Module: Open Source Intelligence

Topic: Meta

Objective

Students will be able to use a metadata viewer to determine information about a photo that was taken.

Prompt

This challenge will give you experience with extracting metadata from an image file. You are given an image with contains metadata and you will need to use a metadata viewer to help answer the questions.

Questions & Answers

1. When was the image created? (Round to the nearest minute) Answer: 2015/05/15 02:14
2. What is the image size in pixels? (ex: 800x600) Answer: 1024x768
3. What is the make of the camera that took the picture? Answer: apple
4. What is the model of the camera that took the picture? Answer: iphone 5
5. What is the exposure time for the picture? (ex: 1/200) Answer: 1/640
6. Where was the picture taken? Please use only positive numbers with 4 decimal places. (ex: 45.4000N, 75.6667W) Possible answers: ● 39.8750N 20.0100E ● 39.8750N, 20.0100E ● 39 deg 52' 30.00" N, 20 deg 0' 36.00" E ● 39 deg 52' 30.00" N 20 deg 0' 36.00" E ● 39.8750 20.0100 ● N 39° 52' 30'' E 20° 0' 36'’ ● Latitude 39:52:30 Longitude 20:0:36 ● 39; 52;30 20;0; 36 ● 39º 52' 30.00" N, 20º 0' 36.00" E Incorrect answers: ● 39.8750 -20.0100 ● -39.8750 -20.0100 ● -39.8750N, 20.0

Extension Activities

Topic: Lookup

Objective

Students will be able to find and use a specification document to answer questions about DNS.

Prompt

Answer these questions about DNS. Make sure you enter the record type and not the description of the record type.

Questions & Answers

1. What type of DNS record hold the DNSSEC public signing key?

Answer: DNSKEY

2. What type of DNS record is used to map hostnames to IPv6 addresses?

Answer: AAAA

3. What type of DNS record is used to delegate a DNS zone?

Answer: NS or Name Server

Extension Activities

Topic: Threat Intel

Objectives

Students will be able to use search tools to answer questions about security topics.

Prompt

Answer the following questions about security issues.

Questions & Answers

1. What is the CVE of the original POODLE attack?

How to solve: The answer to this question can be found on Wikipedia. Answer: CVE-2014-3566

2. What version of VSFTPD contained the smiley face backdoor?

How to solve: The answer to this question can be found on Wikipedia. Answer: 2.3.4

3. What was the first 1.0.1 version of OpenSSL that was NOT vulnerable to heartbleed?

How to solve: The answer to this question can be found on Wikipedia. Answer: 1.0.1g

4. What was the original RFC number that described Telnet?

How to solve: The answer to this question can be found on Wikipedia. You will have to search another linked Wikipedia page for more information related to when Telnet was first developed. Answer: 15

5. How large (in bytes) was the SQL Slammer worm?

How to solve: The answer to this question can be found on Wikipedia. Answer: 376

6. Samy is my…

How to solve: The answer to this question can be found on Wikipedia. Answer: hero

Extension Activities

Topic: HTTP Headers

Objectives

Students will be able to find resources to understand different types of HTTP request headers.

Prompt

Solve these questions about HTTP headers.

Questions & Answers

1. What HTTP request header is used to denote what URI linked to the resource being requested?

Answer: referer *Note that the official specification for this header has “referrer” spelled incorrectly as “referer”

2. What HTTP request header is used to identify the client software that made the HTTP request?

Answer: user-agent

3. What HTTP request header is used to identify the acceptable content types that can be returned?

Answer: accept

Extension Activities

Topic: WHOIS

Objective

Students will be able to conduct a WHOIS query to learn publicly available information about a domain name.

Prompt

Conduct open source intelligence data collection about cityinthe.cloud. Answer the following questions as they relate to the cityinthe.cloud domain.

Questions & Answers

1. Who is the registrar of this domain?

Answer: Dynadot

2. On what day was this domain first registered?

Answer: 2016-02-16

3. What is this domain's registry domain ID?

Answer: D15CD1AC4DEB54207A5048A69B9FC0558-ARI

4. What is the Top-Level Domain (TLD) of this domain?

Answer: cloud

5. What organization manages the TLD used by cityinthe.cloud?

Answer: Aruba

Extension Activities

Topic: PGP Lookup

Objectives

Students will query a public key database to identify the types of information stored there.

Prompt

Individuals use PGP to securely encrypt their emails, can you find out more about the following PGP keys?

Questions & Answers

1. What is the key fingerprint for security@cpanel.net?

Answer: B6709B4CC6F42077F69841919521BEDCABD94DDF

2. What email address is associated with the key fingerprint 7A39A56B73D1E097D57435CFCDE2DE1DCB2077F2?

Answer: hx@liber8tion.cityinthe.cloud

3. On what date does the above key expire (in UTC)?

Answer: 2050-12-26

Extension Activities

Topic: SSL

Objectives

Students will use a browser in order to analyze a SSL certificate chain.

Prompt

Solve the following questions about the Cyber Skyline SSL certificate.

Note: If you see references to "BitDefender" in the process of solving this challenge, that means your BitDefender software is intercepting your SSL/TLS connection and will produce incorrect results.

Questions & Answers

1. Who is the issuer for Cyber Skyline's SSL certificate?

Possible Answers: sectigo, comodo

2. How many bits long is the SSL key?

Answer: 2048

3. How many certificates are in the certificate chain?

Answer: 3

Extension Activities

Topic: Barcode

Objective

Students will be able to use a barcode reader to identify hidden information.

Prompt

We intercepted a barcode we think might be hiding a flag. See if you can find it.

Questions & Answers

1. What format does the barcode use?

Possible Answers: code 39, code39, Code_39, USD-3, Code 3 of 9, Code 3/9, Alpha 39

2. What is the flag hidden in the barcode?

Answer: SKY-UZLU-5635

Extension Activities

Module: Cryptography

Topic: Number Bases

Objectives

Students will use tools to recognize and convert various number bases.

Prompt

Our analysts have obtained password dumps storing hacker passwords. After obtaining a few plaintext passwords, it appears that they are all encoded using different number bases.

