The Cyber Security Body of Knowledge (CyBOK) is a body of knowledge that aims to encapsulate the various knowledge areas present within cyber security. Scenarios within SecGen now contain XML elements linking them to CyBOK knowledge areas and specific topics within those knowledge areas. Additionally, video lectures for scenarios are tagged with CyBOK associations.
This file is an autogenerated index and cross referencing of the 104 SecGen lab scenarios that have CyBOK metadata.
You can browse the list below in terms of the CyBOK Knowledge Areas, and Topics. The list of scenarios in the second half of this document includes keywords (also known as "indicative topics" in CyBOK terminology).
The all lowercase topics and keywords are provided by NCSC for CyBOK mapping, while all caps indicates it is taken from the CyBOK mapping reference, mixed case keywords are ones that we have added.
Cyber Securtiy Body of Knowledge (CyBOK) Issue 1.1 is Crown Copyright, The National Cyber Security Centre 2021, licensed under the Open Government Licence http://www.nationalarchives.gov.uk/doc/open-government-licence/.
Network Security (NS)
Security Operations & Incident Management (SOIM)
Malware & Attack Technology (MAT)
Adversarial Behaviours (AB)
Software Security (SS)
Authentication, Authorisation & Accountability (AAA)
Operating Systems & Virtualisation (OSV)
Forensics (F)
Cyber-Physical Systems Security (CPS)
Web & Mobile Security (WAM)
Cryptography (C)
introducing_attacks/1_intro_linux.xml
introducing_attacks/4_dns_footprinting.xml
introducing_attacks/5_scanning.xml
labtainers/arp-spoof.xml
labtainers/denyhost.xml
labtainers/dmz-example.xml
labtainers/dmz-lab.xml
labtainers/grfics.xml
labtainers/iptables-ics.xml
labtainers/iptables.xml
labtainers/iptables2.xml
labtainers/local-dns.xml
labtainers/nix-commands.xml
labtainers/nmap-discovery.xml
labtainers/nmap-ssh.xml
labtainers/pcapanalysis.xml
labtainers/pubkey.xml
labtainers/radius.xml
labtainers/remote-dns.xml
labtainers/routing-basics.xml
labtainers/routing-basics2.xml
labtainers/snort.xml
labtainers/tcpip.xml
labtainers/telnetlab.xml
labtainers/vpnlab.xml
labtainers/vpnlab2.xml
response_and_investigation/4_ids.xml
response_and_investigation/5_ids_rules.xml
response_and_investigation/6_exfiltration_detection.xml
introducing_attacks/1_intro_linux.xml
introducing_attacks/2_malware_msf_payloads.xml
introducing_attacks/3_vulnerabilities.xml
introducing_attacks/4_dns_footprinting.xml
introducing_attacks/5_scanning.xml
introducing_attacks/6_exploitation.xml
introducing_attacks/7_post-exploitation.xml
introducing_attacks/8_vulnerability_analysis.xml
labtainers/arp-spoof.xml
labtainers/backups.xml
labtainers/backups2.xml
labtainers/capabilities.xml
labtainers/centos-log.xml
labtainers/centos-log2.xml
labtainers/denyhost.xml
labtainers/file-integrity.xml
labtainers/grassmarlin.xml
labtainers/ldap.xml
labtainers/metasploit.xml
labtainers/nmap-ssh.xml
labtainers/packet-introspection.xml
labtainers/pcapanalysis.xml
labtainers/snort.xml
labtainers/sys-log.xml
labtainers/wireshark-intro.xml
response_and_investigation/2_integrity_detection.xml
response_and_investigation/3_backups_and_recovery.xml
response_and_investigation/4_ids.xml
response_and_investigation/5_ids_rules.xml
response_and_investigation/6_exfiltration_detection.xml
introducing_attacks/2_malware_msf_payloads.xml
introducing_attacks/3_vulnerabilities.xml
introducing_attacks/4_dns_footprinting.xml
introducing_attacks/5_scanning.xml
introducing_attacks/6_exploitation.xml
introducing_attacks/7_post-exploitation.xml
introducing_attacks/8_vulnerability_analysis.xml
labtainers/acl-hackerbot-flags.xml
labtainers/acl.xml
labtainers/bufoverflow.xml
labtainers/formatstring.xml
labtainers/gdblesson.xml
labtainers/ida.xml
labtainers/metasploit.xml
labtainers/retlibc.xml
labtainers/snort.xml
response_and_investigation/4_ids.xml
response_and_investigation/5_ids_rules.xml
response_and_investigation/7_live_analysis.xml
response_and_investigation/8_dead_analysis.xml
software_and_malware_analysis/10_anti_sre.xml
software_and_malware_analysis/1_dynamic_and_static_analysis.xml
software_and_malware_analysis/2_intro_to_c.xml
software_and_malware_analysis/3_c_and_asm.xml
software_and_malware_analysis/4_asm.xml
software_and_malware_analysis/5_ghidra.xml
software_and_malware_analysis/6_ghidra_analysis.xml
software_and_malware_analysis/6_ghidra_with_live_malware_samples.xml
software_and_malware_analysis/7_dynamic.xml
software_and_malware_analysis/8_dynamic_continued.xml
software_and_malware_analysis/9_malware_behaviour.xml
software_security_exploitation/4_exploit_development.xml
software_security_exploitation/5_linux_stack_bof.xml
software_security_exploitation/6_linux_nx_bypass.xml
software_security_exploitation/7_linux_aslr_bypass.xml
software_security_exploitation/8_linux_bof_format.xml
introducing_attacks/4_dns_footprinting.xml
introducing_attacks/5_scanning.xml
introducing_attacks/6_exploitation.xml
introducing_attacks/7_post-exploitation.xml
labtainers/grfics.xml
introducing_attacks/6_exploitation.xml
labtainers/bufoverflow.xml
labtainers/formatstring.xml
labtainers/pass-crack.xml
labtainers/retlibc.xml
labtainers/sql-inject.xml
labtainers/xforge.xml
labtainers/xsite.xml
software_security_exploitation/1_c_asm_iof.xml
software_security_exploitation/2_race_conditions_format_str.xml
software_security_exploitation/3_bug_hunting_and_fuzzing.xml
software_security_exploitation/4_exploit_development.xml
software_security_exploitation/5_linux_stack_bof.xml
software_security_exploitation/6_linux_nx_bypass.xml
software_security_exploitation/7_linux_aslr_bypass.xml
software_security_exploitation/8_linux_bof_format.xml
systems_security/8_apparmor.xml
web_security/websec_lab.xml
labtainers/acl-hackerbot-flags.xml
labtainers/acl.xml
labtainers/file-integrity.xml
labtainers/ldap.xml
labtainers/macs-hash.xml
labtainers/nix-commands.xml
labtainers/onewayhash.xml
labtainers/radius.xml
labtainers/setuid-env.xml
response_and_investigation/1_integrity_protection.xml
response_and_investigation/7_live_analysis.xml
response_and_investigation/8_dead_analysis.xml
systems_security/1_authentication.xml
systems_security/2_pam.xml
systems_security/4_access_controls.xml
systems_security/5_suid.xml
systems_security/6_facls.xml
systems_security/7_containers.xml
systems_security/8_apparmor.xml
labtainers/acl-hackerbot-flags.xml
labtainers/acl.xml
labtainers/capabilities.xml
labtainers/setuid-env.xml
response_and_investigation/1_integrity_protection.xml
response_and_investigation/2_integrity_detection.xml
response_and_investigation/7_live_analysis.xml
systems_security/1_authentication.xml
systems_security/2_pam.xml
systems_security/4_access_controls.xml
systems_security/5_suid.xml
systems_security/6_facls.xml
systems_security/7_containers.xml
systems_security/8_apparmor.xml
labtainers/file-deletion.xml
labtainers/file-integrity.xml
labtainers/macs-hash.xml
labtainers/onewayhash.xml
labtainers/packet-introspection.xml
labtainers/pass-crack.xml
labtainers/pcapanalysis.xml
labtainers/webtrack.xml
response_and_investigation/2_integrity_detection.xml
response_and_investigation/6_exfiltration_detection.xml
response_and_investigation/7_live_analysis.xml
response_and_investigation/8_dead_analysis.xml
labtainers/grassmarlin.xml
labtainers/grfics.xml
labtainers/iptables-ics.xml
labtainers/plc-app.xml
labtainers/plc-forensics-adv.xml
labtainers/plc-forensics.xml
labtainers/plc.xml
labtainers/softplc.xml
labtainers/softplc2.xml
labtainers/ssl.xml
labtainers/iptables-ics.xml
labtainers/iptables.xml
labtainers/iptables2.xml
labtainers/sql-inject.xml
labtainers/webtrack.xml
labtainers/xforge.xml
labtainers/xsite.xml
systems_security/7_containers.xml
web_security/websec_lab.xml
| Topic | Scenario |
|---|---|
| FIREWALLS | labtainers/iptables-ics.xml labtainers/iptables.xml labtainers/iptables2.xml |
| Server-Side Vulnerabilities and Mitigations | labtainers/sql-inject.xml labtainers/xforge.xml labtainers/xsite.xml web_security/websec_lab.xml |
| Fundamental Concepts and Approaches | labtainers/webtrack.xml systems_security/7_containers.xml web_security/websec_lab.xml |
| Client-Side Vulnerabilities and Mitigations | web_security/websec_lab.xml |
labtainers/macs-hash.xml
labtainers/onewayhash.xml
labtainers/pubkey.xml
labtainers/ssh-agent.xml
labtainers/sshlab.xml
labtainers/ssl.xml
labtainers/symkeylab.xml
| Topic | Scenario |
|---|---|
| Public-Key Cryptography | labtainers/macs-hash.xml labtainers/onewayhash.xml labtainers/ssh-agent.xml labtainers/sshlab.xml labtainers/ssl.xml |
| Schemes | labtainers/pubkey.xml labtainers/symkeylab.xml |
| Symmetric Cryptography | labtainers/symkeylab.xml |
| Key | Data |
|---|---|
| Name | Introduction to Linux and Security lab |
| Description | Introduction This topic covers lots of ground regarding fundamentals of Linux and free open source software (FOSS). Lecture Slides here Reading Chapters 1 "Introduction" and 2 "Unix History and Lineage": Garfinkel, S. and Spafford, G. and Schwartz, A. (2003), Practical Unix and Internet Security, O'Reilly. (ISBN-10: 0596003234) Suggested: Chapter 1 "An Overview of Computer Security": Bishop, M. (2005), Introduction to Computer Security, Addison-Wesley. (ISBN-10: 0321247442) Lab Lab sheet here. |
| Type | ctf-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | |
| VM names | desktop; kali |
| KA | Topic | Keywords |
|---|---|---|
| Network Security (NS) | Network Protocols and Vulnerability | common network attacks |
| Security Operations & Incident Management (SOIM) | PENETRATION TESTING | PENETRATION TESTING - SOFTWARE TOOLS |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/introducing_attacks/1_intro_linux.xml run
| Key | Data |
|---|---|
| Name | Malware and an Introduction to Metasploit and Payloads |
| Description | Introduction This week we will cover the ever present danger of malicious code, the problems with the traditional approaches such as anti-malware, and you will try your hand at using the Metasploit Framework to create a Trojan horse program. Lecture Slides here Reading Chapter 23 "Protecting Against Programmed Threats": Garfinkel, S. and Spafford, G. and Schwartz, A. (2003), Practical Unix and Internet Security, O'Reilly. (ISBN-10: 0596003234) Available online via the library Suggested: Chapter 3 "Program Security": Pfleeger, C.P. and Pfleeger, S.L. (2007), Security in Computing, Prentice Hall. (ISBN-10: 0132390779) Chapter 19 "Malicious Logic": Bishop, M. (2005), Introduction to Computer Security, Addison-Wesley. (ISBN-10: 0321247442) Lab Lab sheet here. |
| Type | lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | |
| VM names | windows_victim; kali |
| KA | Topic | Keywords |
|---|---|---|
