;' and '&gt;' characters.

As a result;

cat access.log | grep -E "%3C|%3E|alert|script|src|cookie|onerror|document"


A command appears.

A screenshot of an example XSS attack detection is given below:

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:80%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-49.png" alt=""/>
</figure>
</center>

 
<h3 style="color:#d9cb30">Protection Methods</h3>


<ul>
<li>Verifying the input (checking that the data entered is indeed the requested type).</li>
<li>Using whitelist instead of blacklist.</li>
</ul>
 

<h2 style="color:#d9cb30; text-align:center;">Security Misconfiguration</h2>
 

This vulnerability is due to security configurations being left incorrect, weak, or default.

 
<h3 style="color:#d9cb30">Attack Sample</h3>

In this sample attack, as a result of not changing the password of the "admin" user automatically created by the system, the attacker can log into the system with the default user name and password.

 
<h3 style="color:#d9cb30">Protection Methods</h3>

<ul>
<li>Editing the default configurations.</li>
<li>Keeping software up to date.</li>
<li>Disable unused services and ports.</li>
</ul>

 
<h2 style="color:#d9cb30; text-align:center;">Cross-Site Request Forgery (CSRF)</h2>
 

CSRF stands for cross-site request forgery. It is a type of attack that is carried out by making the user take action against his will by the attackers.

 
<h3 style="color:#d9cb30">Attack Sample</h3>

In this sample attack, our goal will be to change the victim's password by sending a request to the target application with a fake web page.

There is only a "click" button on the fake web page. The screenshot of the relevant button is given below:

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:30%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-50.png" alt=""/>
</figure>
</center>

A screenshot of the source code of the fake page is given below:

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:100%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-51.png" alt=""/>
</figure>
</center>

The following action will be taken on our fake page; If the victim clicks the "click" button, they will send a request to the target application that they want to change their password to 123456.

And the password of the user who clicked the button will be changed. The relevant screenshot is given below:

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:50%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-52.png" alt=""/>
</figure>
</center>

 
<h3 style="color:#d9cb30">Log Records</h3>

When the log records are examined after the attack, it is seen that the victim requested a password to the application and the user's password was changed.

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:100%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-53-1024x54.png" alt=""/>
</figure>
</center>

 
<h3 style="color:#d9cb30">Protection Methods</h3>

<ul>
<li>Using the CSRF protection mechanisms offered by the frameworks.</li>
<li>Using token and session.</li>
</ul>

Attacks Against Web Applications

In this section, we will be examining a fully compromised web server running Wordpress by post-attack analysis.

First, understanding whether the attacker has access to the admin panel can be discovered by entering this command below:

 
cat access.log | grep POST | grep wp-login

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:70%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-89.png" alt=""/>
</figure>
</center>

As can be seen in the output in the screenshot above, many POST requests have been sent to the admin panel login page over the same IP address. Network traffic is examined to check the data sent with the request. For this, in Wireshark;

<a href="https://www.wireshark.org/" target="_blank">Wireshark</a> is the world's foremost and widely-used network protocol analyzer.

 
Query: ip.src == 192.168.2.232 &amp;&amp; ip.dst == 192.168.2.31 &amp;&amp; http.request.method == POST
 

POST requests to the web server through the attacker are listed using the filter.

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:100%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-90.png" alt=""/>
</figure>
</center>

When the requests were examined, it was determined that a brute force attack was carried out on the "wp-login" page.

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:70%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-91.png" alt=""/>
</figure>
</center>

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:70%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-92.png" alt=""/>
</figure>
</center>

As a result of the attack, the correct username and password were found as admin: admin.

When the “error.log” file is examined, it is seen that the fscockopen() function is intended to be activated. Thus, it can be predicted what the attacker did in the admin panel. The cat error.log command reads the error.log page.

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:100%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-93.png" alt=""/>
</figure>
</center>

Looking at the file details, it was determined that it sent a request to the /words/test123123 path. The relevant screenshot is given below:

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:100%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-94.png" alt=""/>
</figure>
</center>

The attacker wanted to go to an inaccessible page and get a 404 Not Found. Thus, instead of the classic 404 Not Found error page, it is thought that the code he has placed will work. We can look at the change by examining the network traffic or logging into the admin panel.