Questions & Answers

Extension Activities

Topic: Shift

Objectives

Students will decode a Ceasar shift cipher.

Prompt

Our analysts have obtained password dumps storing hacker passwords. It seems to be using a pretty simple encryption scheme, see if you can crack them.

Questions & Answers

Extension Activities

Topic: @bash

Objective

Students will decode an atbash shift cipher.

Prompt

Our analysts have obtained password dumps storing hacker passwords. See if you can crack them.

Questions & Answers

Extension Activities

Topic: Beep

Objective

Students will recognize and decode morse code.

Prompt

Our analysts have intercepted an encoded message. See if you can decode it.

Questions & Answers

Extension Activities

Topic: Fencing

Objective

Students will recognize and decode a rail fence cipher.

Prompt

Our analysts have obtained encrypted messages. We saw hand-written notes that indicated the keys as being "3" and "5". See if you can crack them.

Questions & Answers

Topic: French

Objective

Students will decrypt a Vigenère cipher.

Prompt

Our analysts have obtained an encrypted message. We know that the key, qizkwcgqbs was used. See if you can crack them.

Questions & Answers

Extension Activities

Topic: RSA

Objective

Use an understanding of key encryption to break a weak implementation of RSA.

Prompt

Our analysts have obtained several artifacts from a message that was encrypted with RSA. We need you to decrypt the message and figure out what the hackers are up to.

n = 1079
e = 43
c = 996 894 379 631 894 82 379 852 631 677 677 194 893

Questions & Answers

1. What is the value of p (the smaller prime)?

Answer: 13

2. What is the value of q (the larger prime)

Answer: 83

3. What is the plaintext of the encrypted message?

Answer: SKY-KRYG-5530

Extension Activities

Module: Log Analysis

Topic: SSH

Objective

Students will analyze the contents of an SSH log to identify adversarial behavior.

Prompt

Analyze this SSH log file to answer the following questions.

Questions & Answers

1. What is the hostname of the ssh server that was compromised?

Answer: myraptor

Copy

Oct 11 10:12:00 myraptor sshd[29459]: Server listening on 0.0.0.0	port 22.

2. What was the first IP address to attack the server?

Answer: 169.139.243.218

Copy

Oct 11 10:12:25 myraptor sshd[29465]: Failed password for harvey from 169.139.243.218 port 57273	ssh2

3. What was the second IP address to attack the server?

Answer: 56.13.188.38

4. What was the third IP address to attack the server?

Answer: 30.167.206.91

5. Which user was targeted in the attack?

Answer: harvey

Copy

Oct 11 10:12:25 myraptor sshd[29465]: Failed password for harvey from 169.139.243.218 port 57273	ssh

6. From which IP address was the attacker able to successfully log in?

Answer: 30.167.206.91

Copy

Oct 11 10:36:59 myraptor sshd[30003]: Accepted password for harvey from 30.167.206.91 port 55326	ssh2

Extension Activities

Topic: Login

Objective

Students will use command line tools to analyze a custom application log format.

Prompt

Analyze a custom application login event log to help us understand user behavior.

Questions & Answers

1. How many total login attempts were made in this log?

How to solve: Get the line count of the log. (Reminder: at the end of the command, that is a lower case ‘L’ not a number 1)

cat login.log | wc -l

Answer: 6063

2. How many unique usernames appear in this log?

How to solve: Extract the third field (with the usernames) of the log, sort the usernames, get the unique usernames, and then get a line count of the number of unique usernames.

cat login.log | cut -f 3 | sort | uniq | wc -l

Answer: 1879

3. What is the username with the most login attempts?

How to solve: Extract the third field (with the usernames) of the log, sort the usernames, get a frequency count of each unique username, and then sort the unique usernames by frequency.

cat login.log | cut -f 3 | sort | uniq -c |sort -n

Answer: ntory

4. How many attempts were made for the username with the most login attempts?

cat login.log | cut -f 3 | sort | uniq -c |sort -n

Answer: 124

5. What is the date with the most login attempts?

How to solve: Extract the first field (with the date+time) of the log, extract just the date, sort the dates, get a frequency count of each unique date, and then sort the unique dates by frequency.

cat login.log | cut -f 1 | cut -d " " -f 1 | sort | uniq -c | sort -n

Answer: 2011-03-23

6. What is the username that had logins from the most unique IP addresses?

How to solve: Extract the second field (with the IP address) and third field (with the username) of the log, sort the IP/username pairs, get the unique IP/username pairs, then extract just the usernames from each pair, sort the usernames, get a frequency count of how many unique pairs each username has, and then sort by frequency.

cat login.log | cut -f 2,3 | sort | uniq | cut -f 2 | sort | uniq -c | sort -n

Answer: wlfla0190

Extension Activities

Topic: VSFTPD

Objective

Students will analyze a VSFTPD log file.

Prompt

Analyze a VSFTPD log file that we obtained.

Questions & Answers

1. What IP address did "ftpuser" first log in from?

How to solve: Search for any entries that include “ftpuser”. One of these lines should include an IP address. cat vsftpd.log | grep ftpuser

Answer: 10.0.0.123

2. What is the first directory that ftpuser created?

cat vsftpd.log | grep ftpuser | grep -i mkdir | head -n 1

Answer: TreeSizeFree

3. What is the last directory that ftpuser created?

cat vsftpd.log | grep ftpuser | grep -i mkdir | tail -n 1

Answer: 110D300S

4. What file extension was the most used by ftpuser?

How to solve: Search for successful file upload entries from ftpuser, extract the file extension for those uploads, and then get the frequency count for each unique file extension

cat vsftpd.log | grep ftpuser | grep 'OK UPLOAD' | awk -F ',' '{print $2 }' | awk -F "." '{print $2}' | sort | uniq -c | sort

Possible Answers: jpeg, jpg, Joint Photographic Experts Group

5. What is the username of the other user in this log?

cat vsftpd.log | awk '{print $8}' | sort | uniq

Answer: jimmy

6. What IP address did this other user log in from?

cat vsftpd.log | grep jimmy

Answer: 10.0.0.214

7. How many total bytes did this other user upload?

How to solve: Search for successful file upload entries from jimmy, extract the number of bytes transferred, then sum the bytes cat vsftpd.log | grep jimmy | grep 'OK UPLOAD' | awk -F ',' '{print $3 }' | awk '{s+=$1} END {print s}’

