Hero Image
Cyber Security Notes

My notes on Notion (backup link) I take notes using Notion. Lots of commands, tools, hints, and tips. Over 72,000 words so far! Screenshot as of October 2021:

    Monday, March 7, 2022 | 1 minute Read
    Hero Image
    MITRE D3FEND - Security BSides London Talk

    Back in November I gave a talk at Security BSides in London about MITRE’s D3FEND framework. Audio is a bit off until 1:27, then it’s fine. Watch it here:

    Monday, January 10, 2022 | 1 minute Read
    Hero Image
    Creating an HMI in CODESYS

    Introduction Learning CODESYS Temperature Control HMI Code Variables HMI Simulation Comments? Introduction Until now I’ve used OpenPLC for all my PLC (ladder logic) projects, as it’s very user-friendly and it makes using an Arduino as a PLC very simply. However, as I was studying LL and ST, another piece of software kept being mentioned - CODESYS. According to CODESYS, they are “the leading manufacturer-independent IEC 61131-3 automation software for engineering control systems”. Compared with OpenPLC, it is much more feature-rich (and more complex), able to interface with a large number of PLCs. However, the reason I was interested in it is for one particular feature it has that OpenPLC doesn’t - you can make your own basic HMI (human-machine interfaces) with it.

    Monday, October 18, 2021 | 3 minutes Read
    Hero Image
    HoneyBOT (pcap Analysis)

    https://cyberdefenders.org/labs/45 Contents Description Tools Questions 1. What is the attackers IP address? 2. What is the targets IP address? 3. Provide the country code for the attackers IP address (a.k.a geo-location). 4. How many TCP sessions are present in the captured traffic? 5. How long did it take to perform the attack (in seconds)? 6. No question 6 . . . 7. Provide the CVE number of the exploited vulnerability. 8. Which protocol was used to carry over the exploit? 9. Which protocol did the attacker use to download additional malicious files to the target system? 10. What is the name of the downloaded malware? 11. The attackers server was listening on a specific port. Provide the port number. 12. When was the involved malware first submitted to VirusTotal for analysis? 13. What is the key used to encode the shellcode? 14. What is the port number the shellcode binds to? 15. The shellcode used a specific technique to determine its location in memory. What is the OS file being queried during this process? Comments? Description A PCAP analysis exercise highlighting attacker’s interactions with honeypots and how automatic exploitation works. (Note that the IP address of the victim has been changed to hide the true location.)

    Monday, October 11, 2021 | 5 minutes Read
    Hero Image
    Structured Text in OpenPLC

    Introduction Structured Text Project Examples Two-Button Latching Circuit One-Button Latching Circuit with Emergency Stop Playing with Timers Steady(ish) State (e.g Temperature) Comments? Introduction After playing around with ladder logic (LL) in OpenPLC, I wanted to get a basic grip of structured text (ST). While LL is a visual method of programming PLCs, ST is a C-like language for programming PLCs, featuring well-know coding functions such as IF and WHILE. Fortunately, OpenPLC also allows you to program PLCs using ST! There is one minor difference; with Ladder Logic, OpenPLC can simulate the circuit and get a pretty visualisation based on the LL design itself - see the images in my previous post. With ST, because there is no design, there is no pretty visualisation. However, the Debugger does give a timeline of the states of the various variables, and it can be used to force a value, so you can still simulate a circuit.

    Monday, September 27, 2021 | 7 minutes Read
    Hero Image
    Arduino as a PLC with OpenPLC and Ladder Logic

    Introduction Getting It All Working Installation First Project Video Walkthrough Project Examples Two-Button Latching Circuit One-Button Latching Circuit with Emergency Stop Playing with Timers Steady(ish) State (e.g Temperature) Comments? Introduction PLCs (programmable logic controllers) are used within the operational technology (OT) space, such as in the industrial control systems (ICS) that manage manufacturing, energy generation, and robotics. PLCs are often integrated into SCADA systems, where a PLC is used to monitor inputs (e.g. temperature) and adjust outputs (e.g. motors) of a control system.

    Monday, September 20, 2021 | 5 minutes Read
    Hero Image
    Network Analysis - Web Shell

    https://blueteamlabs.online/home/challenge/12 Contents Contents Introduction Questions What is the IP responsible for conducting the port scan activity? What is the port range scanned by the suspicious host? What is the type of port scan conducted? Two more tools were used to perform reconnaissance against open ports, what were they? What is the name of the php file through which the attacker uploaded a web shell? What is the name of the web shell that the attacker uploaded? What is the parameter used in the web shell for executing commands? What is the first command executed by the attacker? What is the type of shell connection the attacker obtains through command execution? What is the port he uses for the shell connection? Comments? Introduction The SOC received an alert in their SIEM for ‘Local to Local Port Scanning’ where an internal private IP began scanning another internal system. Can you investigate and determine if this activity is malicious or not? You have been provided a PCAP, investigate using any tools you wish.