Looking at the changes, it was determined that the content of the 404 Not Found error page was changed by the attacker.

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:100%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-95.png" alt=""/>
</figure>
</center>

The piece of code used by the attacker for the error page is shown in the screenshot below:

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:50%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-96.png" alt=""/>
</figure>
</center>

When the code used by the attacker for the 404 error code page is examined, it is seen that he opened access to his own address on port 1234.

The attacker will have access to the server with www-data user rights with this door opened for himself. In this case, the commands run by the "www-data" user on the server are examined.

Below is a screenshot of the commands the attacker ran on the server.

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:30%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-97.png" alt=""/>
</figure>
</center>

The attacker, who read the "wp-config.php" file, switched to the root user. When looking at the wp-config.php file, the database password is the same as the root user's password.

A screenshot of the contents of the wp-config.php file is given below:

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:50%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-98.png" alt=""/>
</figure>
</center>

With the above password, the attacker gained root authority and took over the entire server.

 
<h2 style="color:#d9cb30; text-align:center;">Conclusion</h2>
 

As discussed in the tutorial, attackers can attack the web server in various ways to take over. In order to detect attacks, <a href="https://app.letsdefend.io/training/lessons/network-log-analysis" target="_blank">log analysis</a> and good control of network traffic are required. For this, it is necessary to know and understand the attack vectors for effective analysis.

Sometimes a security vulnerability can be caused by the server or programming language you are using. Therefore, it is necessary to keep the components on the server constantly updated.

 
<div data-tf-widget="TIYSdddb" data-tf-iframe-props="title=Course Feedback Survey" data-tf-medium="snippet" data-tf-hidden="training=Hacked Web Server Analysis" style="width:100%;height:500px;"></div><script src="//embed.typeform.com/next/embed.js"></script>

Hacked Web Server Analysis Example

<h2 style="color:#d9cb30; text-align:center;">Finding the Shell Installed on the Server</h2>
 

Shell is a script that transfers the rights to the installer on the server it is installed on. c99,r57 is one of the most popular shells known. In this section, we will talk about PHP shells.

If we take a look at the shell example, which allows running a simple command, it is seen that it runs the system() function outside of ordinary commands.

Below is a screenshot of a simple PHP shell.

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:100%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-78.png" alt=""/>
</figure>
</center>

In this case, if the files that call the system() function in the server are extracted, the malicious file can be found more easily among hundreds of files.

With the command below, all files that call the system function under the /var/www directory are scanned.

Command: grep -Rn "system *(" /var/www

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:100%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-79.png" alt=""/>
</figure>
</center>

When a different PHP shell is examined, it is seen that the shell_exec() function is preferred instead of the system function.

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:100%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-80.png" alt=""/>
</figure>
</center>

As mentioned before, shell_exec() and eval() functions also stand out when paying attention to the different functions used.

In other words, the shell_exec and eval functions should also be scanned while searching for the shell.

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:100%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-81.png" alt=""/>
</figure>
</center>

When PHP shells are examined, it is observed that they generally contain parameters such as passthru, shell_exec, system, phpinfo, base64_decode, edoced_46esab, chmod, mkdir, fopen, fclose, readfile, php_uname, and eval. For this, it is possible to find the shells in the server in a scan performed with the command given below.

<figure class="wp-block-table">
<table>
<tbody>
<tr><td>grep -RPn "(passthru|shell_exec|system|phpinfo|base64_decode|chmod|mkdir|fopen|fclose|readfile|php_uname|eval) *\(" /var/www</td></tr>
</tbody>
</table>
</figure>

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:100%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-82.png" alt=""/>
</figure>
</center>

<h2 style="color:#d9cb30; text-align:center;">Shell Hide Methods</h2>
 

In order not to be caught in the firewall by the system administrator or while uploading files, attackers apply some shell hiding methods. In this section, we will discuss these methods.

<h3 style="color:#d9cb30">Remote Summoning</h3>
 

In this method, the shell is not actually hosted on the target server. The codes belonging to the shell from another address are pulled and run on the target server.

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:100%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-83.png" alt=""/>
</figure>
</center>

<h3 style="color:#d9cb30">Encrypted Code</h3>
 

By encrypting the code of the shell, the firewall, if any, is tried to be bypassed it.