Answer: 105750628 bytes

8. How many total bytes did ftpuser upload?

cat vsftpd.log | grep ftpuser | grep 'OK UPLOAD' | awk -F ',' '{print $3 }' | awk '{s+=$1} END {print s}’

Answer: 13980839165 bytes

9. How many total bytes did ftpuser download?

cat vsftpd.log | grep ftpuser | grep 'OK DOWNLOAD' | awk -F ',' '{print $3 }' | awk '{s+=$1} END {print s}’

Answer: 6008032 bytes

10. Identify the IP address of the suspicious login (the login with no subsequent activity).

How to solve: Search for all of the successful login attempts, extract the IP address used to log in, then sort and unique the IP addresses to identify IP addresses for manual inspection

cat vsftpd.log | grep 'OK LOGIN' | awk -F '"' '{print $2 }' | sort | uniq

Answer: 10.3.0.6

Extension Activities

Topic: Nginx

Objective

Students will analyze an nginx access log.

Prompt

Analyze an nginx access log and answer questions about what happened.

Questions & Answers

1. How many different IP addresses reached the server?

Answer: 47

2. How many requests yielded a 200 code?

How to solve: Extract the third field after double quotes as the delimiter (which includes the HTTP codes), sort the codes, get the unique values with a count of the occurrences of each. Optional: sort in descending numeric order.

cat access.log | cut -d '"' -f3 | cut -d ' ' -f2 | sort | uniq -c | sort -rn

Answer: 19

3. How many requests yielded a 400 code?

cat access.log | cut -d '"' -f3 | cut -d ' ' -f2 | sort | uniq -c | sort -rn

Answer: 38

4. What IP address rang at the doorbell?

cat access.log | grep "bell"

Answer: 186.64.69.141

5. What version of the Googlebot visited the website?

cat access.log | grep "Googlebot"

Answer: 2.1

6. Which IP address attempted to exploit the shellshock vulnerability?

How to solve: Search online for details about the Shellshock vulnerability. You should be able to find that the presence of this sequence of characters () { :; }; is an indication of an attempted exploitation of this vulnerability. With this knowledge, search the log for any lines with that sequence of characters.

cat access.log | grep '() { :; };'

Answer: 61.161.130.241

7. What was the most popular version of Firefox used for browsing the website?

How to solve: Search the log for all lines that contain “Firefox” and the following characters which make up the version number, sort those values, and then get a unique count.

cat access.log | grep -o "Firefox/.*" | sort | uniq -c

Answer: Firefox/31.0

8. What is the most common HTTP method used?

How to solve: Extract the 6th field (with the HTTP method), sort, get the unique values with a count of the occurrences of each value, and then sort in descending numeric order.

cat access.log | awk -F " " '{print $6}' | sort | uniq -c | sort -rn

Answer: GET

Incorrect: POST, PUT, HEAD, DELETE, CONNECT

9. What is the second most common HTTP method used?

cat access.log | awk -F " " '{print $6}' | sort | uniq -c | sort -rn

Answer: CONNECT

Incorrect: GET, POST, PUT, HEAD, DELETE

10. How many requests were for \x04\x01\x00P\xC6\xCE\x0Eu0\x00?

Note that that command requires two backslashes for each original backslash to perform a proper escape sequence for the backslash.

cat access.log | grep '\\x04\\x01\\x00P\\xC6\\xCE\\x0Eu0\\x00' | wc -l

Answer: 6

Extension Activities

Topic: History

Objective

Students will use SQL commands to analyze a SQlite database.

Prompt

Analyze a Firefox SQlite history database and answer questions about what happened. It you are not familiar with SQL you may want to learn more about SQL here: https://www.tutorialrepublic.com/sql-tutorial/

Questions & Answers

1. What did the user search for on craigslist?

Answer: bitcoin

2. What was the current price (USD) of bitcoin when the user was browsing?

Answer: $239.50

3. What Bitcoin exchange did the user log in to?

Answer: Coinbase

4. What is the email that was used to log into the exchange?

Answer: b1gbird@gmail.com

5. What was the ID of the Bitcoin transaction that the user looked at?

Answer: 5274cfba585a4b5681527a37f95c76340428916bb7480cef6c545f0a28dcd2d7 blockchain.info

6. What was the total BTC value of all the inputs of the Bitcoin transaction?

Answer: 0.22616302

7. Which Bitcoin address received the majority of the Bitcoin in the transaction?

Answer: 18z6bTFjxkXCmhfp8YBetR2wgmoVjXGJZz

Extension Activities

Topic: Squid

Objective

Students will analyze a Squid proxy log.

Prompt

Analyze this Squid proxy log to answer the following questions.

Questions & Answers

1. In what year was this log saved?

How to solve: Take any of the Epoch timestamps and convert them into a human-readable date. An online tool, such as Epoch Converter, can be used to do this.

Answer: 2010

2. How many milliseconds did the fastest request take?

How to solve: Extract the second field (the response time) and then sort the results numerically

cat squid_access.log | awk '{print $2}' | sort -n

Answer: 5

3. How many milliseconds did the longest request take?

How to solve: Same as the question above.

cat squid_access.log | awk '{print $2}' | sort -n

Answer: 41762

4. How many different IP addresses did the proxy service in this log?

How to solve: Extract the third field (the IP address of the proxy client), sort, get the unique values, and then get the line count.

cat squid_access.log | awk '{print $3}' | sort | uniq | wc -l

Answer: 4

5. How many GET requests were made?

How to solve: Extract the 6th field (the HTTP Request type), sort, and then get the unique values with a count of their occurrences. cat squid_access.log | awk '{print $6}' | sort | uniq –c

Answer: 35

6. How many POST requests were made?

Answer: 78

7. What company created the antivirus used on the host at 192.168.0.224?

How to solve: The name of the company is found within the URLs of the requests made 192.168.0.224 . cat squid_access.log | grep "192.168.0.224"

Answer: Symantec

8. What URL is used to download an antivirus update?

How to solve: Use the command from the question above and then find the URL that includes “virus” and “definitions”

Answer: http://liveupdate.symantecliveupdate.com/streaming/norton$202009$20streaming$20virus$20definitions_1.0_symalllanguages_livetri.zip

Extension Activities

Topic: Log Payments

Objective

Students will analyze a SOAP log using the command line and a spreadsheet editor.