| Malware & Attack Technology (MAT) | Malware Taxonomy | dimensions; kinds |
| Malware & Attack Technology (MAT) | Malware Analysis | anti-analysis and evasion techniques |
| Malware & Attack Technology (MAT) | Attacks and exploitation | EXPLOITATION FRAMEWORKS |
| Security Operations & Incident Management (SOIM) | PENETRATION TESTING | PENETRATION TESTING - SOFTWARE TOOLS; PENETRATION TESTING - ACTIVE PENETRATION |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/introducing_attacks/2_malware_msf_payloads.xml run
| Key | Data |
|---|---|
| Name | Vulnerabilities, Exploits, and Remote Access Payloads |
| Description | Introduction This week we will cover one of the major threats in computer security: software vulnerabilities. You will learn about the danger these pose, and start to learn about the power of the Metasploit framework, a popular hacking and penetration testing tool. You will learn and apply a number of important concepts such as payloads, shell code, bind and reverse shells, and both remote and local (client-side) exploits. Lecture Slides here Reading Chapter 8: Using Metasploit. Harper, A. and Harris, S. and Ness, J. and Eagle, C. and Lenkey, G, and Williams, T. (2011), Gray hat hacking : the ethical hacker's handbook, McGraw-Hill. (ISBN: 978-0-07-174256-6) Available online via the library Lab Lab sheet here. |
| Type | ctf-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | |
| VM names | windows_victim; linux_victim_server; kali |
| KA | Topic | Keywords |
|---|---|---|
| Malware & Attack Technology (MAT) | Attacks and exploitation | EXPLOITATION; EXPLOITATION FRAMEWORKS |
| Security Operations & Incident Management (SOIM) | PENETRATION TESTING | PENETRATION TESTING - SOFTWARE TOOLS; PENETRATION TESTING - ACTIVE PENETRATION |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/introducing_attacks/3_vulnerabilities.xml run
| Key | Data |
|---|---|
| Name | Information Gathering: Footprinting |
| Description | Introduction The topic of information gathering spans two weeks, and covers practical steps that an attacker needs to take in order to attack a system, starting with footprinting (discovering systems to attack) and scanning (learning more about the systems such as what kinds of attacks they are vulnerable to). Lecture Slides here Reading Part I Casing the establishment. McClure, S. and Scambray, J. and Kurtz, G. (2009), Hacking exposed, McGraw-Hill. (ISBN: 978-0-07-161375-0) Available online via the library Lab Lab sheet here. |
| Type | lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | |
| VM names | kali |
| KA | Topic | Keywords |
|---|---|---|
| Adversarial Behaviours (AB) | Models | kill chains |
| Malware & Attack Technology (MAT) | Malicious Activities by Malware | cyber kill chain |
| Network Security (NS) | PENETRATION TESTING | PENETRATION TESTING - DNS ZONE TRANSFER; EXPLOITATION FRAMEWORKS |
| Security Operations & Incident Management (SOIM) | PENETRATION TESTING | PENETRATION TESTING - NETWORK MAPPING - RECONNAISSANCE; PENETRATION TESTING - SOFTWARE TOOLS |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/introducing_attacks/4_dns_footprinting.xml run
| Key | Data |
|---|---|
| Name | Information Gathering: Scanning |
| Description | Introduction This week we learn how to scan networks to get an understanding of and to map out a network. Scanning is a critical stage for an attacker, since it can give them the information they need in order to launch an attack. Reading Chapter 2 Reconnaissance and Chapter 3 Scanning. Engebretson, P. (2011), The Basics of Hacking and Penetration Testing: Ethical Hacking and Penetration Testing Made Easy, Elsevier Inc. (ISBN: 978-1-59749-655-1) Available online via the library Lab Lab sheet here. |
| Type | ctf-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | |
| VM names | linux_victim_server; kali |
| KA | Topic | Keywords |
|---|---|---|
| Adversarial Behaviours (AB) | Models | kill chains |
| Malware & Attack Technology (MAT) | Malicious Activities by Malware | cyber kill chain |
| Network Security (NS) | PENETRATION TESTING | PENETRATION TESTING - NETWORK MAPPING - FINGERPRINTING; PENETRATION TESTING - NETWORK MAPPING - NMAP; PENETRATION TESTING - NETWORK MAPPING - PING |
| Security Operations & Incident Management (SOIM) | PENETRATION TESTING | PENETRATION TESTING - NETWORK MAPPING - RECONNAISSANCE; PENETRATION TESTING - SOFTWARE TOOLS |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/introducing_attacks/5_scanning.xml run
| Key | Data |
|---|---|
| Name | From Scanning to Exploitation |
| Description | Introduction This week we learn how we can scan networks to discover vulnerable services, and exploit them. Reading Chapter 2 Reconnaissance and Chapter 3 Scanning. Engebretson, P. (2011), The Basics of Hacking and Penetration Testing: Ethical Hacking and Penetration Testing Made Easy, Elsevier Inc. (ISBN: 978-1-59749-655-1) Available online via the library Lab Lab sheet here. |
| Type | ctf-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | |
| VM names | windows_server; linux_server; kali |
| KA | Topic | Keywords |
|---|---|---|
| Adversarial Behaviours (AB) | Models | kill chains |
| Malware & Attack Technology (MAT) | Malicious Activities by Malware | cyber kill chain |
| Software Security (SS) | Categories of Vulnerabilities | CVEs and CWEs |
| Malware & Attack Technology (MAT) | Attacks and exploitation | EXPLOITATION; EXPLOITATION FRAMEWORKS |
| Security Operations & Incident Management (SOIM) | PENETRATION TESTING | PENETRATION TESTING - SOFTWARE TOOLS; PENETRATION TESTING - ACTIVE PENETRATION |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/introducing_attacks/6_exploitation.xml run
| Key | Data |
|---|---|
| Name | Post-exploitation |
| Description | Introduction Once an attacker has a foothold in a system, they can misuse the privileges they have “appropriated” to take actions on the system, or go on to try to gain even more access on this or other connected systems. You will learn the skills used by an attacker or security tester, to take action once an exploit has been successful. Suggested reading An excellent resource is Metasploit Unleashed. Lab Lab sheet here. |
| Type | ctf-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | |
| VM names | windows_server; linux_server; kali |
| KA | Topic | Keywords |
|---|---|---|
| Adversarial Behaviours (AB) | Models | kill chains |
| Malware & Attack Technology (MAT) | Malicious Activities by Malware | cyber kill chain; attack on confidentiality; integrity; availability |
| Malware & Attack Technology (MAT) | Attacks and exploitation | Post-exploitation: pivoting attacks; information gathering |
| Security Operations & Incident Management (SOIM) | PENETRATION TESTING | PENETRATION TESTING - SOFTWARE TOOLS; PENETRATION TESTING - ACTIVE PENETRATION |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/introducing_attacks/7_post-exploitation.xml run
| Key | Data |
|---|---|
| Name | Vulnerability Analysis |
| Description | Introduction It is important for organisations to manage the security of their systems and for security professionals to efficiently scan networks for vulnerabilities. Lab Lab sheet here. |
| Type | ctf-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | |
| VM names | linux_server; kali |
| KA | Topic | Keywords |
|---|---|---|
| Security Operations & Incident Management (SOIM) | PENETRATION TESTING | VULNERABILITY ANALYSIS / VULNERABILITY SCANNING; AUDIT APPROACH; PENETRATION TESTING - SOFTWARE TOOLS; PENETRATION TESTING - ACTIVE PENETRATION |
| Malware & Attack Technology (MAT) | Attacks and exploitation | EXPLOITATION |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/introducing_attacks/8_vulnerability_analysis.xml run
| Key | Data |
|---|---|
| Name | Labtainers lab: acl |
| Description | A Labtainers lab. |
| Type | ctf-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | |
| VM names | desktop; hackerbot_server |
| KA | Topic | Keywords |
|---|---|---|
| Authentication, Authorisation & Accountability (AAA) | Authorisation | access control; enforcing access control; ACCESS CONTROL - DAC (DISCRETIONARY ACCESS CONTROL); Vulnerabilities and attacks on access control misconfigurations |
| Malware & Attack Technology (MAT) | MALCODE/MALWARE | trojan; backdoor; TROJANS - BACKDOOR |
| Operating Systems & Virtualisation (OSV) | Primitives for Isolation and Mediation | Access controls and operating systems; Linux security model; Unix File Permissions; filesystems; inodes; and commands; umask |
| Operating Systems & Virtualisation (OSV) | Primitives for Isolation and Mediation | Access controls and operating systems; Linux security model; Linux Extended Access Control Lists (facl) |
| Operating Systems & Virtualisation (OSV) | Role of Operating Systems | mediation |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/labtainers/acl-hackerbot-flags.xml run
| Key | Data |
|---|---|
| Name | Labtainers lab: acl |
| Description | A Labtainers lab. |
| Type | ctf-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | |
| VM names | desktop |
| KA | Topic | Keywords |
|---|---|---|
| Authentication, Authorisation & Accountability (AAA) | Authorisation | access control; enforcing access control; ACCESS CONTROL - DAC (DISCRETIONARY ACCESS CONTROL); Vulnerabilities and attacks on access control misconfigurations |
| Malware & Attack Technology (MAT) | MALCODE/MALWARE | trojan; backdoor; TROJANS - BACKDOOR |
| Operating Systems & Virtualisation (OSV) | Primitives for Isolation and Mediation | Access controls and operating systems; Linux security model; Unix File Permissions; filesystems; inodes; and commands; umask |
| Operating Systems & Virtualisation (OSV) | Primitives for Isolation and Mediation | Access controls and operating systems; Linux security model; Linux Extended Access Control Lists (facl) |
| Operating Systems & Virtualisation (OSV) | Role of Operating Systems | mediation |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/labtainers/acl.xml run
| Key | Data |
|---|---|
| Name | Labtainers lab: arp-spoof |
| Description | A Labtainers lab. |
| Type | ctf-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | |
| VM names | desktop |
| KA | Topic | Keywords |
|---|---|---|
| Network Security (NS) | Network Protocols and Vulnerability | ADDRESS RESOLUTION PROTOCOL(ARP); ARP (ADDRESS RESOLUTION PROTOCOL); ARP SPOOFING; MITM (MAN-IN-THE-MIDDLE ATTACK); MAN-IN-THE-MIDDLE ATTACK (MITM); ATTACK(S) - ARP |
| Security Operations & Incident Management (SOIM) | Monitor: Data Sources | network traffic |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/labtainers/arp-spoof.xml run
| Key | Data |
|---|---|
| Name | Labtainers lab: backups |
| Description | A Labtainers lab. |