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:100%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-84.png" alt=""/>
</figure>
</center>

<h3 style="color:#d9cb30">Hiding in Picture</h3>
 

Here, the malicious code is placed in the exif information of any image, and the code is run by reading the exif information of the image with PHP.

First, the desired codes are placed in the exif information of the image with the help of exiftool. The screenshot of the image whose "exif" information has been changed is given below:

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:100%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-85.png" alt=""/>
</figure>
</center>

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:100%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-86.png" alt=""/>
</figure>
</center>

Then PHP code is written to read the exif information from the image.

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:100%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-php.png" alt=""/>
</figure>
</center>

Firewalls can be bypassed with such hiding methods. When it comes to finding the shell, it is not very difficult by searching the files on the server one by one with the help of grep. But apart from the functions mentioned earlier, it will be necessary to scan the exif_read_data() and preg_replace() functions.

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:100%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-88.png" alt=""/>
</figure>
</center>

As can be seen above, the encrypted shell, the hidden shell in the picture, and the remotely called shells have all been located.

Discovering the Web Shell

In this section, the vulnerabilities on the server itself will be reviewed. For further information on the vulnerabilities, you can visit the below site:

<ul>
<li><a href="http://www.cvedetails.com">http://www.cvedetails.com</a>&nbsp;</li>
</ul>

<h2 style="color:#d9cb30; text-align:center;">Apache Web Server</h2>
 

The vulnerability with the code CVE-2014-6271, which is called "Shellshock" for the Apache server and is used to run commands remotely, will be discussed. Systems using mod_cgi and mod_cgid modules on Apache servers are affected by the vulnerability and bash versions 1.14 to 4.3 are affected.

The vulnerability can be exploited by modifying the HTTP_USER_AGENT environment variable to be malicious and targeting it to CGI scripts.

 
<h3 style="color:#d9cb30">Attack Sample</h3>


For the sample attack to be carried out, the script runs on the target that pulls the "uptime" and "kernel" information from the server.

With the following command, it is desired to read the "passwd" file of the destination address.

 
echo -e "HEAD /cgi-bin/status HTTP/1.1\r\nUser-Agent: () { :;}; echo \$(&lt;/etc/passwd)\r\nHost: TARGET_ADDRESS\r\nConnection: close\r\n\r\n" | nc TARGET_ADDRESS 80
 

When the HTTP header of the response is examined, the content of the "passwd" file is displayed.

The screenshot below shows that the user-agent header information has been changed and the request has been sent to the target.

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:60%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-54.png" alt=""/>
</figure>
</center>

 
<h3 style="color:#d9cb30">Log Records</h3>

When the log records are examined, it is noteworthy that a HEAD request is sent to /cgi-bin/status.

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:100%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-55.png" alt=""/>
</figure>
</center>

At the same time, the /etc/passwd section, which is sent with various parameters, stands out. Network traffic is inspected to display the returned response.

The request sent to the “cgi-bin/status” file is given in the screenshot below.

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:60%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-56.png" alt=""/>
</figure>
</center>

Below is a screenshot of the response returned by the server to the requested request.

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:60%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-57.png" alt=""/>
</figure>
</center>

When the response is examined, it is seen that the server information has been disclosed.

 
<h3 style="color:#d9cb30">Protection Methods</h3>


<ul>
<li>Upgrade Bash to the current version.</li>
</ul>

The command to be used for this is;

sudo apt-get update &amp;&amp; sudo apt-get install --only-upgrade bash

 
<h2 style="color:#d9cb30; text-align:center;">Nginx Web Server</h2>
 

Looking at the security vulnerabilities found for the Nginx server, there is no critical vulnerability in 2010-2017.

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:70%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-58.png" alt=""/>
</figure>
</center>

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:70%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-59.png" alt=""/>
</figure>
</center>

<h2 style="color:#d9cb30; text-align:center;">IIS Web Server</h2>
 

In this section, two vulnerabilities will be mentioned. These are CVE-2017-7269 and MS15-034.

 
<h3 style="color:#d9cb30">MS15-034 Vulnerability</h3>


This vulnerability allows remote code execution when a specially crafted HTTP request is sent to the windows system.