Prompt

A payment transaction log was compromised in a data breach. Help us determine what information was stolen.

Questions & Answers

1. How many transactions are contained in the log?

How to solve: Count the number of lines that start with PPAPIService: Request:

Answer: 192

2. What is the transaction ID of the largest purchase made in the log?

Answer: 3a4da8c8-6934-4655-9ec5-335ab4540a2b

3. Which state made the greatest number of purchases?

Answer: massachusetts Incorrect: maryland

Extension Activities

Topic: Custom File Format

Objective

Students will parse a custom log format to extract meaningful information.

Prompt

We need to analyze a custom log format that we use to monitor data transfers on a secure network. Unfortunately, the parser was not committed to our code repository, but we do have a copy of the file format spec. See if you can use it and help us answer questions about the log file. Provide all date/timestamps as UTC.

Questions & Answers

1. What is the hostname of the server?

How to Solve: Calculate the length of the hostname, which is represented as a 4-byte integer at offset 13. Use this cyberchef recipe to calculate the length of the hostname, which is 14.

Extract the hostname, which is an ASCII string of length 14 at offset 17. Use this cyberchef recipe to extract the hostname.

Answer: sky-server-711

2. What is the plaintext flag in the log file?

How to Solve: Calculate the length of the flag, which is represented as a 4-byte integer at offset 31. Use this cyberchef recipe to calculate the length of the flag, which is 20.

Extract the flag, which is an ASCII string of length 20 at offset 35. Then, perform a base64 decode. Use this cyberchef recipe to extract the flag.

Answer: SKY-PARS-7325

3. On what date was the file created (in UTC)?

How to Solve: The date is a 4-byte timestamp at offset 9. Use this cyberchef recipe to extract the timestamp.

Answer: 2018-03-03

4. How many entries are in the log file?

How to Solve: The number of entries is a 4-byte integer at offset 55. Use this cyberchef recipe to extract the number of entries.

Answer: 161 or 162

5. How many total transferred bytes were recorded in the log?

How to Solve: The entries are each 16-bytes long starting at offset 59. The number of bytes transferred for each entry is a 4-byte integer that is at offset 12 from the start of each entry. You can use this cyberchef recipe to calculate the total transferred bytes. This recipe extracts the bytes for the entries, splits the data into 16-byte lines (one line per entry), extracts just the number of bytes transferred as an integer value, and then sums the total amounts.

Answer: 811167

6. How many unique IP addresses (both senders and receivers) are recorded?

How to Solve: The entries are each 16-bytes long starting at offset 59. The source and destination IP addresses are each a 4-byte integers at are at offsets 0 and 4 from the start of each entry. You can use this cyberchef recipe to calculate the number of unique IP addresses. This recipe extracts the bytes for the entries, splits the data into 16-byte lines (one line per entry), extracts the source + destination IP addresses, splits those into 4-byte lines (one line per IP address), converts each line into a human-readable IP addresses, and then gets a count of the number of unique IP addresses.

Answer: 13

7. Which IP address sent the most amount of data?

How to Solve: Use awk to parse the human-readable log.

Copy

awk '{sums[$1]+=$4} END {for (ip in sums) print sums[ip], ip}' merged.log  | sort -n

Create a hashtable where the keys are the source IP addresses (column 1), sum the number of bytes transferred (column 4) for each source IP address, print the result, and then sort by the most bytes transferred.

Answer: 229.212.21.212

8. How many total bytes were sent by the above IP address that sent the most amount of data?

Answer: 145048

9. What was the busiest day (day with the most bytes transferred)?

How to Solve:

Copy

awk '{sums[$3]+=$4} END {for (date in sums) print sums[date], date}' merged.log  | sort -n

Answer: 2018-03-23

Module: Network Traffic Analysis

Topic: DNS

Objectives

Students will analyze a network packet capture to communicate an understanding of DNS.

Prompt

DNS is what enables us to access much of the internet without remembering IP addresses, analyze the network packet capture to understand more about DNS.

You can read this guide to learn more about computer networking.

Questions & Answers

1. What is the type of the DNS query requested?

Answer: AXFR

2. What domain was requested?

Answer: etas.com

3. How many items were in the response?

Answer: 4

4. What is the TTL for all of the DNS records?

Answer: 3600

5. What is the IP address for the "welcome" subdomain?

Answer: 1.1.1.1

Extension Activities

Topic: FTP Traffic

Objective

Students will analyze a network packet capture to communicate an understanding of FTP traffic.

Prompt

We found some interesting FTP traffic, analyze the network packet capture to identify what was transferred.

You can read this guide to learn more about computer networking.

Questions & Answers

1. What was the first username:password combination attempt made to log in to the server? ex. 'user:password'

Possible answers: user1/cyberskyline, user1:cyberskyline

2. What software is the FTP server running? (Name and version)?

Answer: FileZillaServer0.9.53

3. What is the first username:password combination that allows for successful authentication?

Possible answers: user1/metropolis, user1:metropolis

4. What is the first command the user executes on the ftp server?

Answer: dir, list

5. What file is deleted from the ftp server?

Answer: bank.cap

6. What file is uploaded to the ftp server?

Answer: compcodes.zip

7. What is the filesize (in bytes) of the uploaded file?

Possible Answer:

1. 3303628E25D43BE4E11CC8878C5C5878
2. 28183
3. 28183 bytes
8. What file does the anonymous user download?

Answer: compcodes.zip

Extension Activities

Topic: HTTP

Objective

Students will analyze a network packet capture to communicate an understanding of HTTP.

Prompt

HTTP is how we're sending you this message, analyze the provided capture to answer the following questions about a HTTP download.

