I have extensive programming experience and a keen interest in Cyber Security, with a focus on security operations and data flow automation. I leverage my GitHub account to curate homelabs to simulate various security operations scenarios and test tools used in Security Operations Centres (SOCs). Additionally, whenever possible, I try to create some small snippets of content covering topics in systems administration, network administration, and cyber security. My certificates can be found here.
- Cyber Security Homelabs
- Cyber Security Standards Overview
- IT and Cyber Security Popular Certifications
- IT and Cyber Security Concepts
- Other Stuff
I have been exploring various homelabs featured in YouTube channels and blogs, focusing on topics like threat hunting (XDR), endpoint security (EDR), network security (IDS/IPS), and log monitoring (SIEM). I have been documenting step-by-step procedures for setting up these labs in a self-hosted, cost-free manner.
- Configured a Host-Only Network in VirtualBox with:
- HDCP Server
- Ubuntu Server (SOC Tools)
- Debian (Web Server)
- Configured the following security tools on an Ubuntu Server VM:
- Wazuh (SIEM/XDR)
- Suricata (IDS/IPS)
- TheHive (CMS)
- Admyral (SOAR)
- MISP (TI)
- Configured the following vulnerable web servers on a Debian VM:
- DVWA
- bWAPP
- Configured in VirtualBox an Internal Network with:
- DHCP Server
- Ubuntu Server (Elastic Host)
- Windows 10 (Victim)
- Configured Elastic Stack 8 on Ubuntu Server:
- Elastic Stack: Elasticsearch, Kibana (UI), and Elastic Agent + Integrations.
- Integrations: Fleet Server, System, Windows, and Elastic Defend.
- Simulated two malicious tests on the Victim machine:
- EICAR Malware Test.
- MITRE ATT&CK Test with Red Team Automation (RTA).
- Configured in VirtualBox a NAT Network with:
- DHCP Server and Host Gateway access.
- Windows 11 (Target) with Windows Defender disabled, Sysmon and LimaCharlie sensor installed.
- Ubuntu Server (Attack) with Sliver installed, a Command & Control (C2) framework by BishopFox.
- Generated in Sliver a C2 payload and executed the payload on the Target machine to start a Sliver C2 session on the Attack machine.
- Used the Sliver C2 session to perform two attacks on the Target machine:
- LSASS access (credential-stealing attack).
- Volume shadow copies deletion using vssadmin Windows utility (used in ransomware attacks).
- Detection and response rules were created in the LimaCharlie platform to detect the two previous attacks and take action. The rules were tested by repeating the attacks.
- Snort network IDS mode configuration in Ubuntu Server.
- NMAP scan detection using Snort (NIDS):
- NMAP Ping Scan, various TCP scans including SYN, Connect, NULL, FIN, and XMAS, as well as UDP Scans.
- Attack detection using Snort (NIDS):
- SQL injection attacks using tools like WPSCan & WordPress and Burp Suite & SQLmap.
- Backdoor attacks using Empire post-exploitation framework and Katana penetration test framework.
- Rogue DHCP & Rogue Routing attacks.
- ICMP Redirect attack.
- Microsoft Sentinel was used to monitor failed RDP login attempts from global attackers on an exposed Windows 10 virtual machine configured in Microsoft Azure.
- A custom log file (
failed_rdp.log) was generated using a PowerShell script that extracts failed login events from Security Log on Event Viewer and forwards them to a third-party API to get geolocation data. - A custom table (
FAILED_RDP_WITH_GEO_CL) was created in Log Analytics Workspace on Microsoft Azure using the generated log file (failed_rdp.log). Custom fields were extracted from the table using a Kusto Query Language (KQL) query. - A workbook was created in Microsoft Sentinel using KQL to query data from the
FAILED_RDP_WITH_GEO_CLtable to display global attackers (RDP login failure) on the world map according to physical location and magnitude (attack count).
Source: https://github.com/robsann/AzureSentinelSIEMAttackMap
Standards in cyber security are guidelines and best practices that organizations follow to protect their systems, networks, and data from cyber threats. These standards help ensure that security measures are consistently implemented and maintained, improving overall security posture.
- The NIST Cybersecurity Framework (CSF) 2.0 is a set of guidelines and best practices for managing cyber security risks.
- It provides a common language for organizations to communicate about cyber security and assess their current cyber security posture.
- The framework helps organizations identify, protect, detect, respond to, and recover from cyber security threats.
- It is a flexible and customizable tool that can be adapted to meet the specific needs of different organizations.