Vulnerable versions: Machines with any version of IIS using HTTP.sys on Windows 7, Windows Server 2008 R2, Windows 8, Windows Server 2012, Windows 8.1, and Windows Server 2012 R2 operating systems.

When the target is scanned with <a href="https://nmap.org/" target="_blank">nmap</a>, it is seen that it is using Windows Vista, 2000 or 7 and also IIS 7.5 is active.

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:70%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-60.png" alt=""/>
</figure>
</center>

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:100%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-61.png" alt=""/>
</figure>
</center>

In order to understand whether the related vulnerability is valid for the target, HTTP request with the "Range" header is sent to the target. The added range will be processed by the server.

wget --header="Range: bytes=0-18446744073709551615" http://192.168.10.169/welcome.png

The above command is entered and it is understood that the vulnerability exists due to the "416 Requested Range Not Satisfiable" output.

Then it is sent again by changing the Range and is under overload.

wget --header="Range: bytes=18-18446744073709551615" http://192.168.10.169/welcome.png

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:70%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-62.png" alt=""/>
</figure>
</center>

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:50%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-63.png" alt=""/>
</figure>
</center>

It is possible to get rid of the vulnerability associated with installing Windows updates.

 
<h3 style="color:#d9cb30">CVE-2017-7269 Vulnerability</h3>

CVE-2017-7269 vulnerability found on a machine running IIS 6.0 on Windows Server 2003 R2 will be discussed. The vulnerability is due to the buffer overflow attack of the ScStoragePathFromUrl function in the WebDAV service in IIS 6.0.

The vulnerability can be exploited by using the “iis_webdav_scstoragepathfromurl” exploit in Metasploit.

The screenshot of the settings made for the exploit is given below:

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:60%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-64.png" alt=""/>
</figure>
</center>



<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:60%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-65.png" alt=""/>
</figure>
</center>

The screenshot of the meterpreter session obtained as a result of exploiting the vulnerability is given above.

Vulnerabilities on Servers

While logging on web servers, requests made with the POST method may not be logged by default. In this case, the situation can be compensated by using modules such as mod_forensic or mod_security.

The data sent with the POST method is not included in the logs. Network traffic needs to be examined to access data.

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:100%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image.png" alt=""/>
</figure>
</center>

A screenshot of the log record of a request sent with the POST method is given above. As can be seen, it is seen in the relevant request to which address the request was sent. Looking at the sent package itself, there is also information such as the data sent by the client to the server and the referring page. A sample post request has been added below for clarity.

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:100%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-1.png" alt=""/>
</figure>
</center>

<h2 style="color:#d9cb30; text-align:center;">Apache Web Server</h2>
 

In this section, we will see how a web application hosted on an Apache server was exposed to an SQL Injection attack by examining the log records.

 
<h3 style="color:#d9cb30">Log Records</h3>

In the Apache web server, log records are kept in access.log and error.log files under /var/log/apache2 folder. In the "access.log", a record of requests made to the server is kept.

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:100%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-2.png" alt=""/>
</figure>
</center>

In the screenshot above, from the IP address “192.168.2.232” to the “/index.php” page, in the “GET” method in the “[18/Aug/2017:15:02:05 +0000]” time zone, “Mozilla/5.0 (X11; Linux x86_64) ) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.78 Safari/537.36” User-Agent request was sent.

The "error.log" file contains errors that the server encounters while processing requests.

The following screenshot shows that the client trying to navigate to the "/test" directory failed.

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:100%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-3.png" alt=""/>
</figure>
</center>

<h4 style="color:#d9cb30">How did the SQL Injection attack happen?</h4>

To examine the logs of the server exposed to the SQL Injection attack, go to the /var/log/apache2 folder.

<table>
<tbody>
<tr><td>cat access.log</td></tr>
</tbody>
</table>

When you look at the log file with the above command, it is clear that many SQL injection attempts are made by the same IP address. If the injection attempts were not made noticeably, the most used parameters in sql attacks would be searched in the logs. These are union, select, from, or, They are parameters such as version. These parameters can be searched in log files with the grep command.

<table>
<tbody>
<tr><td>cat access.log | grep -E “%27|--|union|select|from|or|@|version|char|varchar|exec</td></tr>
</tbody>
</table>

Below is a screenshot of the SQL injection records in the "access.log" file.