| Type | ctf-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | |
| VM names | desktop |
| KA | Topic | Keywords |
|---|---|---|
| Security Operations & Incident Management (SOIM) | Execute: Mitigation and Countermeasures | Recover data and services after an incident; BACKUP - DIFFERENTIAL; BACKUP - INFERENTIAL |
| Security Operations & Incident Management (SOIM) | INCIDENT RESPONSE | RECOVERY - BACKUPS; RECOVERY; BACKUPS |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/labtainers/backups.xml run
| Key | Data |
|---|---|
| Name | Labtainers lab: backups2 |
| Description | A Labtainers lab. |
| Type | ctf-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | |
| VM names | desktop |
| KA | Topic | Keywords |
|---|---|---|
| Security Operations & Incident Management (SOIM) | Execute: Mitigation and Countermeasures | Recover data and services after an incident; BACKUP - DIFFERENTIAL; BACKUP - INFERENTIAL |
| Security Operations & Incident Management (SOIM) | INCIDENT RESPONSE | RECOVERY - BACKUPS; RECOVERY; BACKUPS |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/labtainers/backups2.xml run
| Key | Data |
|---|---|
| Name | Labtainers lab: bufoverflow |
| Description | A Labtainers lab. |
| Type | ctf-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | |
| VM names | desktop |
| KA | Topic | Keywords |
|---|---|---|
| Software Security (SS) | Categories of Vulnerabilities | memory management vulnerabilities; Stack smashing buffer overflows |
| Malware & Attack Technology (MAT) | Attacks and exploitation | EXPLOITATION; EXPLOITATION FRAMEWORKS; Exploit development; Metasploit Framework development |
| Software Security (SS) | Mitigating Exploitation | ASLR (ADDRESS SPACE LAYOUT RANDOMIZATION); NON-EXECUTABLE MEMORY |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/labtainers/bufoverflow.xml run
| Key | Data |
|---|---|
| Name | Labtainers lab: capabilities |
| Description | A Labtainers lab. |
| Type | ctf-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | |
| VM names | desktop |
| KA | Topic | Keywords |
|---|---|---|
| Operating Systems & Virtualisation (OSV) | Primitives for Isolation and Mediation | capabilities; Rule-based controls: Course grained: Linux capabilities |
| Security Operations & Incident Management (SOIM) | Monitor: Data Sources | network traffic |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/labtainers/capabilities.xml run
| Key | Data |
|---|---|
| Name | Labtainers lab: centos-log |
| Description | A Labtainers lab. |
| Type | ctf-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | |
| VM names | desktop |
| KA | Topic | Keywords |
|---|---|---|
| Security Operations & Incident Management (SOIM) | Monitor: Data Sources | application logs: web server logs and files; system and kernel logs; Syslog |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/labtainers/centos-log.xml run
| Key | Data |
|---|---|
| Name | Labtainers lab: centos-log2 |
| Description | A Labtainers lab. |
| Type | ctf-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | |
| VM names | desktop |
| KA | Topic | Keywords |
|---|---|---|
| Security Operations & Incident Management (SOIM) | Monitor: Data Sources | application logs: web server logs and files; system and kernel logs; Syslog |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/labtainers/centos-log2.xml run
| Key | Data |
|---|---|
| Name | Labtainers lab: denyhost |
| Description | A Labtainers lab. |
| Type | ctf-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | |
| VM names | desktop |
| KA | Topic | Keywords |
|---|---|---|
| Network Security (NS) | Network Defence Tools | packet filters; intrusion detection systems; intrusion prevention systems |
| Security Operations & Incident Management (SOIM) | Execute: Mitigation and Countermeasures | intrusion prevention systems |
| Security Operations & Incident Management (SOIM) | CM (CONFIGURATION MANAGEMENT) | SSH (SECURE SHELL) |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/labtainers/denyhost.xml run
| Key | Data |
|---|---|
| Name | Labtainers lab: dmz-example |
| Description | A Labtainers lab. |
| Type | ctf-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | |
| VM names | desktop |
| KA | Topic | Keywords |
|---|---|---|
| Network Security (NS) | Network Defence Tools | DEMILITARISED ZONE (DMZ) |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/labtainers/dmz-example.xml run
| Key | Data |
|---|---|
| Name | Labtainers lab: dmz-lab |
| Description | A Labtainers lab. |
| Type | ctf-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | |
| VM names | desktop |
| KA | Topic | Keywords |
|---|---|---|
| Network Security (NS) | Network Defence Tools | DEMILITARISED ZONE (DMZ) |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/labtainers/dmz-lab.xml run
| Key | Data |
|---|---|
| Name | Labtainers lab: file-deletion |
| Description | A Labtainers lab. |
| Type | ctf-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | |
| VM names | desktop |
| KA | Topic | Keywords |
|---|---|---|
| Forensics (F) | Operating System Analysis | storage forensics; data recovery and file content carving |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/labtainers/file-deletion.xml run
| Key | Data |
|---|---|
| Name | Labtainers lab: file-integrity |
| Description | A Labtainers lab. |
| Type | ctf-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | |
| VM names | desktop |
| KA | Topic | Keywords |
|---|---|---|
| Authentication, Authorisation & Accountability (AAA) | Authentication | access control; Protecting integrity |
| Forensics (F) | Operating System Analysis | cryptographic hashing; storage forensics; data recovery and file content carving |
| Security Operations & Incident Management (SOIM) | Monitor: Data Sources | MONITORING - FILE INTEGRITY CHECKERS |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/labtainers/file-integrity.xml run
| Key | Data |
|---|---|
| Name | Labtainers lab: formatstring |
| Description | A Labtainers lab. |
| Type | ctf-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | |
| VM names | desktop |
| KA | Topic | Keywords |
|---|---|---|
| Malware & Attack Technology (MAT) | Attacks and exploitation | EXPLOITATION; Exploit development; Mitigation bypass: ASLR |
| Software Security (SS) | Categories of Vulnerabilities | memory management vulnerabilities; Format string attacks |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/labtainers/formatstring.xml run
| Key | Data |
|---|---|
| Name | Labtainers lab: gdblesson |
| Description | A Labtainers lab. |
| Type | ctf-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | |
| VM names | desktop |
| KA | Topic | Keywords |
|---|---|---|
| Malware & Attack Technology (MAT) | Malware Analysis | analysis techniques; analysis environments; STATIC ANALYSIS |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/labtainers/gdblesson.xml run
| Key | Data |
|---|---|
| Name | Labtainers lab: grassmarlin |
| Description | A Labtainers lab. |
| Type | ctf-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | |
| VM names | desktop |
| KA | Topic | Keywords |
|---|---|---|
| Cyber-Physical Systems Security (CPS) | Cyber-Physical Systems | characteristics; security and privacy concerns |
| Cyber-Physical Systems Security (CPS) | Cyber-Physical Systems Domains | industrial control systems; SUPERVISORY CONTROL AND DATA ACQUISITION (SCADA) |
| Security Operations & Incident Management (SOIM) | Monitor: Data Sources | network traffic |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/labtainers/grassmarlin.xml run
| Key | Data |
|---|---|
| Name | Labtainers lab: grfics |
| Description | A Labtainers lab. |
| Type | ctf-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | |
| VM names | desktop |
| KA | Topic | Keywords |
|---|---|---|
| Adversarial Behaviours (AB) | Models | kill chains |
| Cyber-Physical Systems Security (CPS) | Cyber-Physical Systems | characteristics; protection against natural events and accidents; security and privacy concerns |
| Cyber-Physical Systems Security (CPS) | Cyber-Physical Systems Domains | industrial control systems |
| Network Security (NS) | Network Defence Tools | intrusion detection systems; network architecture design |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/labtainers/grfics.xml run
| Key | Data |
|---|---|
| Name | Labtainers lab: ida |
| Description | A Labtainers lab. |
| Type | ctf-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | |
| VM names | desktop |
| KA | Topic | Keywords |
|---|---|---|
| Malware & Attack Technology (MAT) | Malware Analysis | analysis techniques; analysis environments; STATIC ANALYSIS |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/labtainers/ida.xml run
| Key | Data |
|---|---|
| Name | Labtainers lab: iptables-ics |
| Description | A Labtainers lab. |
| Type | ctf-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | |
| VM names | desktop |
| KA | Topic | Keywords |
|---|---|---|
| Cyber-Physical Systems Security (CPS) | Cyber-Physical Systems Domains | industrial control systems |
| Cyber-Physical Systems Security (CPS) | Cyber-Physical Systems | security and privacy concerns |
| Network Security (NS) | Network Defence Tools | FIREWALLS; IPTables |
| Network Security (NS) | Internet Architecture | network layer security |
| Web & Mobile Security (WAM) | FIREWALLS | FIREWALLS |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/labtainers/iptables-ics.xml run
| Key | Data |
|---|---|
| Name | Labtainers lab: iptables |
| Description | A Labtainers lab. |
| Type | ctf-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | |
| VM names | desktop |
| KA | Topic | Keywords |
|---|---|---|
| Network Security (NS) | Network Defence Tools | FIREWALLS; IPTables |
| Network Security (NS) | Internet Architecture | network layer security |
| Web & Mobile Security (WAM) | FIREWALLS | FIREWALLS |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/labtainers/iptables.xml run
| Key | Data |
|---|---|
| Name | Labtainers lab: iptables2 |
| Description | A Labtainers lab. |
| Type | ctf-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | |
| VM names | desktop |
| KA | Topic | Keywords |
|---|---|---|
| Network Security (NS) | Network Defence Tools | FIREWALLS; IPTables |
| Network Security (NS) | Internet Architecture | network layer security |
| Web & Mobile Security (WAM) | FIREWALLS | FIREWALLS |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/labtainers/iptables2.xml run
| Key | Data |
|---|---|
| Name | Labtainers lab: ldap |
| Description | A Labtainers lab. |
| Type | ctf-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | |
| VM names | desktop |
| KA | Topic | Keywords |
|---|---|---|