1.Cybersecurity Framework (CSF) Overview2.Introduction to the CSF Core3.Introduction to CSF Profiles and Tiers4.Introduction to Online Resources That Supplement the CSF5.Improving Cybersecurity Risk Communication and Integration- NIST SP 800-12 Rev. 1 is a publication that serves as an introduction to information security.
- It provides guidance on understanding the importance of information security, the risks and threats that organizations face, and the best practices for protecting information assets.
- The document covers topics such as security policies, risk management, security controls, and incident response.
- It is designed to help organizations establish a strong foundation for their information security programs and ensure the confidentiality, integrity, and availability of their data and systems.
1.Introduction2.Elements of Information Security3.Roles and Responsibilities4.Threats and Vulnerabilities: A Brief Overview5.Information Security Policy6.Information Security Risk Management7.Assurance8.Security Considerations in System Support and Operations9.Cryptography10.Control Families- NIST SP 800-37 Rev. 2 is a publication that outlines a structured approach to managing risks associated with information systems and organizations.
- The framework provides a systematic process for identifying, assessing, and responding to risks, with the goal of protecting critical assets and ensuring the confidentiality, integrity, and availability of information.
- It emphasizes continuous monitoring and improvement, as well as collaboration between stakeholders to effectively manage and mitigate risks.
- The framework is designed to be flexible and scalable, making it applicable to organizations of all sizes and industries.
1.Introduction2.The Fundamentals3.The Process- NIST SP 800-53 Rev. 5 is a publication that provides a comprehensive set of security and privacy controls for information systems and organizations.
- These controls are designed to help organizations protect their sensitive information and systems from various threats, including cyber attacks, data breaches, and unauthorized access.
- The publication outlines a framework for implementing security and privacy measures, including policies, procedures, and technical safeguards, to ensure the confidentiality, integrity, and availability of information.
- It is widely used by government agencies, private sector organizations, and other entities to enhance their cyber security posture and compliance with regulations.
1.Introduction2.The Fundamentals3.The Controls- NIST SP 800-61 Rev 2 is a comprehensive guide to help organizations effectively respond to and manage computer security incidents.
- It provides a structured approach for handling incidents, including preparation, detection, analysis, containment, eradication, recovery, and post-incident activities.
- The guide outlines best practices for incident response, including establishing an incident response team, creating incident response policies and procedures, and conducting post-incident reviews to improve future incident handling.
- By following the guidelines outlined in NIST SP 800-61 Rev 2, organizations can better protect their systems and data from cyber threats.
Executive Summary
1.Introduction2.Organizing a Computer Security Incident Response Capability3.Handling an Incident4.Coordination and Information Sharing- NIST SP 800-63-3 is a set of guidelines created to help organizations improve the security and usability of digital identity systems.
- The guidelines provide recommendations for identity proofing, authentication, and lifecycle management, with a focus on protecting against identity theft and fraud.
- By following these guidelines, organizations can enhance the security of their digital systems and better protect the privacy and security of their users' identities.
1.Purpose2.Introduction3.Definitions and Abbreviations4.Digital Identity Model5.Digital Identity Risk Management6.Selecting Assurance Levels7.Federation Considerations8.References- NIST SP 800-82 Rev. 3 is a guide developed to help organizations secure their Operational Technology (OT) systems.
- It provides recommendations and best practices for protecting OT systems, which are used to monitor and control physical processes in industries such as manufacturing, energy, and transportation.
- The guide covers topics such as risk management, access control, network security, and incident response, helping organizations to identify and mitigate potential threats to their OT systems and ensure the reliability and safety of their operations.
1.Introduction2.OT Overview3.OT Cybersecurity Program Development4.Risk Management for OT Systems5.OT Cybersecurity Architecture6.Applying the Cybersecurity Framework to OT- NIST SP 800-115 is a technical guide that provides organizations with guidance on conducting information security testing and assessments.
- The document outlines best practices for evaluating the effectiveness of security controls, identifying vulnerabilities, and assessing the overall security posture of an organization's systems and networks.
- It covers various testing methodologies, tools, and techniques that can be used to assess the security of an organization's information systems.
- The guide aims to help organizations improve their security posture and protect their sensitive information from cyber threats.
Executive Summary
1.Introduction2.Security Testing and Examination Overview3.Review Techniques4.Target Identification and Analysis Techniques5.Target Vulnerability Validation Techniques6.Security Assessment Planning7.Security Assessment Execution8.Post-Testing Activities- ISO/IEC 27001 is an internationally recognized standard that outlines the requirements for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS).