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:100%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-4-1024x415.png" alt=""/>
</figure>
</center>

In order to view the successful attempts, the responses that return 200 codes from the server must be filtered.

 
cat access.log | grep 200
 
Filtering is performed with the grep command. After the filtering, output shows the logs that has HTTP Response 200 status code were returned to the SQL query where the username and password were drawn.

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:80%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-5.png" alt=""/>
</figure>
</center>

Let's apply the "URL Decode" operation to the URL address above.

Decoded URL: /cat.php?id=1 UNION SELECT 1,concat(login,':',password),3,4 FROM users;

When the encoded URL is decoded, you can see that there is clearly a SQL Injection attack.

To check if the attacker is logged into the "admin" panel, we can look at the access logs via command below:

cat access.log | grep 192.168.2.232 | grep admin/index.php

The screenshot of the records of the attacker who made a request to the admin panel is given below:

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:70%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-6.png" alt=""/>
</figure>
</center>

In the screenshot, it is seen that the attacker sends a request to the admin panel with the POST method. When the sent POST request is examined with Wireshark, it is certain that the attacker has logged into the panel.

The details of the POST request sent to the admin panel are given in the screenshot below:

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:70%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-7.png" alt=""/>
</figure>
</center>

<h2 style="color:#d9cb30; text-align:center;">Nginx Server</h2>
 

In this section, log records of "directory traversal vulnerability" attempts, which are an attack on the application running on the Nginx server, will be examined. In this attack, different files are accessed by changing the directory with dot-dot-slash ( ../ ).

 
<h3 style="color:#d9cb30">Log Records</h3>

On Nginx servers, log files are kept in the /var/log/nginx directory, as in Apache servers, in access.log and error.log files.

 
<h4 style="color:#d9cb30">How Did the Attack Occur?</h4>

It would be more convenient for us to filter the characters “../” or “..\” for the detection of the attack.

Command: cat access.log | grep ../

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:100%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-8.png" alt=""/>
</figure>
</center>

As can be seen in the output above, the attacker tried to read the passwd file. After the third attempt, he transferred the page to himself with the wget command.

When the transferred page is examined, it is seen that the information in the "passwd" file has been disclosed. The screenshot of the page copied by the attacker is given below:

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:70%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-9.png" alt=""/>
</figure>
</center>

<h2 style="color:#d9cb30; text-align:center;">IIS Web Server</h2>
 

Log records are kept in the C:\inetpub\logs\LogFiles\W3SVC1 folder on the IIS web Server.

A sample screenshot of the log records on IIS web servers is given below:

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:100%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-10.png" alt=""/>
</figure>
</center>

Log Analysis on Web Servers

When the internet is widely available in almost every home, web services have become a part of life and this has led to attackers targeting these services.

Attackers can steal information from web services for the purpose of making them nonfunctional, gaining fame, etc. They organize attacks on web servers to perform illegal activities. During the training, various attacks on web servers and analysis methods will be examined.

 
<h3 style="color:#d9cb30">Introduction to Log Analysis</h3>


Log recording is the recording of events that occur on the server. Thanks to the log records, undesired situations such as system errors and security risks can be analyzed.

In log analysis, it is of great importance that the analyst knows what he/she is looking for. Considering that there are all kinds of activity records in the log files, it will be very troublesome to reach the result without filtering.

Thus, it is crucial to pay attention to 3 steps during log analysis:

<ol>
<li>Accessing the logs</li>
<li>Determining the purpose for which log analysis will be carried out</li>
<li>Extracting data by filtering log records for your intention</li>
</ol>

In the following sections, UNIX tools will be used while performing log analysis. If you are not familiar with these tools, we recommend that you should complete the <a href="https://app.letsdefend.io/training/lessons/linux-for-blue-team" target="_blank">"Linux for Blue Team"</a> training first to get a better understanding.

Introduction to Hacked Web Server Analysis

Attacks on web servers are usually caused by the vulnerability of the web server itself, the vulnerabilities of the application server, or the web application that has not taken adequate security measures.

<h2 style="color:#d9cb30; text-align:center;">Application Servers</h2>
 

In this section, we will examine the security vulnerabilities arising from application servers such as tomcat, jboss, glassfish.