You can read this guide to learn more about computer networking.

Questions & Answers

1. What Linux tool was used to execute a file download?

How to solve: Apply thehttp.request filter and looking at the HTTP dissection. The “User-Agent” field in the HTTP portion of the packet is used to identify the software making the HTTP request.

Answer: wget

2. What is the name of the web server software that handled the request?

How to solve: Apply the http.response filter and looking at the HTTP packet dissection. The “Server” field in the HTTP portion of the packet is used to identify the software responding to the HTTP request.

Answer: nginx

3. What IP address initiated request?

How to solve: Apply the http.response filter and looking at the HTTP packet dissection. The Destination is the IP address that initiated the request.

Answer: 192.168.1.140

4. What is the IP address of the server?

How to solve: Apply the http.response filter and looking at the HTTP packet dissection. The Source is the IP address of the server.

Answer: 174.143.213.184

5. What is the MD5 sum of the file downloaded?

How to solve: Copy data into Cyberchef and add the following operations to the Recipe: Ensure data is in Hex, Determine file type, Calculate MD5 sum.

Answer: 966007c476e0c200fba8b28b250a6379

Extension Activities

Topic: Telnet

Objective

Students will analyze a network packet capture to communicate an understanding of Telnet.

Prompt

Telnet is an older protocol that allowed an interactive text-oriented communication with remote systems, use the provided capture to answer the following questions about telnet.

Questions & Answers

1. What is the username that was used to log in?

Answer: test

2. What is the password that was used to log in?

Answer: capture

3. What command was executed once the user was authenticated?

Answer: uname

4. In what year was this capture created?

Answer: 2011

5. What is the hostname of the machine that was logged in to?

Answer: cm4116

6. What CPU architecture does the remote machine use?

Answer: armv4tl

Extension Activities

Topic: Packet Dissection

Objectives

Students will analyze a portion of a packet to identify how IP packet headers are structured.

Prompt

Dissect an IP packet header to understand how the protocol works.

You can read this guide to learn more about computer networking.

Data

Questions & Answers

1. What is the header checksum in hexadecimal representation?

Answer: 4F93

2. What is the TTL of the packet?

Answer: 64

3. What is the source IP address?

Answer: 192.168.128.128

4. What is the destination IP address?

Answer: 159.203.96.154

Extension Activities

Topic: Decrypt

Objective

Students will decrypt a packet capture with an SSL key log file to analyze encrypted HTTPS traffic.

Prompt

The 'S' in HTTPS stands for secure and it uses the TLS/SSL protocol to achieve its security. Let's decrypt this traffic to find the hidden flag.

Questions & Answers

1. What Cipher Suite was chosen by the secure socket server?

Answer: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

2. What is the domain covered by the SSL key?

Answer: tomsvacations.com

3. What is the flag transferred over HTTPS?

Answer: SKY-LADN-1435

Topic: Pandora

Objective

Students will analyze a packet capture to reverse-engineer a custom network protocol and extract data.

Prompt

The hackers have created their own custom protocol for private communication. Luckily, our analysts have managed to obtain the documentation describing the protocol. Use the provided capture to answer the following questions about a custom protocol hackers have created.

Questions & Answers

Topic: CAN Bus

Objective

Students will audit a CAN Bus packet capture to analyze vehicle network traffic and extract speed data.

Prompt

Ohm Motors has requested assistance with conducting a security audit on their CAN Bus protocol. They have provided a small code snippet. Use this to help you complete this report.

Questions & Answers

1. How many unique CAN Bus IDs are present in this capture?

How to Solve: Export the CAN bus IDs and data as a CSV file, then use a spreadsheet editor to calculate the number of unique CAN bus ID values.

Answer: 36

2. How many speed update messages are present in this capture?

How to Solve: Use a spreadsheet editor to count the number of times calculate the number of lines that contain 589 in the ID column.

Answer: 352

3. What is the maximum speed, in mph, that this vehicle reached in the capture?

How to Solve: Filter the data to only include lines that contain 589 in the ID column, then write a script that will ingest the data column of the CSV and perform the same calculations the code snippet to calculate the maximum speed.

Possible Answers: 20.13, or 19.88, or 19.89 (differences due to rounding throughout vs at the end)

Module: Password Cracking

Topic: Rockyou

Objective

Identify hash types in order to crack hashes using a common wordlist.

Prompt

Our analysts have obtained password dumps storing hacker passwords. After obtaining a few plaintext passwords, it appears that they overlap with the passwords from the Rockyou breach.

Questions & Answers

1. 68a96446a5afb4ab69a2d15091771e39

Answer: emilybffl

2. ec5f0b1826389df8622133014e88afde

Answer: ryjd1982

3. 32e5f63b189b78dccf0b97ac41f0d228

Answer: joybird1

4. 2233287f476ba63323e60addca1f6b64

Answer: kirkles

5. 2233287f476ba63323e60addca1f6b64

Answer: ddmack

Topic: Mask

Objective

Use a mask attack to recover the plaintext of a password.

Prompt

Our analysts have obtained password dumps storing hacker passwords. After obtaining a few plaintext passwords, it appears that they are all in the format: "SKY-HQNT-" followed by 4 digits. Can you crack them?

Questions & Answers

1. 71b816fe0b7b763d889ecc227eab400a

Answer: SKY-HQNT-8765

2. 674291170dffcf620bda2a604a6820ea

Answer: SKY-HQNT-7659

3. 06f03267f31077d2c4b5c728472070ae

Answer: SKY-HQNT-6598

4. d866f4b3b34b598375149fb7661113ab

Answer: SKY-HQNT-5981

5. d9053951a8d1c15254b46ec9fc974a6b

Answer: SKY-HQNT-9816

Topic: Pokemon

Objective

Create a wordlist to crack password candidates.

Prompt

Our analysts have obtained password dumps storing hacker passwords. After obtaining a few plaintext passwords, it appears that they are based on Pokémon.