- The ISMS is a systematic approach to managing sensitive company information, ensuring its confidentiality, integrity, and availability.
- By implementing ISO/IEC 27001, organizations can identify and mitigate information security risks, comply with legal and regulatory requirements, and demonstrate their commitment to protecting data.
- This standard helps organizations build a culture of security, improve their reputation, and enhance customer trust.
1.Scope2.Normative references3.Terms and definitions4.Context of the organization5.Leadership6.Planning7.Support8.Operation9.Performance evaluation10.Improvement- ISO/IEC 27002 is a globally recognized standard that provides guidelines and best practices for implementing information security controls within an organization.
- It covers a wide range of security topics, including risk assessment, access control, cryptography, incident management, and compliance.
- The standard helps organizations establish a comprehensive framework for protecting their information assets and managing security risks effectively.
- By following the recommendations outlined in ISO/IEC 27002, organizations can improve their overall security posture, enhance their resilience to cyber threats, and demonstrate their commitment to safeguarding sensitive information.
1.Scope2.Normative references3.Terms, definitions and abbreviated terms4.Structure of this document5.Organizational controls6.People controls7.Physical controls8.Technological controls- ISO/IEC 27005 is a standard that provides guidelines for implementing an effective information security risk management process.
- It helps organizations identify, assess, and manage risks to their information assets.
- The standard outlines a systematic approach to risk management, including risk assessment, risk treatment, and risk monitoring and review.
- By following the principles and guidelines set forth in ISO/IEC 27005, organizations can better protect their sensitive information from threats and vulnerabilities, ensuring the confidentiality, integrity, and availability of their data.
- This standard is essential for organizations looking to establish a robust information security risk management framework.
1.Scope2.Normative references3.Terms and definitions4.Structure of this document5.Information security risk management6.Context establishment7.Information security risk assessment process8.Information security risk treatment process9.Operation10.Leveraging related ISMS processes- ISO/IEC 27017 is a code of practice that provides guidelines for implementing information security controls in cloud services.
- It outlines specific security measures that cloud service providers should implement to protect the confidentiality, integrity, and availability of data stored in the cloud.
- The standard covers areas such as data encryption, access control, incident response, and compliance with legal and regulatory requirements.
- By following the guidelines outlined in ISO/IEC 27017, organizations can ensure that their data is secure and protected when using cloud services.
1.Scope2.Normative references3.Definitions and abbreviations4.Cloud sector-specific concepts5.Information security policies6.Organization of information security7.Human resource security8.Asset management9.Access control10.Cryptography11.Physical and environmental security12.Operations security13.Communications security14.System acquisition, development and maintenance15.Supplier relationships16.Information security incident management17.Information security aspects of business continuity management18.Compliance- ISO/IEC 27018 is a code of practice that provides guidelines for protecting personal data in the cloud.
- It outlines specific controls and measures that cloud service providers should implement to ensure the privacy and security of personal information stored in the cloud.
- This standard addresses issues such as data encryption, data retention, data access controls, and transparency in data processing.
- By following the guidelines set forth in ISO/IEC 27018, organizations can demonstrate their commitment to protecting personal data and build trust with their customers regarding the handling of their sensitive information in the cloud.
1.Scope2.Normative references3.Terms and definitions4.Overview5.Information security policies6.Organization of information security7.Human resource security8.Asset management9.Access control10.Cryptography11.Physical and environmental security12.Operations security13.Communications security14.System acquisition, development and maintenance15.Supplier relationships16.Information security incident management17.Information security aspects of business continuity management18.Compliance- ISO/IEC 27701 is a standard that provides guidelines for establishing, implementing, maintaining, and continually improving a Privacy Information Management System (PIMS).
- It is an extension to the ISO/IEC 27001 standard, focusing specifically on privacy management within an organization.
- The standard helps organizations to identify and manage privacy risks, comply with privacy regulations, and build trust with stakeholders by demonstrating a commitment to protecting personal information.
- By implementing ISO/IEC 27701, organizations can enhance their privacy practices, improve data protection measures, and ensure the confidentiality, integrity, and availability of personal information.
1.Scope2.Normative references3.Terms, definitions and abbreviations4.General5.PIMS-specific requirements related to ISO/IEC 270016.PIMS-specific guidance related to ISO/IEC 270027.Additional ISO/IEC 27002 guidance for PII controllers8.Additional ISO/IEC 27002 guidance for PII processorsA brief overview of popular CompTIA certifications, with mind maps detailing exam domains and links to related YouTube resources, is provided here. This includes System Administration and Network Administration certifications such as CompTIA A+, CompTIA Linux+, and CompTIA Network+, as well as Cyber Security certifications like CompTIA Security+ and CompTIA CySA+. You can access these mind maps in high-resolution PDF format on Dropbox by clicking on the images.