 
<h3 style="color:#d9cb30">Tomcat Application Server</h3>

The vulnerability is caused by the server using mod_jk and the application server allowing the URL addresses sent by the client to be decoded.

The purpose here is to use the directory traversal vulnerability by encoding the ".." parameter twice.

<figure class="wp-block-table">
<table>
<tbody>
<tr><td>“..” → “%2e” →“%252e”</td></tr>
</tbody>
</table>
</figure>

The page cannot be accessed when the "/manager/html" extension of the target address is accessed.

However, when trying to go to the “/examples/jps/%252e%252e/%252e%252e/manager/html” extension, the login panel is encountered.

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:100%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-11.png" alt=""/>
</figure>
</center>

After trying the default user name and password, access to the admin panel is provided. Before the prepared webshell is loaded, “/examples/jsp/%252e%252e/%252e%252e/” is added to the beginning of the action part of the deploy button. After the process, the webshell is loaded.

The screenshot of the action part of the Deploy button is given below:

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:100%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-12.png" alt=""/>
</figure>
</center>

Then, the desired commands can be run by going to the "/examples/jsp/%252e%252e/%252e%252e/test" extension.

The screenshot of the extension with Webshell is given below:

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:100%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image.jpeg" alt=""/>
</figure>
</center>

 
<h4 style="color:#d9cb30">Log Records</h4>

Requests made to the login panel are listed with the command below. When the requests were examined, it was seen that the address was reached with the URL encode.

Command: cat access.log | grep manager/html | grep 200

The relevant screenshot is given below:

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:100%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-13.png" alt=""/>
</figure>
</center>

When filtering the logs with the IP address of the attacker reaching the panel; The requests sent by the attacker were examined. The POST request sent is noteworthy.

With the following command, all 200 http response code requests of the target are listed.

Command: cat access.log | grep 192.168.68.1 | grep 200

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:100%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-14.png" alt=""/>
</figure>
</center>

Using the Wireshark filter below, the relevant request is found and examined.

Wireshark filter: ip.src == 192.168.68.1 &amp;&amp; http.request.method == POST

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:100%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-1.jpeg" alt=""/>
</figure>
</center>

As seen in the screenshot above, the attacker installed the test.war file on the system.

 
<h4 style="color:#d9cb30">Protection Methods</h4>

The vulnerability can be avoided by updating “mod_jk”.

 
<h3 style="color:#d9cb30">GlassFish</h3>

This section will discuss CVE-2011-0807 and the remote code execution vulnerability. You can access the vulnerability details by clicking <a href="https://nvd.nist.gov/vuln/detail/CVE-2011-0807" target="_blank">here.</a>

The panel is accessed using various methods such as authentication bypass, default user name, and password, and remote access is provided by uploading a malicious file to the system. The target system has Sun GlassFish Enterprise Server 2.1 and Java System Application Server 9.1. In this case, the target system is exploited using the "exploit/multi/http/glassfish_deployer" exploit in the Metasploit Framework.

First of all, the target is scanned with nmap and it is tried to determine the open ports on the system and what the ports are used for.

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:100%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-15.png" alt=""/>
</figure>
</center>

As seen in the image above, GlassFish 2.1 is running on the target system. Exploits created for GlassFish are searched with the help of msfconsole.

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:100%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-16.png" alt=""/>
</figure>
</center>

The exploit is selected with the “use” command and necessary adjustments are made. The settings for the exploit are given in the screenshot below:

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:100%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-17.png" alt=""/>
</figure>
</center>

The exploit is run by issuing the "run" command.

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:100%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-18.png" alt=""/>
</figure>
</center>

After the exploit is run, our meterpreter session is prepared and we can run commands on the target.

Below is a screenshot showing that the Meterpreter session is active and the command is executable on the target.

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:100%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-19.png" alt=""/>
</figure>
</center>

 
<h4 style="color:#d9cb30">Log Records</h4>

With the "netstat -an" command, the addresses that the system communicates with are displayed and it is seen that it is communicating with an unrecognized address on port 4444.