| Authentication, Authorisation & Accountability (AAA) | Authentication | identity management; user authentication; facets of authentication; authentication in distributed systems |
| Authentication, Authorisation & Accountability (AAA) | Authorisation | AUTHORIZATION - LDAP (LIGHTWEIGHT DIRECTORY ACCESS PROTOCOL) |
| Security Operations & Incident Management (SOIM) | Monitor: Data Sources | network traffic |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/labtainers/ldap.xml run
| Key | Data |
|---|---|
| Name | Labtainers lab: local-dns |
| Description | A Labtainers lab. |
| Type | ctf-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | |
| VM names | desktop |
| KA | Topic | Keywords |
|---|---|---|
| Network Security (NS) | Network Protocols and Vulnerability | ADDRESS RESOLUTION PROTOCOL(ARP); ARP (ADDRESS RESOLUTION PROTOCOL); ARP SPOOFING; DNS ATTACKS |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/labtainers/local-dns.xml run
| Key | Data |
|---|---|
| Name | Labtainers lab: macs-hash |
| Description | A Labtainers lab. |
| Type | ctf-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | |
| VM names | desktop |
| KA | Topic | Keywords |
|---|---|---|
| Authentication, Authorisation & Accountability (AAA) | Authentication | user authentication; Cryptography and authentication (hashes and attacks against authentication schemes / passwords) |
| Cryptography (C) | Public-Key Cryptography | symmetric encryption and authentication; MESSAGE AUTHENTICATION CODE (MAC); HASHED MESSAGE AUTHENTICATION CODE (HMAC) |
| Forensics (F) | Artifact Analysis | cryptographic hashing |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/labtainers/macs-hash.xml run
| Key | Data |
|---|---|
| Name | Labtainers lab: metasploit |
| Description | A Labtainers lab. |
| Type | ctf-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | |
| VM names | desktop |
| KA | Topic | Keywords |
|---|---|---|
| Malware & Attack Technology (MAT) | Malicious Activities by Malware | cyber kill chain |
| Malware & Attack Technology (MAT) | Attacks and exploitation | EXPLOITATION; EXPLOITATION FRAMEWORKS |
| Security Operations & Incident Management (SOIM) | PENETRATION TESTING | PENETRATION TESTING - SOFTWARE TOOLS; PENETRATION TESTING - ACTIVE PENETRATION |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/labtainers/metasploit.xml run
| Key | Data |
|---|---|
| Name | Labtainers lab: nix-commands |
| Description | A Labtainers lab. |
| Type | ctf-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | |
| VM names | desktop |
| KA | Topic | Keywords |
|---|---|---|
| Authentication, Authorisation & Accountability (AAA) | Authorisation | access control |
| Network Security (NS) | PENETRATION TESTING | PENETRATION TESTING - NETWORK MAPPING - PING |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/labtainers/nix-commands.xml run
| Key | Data |
|---|---|
| Name | Labtainers lab: nmap-discovery |
| Description | A Labtainers lab. |
| Type | ctf-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | |
| VM names | desktop |
| KA | Topic | Keywords |
|---|---|---|
| Network Security (NS) | PENETRATION TESTING | PENETRATION TESTING - NETWORK MAPPING - FINGERPRINTING; PENETRATION TESTING - NETWORK MAPPING - NMAP |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/labtainers/nmap-discovery.xml run
| Key | Data |
|---|---|
| Name | Labtainers lab: nmap-ssh |
| Description | A Labtainers lab. |
| Type | ctf-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | |
| VM names | desktop |
| KA | Topic | Keywords |
|---|---|---|
| Network Security (NS) | PENETRATION TESTING | PENETRATION TESTING - NETWORK MAPPING - FINGERPRINTING; PENETRATION TESTING - NETWORK MAPPING - NMAP |
| Security Operations & Incident Management (SOIM) | CM (CONFIGURATION MANAGEMENT) | SSH (SECURE SHELL) |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/labtainers/nmap-ssh.xml run
| Key | Data |
|---|---|
| Name | Labtainers lab: onewayhash |
| Description | A Labtainers lab. |
| Type | ctf-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | |
| VM names | desktop |
| KA | Topic | Keywords |
|---|---|---|
| Authentication, Authorisation & Accountability (AAA) | Authentication | user authentication; Cryptography and authentication (hashes and attacks against authentication schemes / passwords) |
| Cryptography (C) | Public-Key Cryptography | symmetric encryption and authentication; MESSAGE AUTHENTICATION CODE (MAC) |
| Forensics (F) | Artifact Analysis | cryptographic hashing |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/labtainers/onewayhash.xml run
| Key | Data |
|---|---|
| Name | Labtainers lab: packet-introspection |
| Description | A Labtainers lab. |
| Type | ctf-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | |
| VM names | desktop |
| KA | Topic | Keywords |
|---|---|---|
| Forensics (F) | Main Memory Forensics | network connections; data recovery and file content carving |
| Security Operations & Incident Management (SOIM) | Monitor: Data Sources | network traffic |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/labtainers/packet-introspection.xml run
| Key | Data |
|---|---|
| Name | Labtainers lab: pass-crack |
| Description | A Labtainers lab. |
| Type | ctf-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | |
| VM names | desktop |
| KA | Topic | Keywords |
|---|---|---|
| Forensics (F) | Artifact Analysis | cryptographic hashing |
| Software Security (SS) | Authentication | user authentication; Cryptography and authentication (hashes and attacks against authentication schemes / passwords) |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/labtainers/pass-crack.xml run
| Key | Data |
|---|---|
| Name | Labtainers lab: pcapanalysis |
| Description | A Labtainers lab. |
| Type | ctf-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | |
| VM names | desktop |
| KA | Topic | Keywords |
|---|---|---|
| Forensics (F) | Main Memory Forensics | network connections |
| Network Security (NS) | OSI (OPEN SYSTEM INTERCONNECT) MODEL | APPLICATION LAYER; DATA LINK LAYER; NETWORK LAYER |
| Security Operations & Incident Management (SOIM) | Monitor: Data Sources | PCAP; network traffic |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/labtainers/pcapanalysis.xml run
| Key | Data |
|---|---|
| Name | Labtainers lab: plc-app |
| Description | A Labtainers lab. |
| Type | ctf-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | |
| VM names | desktop |
| KA | Topic | Keywords |
|---|---|---|
| Cyber-Physical Systems Security (CPS) | Cyber-Physical Systems | characteristics; security and privacy concerns |
| Cyber-Physical Systems Security (CPS) | Cyber-Physical Systems Domains | industrial control systems |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/labtainers/plc-app.xml run
| Key | Data |
|---|---|
| Name | Labtainers lab: plc-forensics-adv |
| Description | A Labtainers lab. |
| Type | ctf-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | |
| VM names | desktop |
| KA | Topic | Keywords |
|---|---|---|
| Cyber-Physical Systems Security (CPS) | Cyber-Physical Systems | characteristics; security and privacy concerns |
| Cyber-Physical Systems Security (CPS) | Cyber-Physical Systems Domains | industrial control systems |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/labtainers/plc-forensics-adv.xml run
| Key | Data |
|---|---|
| Name | Labtainers lab: plc-forensics |
| Description | A Labtainers lab. |
| Type | ctf-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | |
| VM names | desktop |
| KA | Topic | Keywords |
|---|---|---|
| Cyber-Physical Systems Security (CPS) | Cyber-Physical Systems | characteristics; security and privacy concerns |
| Cyber-Physical Systems Security (CPS) | Cyber-Physical Systems Domains | industrial control systems |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/labtainers/plc-forensics.xml run
| Key | Data |
|---|---|
| Name | Labtainers lab: plc |
| Description | A Labtainers lab. |
| Type | ctf-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | |
| VM names | desktop |
| KA | Topic | Keywords |
|---|---|---|
| Cyber-Physical Systems Security (CPS) | Cyber-Physical Systems | characteristics; security and privacy concerns |
| Cyber-Physical Systems Security (CPS) | Cyber-Physical Systems Domains | industrial control systems |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/labtainers/plc.xml run
| Key | Data |
|---|---|
| Name | Labtainers lab: pubkey |
| Description | A Labtainers lab. |
| Type | ctf-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | |
| VM names | desktop |
| KA | Topic | Keywords |
|---|---|---|
| Cryptography (C) | Schemes | TLS |
| Network Security (NS) | Internet Architecture | transport layer security |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/labtainers/pubkey.xml run
| Key | Data |
|---|---|
| Name | Labtainers lab: radius |
| Description | A Labtainers lab. |
| Type | ctf-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | |
| VM names | desktop |
| KA | Topic | Keywords |
|---|---|---|
| Authentication, Authorisation & Accountability (AAA) | Authentication | identity management; user authentication; facets of authentication; authentication in distributed systems |
| Network Security (NS) | Internet Architecture | link layer security |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/labtainers/radius.xml run
| Key | Data |
|---|---|
| Name | Labtainers lab: remote-dns |
| Description | A Labtainers lab. |
| Type | ctf-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | |
| VM names | desktop |
| KA | Topic | Keywords |
|---|---|---|
| Network Security (NS) | Network Protocols and Vulnerability | ADDRESS RESOLUTION PROTOCOL(ARP); ARP (ADDRESS RESOLUTION PROTOCOL); ARP SPOOFING; DNS ATTACKS |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/labtainers/remote-dns.xml run
| Key | Data |
|---|---|
| Name | Labtainers lab: retlibc |
| Description | A Labtainers lab. |
| Type | ctf-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | |
| VM names | desktop |
| KA | Topic | Keywords |
|---|---|---|
| Software Security (SS) | Categories of Vulnerabilities | memory management vulnerabilities; Stack smashing buffer overflows |
| Software Security (SS) | Mitigating Exploitation | NON-EXECUTABLE MEMORY |
| Malware & Attack Technology (MAT) | Attacks and exploitation | EXPLOITATION; EXPLOITATION FRAMEWORKS; Exploit development; Metasploit Framework development; Mitigation bypass: non-executable memory |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/labtainers/retlibc.xml run
| Key | Data |
|---|---|
| Name | Labtainers lab: routing-basics |
| Description | A Labtainers lab. |
| Type | ctf-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | |
| VM names | desktop |
| KA | Topic | Keywords |
|---|---|---|
| Network Security (NS) | Internet Architecture | network layer security |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/labtainers/routing-basics.xml run
| Key | Data |
|---|---|
| Name | Labtainers lab: routing-basics2 |
| Description | A Labtainers lab. |
| Type | ctf-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | |
| VM names | desktop |
| KA | Topic | Keywords |
|---|---|---|
| Network Security (NS) | Internet Architecture | network layer security |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/labtainers/routing-basics2.xml run
| Key | Data |
|---|---|
| Name | Labtainers lab: setuid-env |
| Description | A Labtainers lab. |
| Type | ctf-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | |
| VM names | desktop |
| KA | Topic | Keywords |
|---|---|---|
| Authentication, Authorisation & Accountability (AAA) | Authorisation | access control; Elevated privileges; Real and effective identity; Vulnerabilities and attacks on access control misconfigurations |
| Operating Systems & Virtualisation (OSV) | Primitives for Isolation and Mediation | Access controls and operating systems; Linux security model; Unix File Permissions; setuid/setgid |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/labtainers/setuid-env.xml run
| Key | Data |
|---|---|
| Name | Labtainers lab: snort |
| Description | A Labtainers lab. |
| Type | ctf-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | |
| VM names | desktop |
| KA | Topic | Keywords |
|---|---|---|
| Security Operations & Incident Management (SOIM) | Monitor: Data Sources | network traffic |
| Security Operations & Incident Management (SOIM) | Analyse: Analysis Methods | misuse detection; anomaly detection |
| Security Operations & Incident Management (SOIM) | Execute: Mitigation and Countermeasures | intrusion prevention systems |
| Network Security (NS) | Network Defence Tools | packet filters; intrusion detection systems; IDS rules creation |
| Malware & Attack Technology (MAT) | Malware Detection | attack detection |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/labtainers/snort.xml run
| Key | Data |
|---|---|
| Name | Labtainers lab: softplc |
| Description | A Labtainers lab. |
| Type | ctf-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | |
| VM names | desktop |
| KA | Topic | Keywords |
|---|---|---|
| Cyber-Physical Systems Security (CPS) | Cyber-Physical Systems | characteristics; security and privacy concerns |
| Cyber-Physical Systems Security (CPS) | Cyber-Physical Systems Domains | industrial control systems |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/labtainers/softplc.xml run
| Key | Data |
|---|---|
| Name | Labtainers lab: softplc2 |
| Description | A Labtainers lab. |
| Type | ctf-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | |
| VM names | desktop |
| KA | Topic | Keywords |
|---|---|---|
| Cyber-Physical Systems Security (CPS) | Cyber-Physical Systems | characteristics; security and privacy concerns |
| Cyber-Physical Systems Security (CPS) | Cyber-Physical Systems Domains | industrial control systems |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/labtainers/softplc2.xml run
| Key | Data |
|---|---|
| Name | Labtainers lab: sql-inject |
| Description | A Labtainers lab. |
| Type | ctf-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | |
| VM names | desktop |
| KA | Topic | Keywords |
|---|---|---|
| Software Security (SS) | Categories of Vulnerabilities | Web vulnerabilities / OWASP Top 10; API vulnerabilities |
| Software Security (SS) | Prevention of Vulnerabilities | coding practices; Protecting against session management attacks; XSS; SQLi; CSRF; API design |
| Web & Mobile Security (WAM) | Server-Side Vulnerabilities and Mitigations | injection vulnerabilities; server-side misconfiguration and vulnerable components; SQL-INJECTION |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/labtainers/sql-inject.xml run
| Key | Data |
|---|---|
| Name | Labtainers lab: ssh-agent |
| Description | A Labtainers lab. |
| Type | ctf-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | |
| VM names | desktop |
| KA | Topic | Keywords |
|---|---|---|
| Cryptography (C) | Public-Key Cryptography | public-key encryption; public-key signatures |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/labtainers/ssh-agent.xml run
| Key | Data |
|---|---|
| Name | Labtainers lab: sshlab |
| Description | A Labtainers lab. |
| Type | ctf-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | |
| VM names | desktop |
| KA | Topic | Keywords |
|---|---|---|
| Cryptography (C) | Public-Key Cryptography | public-key encryption; public-key signatures |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/labtainers/sshlab.xml run
| Key | Data |
|---|---|
| Name | Labtainers lab: ssl |
| Description | A Labtainers lab. |
| Type | ctf-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | |
| VM names | desktop |
| KA | Topic | Keywords |
|---|---|---|
| Cryptography (C) | Public-Key Cryptography | public-key encryption; public-key signatures |
| Cyber-Physical Systems Security (CPS) | Cyber-Physical Systems | characteristics; security and privacy concerns |
| Cyber-Physical Systems Security (CPS) | Cyber-Physical Systems Domains | industrial control systems |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/labtainers/ssl.xml run
| Key | Data |
|---|---|
| Name | Labtainers lab: symkeylab |
| Description | A Labtainers lab. |
| Type | ctf-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | |
| VM names | desktop |
| KA | Topic | Keywords |
|---|---|---|
| Cryptography (C) | Schemes | AES |
| Cryptography (C) | Symmetric Cryptography | symmetric primitives; symmetric encryption and authentication |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/labtainers/symkeylab.xml run
| Key | Data |
|---|---|
| Name | Labtainers lab: sys-log |
| Description | A Labtainers lab. |
| Type | ctf-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | |
| VM names | desktop |
| KA | Topic | Keywords |
|---|---|---|
| Security Operations & Incident Management (SOIM) | Monitor: Data Sources | application logs: web server logs and files; system and kernel logs; Syslog |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/labtainers/sys-log.xml run
| Key | Data |
|---|---|
| Name | Labtainers lab: tcpip |
| Description | A Labtainers lab. |
| Type | ctf-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | |
| VM names | desktop |
| KA | Topic | Keywords |
|---|---|---|
| Network Security (NS) | Internet Architecture | transport layer security |
| Network Security (NS) | Network Protocols and Vulnerability | common network attacks |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/labtainers/tcpip.xml run
| Key | Data |
|---|---|
| Name | Labtainers lab: telnetlab |
| Description | A Labtainers lab. |
| Type | ctf-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | |
| VM names | desktop |
| KA | Topic | Keywords |
|---|---|---|
| Network Security (NS) | REMOTE ACCESS | TELNET |
| Network Security (NS) | TCP/IP | SSH (SECURE SHELL); TELNET; TERMINAL EMULATION PROTOCOL (TELNET) |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/labtainers/telnetlab.xml run
| Key | Data |
|---|---|
| Name | Labtainers lab: vpnlab |
| Description | A Labtainers lab. |
| Type | ctf-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | |
| VM names | desktop |
| KA | Topic | Keywords |
|---|---|---|
| Network Security (NS) | Network Defence Tools | VIRTUAL - PRIVATE NETWORK (VPN) |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/labtainers/vpnlab.xml run
| Key | Data |
|---|---|
| Name | Labtainers lab: vpnlab2 |
| Description | A Labtainers lab. |
| Type | ctf-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | |
| VM names | desktop |
| KA | Topic | Keywords |
|---|---|---|
| Network Security (NS) | Network Defence Tools | VIRTUAL - PRIVATE NETWORK (VPN) |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/labtainers/vpnlab2.xml run
| Key | Data |
|---|---|
| Name | Labtainers lab: webtrack |
| Description | A Labtainers lab. |
| Type | ctf-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | |
| VM names | desktop |
| KA | Topic | Keywords |
|---|---|---|
| Forensics (F) | WEB | WEB BROWSERS |
| Web & Mobile Security (WAM) | Fundamental Concepts and Approaches | BROWSER; cookies |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/labtainers/webtrack.xml run
| Key | Data |
|---|---|
| Name | Labtainers lab: wireshark-intro |
| Description | A Labtainers lab. |
| Type | ctf-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | |
| VM names | desktop |
| KA | Topic | Keywords |
|---|---|---|
| Security Operations & Incident Management (SOIM) | Monitor: Data Sources | network traffic |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/labtainers/wireshark-intro.xml run
| Key | Data |
|---|---|
| Name | Labtainers lab: xforge |
| Description | A Labtainers lab. |
| Type | ctf-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | |
| VM names | desktop |
| KA | Topic | Keywords |
|---|---|---|
| Web & Mobile Security (WAM) | Server-Side Vulnerabilities and Mitigations | CROSS-SITE REQUEST FORGERY (CSRF) |
| Software Security (SS) | Prevention of Vulnerabilities | Protecting against session management attacks; XSS; SQLi; CSRF |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/labtainers/xforge.xml run
| Key | Data |
|---|---|
| Name | Labtainers lab: xsite |
| Description | A Labtainers lab. |
| Type | ctf-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | |
| VM names | desktop |
| KA | Topic | Keywords |
|---|---|---|
| Web & Mobile Security (WAM) | Server-Side Vulnerabilities and Mitigations | CROSS-SITE SCRIPTING (XSS) |
| Software Security (SS) | Prevention of Vulnerabilities | Protecting against session management attacks; XSS; SQLi; CSRF |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/labtainers/xsite.xml run
| Key | Data |
|---|---|
| Name | Integrity protection lab |
| Description | A Hackerbot lab. Work through the labsheet, then when prompted interact with Hackerbot. Topics covered: Protecting integrity with file attributes; Protecting integrity with read-only filesystems. |
| Type | ctf-lab; hackerbot-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | https://www.youtube.com/watch?v=sv1pHuuoW9g; https://www.youtube.com/watch?v=grISRv-CuHE |
| VM names | desktop; hackerbot_server |
| KA | Topic | Keywords |
|---|---|---|
| Authentication, Authorisation & Accountability (AAA) | Authorisation | access control; Protecting integrity |