Questions & Answers

1. a532443f3e04a9e00295a8cd2a75e080

Answer:  golduck

2. 54c10b9736b70e75c6e505f340b6e2f1

Answer: basculin

3. b8a24794813a47521b4be55747e0665a

Answer:  rotom

4. 83b020b0a7b3c353e1c11b1647b53cda

Answer: celebi

5. 999cae1e22fe69d89d6f56e3050f18cb

Answer: goldeen

Topic: Windows

Objective

Use ophcrack to crack Windows NTLM passwords.

Prompt

Our analysts have obtained Windows password dumps storing hacker passwords. Can you crack them?

Questions & Answers

1. 21259DD63B980471AAD3B435B51404EE:1E43E37B818AB5EDB066EB58CCDC1823

Answer:  starf0x

2. 11CB3F697332AE4C4A3B108F3FA6CB6D:13B29964CC2480B4EF454C59562E675C

Answer: P@ssword

3. 65711C079DC4CD3CC2265B23734E0DAC:47F747C5190DC0F0B921AA4A07F06285

Answer:  footba11

4. FBBDA33FC12E83FB0C240E84A183686E:DDE9DC6E34E2E6E11EF9E51C6B27ED96

Answer: 1trustno1

5. 21C4E7C2EFE8E8D1C00B70065ED76AA7:A7A0F9AFD4A78F531A1CF4C42E531BBF

Answer:  ectoplasm32

6. E85B4B634711A266AAD3B435B51404EE:FD134459FE4D3A6DB4034C4E52403F16

Answer: "=Cxu&L

7. BA756FB317B622DBAAD3B435B51404EE:C8405270B10B13AE8A24612BB853567A

Answer:  yhM^GK7

8. 199C926FA387EAB7AAD3B435B51404EE:F196F77BF8BB15781BA8364C649C5FD4

Answer: 58?-<C6

9. FE4AACAAAD7D986AAAD3B435B51404EE:3928E16F614E2316CA51C336FA5B3011

Answer:  $xEn@=y

10. 3613F7EC15407F56AAD3B435B51404EE:C82E164316183AA3AF3EA6BAA642A237

Answer: ^B7e3D;

Topic: PDF Cracking

Objective

Recover a password from a PDF file in order to open the file.

Prompt

We have captured an encrypted pdf from a hacker's FTP server. Decrypt it and find out what you can.

Questions & Answers

1. What is the password used to encrypt the pdf?

Answer: keanureeves2008

2. What is the flag in the PDF?

Answer: SKY-KANU-5902

Topic: Law & Order

Objective

Create a wordlist of episode names and use a mask attack to crack passwords.

Prompt

Our analysts have obtained password dumps storing hacker passwords. It appears that they are based off of Law and Order: SVU episodes and end in 2 digits.

Questions & Answers

1. 6475c851b56004eb96ab1404252c3a34

Answer: hooked37

2. abe6591e06aafc3cf1b0783b120f685e

Answer: manhunt74

3. 1e1612db8bdeebc7e8d56f8f30b39456

Answer:  philadelphia53

4. 3dd9dd0e352df4433aadf2273e269287

Answer: resilience05

5. 08038f679de74982bfb9bac43d46271a

Answer:  unorthodox12

Topic: Kali Linux

Objective

Crack a yescrypt password hash included in Kali Linux.

Prompt

We have obtained /etc/shadow from a Kali Linux machine. Help us obtain the password, we think this might be a using a password from the Rockyou wordlist.

Questions & Answers

hollie:$y$j9T$/WzixhAsn8sdXhCquYzh01$KZlio78LilItobsx/17ecFf1e2SbsduhP1sZEWuHrL4:18934:0:99999:7:::

1. What is the username of the only user account with a password?

Answer: hollie

2. On what date was the user's password last changed?

Answer: 2021-11-03

3. What is the salt used to secure the user's password?

Answer: /WzixhAsn8sdXhCquYzh01

4. What is the hash digest of the user's password?

Answer: KZlio78LilItobsx/17ecFf1e2SbsduhP1sZEWuHrL4

5. What is the plaintext password of the user's password?

Answer: hollie03

Module: Forensics

Topic: Version Control

Objectives

Use Git to examine file system metadata and conduct artifact analysis.

Prompt

One of our employee's computers was compromised and we saw this backup file leave the network, but we couldn't find anything other than a simple README.md file in it. Help us found out what information the hackers got.

Questions & Answers

1. What is the email address of the employee who was compromised?

Answer: gpeterson@mpd.hacknet.cityinthe.cloud

2. Each employee is assigned a flag. What is the flag that was compromised?

Answer: SKY-LRHX-4910

3. Greg thinks that he may have had additional account credentials that were compromised. What's the name of the service provider for that other compromised account?

Answer: facebook

4. What was the password on that compromised account?

Answer: waffles85

Topic: PDF Examination

Objective

Use a PDF editor to examine file metadata and conduct artifact analysis.

Prompt

Our analysts managed to get hold of a document that we believe has a flag on it. Can you recover it?

Questions & Answers

1. What is the name of the program that exported this PDF file?

Answer: Photoshop

2. What PDF version is this file?

Answer: 1.7

3. What software was used to redact the file and insert a watermark?

Answer: pdftron

4. What is the flag?

Answer: SKY-PDRD-2390

Topic: File Carving

Objective

Use a hex editor or a forensics tool to perform file signature analysis and recover hidden files.

Prompt

The security team has found a rather strange file exiting the network, we're not sure if it's containing any sensitive information. Help us identify what's in it.

Questions & Answers

1. This file initially looks like something green, what's the file format of this green file?

Answer: PNG or portable network graphics

Incorrect: JPG, JPEG, BMP, GIF

2. How many files can be extracted from the binary blob?

Answer: 6

3. What is the hidden flag in the file?

Answer: SKY-RWCI-4291

Topic: Magic Bytes

Objective

Use a hex editor or a forensics tool to perform a file signature analysis and repair the file.

Prompt

This file appears to be changed in some way. Can you recover the original?

(You can use either CyberChef or a tool of your choosing to complete this challenge)

Questions & Answers

1. What is the original file type?

Answer: PNG, png, or Portable Network Graphics

2. What is the flag?

Answer: SKY-DSFG-5792

Topic: Doctor

Objective

Use a hex editor or a forensics tool to perform file signature analysis and recover hidden files from a Microsoft Word Doc.

