Module: Open Source Intelligence

Topic: Meta

Objective

Students will be able to use a metadata viewer to determine information about a photo that was taken.

Prompt

This challenge will give you experience with extracting metadata from an image file. You are given an image with contains metadata and you will need to use a metadata viewer to help answer the questions.

Questions & Answers

1. When was the image created? (Round to the nearest minute) Answer: 2015/05/15 02:14
2. What is the image size in pixels? (ex: 800x600) Answer: 1024x768
3. What is the make of the camera that took the picture? Answer: apple
4. What is the model of the camera that took the picture? Answer: iphone 5
5. What is the exposure time for the picture? (ex: 1/200) Answer: 1/640
6. Where was the picture taken? Please use only positive numbers with 4 decimal places. (ex: 45.4000N, 75.6667W) Possible answers: ● 39.8750N 20.0100E ● 39.8750N, 20.0100E ● 39 deg 52' 30.00" N, 20 deg 0' 36.00" E ● 39 deg 52' 30.00" N 20 deg 0' 36.00" E ● 39.8750 20.0100 ● N 39° 52' 30'' E 20° 0' 36'’ ● Latitude 39:52:30 Longitude 20:0:36 ● 39; 52;30 20;0; 36 ● 39º 52' 30.00" N, 20º 0' 36.00" E Incorrect answers: ● 39.8750 -20.0100 ● -39.8750 -20.0100 ● -39.8750N, 20.0

Extension Activities

To find the model of the camera that took the picture, see the “Model” field from the metadata viewer.

Tutorial Video

Watch our full Tutorial Video to learn more about open source intelligence and see a walkthrough of how to solve this challenge:

Topic: Lookup

Objective

Students will be able to find and use a specification document to answer questions about DNS.

Prompt

Answer these questions about DNS. Make sure you enter the record type and not the description of the record type.

Questions & Answers

1. What type of DNS record hold the DNSSEC public signing key?

Answer: DNSKEY

2. What type of DNS record is used to map hostnames to IPv6 addresses?

Answer: AAAA

3. What type of DNS record is used to delegate a DNS zone?

Answer: NS or Name Server

Extension Activities

Topic: Threat Intel

Objectives

Students will be able to use search tools to answer questions about security topics.

Prompt

Answer the following questions about security issues.

Questions & Answers

1. What is the CVE of the original POODLE attack?

How to solve: The answer to this question can be found on Wikipedia. Answer: CVE-2014-3566

2. What version of VSFTPD contained the smiley face backdoor?

How to solve: The answer to this question can be found on Wikipedia. Answer: 2.3.4

3. What was the first 1.0.1 version of OpenSSL that was NOT vulnerable to heartbleed?

How to solve: The answer to this question can be found on Wikipedia. Answer: 1.0.1g

4. What was the original RFC number that described Telnet?

How to solve: The answer to this question can be found on Wikipedia. You will have to search another linked Wikipedia page for more information related to when Telnet was first developed. Answer: 15

5. How large (in bytes) was the SQL Slammer worm?

How to solve: The answer to this question can be found on Wikipedia. Answer: 376

6. Samy is my…

How to solve: The answer to this question can be found on Wikipedia. Answer: hero

Extension Activities

Topic: HTTP Headers

Objectives

Students will be able to find resources to understand different types of HTTP request headers.

Prompt

Solve these questions about HTTP headers.

Questions & Answers

1. What HTTP request header is used to denote what URI linked to the resource being requested?

Answer: referer *Note that the official specification for this header has “referrer” spelled incorrectly as “referer”

2. What HTTP request header is used to identify the client software that made the HTTP request?

Answer: user-agent

3. What HTTP request header is used to identify the acceptable content types that can be returned?

Answer: accept

Extension Activities

Topic: WHOIS

Objective

Students will be able to conduct a WHOIS query to learn publicly available information about a domain name.

Prompt

Conduct open source intelligence data collection about cityinthe.cloud. Answer the following questions as they relate to the cityinthe.cloud domain.