| Operating Systems & Virtualisation (OSV) | Primitives for Isolation and Mediation | Linux read only protections: ro mounts; file attributes |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/response_and_investigation/1_integrity_protection.xml run
| Key | Data |
|---|---|
| Name | Integrity detection lab |
| Description | A Hackerbot lab. Work through the labsheet, then when prompted interact with Hackerbot. Topics covered: Detecting changes to resources using backups; File integrity checkers; Detecting changes to resources using package management. |
| Type | ctf-lab; hackerbot-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | https://www.youtube.com/watch?v=qzyEdeQ_7ZY; https://www.youtube.com/watch?v=kz7m-iyzSOw |
| VM names | desktop; hackerbot_server |
| KA | Topic | Keywords |
|---|---|---|
| Forensics (F) | Artifact Analysis | cryptographic hashing |
| Security Operations & Incident Management (SOIM) | Monitor: Data Sources | MONITORING - FILE INTEGRITY CHECKERS |
| Operating Systems & Virtualisation (OSV) | OS Hardening | code and data integrity checks |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/response_and_investigation/2_integrity_detection.xml run
| Key | Data |
|---|---|
| Name | Backups lab |
| Description | A Hackerbot lab. Work through the labsheet, then when prompted interact with Hackerbot. Topics covered: Rsync, and backups and restoring data using differential and incremental backups. |
| Type | ctf-lab; hackerbot-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | https://youtu.be/lak1Sued4GY; https://youtu.be/stVomGROfbQ; https://youtu.be/n8IKEJUOISY |
| VM names | desktop; backup_server; hackerbot_server |
| KA | Topic | Keywords |
|---|---|---|
| Security Operations & Incident Management (SOIM) | Execute: Mitigation and Countermeasures | Recover data and services after an incident; BACKUP - DIFFERENTIAL; BACKUP - INFERENTIAL |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/response_and_investigation/3_backups_and_recovery.xml run
| Key | Data |
|---|---|
| Name | IDS lab |
| Description | A Hackerbot lab. Work through the labsheet, then when prompted interact with Hackerbot. |
| Type | ctf-lab; hackerbot-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | https://youtu.be/raR0HstMnjg; https://youtu.be/3oDVTSFhl8Y; https://youtu.be/M6MisvbU32M |
| VM names | desktop; ids_snoop; web_server; hackerbot_server |
| KA | Topic | Keywords |
|---|---|---|
| Security Operations & Incident Management (SOIM) | Monitor: Data Sources | network traffic |
| Security Operations & Incident Management (SOIM) | Analyse: Analysis Methods | misuse detection; anomaly detection |
| Security Operations & Incident Management (SOIM) | Execute: Mitigation and Countermeasures | intrusion prevention systems |
| Network Security (NS) | Network Defence Tools | packet filters; intrusion detection systems |
| Malware & Attack Technology (MAT) | Malware Detection | attack detection |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/response_and_investigation/4_ids.xml run
| Key | Data |
|---|---|
| Name | IDS rules lab |
| Description | A Hackerbot lab. Work through the labsheet, then when prompted interact with Hackerbot. |
| Type | ctf-lab; hackerbot-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | https://youtu.be/ZUMBsMppsLo; https://youtu.be/nuUm4NO_S1s |
| VM names | desktop; ids_snoop; web_server; hackerbot_server |
| KA | Topic | Keywords |
|---|---|---|
| Security Operations & Incident Management (SOIM) | Monitor: Data Sources | network traffic |
| Security Operations & Incident Management (SOIM) | Analyse: Analysis Methods | misuse detection; anomaly detection |
| Network Security (NS) | Network Defence Tools | packet filters; intrusion detection systems; IDS rules creation |
| Malware & Attack Technology (MAT) | Malware Detection | attack detection |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/response_and_investigation/5_ids_rules.xml run
| Key | Data |
|---|---|
| Name | Exfiltration detection lab |
| Description | A Hackerbot lab. Work through the labsheet, then when prompted interact with Hackerbot. |
| Type | ctf-lab; hackerbot-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | https://youtu.be/4zYn4hbwKYQ; https://youtu.be/Y32tmFrCEBk |
| VM names | desktop; ids_snoop; web_server; hackerbot_server |
| KA | Topic | Keywords |
|---|---|---|
| Forensics (F) | Artifact Analysis | cryptographic hashing |
| Security Operations & Incident Management (SOIM) | Monitor: Data Sources | network traffic |
| Security Operations & Incident Management (SOIM) | Analyse: Analysis Methods | Exfiltation detection / data loss prevention |
| Network Security (NS) | Network Defence Tools | packet filters; intrusion detection systems; intrusion prevention systems; IDS rules creation |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/response_and_investigation/6_exfiltration_detection.xml run
| Key | Data |
|---|---|
| Name | Live analysis lab |
| Description | A Hackerbot lab. Work through the labsheet, then when prompted interact with Hackerbot. |
| Type | ctf-lab; hackerbot-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | https://youtu.be/aNvVtF437LI; https://www.youtube.com/watch?v=iUInvMrBw3k; https://youtu.be/9nyvtJRQ17w |
| VM names | desktop; compromised_server; hackerbot_server |
| KA | Topic | Keywords |
|---|---|---|
| Forensics (F) | Main Memory Forensics | process information; file information; network connections; artifacts and fragments; challenges of live forensics |
| Operating Systems & Virtualisation (OSV) | OS Hardening | anomaly detection |
| Authentication, Authorisation & Accountability (AAA) | Accountability | The fallibility of digital evidence to tampering |
| Malware & Attack Technology (MAT) | Malware Detection | identifying the presence of malware |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/response_and_investigation/7_live_analysis.xml run
| Key | Data |
|---|---|
| Name | Dead analysis lab |
| Description | A Hackerbot lab. Work through the labsheet, then when prompted interact with Hackerbot. |
| Type | ctf-lab; hackerbot-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | https://youtu.be/3kiV0ZJWmMY; https://youtu.be/0EafG4CLwA4 |
| VM names | desktop; hackerbot_server; kali |
| KA | Topic | Keywords |
|---|---|---|
| Forensics (F) | Operating System Analysis | storage forensics; data recovery and file content carving; Timeline analysis |
| Malware & Attack Technology (MAT) | Malware Detection | identifying the presence of malware |
| Authentication, Authorisation & Accountability (AAA) | Accountability | The fallibility of digital evidence to tampering |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/response_and_investigation/8_dead_analysis.xml run
| Key | Data |
|---|---|
| Name | Anti-SRE |
| Description | A MetaCTF lab. In your home directory you will find some binaries that you need to reverse engineer in order to determine the password that the program expects. Once you have found the password, run the program and enter the password to receive the file. There are binaries to perform dynamic SRE. Lab sheet here |
| Type | ctf-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | |
| VM names | metactf |
| KA | Topic | Keywords |
|---|---|---|
| Malware & Attack Technology (MAT) | Malware Analysis | analysis techniques; analysis environments; anti-analysis and evasion techniques |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/software_and_malware_analysis/10_anti_sre.xml run
| Key | Data |
|---|---|
| Name | Introdution to Malware analysis lab |
| Description | A MetaCTF lab. In your home directory you will find some binaries that you need to reverse engineer in order to determine the password that the program expects. Once you have found the password, run the program and enter the password to receive the file. Lab sheet here. |
| Type | ctf-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | https://youtu.be/14Hv_QodLxs; https://youtu.be/quKsZbpvYIY; https://youtu.be/CxZx7b3OPsg; https://youtu.be/3qmmqfBtJio; https://youtu.be/k3NwrFWuhaY |
| VM names | metactf |
| KA | Topic | Keywords |
|---|---|---|
| Malware & Attack Technology (MAT) | Malware Taxonomy | dimensions; kinds |
| Malware & Attack Technology (MAT) | Malware Analysis | analysis techniques; analysis environments |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/software_and_malware_analysis/1_dynamic_and_static_analysis.xml run
| Key | Data |
|---|---|
| Name | Introdution to C lab |
| Description | An introduction to C. Really important fundamentals. No flags this week. Lab sheet here. |
| Type | ctf-lab; lab-sheet |
| Author | Thalita Vergilio |
| Linked videos | https://youtu.be/chebVVwj1kM; https://youtu.be/2R4QzDAfzLQ |
| VM names | metactf |
| KA | Topic | Keywords |
|---|---|---|
| Malware & Attack Technology (MAT) | Technical Underpinning | Technical underpinnings for malware analysis: C |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/software_and_malware_analysis/2_intro_to_c.xml run
| Key | Data |
|---|---|
| Name | C and Assembly lab |
| Description | A MetaCTF lab. In your home directory you will find some binaries that you need to reverse engineer in order to determine the password that the program expects. Once you have found the password, run the program and enter the password to receive the file. This week, we will finish our crash course in C programming by looking at structs, a data type used to represent composite data, memory management, one of the biggest strengths of the C language, and bitwise operators, which you will find particularly helpful when looking at disassembled code. We will then change our focus to assembly language. Starting with some basics, we will familiarise ourselves with the syntax and organisation of decompiled code before moving onto recognising the structures we learned last week in the assembly code. Lab sheet here. |
| Type | ctf-lab; lab-sheet |
| Author | Thalita Vergilio |
| Linked videos | https://youtu.be/QbyorEb3WTs |
| VM names | metactf |
| KA | Topic | Keywords |
|---|---|---|
| Malware & Attack Technology (MAT) | Malware Analysis | analysis techniques; analysis environments |
| Malware & Attack Technology (MAT) | Technical Underpinning | Technical underpinnings for malware analysis: C; Technical underpinnings for malware analysis: ASM |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/software_and_malware_analysis/3_c_and_asm.xml run
| Key | Data |
|---|---|
| Name | Recognising C Code Constructs in Assembly lab |