Prompt

We think this document is hiding something. Can you find what is hidden?

Questions & Answers

1. What is the name of the hidden file containing the flag?

Answers: image0.png, image0

2. What is the flag?

Answer: SKY-RATL-8439

Topic: The Book

Objective

Analyze and search through a live Windows memory dump to extract the SQL database from memory.

Prompt

We have obtained a live system memory dump from a hacker's computer before it fried itself. The hacker was looking at a suspicious document. Can you retrieve the lost information?

Questions & Answers

1. What operating system was this dump taken from?

Answer: Windows

2. What is the name of the computer?

Answer: DESKTOP-OT97GG3

3. What is the name of the user that was logged in?

Answer: liber8hacker

4. What is the full filepath and file of the file in interest?

Answer: Users\liber8hacker\Desktop\black_book.db

5. What is the real name of "cloud"?

Answer: Gloria Hampton

6. What is the password of the currently logged in user?

Answer: avatar2

Module: Scanning & Reconnaissance

Topic: Dig

Objective

Use DNS services to gain information about an organization's internet resources.

Prompt

You've been tasked to help the newly launched company, Fortaigan, audit its DNS records.

To complete the tasks, use the device with the resolver hostname in the provided terminal as the DNS resolver to query for fortaigan.net.

Questions & Answers

1. What is the IPv4 address for fortaigan.net?

Answer: 104.231.72.5

2. How many mail servers does fortaigan.net have?

Answer: 3

3. What's the name of the mail server that takes the first priority?

Answer: maila2.fortaigan.net

4. What is the IPv4 address of the name server record for fortaigan.net?

Answer: 104.231.73.10

5. What's the full name of the responsible person at fortaigan.net?

Answer: Leo Danza

6. What is the text flag found in the DNS records?

Answer: SKY-PZUV-5091

7. What is the priority number given to the SIP service using the TCP protocol on fortaigan.net?

Answer: 0

8. What is the IPv4 address of the machine that's running the SIP service for fortaigan.net?

Answer: 104.231.74.3

Topic: NMAP

Objective

Scan a target host using Nmap to identify open TCP and UDP ports.

Prompt

Test your understanding of port scanning by scanning the website and answering these questions.

Questions & Answers

1. What is the lowest open port on the system?

Answer: 7

2. What is the second lowest open port on the system?

Answer: 13

3. What is the third lowest open port on the system?

Answer: 37

4. What is the lowest UDP port on the system?

Answer: 7

5. What software is being run on port 16080?

Answer: nginx

Topic: Git

Objective

Investigate a Git repository's history to uncover hidden flags and metadata.

Prompt

Analyze a git project and find some hidden flags. You can try to clone the repository but that might not work for you. If not, you'll need to find a way around it.

Questions & Answers

1. What is the display name of the author of this git project?

Answer: Cyber Cyber

2. What is the short commit hash (first 8 characters) of the initial commit?

Answer: F9714EDD

3. What is flag #1?

Answer: SKY-HSNO-2303

4. What is flag #2?

Answer: SKY-OZNW-3730

5. What is flag #3?

Answer: SKY-CCXL-4067

6. What is flag #4?

Answer: SKY-IRRK-9672

7. What is flag #5?

Answer: SKY-DKIT-9801

Topic: Net Track

Objective

Communicate with a text-based service using netcat/telnet.

Prompt

Can you interact with the strange server and see what information you can extract?

Questions & Answers

1. What is the name and version of the software?

Answer: RadicalShell v9

2. What is the flag?

Answer: SKY-NCAT-3071

3. What is the size of the largest file in bytes?

Answer: 40 bytes

Topic: Metadata

Objectives

Scan an AWS EC2 Metadata Service to extract information about the instance.

Prompt

We have found what appears to be a server displaying metadata about a cloud service. Can you find out more information?

Questions & Answers

1. What availability zone is this instance hosted in?

Answer: us-west-2a

2. What is the security credentials role named?

Answer: liber8-role

3. What is the instance type being used?

Answer: c6g.16xlarge

4. What is the operating system name and version number?

Answer: Ubuntu 16.04

5. What is the flag?

Answer: SKY-AWSM-1570

Module: Enumeration & Exploitation

Topic: Bytes

Objective

Students will analyze a Python script to identify the value that will return ‘True’ from the program.

Prompt

Determine the secret password that will validate successfully against the verify function. We've been having trouble getting it to run, but we saw it running properly on a different system. The code seems to be a bit old, maybe you can find the right environment/configuration to get it to run.

Questions & Answers

1. What language is this program written in?

Answer: Python

2. What is the password that will successfully pass the verify function?

Answer: 534b592d484558482d35363830

Extension Activities

Topic: Python 1

Objective

Students will analyze a Python script to calculate an input that will authenticate with the program.

Prompt

We have created a python script for you to break into as training. See if you can figure out a password that will authenticate with the program. Note: The password cannot contain special characters.

#!/usr/bin/python
import sys

def main():
if len(sys.argv) != 2:
print("Invalid args")
return
password = sys.argv[1]
builder = 0
for c in password:
builder += ord(c)
if builder == 1000 and len(password) == 10 and ord(password[1]) == 83:
print("correct")
else:
print("incorrect")

if **name** == "**main**":
main()

Questions & Answers

1. What is a secret key that will pass validation?

Possible Answer: mSeeeeeeee (multiple answers exist)

Extension Activities

Topic: Python 2

Objective

Students will analyze a compiled Python script to calculate an input that will authenticate with the program.

Prompt

We have created a python script for you to break into as training. See if you can figure out a password that will authenticate with the program.

Questions & Answers

1. What is a secret key that will pass validation?

Possible Answers:

1. mysupersecretpassword
2. m_s[persecreZpass]ord
3. m_supersecretpassword

Incorrect: M_supersecretpassword

Extension Activities

Topic: Python 3

Objective

Students will analyze a Python script to calculate an input that will authenticate with the program.

Prompt

We have created a python script for you to break into as training. See if you can figure out a password that will authenticate with the program.