Questions & Answers

1. Who is the registrar of this domain?

Answer: Dynadot

2. On what day was this domain first registered?

Answer: 2016-02-16

3. What is this domain's registry domain ID?

Answer: D15CD1AC4DEB54207A5048A69B9FC0558-ARI

4. What is the Top-Level Domain (TLD) of this domain?

Answer: cloud

5. What organization manages the TLD used by cityinthe.cloud?

Answer: Aruba

Extension Activities

Topic: PGP Lookup

Objectives

Students will query a public key database to identify the types of information stored there.

Prompt

Individuals use PGP to securely encrypt their emails, can you find out more about the following PGP keys?

Questions & Answers

1. What is the key fingerprint for security@cpanel.net?

Answer: B6709B4CC6F42077F69841919521BEDCABD94DDF

2. What email address is associated with the key fingerprint 7A39A56B73D1E097D57435CFCDE2DE1DCB2077F2?

Answer: hx@liber8tion.cityinthe.cloud

3. On what date does the above key expire (in UTC)?

Answer: 2050-12-26

Extension Activities

Topic: SSL

Objectives

Students will use a browser in order to analyze a SSL certificate chain.

Prompt

Solve the following questions about the Cyber Skyline SSL certificate.

Note: If you see references to "BitDefender" in the process of solving this challenge, that means your BitDefender software is intercepting your SSL/TLS connection and will produce incorrect results.

Questions & Answers

1. Who is the issuer for Cyber Skyline's SSL certificate?

Possible Answers: sectigo, comodo

2. How many bits long is the SSL key?

Answer: 2048

3. How many certificates are in the certificate chain?

Answer: 3

Extension Activities

Topic: Barcode

Objective

Students will be able to use a barcode reader to identify hidden information.

Prompt

We intercepted a barcode we think might be hiding a flag. See if you can find it.

Questions & Answers

1. What format does the barcode use?

Possible Answers: code 39, code39, Code_39, USD-3, Code 3 of 9, Code 3/9, Alpha 39

2. What is the flag hidden in the barcode?

Answer: SKY-UZLU-5635

Extension Activities

Module: Cryptography

Topic: Number Bases

Objectives

Students will use tools to recognize and convert various number bases.

Prompt

Our analysts have obtained password dumps storing hacker passwords. After obtaining a few plaintext passwords, it appears that they are all encoded using different number bases.

Questions & Answers

Extension Activities

Topic: Shift

Objectives

Students will decode a Ceasar shift cipher.

Prompt

Our analysts have obtained password dumps storing hacker passwords. It seems to be using a pretty simple encryption scheme, see if you can crack them.

Questions & Answers

Extension Activities

Topic: @bash

Objective

Students will decode an atbash shift cipher.

Prompt

Our analysts have obtained password dumps storing hacker passwords. See if you can crack them.

Questions & Answers

Extension Activities

Topic: Beep

Objective

Students will recognize and decode morse code.

Prompt

Our analysts have intercepted an encoded message. See if you can decode it.

Questions & Answers

Extension Activities

Topic: Fencing

Objective

Students will recognize and decode a rail fence cipher.

Prompt

Our analysts have obtained encrypted messages. We saw hand-written notes that indicated the keys as being "3" and "5". See if you can crack them.

Questions & Answers

Topic: French

Objective

Students will decrypt a Vigenère cipher.

Prompt

Our analysts have obtained an encrypted message. We know that the key, qizkwcgqbs was used. See if you can crack them.

Questions & Answers

Extension Activities

Module: Linux

Topic: DIR

Objective

Students will use commands via the Linux Command Line (CLI) to analyze files and directories.

Prompt

One of our analysts had their laptop damaged. However, we were able to recover and mount the hard drive. Access the terminal and recover various flags from the disk.

Questions & Answers

1. What are the contents of flag1.txt, found in root's home directory?

How to solve: Run cat flag1.txt from root’s home directory

Answer: SKY-FNKC-3207

2. What are the contents of flag2.txt, found in the root directory?

How to solve: Use cd / to navigate to the root directory and then run cat flag2.txt.