CompTIA A+ Core 2 (220-1102) Objectives - CompTIA link
The CompTIA A+ Core 2 certification objectives cover advanced troubleshooting, operating systems, security, and software troubleshooting. It includes topics like hardware, networking, mobile devices, virtualization, and cloud computing. Candidates are tested on their ability to secure and manage various devices and technologies, ensuring comprehensive IT skills and knowledge. CompTIA A+ Core 2 demonstrates proficiency in essential IT areas.
1.0 Operating Systems
2.0 Security
3.0 Software Troubleshooting
4.0 Operational ProceduresProfessor Messer CompTIA A+ Core 2 (220-1102) course - YouTube Link
CompTIA Linux+ (XK0-005) Objectives - CompTIA link
The CompTIA Linux+ certification validates essential skills in Linux system administration and operation. Covering topics such as system architecture, Linux installation, package management, command line usage, file permissions, and security, this certification ensures proficiency in managing Linux-based systems. Candidates learn troubleshooting, scripting, and networking in a Linux environment, making them well-equipped for various IT roles requiring Linux expertise. Achieving CompTIA Linux+ certification demonstrates a thorough understanding of Linux systems.
1.0 System Management 2.0 Security 3.0 Scripting, Containers, and Automation
4.0 TroubleshootingShawn Powers' CompTIA Linux+ (XK0-005) prep (in progress) - YouTube Link
CompTIA Network+ (N10-008) Objectives - CompTIA link
The CompTIA Network+ certification validates essential skills in networking, covering topics such as network architecture, security, troubleshooting, and cloud technologies. Candidates learn to design and implement functional networks, configure network devices, and manage network security protocols. The certification also emphasizes practical skills in areas like network installation, configuration, and diagnostics, ensuring proficiency in both wired and wireless networks. Overall, CompTIA Network+ certification demonstrates expertise in network administration.
1.0 Networking Fundamentals
2.0 Network Implementations
3.0 Network Operations
4.0 Network Security
5.0 Network TroubleshootingProfessor Messer CompTIA Network+ (N10-008) course - YouTube Link
CompTIA Security+ (SY0-501) Objectives - CompTIA link
The CompTIA Security+ certification objectives cover essential topics in cyber security, including network security, threats and vulnerabilities, access control, identity management, cryptography, and risk management. It also emphasizes security compliance, incident response, and security architecture. Successfully mastering these objectives demonstrates proficiency in securing IT systems.
1.0 Threats, Attacks and Vulnerabilities 2.0 Technologies and Tools 3.0 Architecture and Design 4.0 Identity and Access Management
5.0 Risk Management
6.0 Cryptography and PKIProfessor Messer's CompTIA Security+ (SY0-501) course - YouTube Link
CompTIA Cybersecurity Analyst (CySA+) (CS0-003) Objectives - CompTIA link
The CompTIA Cybersecurity Analyst (CySA+) certification focuses on identifying and responding to security threats and vulnerabilities in a cyber security context. CySA+ certified professionals demonstrate skills in threat detection, analysis, and response using various tools and techniques. They are proficient in analysing data to identify vulnerabilities, threats, and risks to an organization's information systems. CySA+ certification validates expertise in cyber security operations, enhancing an individual's ability to protect and secure organizational assets against cyber threats.
1.0 Security Operations 2.0 Vulnerability Management 3.0 Incident Response and Management
4.0 Reporting and CommunicationCyber Security Domains from 2021 (credits to MyDFIR)
Mind map from 2021 that provides a comprehensive overview of the various domains within cyber security.
- LetsDefend: Hands-on security operations training with alert addressing on simulated SOC environment.
- CyberDefenders: A blue team training platform.
- TryHackMe: Hands-on cyber security training with offensive and defensive paths.
- HackTheBox: Hands-on cyber security training with offensive and defensive paths.
Below are brief descriptions accompanied by images to help illustrate popular concepts in IT and Cyber Security.
The Linux File System is a hierarchical structure that organizes and stores files on a Linux system. It uses a tree-like directory structure, starting with the root directory ("/"), with directories and files arranged systematically to facilitate efficient file management and access.