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:100%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-20.png" alt=""/>
</figure>
</center>

When the network traffic is examined, it is seen that the attacker sent three different GET requests. Relevant requests are given in the screenshot below:

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:100%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-21-1024x52.png" alt=""/>
</figure>
</center>

After GET requests, TCP traffic occurs over many 4444 ports. However, since Metasploit encrypts the data with AES, we cannot learn which commands the attacker executed over the network traffic.

 
<h4 style="color:#d9cb30">Protection Methods</h4>


<ul>
<li>Not leaving the username and password as default.</li>
<li>Installing updates.</li>
</ul>

 
<h3 style="color:#d9cb30">Jboss</h3>

In this section, the remote code execution vulnerability running in Jboss AS versions 3,4,5, and 6 will be examined. The target system is running Jboss 6 on Ubuntu 14.04. Exploit ID number 36575 in exploit-db;

<ul>
<li><a href="https://www.exploit-db.com/exploits/36575/">https://www.exploit-db.com/exploits/36575/</a></li>
</ul>

The vulnerability will be exploited.

After the exploit is downloaded, the target address and port number are specified and the attack is started with command below.

python 36575.py http://192.168.2.105:8080

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:100%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-22.png" alt=""/>
</figure>
</center>

Then the exploit is performed and the shell appears on the screen. "Whoami" and "uname -a" commands are run on this screen.

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:100%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-23.png" alt=""/>
</figure>
</center>

 
<h4 style="color:#d9cb30">Log Records</h4>

When the HTTP requests to the server are examined, parameters such as id, whoami, uname -a draw attention.

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:100%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-24.png" alt=""/>
</figure>
</center>

When the details of the relevant packets are examined, the response returned by the server and the address of the request is seen.

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:100%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-25-1024x290.png" alt=""/>
</figure>
</center>

As seen in the records, requests are made to "/jbossass/jbossass.jps" path.

The file where the request is made is searched on the server with the command below.

find /opt/jboss-6.0.0.Final/ -type f -name "jbossass.jsp"

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:100%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-26.png" alt=""/>
</figure>
</center>

Below is a screenshot of the source code of the "jbossass.jsp" file. When the related file is examined, as seen that it is a webshell.

<center>
<figure class="wp-block-image size-large">
<img class="responsive" style="width:100%" src="https://letsdefend.io/blog/wp-content/uploads/2022/11/image-27.png" alt=""/>
</figure>
</center>

 
<h4 style="color:#d9cb30">Protection Methods</h4>

<ul>
<li>Upgrade to JBoss EAP 7.</li>
<li>Running software with an unauthorized user.</li>
</ul>

Attacks on Web Servers

When you're connected to Splunk, click near the Administrator menu
On the left control panel, you have the status of each part of Splunk Server. On the right control panel, you have the description of each signal.

Splunk Health Status Check

Alerts are saved searches that trigger when certain conditions are met. They can be scheduled or in real-time. In that case, be careful not to overload your Splunk server.

Alerts on Splunk

Go to the Windows computer
Download the setup
Read the Splunk General Terms
Download the MD5
Open the md5 file to have the checksum: at this time is: 183a09c64537832701320609e665e3e7
Check your MD5 (Get-FileHash .\splunkforwarder-9.0.0.1-9e907cedecb1-x64-release.msi -Algorithm md5) to confirm you've got the right installer.
Launch the setup
Read the Licence Agreement
Accept the Licence Agreement
Select "an on-premises Splunk Enterprise instance" because we have to install Splunk on an on-premise server.

Splunk Universal Forwarders

Let's take a tour on the Search page. As you see, there is a lot of information to learn, let's try to clarify them.

Search on Splunk

Splunk is the data platform that powers enterprise observability, unified security, and limitless custom applications in hybrid environments. Splunk is one of the most popular security solutions in the cybersecurity industry. This is why we'll show you how this product works.

Introduction to Splunk

In Splunk, you can add data in different ways. Here we are going to see the forwarder installed on the Win10 computer and with the upload of a log file.

Add Data to Splunk

A dashboard is nothing more than a dashboard. Here you can find a lot of information you need.
You can make one for analysts, and one for your customers, with different types of information. If you use always the same requests and always need the same information, then making a Dashboard is a good idea.

Dashboards

For the training, we are gonna install Splunk on a Windows Server 2022 virtual machine.