Answer: SKY-NPEJ-2501

3. What are the contents of flag3.txt, found in an archive in /var/log?

How to solve: Navigate to /var/log and then run tar -zxvf flag.tar.gz to extract the files from the archive.

Answer: SKY-FVHR-3562

4. What are the contents of flag4.txt, found in the flag user's home directory?

How to solve: Navigate to the /home/flag directory and then run cat flag4.txt.

Answer: SKY-SXIJ-6142

5. What flag is printed when you run the flag5 program?

How to solve: Run the flag5 program with the command flag5

Answer: SKY-UDSV-9689

6. What is the full path to the flag5 program?

How to solve: Run which flag5

Answers:

• /usr/bin/flag5
• /usr/bin/

Incorrect: ./usr/bin/flag5

Extension Activities

This challenge will give you experience running basic Linux commands. To solve these challenges, you will be using a Linux Command Line Interface (aka terminal or shell).

Background

The command line interface (CLI) functions similarly to File Explorer on Windows or Finder on macOS but relies on a text-based interface rather than a graphical user interface (GUI). Like its GUI counterparts, the CLI enables navigation through directories (folders) and the launching of files or programs. Upon opening the CLI, the prompt and command input line appear.

The prompt can be customized and configured for your personal preference. In this case, the default prompt contains some important information:

root is the name of the user that we are logged in as. On Linux systems, the root user is the default admin account.

dir is the hostname, or the name of the computer.

/home is the path of the directory that we are in. A “path” specifies a directory’s location, similar to how File Explorer displays it in the navigation bar, enabling easy navigation between folders.

Commands entered at the prompt tell the CLI what task to perform; like navigating directories, displaying file contents, or renaming folders. Each action uses a specific program. Typing the program name, supplying any necessary input, and pressing “Enter” runs the command and displays the result. The following includes examples of these commands and outputs.

Guide

List files in a directory: ls

In this challenge, access is provided as the root user, with the session starting in root’s home directory. Running the ls (short for ‘list’) command displays the contents of the current directory. Press enter after typing ls to get the command to run.

Display contents of a file: cat

This directory listing shows that only 1 file. In order to display the contents of a file, run the cat command (short for concatenate) followed by the name of the file you wish to display. This is the output of cat flag1.txt:

Change to another directory: cd

Try navigating to other directories using the cd command (short for change directory). Add the file path you want to go to after the cd command. To navigate to the root directory, simply use a forward slash. After changing to the root directory, the command line prompt has switched from ~ to /. This is the output after running cd / :

The ~ symbol denotes the home directory of the current user, while / indicates the root directory. The term “root” can refer either to the root user (a superuser account) or the root directory (the top-level directory in the system).

In the root directory, running ls lists the files. Running ls in the root directory reveals additional items beyond flag2.txt, most of which are directories.

Extracting tar files: tar

Use the cd command to navigate to the /var/log directory and use ls to see the files there.

The tar -zxvf flag.tar.gz command will decompress and extract the files from the tarball:

For tar -zxvf flag.tar.gz :

• z flag enables decompression
• x extracts the archive
• v (optional) activates verbose output (shows you what files are decompressed)
• f signals that the archive filename to decompress follows

The output includes ./flag/ and ./flag/flag3.txt, indicating that a folder named flag was extracted, containing a file named flag3.txt. The flag folder now appears in the current directory. Change to the flag directory to view the contents of flag3.txt.

Users & Home Directories: ~ or /home/

From the home directory, you can list the private directory of other users (if you have permission). As with Windows or macOS, each user on a Linux system has a private home directory, typically stored under /home/ . You can navigate directly to your own home directory by entering ~. The blue text below indicates a directory for a user named “flag”.

It is not required to switch users to view the contents of the ‘flag’ user’s folder because root is the default admin. However, if it was needed to switch users and become the ‘flag’ user use the su or ‘switch user’ command as follows and enter the password for that user. Notice how the user name changes from root to flag:

Run Programs:

There a couple ways to run programs. One way is to type in the program name and press enter. Running programs in user folders might not work if that user doesn’t have permission to run the program. Navigate back to root user’s home directory (~) or to the root directory (/). Below is the output of running the flag5 program:

Identify file paths: which

Non built-in Linux programs are simply files located somewhere in the file system. While it's possible to navigate directly to their directories, the command line automatically searches a predefined set of directories when a command is entered. The which command can be used to determine the location of a given program.