| Description | A MetaCTF lab. In your home directory you will find some binaries that you need to reverse engineer in order to determine the password that the program expects. Once you have found the password, run the program and enter the password to receive the file. We start with understanding how branching and conditionals are represented in assembly. We then move onto learning how to identify the common C code constructs we saw in previous weeks in disassembled code, namely loops, function calls, switch statements, arrays and structs. Lab sheet here. |
| Type | ctf-lab; lab-sheet |
| Author | Thalita Vergilio |
| Linked videos | https://youtu.be/8b6JokfEFEo |
| VM names | metactf |
| KA | Topic | Keywords |
|---|---|---|
| Malware & Attack Technology (MAT) | Malware Analysis | analysis techniques; analysis environments; STATIC ANALYSIS |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/software_and_malware_analysis/4_asm.xml run
| Key | Data |
|---|---|
| Name | Ghidra lab |
| Description | A MetaCTF lab. In your home directory you will find some binaries that you need to reverse engineer in order to determine the password that the program expects. Once you have found the password, run the program and enter the password to receive the file. Lab sheet here. |
| Type | ctf-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | https://youtu.be/0zUmUZoEpC4; https://youtu.be/m73pHO_0vhI |
| VM names | metactf |
| KA | Topic | Keywords |
|---|---|---|
| Malware & Attack Technology (MAT) | Malware Analysis | analysis techniques; analysis environments; STATIC ANALYSIS |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/software_and_malware_analysis/5_ghidra.xml run
| Key | Data |
|---|---|
| Name | Ghidra lab analysis |
| Description | A MetaCTF lab. In your home directory you will find some binaries that you need to reverse engineer in order to determine the password that the program expects. Once you have found the password, run the program and enter the password to receive the file. There are two binaries to practice SRE with Ghidra. |
| Type | ctf-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | |
| VM names | metactf |
| KA | Topic | Keywords |
|---|---|---|
| Malware & Attack Technology (MAT) | Malware Analysis | analysis techniques; analysis environments; STATIC ANALYSIS |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/software_and_malware_analysis/6_ghidra_analysis.xml run
| Key | Data |
|---|---|
| Name | Ghidra lab with LIVE MALWARE SAMPLES |
| Description | You will find live malware samples in /opt/theZoo. |
| Type | lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | |
| VM names | metactf |
| KA | Topic | Keywords |
|---|---|---|
| Malware & Attack Technology (MAT) | Malware Analysis | analysis techniques; analysis environments |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/software_and_malware_analysis/6_ghidra_with_live_malware_samples.xml run
| Key | Data |
|---|---|
| Name | Dynamic analysis SRE |
| Description | A MetaCTF lab. In your home directory you will find some binaries that you need to reverse engineer in order to determine the password that the program expects. Once you have found the password, run the program and enter the password to receive the file. There are binaries to perform dynamic SRE. Lab sheet here |
| Type | ctf-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | https://youtu.be/6MeJIr3EKKM |
| VM names | metactf |
| KA | Topic | Keywords |
|---|---|---|
| Malware & Attack Technology (MAT) | Malware Analysis | analysis techniques; analysis environments; DYNAMIC ANALYSIS |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/software_and_malware_analysis/7_dynamic.xml run
| Key | Data |
|---|---|
| Name | Dynamic analysis SRE (cont.) |
| Description | A MetaCTF lab. In your home directory you will find some binaries that you need to reverse engineer in order to determine the password that the program expects. Once you have found the password, run the program and enter the password to receive the file. There are binaries to perform dynamic SRE. Lab sheet here |
| Type | ctf-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | https://youtu.be/pExTbDVt0Gw |
| VM names | metactf |
| KA | Topic | Keywords |
|---|---|---|
| Malware & Attack Technology (MAT) | Malware Analysis | analysis techniques; analysis environments; DYNAMIC ANALYSIS |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/software_and_malware_analysis/8_dynamic_continued.xml run
| Key | Data |
|---|---|
| Name | Malware Behaviour |
| Description | A MetaCTF lab. In your home directory you will find some binaries that you need to reverse engineer in order to determine the password that the program expects. Once you have found the password, run the program and enter the password to receive the file. There are binaries to perform dynamic SRE. |
| Type | ctf-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | https://youtu.be/6XMrHyAqD-4; https://youtu.be/KJPeZptzl1U; https://youtu.be/6qeDnjOaRiI |
| VM names | metactf |
| KA | Topic | Keywords |
|---|---|---|
| Malware & Attack Technology (MAT) | Malware Taxonomy | dimensions; kinds |
| Malware & Attack Technology (MAT) | Malware Analysis | analysis techniques; analysis environments |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/software_and_malware_analysis/9_malware_behaviour.xml run
| Key | Data |
|---|---|
| Name | Understanding Software Vulnerabilities: C, Debugging Assembly, and Buffer Overflows |
| Description | A MetaCTF lab. In your home directory you will find some binaries that you need to reverse engineer in order to determine the password that the program expects. Once you determing the password, run the program and enter the password to receive the file. Lab sheet here. |
| Type | ctf-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | https://youtu.be/jo_07iOplzA; https://youtu.be/1Hy_166CwRk |
| VM names | desktop |
| KA | Topic | Keywords |
|---|---|---|
| Software Security (SS) | Categories of Vulnerabilities | Integer overflow |
| Software Security (SS) | Prevention of Vulnerabilities | language design and type systems |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/software_security_exploitation/1_c_asm_iof.xml run
| Key | Data |
|---|---|
| Name | Understanding Software Vulnerabilities: Injection Attacks, Race Conditions, and Format String Attacks |
| Description | A MetaCTF lab. In your home directory you will find some binaries that you need to reverse engineer in order to determine the password that the program expects. Once you determing the password, run the program and enter the password to receive the file. Lab sheet here. |
| Type | ctf-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | https://youtu.be/nVpqjsfii6c; https://youtu.be/PH73lpG2B1M; https://youtu.be/Du3fVc_ZLiI |
| VM names | desktop |
| KA | Topic | Keywords |
|---|---|---|
| Software Security (SS) | Categories of Vulnerabilities | race condition vulnerabilities; structured output generation vulnerabilities; Format string attacks |
| Software Security (SS) | Prevention of Vulnerabilities | race condition mitigations; structured output generations mitigations |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/software_security_exploitation/2_race_conditions_format_str.xml run
| Key | Data |
|---|---|
| Name | Bug Hunting and Fuzzing |
| Description | Lab sheet here. |
| Type | ctf-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | https://youtu.be/nwxtlR31hvw; https://youtu.be/vT2PP7VnSNw |
| VM names | windows_victim; kali; desktop |
| KA | Topic | Keywords |
|---|---|---|
| Software Security (SS) | Detection of Vulnerabilities | dynamic detection |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/software_security_exploitation/3_bug_hunting_and_fuzzing.xml run
| Key | Data |
|---|---|
| Name | Exploit Development |
| Description | Lab sheet here. |
| Type | ctf-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | https://youtu.be/Zh7IdmnCfy0; https://youtu.be/WU06L-u0t2Q; https://youtu.be/j2S-XgY-Fyg; https://youtu.be/Lf1UPaqPJMM; https://youtu.be/5OUQ7ExlgKI |
| VM names | windows_victim; kali; windows_victim_server |
| KA | Topic | Keywords |
|---|---|---|
| Software Security (SS) | Categories of Vulnerabilities | memory management vulnerabilities; Stack smashing buffer overflows |
| Malware & Attack Technology (MAT) | Attacks and exploitation | EXPLOITATION; EXPLOITATION FRAMEWORKS; Exploit development; Metasploit Framework development |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/software_security_exploitation/4_exploit_development.xml run
| Key | Data |
|---|---|
| Name | Writing Exploits: Linux and Stack-smashing Buffer Overflows |
| Description | Lab sheet here. |
| Type | ctf-lab; lab-sheet |
| Author | Thomas Shaw |
| Linked videos | https://youtu.be/oi_CfBe_umU; https://youtu.be/Wry2get_RRc |
| VM names | metactf_desktop; kali |
| KA | Topic | Keywords |
|---|---|---|
| Software Security (SS) | Categories of Vulnerabilities | memory management vulnerabilities; Stack smashing buffer overflows |
| Malware & Attack Technology (MAT) | Attacks and exploitation | EXPLOITATION; EXPLOITATION FRAMEWORKS; Exploit development; Metasploit Framework development |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/software_security_exploitation/5_linux_stack_bof.xml run
| Key | Data |
|---|---|
| Name | Linux bypassing NX bit with return-to-libc |
| Description | Similar to last week. Same C code, just compiled w/ stack protections and non-executable stack. Lab sheet here. |
| Type | ctf-lab; lab-sheet |
| Author | Thomas Shaw |
| Linked videos | https://youtu.be/ywLXfSR5YWk |
| VM names | metactf_desktop; kali |
| KA | Topic | Keywords |
|---|---|---|
| Software Security (SS) | Categories of Vulnerabilities | memory management vulnerabilities; Stack smashing buffer overflows |
| Software Security (SS) | Mitigating Exploitation | NON-EXECUTABLE MEMORY |
| Malware & Attack Technology (MAT) | Attacks and exploitation | EXPLOITATION; EXPLOITATION FRAMEWORKS; Exploit development; Metasploit Framework development; Mitigation bypass: non-executable memory |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/software_security_exploitation/6_linux_nx_bypass.xml run
| Key | Data |
|---|---|
| Name | Linux ASLR bypass |
| Description | Practical challenges to bypass ASLR, PIE and RelRO. Lab sheet here. |
| Type | ctf-lab; lab-sheet |
| Author | Thomas Shaw |
| Linked videos | https://youtu.be/v2rChKDAmFg; https://youtu.be/xwsBaNQZozg |
| VM names | metactf_desktop; kali |
| KA | Topic | Keywords |
|---|---|---|
| Software Security (SS) | Categories of Vulnerabilities | memory management vulnerabilities; Stack smashing buffer overflows |
| Software Security (SS) | Mitigating Exploitation | ASLR (ADDRESS SPACE LAYOUT RANDOMIZATION) |