Questions & Answers

1. What is an input to this program that will result in a correct validation?

Possible Answers:

1. N>>>>>>>>>>
2. NOTC0FFEE

Incorrect:

3. NAAAAAAAANZ

Extension Activities

Topic: Timebomb

Objective

Students will decompile a .class file and extract its original source code to understand its logic.

Prompt

Reverse engineer a program to find out when it activates.

Questions & Answers

1. What programming language is the program written in?

Answer: java Incorrect: JavaScript

2. What exit code does the program exit with when it is not time?

Answer: 10

3. What time (in UTC) does the software go "Boom"?

Answer: 2022-07-17 13:13 (also accepted: 2022-07-17 13:12) Incorrect: 2022/07/17 09:12

Topic: Not Affine

Objective

Students will perform code analysis on C source code to reverse a series of bitwise operations.

Prompt

Math is often tricky and hard, which is why we make computers do math for us. That being said, it's important to know how to solve the math when the bidding is essential.

Questions & Answers

1. What are the dimensions of the transform_matrix variable?

Answer: 3x3

2. What is the integer value stored at transform_matrix[0][1]?

Answer: 3

3. What is the header file that provides functions like isdigit and isalpha?

Answer: ctype.h

4. What is the hex value assigned to the letter_r_xor_key variable?

Answer: 1A

5. A matrix change is applied to the letters at indices 0 to 2. What are these three letters in the target_string?

Answer: EOC

6. What is the input that correctly works for this code?

Answer: SKY-MMTR-4555

Topic: Binary 1

Objective

Use a disassembler (like ghidra) to exploit a compiled binary.

Prompt

We need to break into a program that the hackers have created. You will need to provide the identifier, 7074, as the only argument to the program.

Questions & Answers

1. What is the flag hidden in the program?

Answer: NCL-EZOF-4024

Topic: Binary 2

Objective

Students will use a debugger to exploit a compiled binary.

Prompt

We need to break into a program that the hackers have created. You will need to provide the identifier, 4930, as the only argument to the program.

Questions & Answers

1. What is the flag hidden in the program?

Answer: NCL-FYOF-0044

Module: Web Application Exploitation

Topic: egov

Objective

Students will utilize web cookies to check the permission level of the user.

Prompt

Conduct a security audit on the egov login panel.

Note: This challenge is limited to HTTPS in scope, please do not attack any other ports on this server.

Questions & Answers

1. What is the flag obtained from logging in?

Answer: ⚠️ The flag is randomly generated so the correct flag for you will be different.

Extension Activities

Topic: Never Winter Bank

Objective

Analyze Java script code on a website to find an exploit to utilize.

Prompt

You have been hired to run a pentest on this bank's old out of date system. Can you find the vulnerability in the code and drain this user's account?

Questions & Answers

1. What is the path of the leaked file?

Answer: /dev/rel.js

2. What is the flag?

Answer: ⚠️ The flag is randomized, follow the guide to capture the flag

Extension Activities

Topic: Cloud Marketing

Objectives

Students will use knowledge of penetration testing principles to identify a directory traversal vulnerability.

Prompt

A hot new firm just opened up to help organizations with digital marketing, but it seems like they need some help with security. Identify the security vulnerability and demonstrate to the firm that their web server is not securely configured by proving that you can extract the contents of /etc/flag from their web server.

Note: Your scope is limited to HTTPS & you may not use automated bruteforce tools for this challenge.

Questions & Answers

1. How many people are listed on their firm's team page?

Answer: 7

2. What path does the firm not want search engines to index?

Answer: /wp-admin

3. What is the value of the flag?

Answer: ⚠️ The flag is randomized, follow the guide to capture the flag

4. What is the common name of the vulnerability used to retrieve the flag?

Accepted Answers: Directory traversal, path traversal, or folder traversal

Topic: Metro Lottery

Objective

Analyze Javascript on a webpage in order to exploit trusted client input.

Prompt

Players of the Metropolis online lottery are able to get a win percentage of more than 80% resulting in more people winning than should be statistically possible. Conduct a security audit to determine the cause.

Note: This challenge is limited to HTTPS in scope, please do not attack any other ports on this server and do not brute force attack this web server.

Questions & Answers

1. What is the flag obtained after winning the lottery?

Answer: ⚠️ The flag is randomly generated so the correct flag for you will be different.

Extension Activities

Topic: Todo

Objectives

Use knowledge of penetration testing and JavaScript cookies in order to expose a cross-site scripting vulnerability.

Prompt

We've uncovered a todo list made by the nefarious Liber8tion group. There seems to be a flag hidden in the admin user's cookies. The admin user periodically checks the todo list to make sure employees are actively working, can you extract the flag from them? Note: Your scope is limited to HTTPS & you may not use automated brute-force tools for this challenge.

Questions & Answers

1. What is the name of the vulnerability used to get the flag?

Answer: Cross site scripting, XSS

2. What is the flag found in the admin user's cookies?

Answer: SKY-XSSV-8390

3. What is the User Agent of the account the flag was extracted from?

Answer: Liber8-XSS-Bot

Topic: Leek

Objectives

Students will use penetration testing knowledge to identify and exploit a type confusion vulnerability.

Prompt

Our favorite grocery store allegedly has a vulnerability, can you replicate it?

Questions & Answers

1. What is the flag?

Answer: ⚠️The flag is randomly generated so the correct flag for you will be different.

Topic: Metro Clinic

Objective

Craft SQL statements in order to exploit a vulnerability in an organization’s database.

Prompt

Conduct a security audit on the city's medical directory system.

Note: This challenge is limited to HTTPS in scope, please do not attack any other ports on this server and do not brute force attack this web server.

Questions & Answers

1. What is the name of the only Orthopedist?

Answer: Tracy Gill

2. What is Katie Cain’s profession?

Answer: Neurologist

3. How many medical professionals can be found in this registry?

Answer: 11

4. What is the name of the person who has a password of "greyblob"?

Answer: Kim Jenkins

5. What is Mike Torres' password?

Answer: SKY-VJDT-4472

Extension Activities