    Monday, September 6, 2021 | 6 minutes Read
    Hero Image
    XLM Macros (Document Analysis)

    https://cyberdefenders.org/labs/55 Contents Description Helpful Tools Questions 1: Sample1: What is the document decryption password? 2. There is no question 2 . . . 3: Sample1: This document contains six hidden sheets. What are their names? Provide the value of the one starting with S. 4: Sample1: What URL is the malware using to download the next stage? 5: Sample1: What malware family was this document attempting to drop? 6: Sample2: This document has a very hidden sheet. What is the name of this sheet? 7: Sample2: This document uses reg.exe. What registry key is it checking? 8: Sample2: From the use of reg.exe, what value of the assessed key indicates a sandbox environment? 9: Sample2: This document performs several additional anti-analysis checks. What Excel 4 macro function does it use? 10: Sample2: This document checks for the name of the environment in which Excel is running. What value is it using to compare? 11: Sample2: What type of payload is downloaded? 12: Sample2: What URL does the malware download the payload from? 13: Sample2: What is the filename that the payload is saved as? 14: Sample2: How is the payload executed? For example, mshta.exe 15: Sample2: What was the malware family? Comments? Description Recently, we have seen a resurgence of Excel-based malicous office documents. Howerver, instead of using VBA-style macros, they are using older style Excel 4 macros. This changes our approach to analyzing these documents, requiring a slightly different set of tools. In this challenge, you’ll get hands-on with two documents that use Excel 4.0 macros to perform anti-analysis and download the next stage of the attack.

    Wednesday, September 1, 2021 | 6 minutes Read
    Hero Image
    L'Espion (OSINT)

    https://cyberdefenders.org/labs/73 Contents Description Questions 1: Github.txt: What is the API key the insider added to his GitHub repositories? 2: Github.txt: What is the plaintext password the insider added to his GitHub repositories? 3: Github.txt: What cryptocurrency mining tool did the insider use? 4: What university did the insider go to? 5: What gaming website the insider had an account on? 6: What is the link to the insider Instagram profile? 7: Where did the insider go on the holiday? (Country only) 8: Where is the insiders family live? (City only) 9: office.jpg: You have been provided with a picture of the building in which the company has an office. Which city is the company located in? 10: Webcam.png: With the intel, you have provided, our ground surveillance unit is now overlooking the person of interests suspected address. They saw them leaving their apartment and followed them to the airport. Their plane took off and has landed in another country. Our intelligence team spotted the target with this IP camera. Which state is this camera in? Comments? Description You have been tasked by a client whose network was compromised and brought offline to investigate the incident and determine the attacker’s identity.

    Tuesday, August 17, 2021 | 5 minutes Read
    Hero Image
    Log Analysis - Privilege Escalation

    https://blueteamlabs.online/home/challenge/4 Contents Introduction Questions What user (other than ‘root’) is present on the server? What script did the attacker try to download to the server? What packet analyzer tool did the attacker try to use? What file extension did the attacker use to bypass the file upload filter implemented by the developer? Based on the commands run by the attacker before removing the php shell, what misconfiguration was exploited in the ‘python’ binary to gain root-level access? 1- Reverse Shell ; 2- File Upload ; 3- File Write ; 4- SUID ; 5- Library load Introduction A server with sensitive data was accessed by an attacker and the files were posted on an underground forum. This data was only available to a privileged user, in this case the ‘root’ account. Responders say ‘www-data’ would be the logged in user if the server was remotely accessed, and this user doesn’t have access to the data. The developer stated that the server is hosting a PHP-based website and that proper filtering is in place to prevent php file uploads to gain malicious code execution. The bash history is provided to you but the recorded commands don’t appear to be related to the attack. Can you find what actually happened?

    Monday, August 9, 2021 | 3 minutes Read
    Hero Image
    Six Months as a SOC Analyst - My Top Three Tips

    Introduction It’s already been six months since I started my journey as a Security Analyst (time flies!) so I thought I’d share some thoughts to help other aspiring SOC Analysts. I started with no professional IT experience, only a lifelong interest. My background was primarily in engineering. I prepared for an infosec role by doing CompTIA Security+ and Blue Team Level One certifications (review here), playing around on TryHackMe and with Security Onion, and generally learning as much as possible.

    Sunday, July 25, 2021 | 8 minutes Read
    Hero Image
    AfricaFalls (Disk Image Forensics)

    https://cyberdefenders.org/labs/66 Contents Introduction Tools Preparation Questions #1: What is the MD5 hash value of the suspect disk? #2: What phrase did the suspect search for on 2021-04-29 18:17:38 UTC? #3: What is the IPv4 address of the FTP server the suspect connected to? #4: What date and time was a password list deleted in UTC? #5: How many times was Tor Browser ran on the suspects computer? #6: What is the suspects email address? #7: What is the FQDN did the suspect port scan? #8: What country was picture 20210429_152043.jpg allegedly taken in? #9: What is the parent folder name picture 20210429_151535.jpg was in before the suspect copy it to contact folder on his desktop? #10: A Windows password hashes for an account are below. What is the users password #11: What is the user John Does Windows login password? Comments Introduction John Doe was accused of doing illegal activities. A disk image of his laptop was taken. Your task is to analyze the image and understand what happened under the hood.

    Sunday, July 18, 2021 | 6 minutes Read