| Malware & Attack Technology (MAT) | Attacks and exploitation | EXPLOITATION; EXPLOITATION FRAMEWORKS; Exploit development; Metasploit Framework development; Mitigation bypass: ASLR |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/software_security_exploitation/7_linux_aslr_bypass.xml run
| Key | Data |
|---|---|
| Name | Linux Buffer Overflows and Advanced Format String Attacks |
| Description | Lab sheet here. |
| Type | ctf-lab; lab-sheet |
| Author | Thomas Shaw |
| Linked videos | |
| VM names | metactf_desktop |
| KA | Topic | Keywords |
|---|---|---|
| Software Security (SS) | Categories of Vulnerabilities | memory management vulnerabilities; Stack smashing buffer overflows; Format string attacks |
| Malware & Attack Technology (MAT) | Attacks and exploitation | EXPLOITATION; EXPLOITATION FRAMEWORKS; Exploit development; Metasploit Framework development |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/software_security_exploitation/8_linux_bof_format.xml run
| Key | Data |
|---|---|
| Name | Authentication lab |
| Description | Lecture Slides here Reading Chapter 11 "Authentication": Bishop, M. (2004), Introduction to Computer Security, Addison-Wesley. (ISBN-10: 0321247442) Lab A Hackerbot lab. Work through the lab instructions, then when prompted interact with Hackerbot. |
| Type | ctf-lab; hackerbot-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | https://youtu.be/2I_JSdTu-oI; https://youtu.be/pGcJEML1mRo; https://youtu.be/icC2Zrno_uM; https://youtu.be/Wrg6XZu6Luw |
| VM names | desktop; server; hackerbot_server; kali_cracker |
| KA | Topic | Keywords |
|---|---|---|
| Authentication, Authorisation & Accountability (AAA) | Authentication | identity management; user authentication; facets of authentication; Cryptography and authentication (hashes and attacks against authentication schemes / passwords) |
| Operating Systems & Virtualisation (OSV) | Primitives for Isolation and Mediation | authentication and identification; Linux authentication; Types of user accounts |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/systems_security/1_authentication.xml run
| Key | Data |
|---|---|
| Name | Pluggable Authentication Modules lab |
| Description | Lecture Slides continued here Reading Chapter 4 "Users, Passwords, and Authentication": Garfinkel, S. Spafford, G. and Schwartz, A. (2003), Practical Unix and Internet Security, O'Reilly. (ISBN-10: 0596003234) Lab A short lab this week, exploring PAM. Work through the labsheet, then when prompted interact with Hackerbot. |
| Type | ctf-lab; hackerbot-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | https://youtu.be/z4L6Yv5ry1A; https://youtu.be/-zcnfmoLjYI; https://youtu.be/xHs3LB4Yyrk; https://youtu.be/c2dPdQmaVyo; https://youtu.be/dCBabesIXo8; https://youtu.be/rhdcxhSDqp4; https://youtu.be/PCXK2cK8tpE |
| VM names | desktop; server; hackerbot_server |
| KA | Topic | Keywords |
|---|---|---|
| Authentication, Authorisation & Accountability (AAA) | Authentication | identity management; user authentication; facets of authentication |
| Operating Systems & Virtualisation (OSV) | Primitives for Isolation and Mediation | authentication and identification; Linux authentication; Authentication frameworks (PAM) |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/systems_security/2_pam.xml run
| Key | Data |
|---|---|
| Name | Access Controls lab |
| Description | Lecture Slides here Reading Chapter 1 "Foundations of Security and Access Control in Computing": Benantar, M. (2006), Access Control Systems: Security, Identity Management and Trust Models, Springer. (ISBN-10: 0387004459) Lab A Hackerbot lab. Work through the labsheet, then when prompted interact with Hackerbot. |
| Type | ctf-lab; hackerbot-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | https://youtu.be/yWJyZEFbchQ; https://youtu.be/i0kO_3ExJv4 |
| VM names | shared_desktop; server; hackerbot_server |
| KA | Topic | Keywords |
|---|---|---|
| Authentication, Authorisation & Accountability (AAA) | Authorisation | access control; enforcing access control; ACCESS CONTROL - DAC (DISCRETIONARY ACCESS CONTROL); Vulnerabilities and attacks on access control misconfigurations |
| Operating Systems & Virtualisation (OSV) | Primitives for Isolation and Mediation | Access controls and operating systems; Linux security model; Unix File Permissions; Filesystems; inodes; and commands; umask |
| Operating Systems & Virtualisation (OSV) | Role of Operating Systems | mediation |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/systems_security/4_access_controls.xml run
| Key | Data |
|---|---|
| Name | Set User ID lab |
| Description | Lecture Slides continued here Reading Chapter 6 "Filesystems and Security": Garfinkel, S. Spafford, G. and Schwartz, A. (2003), Practical Unix and Internet Security, O'Reilly. (ISBN-10: 0596003234) Lab A Hackerbot lab. Work through the labsheet, then when prompted interact with Hackerbot. |
| Type | ctf-lab; hackerbot-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | https://youtu.be/viSkkNB777k; https://youtu.be/PGHsb3bg_h4 |
| VM names | shared_desktop; server; hackerbot_server |
| KA | Topic | Keywords |
|---|---|---|
| Authentication, Authorisation & Accountability (AAA) | Authorisation | access control; Elevated privileges; Real and effective identity; Vulnerabilities and attacks on access control misconfigurations |
| Operating Systems & Virtualisation (OSV) | Primitives for Isolation and Mediation | Access controls and operating systems; Linux security model; Unix File Permissions; setuid/setgid; Hardlink protections |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/systems_security/5_suid.xml run
| Key | Data |
|---|---|
| Name | Access Control Lists (ACLs) lab |
| Description | Lecture Slides continued here Reading Grunbacher, Andreas. "POSIX Access Control Lists on Linux." USENIX Annual Technical Conference, FREENIX Track. 2003. Lab A Hackerbot lab. Work through the labsheet, then when prompted interact with Hackerbot. |
| Type | ctf-lab; hackerbot-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | https://youtu.be/Bn3NJhgmdLk; https://youtu.be/OT7ifs8PkHI |
| VM names | shared_desktop; server; hackerbot_server |
| KA | Topic | Keywords |
|---|---|---|
| Authentication, Authorisation & Accountability (AAA) | Authorisation | access control; ACCESS CONTROL LIST (ACL); Vulnerabilities and attacks on access control misconfigurations |
| Operating Systems & Virtualisation (OSV) | Primitives for Isolation and Mediation | Access controls and operating systems; Linux security model; Linux Extended Access Control Lists (facl) |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/systems_security/6_facls.xml run
| Key | Data |
|---|---|
| Name | Containers lab |
| Description | Lecture Slides here Reading Z. C. Schreuders, T. McGill, and C. Payne, "The State of the Art of Application Restrictions and Sandboxes: A Survey of Application-oriented Access Controls and their Shortfalls," Computers and Security, Volume 32, Elsevier B.V., 2013. DOI: 10.1016/j.cose.2012.09.007 Lab A Hackerbot lab. Work through the labsheet, then when prompted interact with Hackerbot. |
| Type | ctf-lab; hackerbot-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | https://youtu.be/f4yBcKkb12g |
| VM names | desktop; hackerbot_server; chroot_esc_server; docker_esc_server |
| KA | Topic | Keywords |
|---|---|---|
| Authentication, Authorisation & Accountability (AAA) | Authorisation | SANDBOX; Application-based access controls: user-based access controls insufficiently limit privileges |
| Operating Systems & Virtualisation (OSV) | Primitives for Isolation and Mediation | capabilities; Container-based sandboxes: chroot; Docker; Rule-based controls: Course grained: Linux capabilities; Vulnerabilities and attacks on sandboxing misconfigurations |
| Operating Systems & Virtualisation (OSV) | Role of Operating Systems | isolation; CONTAINERS |
| Web & Mobile Security (WAM) | Fundamental Concepts and Approaches | sandboxing |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/systems_security/7_containers.xml run
| Key | Data |
|---|---|
| Name | AppArmor lab |
| Description | Lecture Slides continued here Lectures for the next two weeks Secure software development Secure design principles Slides Lab A Hackerbot lab. Work through the labsheet, then when prompted interact with Hackerbot. |
| Type | ctf-lab; hackerbot-lab; lab-sheet |
| Author | Z. Cliffe Schreuders |
| Linked videos | https://youtu.be/Xgs5akM6ayc |
| VM names | desktop; hackerbot_server |
| KA | Topic | Keywords |
|---|---|---|
| Authentication, Authorisation & Accountability (AAA) | Authorisation | ACCESS CONTROL - MAC (MANDATORY ACCESS CONTROL); ACCESS CONTROL - NDAC (NON-DISCRETIONARY ACCESS CONTROL); Application-based access controls: user-based access controls insufficiently limit privileges; Rule-based sandboxes |
| Operating Systems & Virtualisation (OSV) | Primitives for Isolation and Mediation | Rule-based controls: Fine grained: AppArmor; Vulnerabilities and attacks on sandboxing misconfigurations |
| Software Security (SS) | Mitigating Exploitation | limiting privileges |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/systems_security/8_apparmor.xml run
| Key | Data |
|---|---|
| Name | Web security lab environment |
| Description | An environment for web security labs. Kali Linux with Damn Vulnerable Web App server, WebGoat, and web sec tools. |
| Type | lab-environment; ctf-lab |
| Author | Z. Cliffe Schreuders |
| Linked videos | |
| VM names | kali |
| KA | Topic | Keywords |
|---|---|---|
| Web & Mobile Security (WAM) | Fundamental Concepts and Approaches | web PKI and HTTPS; authentication; cookies; passwords and alternatives; JAVASCRIPT / HYPERTEXT MARKUP LANGUAGE (HTML) / CASCADING STYLE SHEETS (CSS) / HYPERTEXT TRANSFER PROTOCOL (HTTP)\n COOKIES; HYPERTEXT TRANSFER PROTOCOL (HTTP) - PROXYING; Broken Access Control / Insecure Direct Object References; SESSION HIJACKING; REPRESENTATIONAL STATE TRANSFER (REST) |
| Web & Mobile Security (WAM) | Client-Side Vulnerabilities and Mitigations | client-side storage; CLIENT-SIDE VALIDATION; clickjacking |
| Web & Mobile Security (WAM) | Server-Side Vulnerabilities and Mitigations | injection vulnerabilities; server-side misconfiguration and vulnerable components; CROSS-SITE SCRIPTING (XSS); SAME ORIGIN POLICY (SOP); COMMAND INJECTION; SQL-INJECTION; CROSS-SITE REQUEST FORGERY (CSRF); CONFUSED DEPUTY ATTACKS |
| Software Security (SS) | Categories of Vulnerabilities | Web vulnerabilities / OWASP Top 10; API vulnerabilities |
| Software Security (SS) | Prevention of Vulnerabilities | coding practices; Protecting against session management attacks; XSS; SQLi; CSRF; API design |
Command to build VMs and start scenario:
ruby secgen.rb -s scenarios/labs/web_security/websec_lab.xml run