Linux File Permissions dictate the access level of users (owner, group, and others) to files and directories. They are represented by read, write, and execute permissions, providing control over file security and user interactions.
Linux commands help users navigate the file system, interact with the files, and administer the entire system using the command line interface.
Note: Use the man command to display the manual page for other commands (e.g., man ls), providing detailed documentation and usage instructions, or use the --help option (e.g., ls --help) for a quick overview of the command options.
- Configuration files (/etc/) store system-wide settings, preferences, and configurations for various applications, facilitating centralized management.
- System Info files (/proc/) provide a virtual file system exposing kernel and process information, allowing dynamic access to real-time system details and parameters.
- Log files (/var/log/) store system and application logs, aiding in troubleshooting by capturing events, errors, and diagnostic information for analysis and monitoring.
The Open Systems Interconnection (OSI) model is a conceptual framework used to describe how network communications work. The OSI model characterizes computing functions into a universal set of rules and requirements in order to support interoperability between different products and software.
TCP (Transmission Control Protocol) is a connection-oriented and reliable transport layer protocol, that ensures data integrity and ordered delivery. UDP (User Datagram Protocol) is a connectionless and lightweight transport layer protocol that sacrifices reliability for reduced latency, making it suitable for real-time applications where occasional data loss is acceptable.
The Dynamic Host Configuration Protocol (DHCP) is a network management protocol used on IP networks that, in 4 steps, automatically assigns IP addresses and other communication parameters to devices connected to the network using a client-server architecture.
The Domain Name System (DNS) is a naming database that translates human-readable domain names (e.g., www.example.com) to machine-readable IP addresses (e.g., 93.184.216.34) used for device communication. If the website is not cached, the DNS resolver will query Root Servers, Top-Level Domain (TLD) Servers, and Authoritative Nameservers to retrieve the IP address.
The CIA Triad is a fundamental concept in information security, representing the core principles of Confidentiality (ensuring data privacy), Integrity (maintaining data accuracy and trustworthiness), and Availability (ensuring data accessibility). These principles guide security measures and strategies to protect information assets in various computing environments.
The Cyber Kill Chain is a framework outlining the stages of a cyber attack, from initial reconnaissance to achieving the attacker's objectives, providing a structured approach for understanding, analysing, and defending against advanced cyber threats.
MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a knowledge base that catalogues and describes the tactics, techniques, and procedures used by cyber adversaries. It provides a comprehensive framework for understanding and analysing the full spectrum of cyber threats, aiding organizations in improving their detection, defence, and response capabilities.
The Pyramid of Pain is a conceptual framework in cyber security that categorizes indicators of compromise (IOCs) in six levels based on the difficulty for adversaries to change or evade detection. The pyramid is structured in ascending order of difficulty, as illustrated below:
Security Operations Center (SOC) technologies encompass a range of tools designed to monitor, analyse, and respond to cyber security threats. These include SIEM for log analysis, EDR for endpoint protection, SOAR for orchestration, and other solutions that collectively fortify an organization's cyber security posture.
The NIST Incident Response Framework provides a systematic approach for organizations to prepare for, detect, respond to, and recover from cyber security incidents. It guides the development of robust incident response capabilities through a four-phase process: preparation, detection and analysis, containment, eradication, recovery, and post-incident activity.
The SANS Incident Response Framework provides a structured approach for organizations to effectively respond to cyber security incidents, comprising six key phases: Preparation, Identification, Containment, Eradication, Recovery, and Lessons Learned. It guides the development of robust incident response capabilities to detect, mitigate, and recover from security incidents.
Below are some helpful shell scripts, instructions for installing tools, and other miscellaneous resources.
This script utilizes the ps command to display the top n processes based on CPU and Memory usage. You can access the script by clicking here.
This script utilizes the ss and ps commands to show the listening ports along with the corresponding process and usernames, as well as the PID number. You can access the script by clicking here.
This script utilizes Nmap to retrieve the IP addresses and MAC addresses of devices connected to the network, then compiles them into a table. You can access the script by clicking here.
Zabbix is an open-source monitoring software tool used for monitoring the performance and availability of servers, network devices, and other IT infrastructure components. It provides real-time monitoring, alerting, and visualization features to help IT teams identify and resolve issues quickly. Zabbix can monitor a wide range of devices and applications, making it a versatile tool for managing and maintaining IT systems.
The procedure for the Zabbix installation can be found here.
I wrote a suggestion to address the issue related to bytes and str types when running the AutoBlue MS17-010 exploit on Python 3, which was originally developed for Python 2. You can access the suggestions by clicking here.