Tutorial Video

Watch our full Tutorial Video to learn more specifics about the Linux command line.

NCL Summer Live - Linux Command Line - Sep 14, 2021

Watch this live demonstration, especially for beginners, on Linux Command Line, presented by popular demand by the National Cyber League organizer Cyber Skyline CEO Franz Payer. Reach out with questions on NCL at info@nationalcyberleague.org. The National Cyber League, powered by Cyber Skyline, is a bi-annual, all-virtual cybersecurity student competition, advancing hands-on skills and knowledge. Check the website at nationalcyberleague.org for details.

www.youtube.com

Topic: File Edit

Objective

Students will use nano and Vim via the command line to create and edit files.

Prompt

Learn how to use command line file editors.

NOTE: The terminal session is logged. Please do not perform any denial of service attacks on the Linux server provided, malicious attempts to attack the Cyber Skyline platform will result in disqualification.

Questions & Answers

1. What key should you press in addition to the CTRL key to trigger the combination to exit nano?

Answer: x

2. What vim mode allows you to write new characters in the file?

How to solve: Search online for “vim mode to write new characters”.

Answer: insert

3. What keyboard combination will save and quit the file with vim?

How to solve: Search online for “how to save and quit with vim” and read the descriptions for the different keyboard combinations.

Answers:

1. :wq
2. wq
4. What keyboard combination will delete an entire line in vim?

How to solve: Search online for “vim delete line” and then read the descriptions for possible keyboard combinations. See the Trove for more detailed guidance.

Answer: dd

5. What command would you use to rename a file?

How to solve: Search online for “linux how to rename a file” and read about the most common commands. See the Trove for more detailed guidance.

Answer: mv

Extension Activities

This challenge will give you experience running basic Linux commands. To solve these challenges, you will be using a Linux Command Line Interface (aka terminal or shell).

Editing files in the Command Line Interface (CLI) requires a text-based editor, as graphical tools like Microsoft Word, Textedit, or Notepad aren't available. Common CLI editors include nano, vim, and Emacs. Nano is the simplest, while Vim and Emacs offer more advanced features but come with a steeper learning curve. This guide focuses on nano and Vim.

Guide

Nano

To open nano, simply type nano into the terminal. File names can also be included as the second argument to the command. For example, nano example.txt will create a file named “example.txt” and will launch the application.

When launched, a list of commands is given at the bottom of the screen. Each command is preceded by a caret character ( ^ ) - this represents the “CTRL” or control key on the keyboard. The caret is used as a shorthand for the CTRL key.

Vim

Nano can often be too simple for certain tasks, which may be reason to use Vim. Start Vim by using the vim command and optionally providing a filename: vim example.txt

There are various modes in Vim. The default normal mode in Vim functions as read-only. Press i to enter insert mode (indicated by “INSERT” at the bottom left) where standard typing and deletions are enabled. Press Esc to exit insert mode.

Visual mode enables copying and pasting. Press v in normal mode to begin selecting text from the cursor. Use arrow keys to expand the selection, then press y to “yank” it. Paste the copied text using the p character key, which will paste the text immediately after your cursor.

To save changes after editing, ensure you're in normal mode, then enter command mode with a colon. If editing is complete, type wq to write and quit, then press Enter. Vim displays a warning when quitting with unsaved changes. To exit without saving, use :q!.

Vim relies on keyboard commands to perform editing tasks due to the lack of on-screen buttons. Only basic features are covered here. Commands like dd , which deletes lines, or shortcuts <SHIFT> + G , which jumps the cursor to the end of a file, become familiar with practice.

Vim Command	Purpose
:q	Quit (only if there are no unsaved edits)
:w	Save the file
:wq	Save the file and quit
:q!	Quit without saving
:dd	Delete whole lines

Renaming, Copying and Deleting Files

After creating a file with nano or Vim, it can be renamed, copied, or deleted as needed.

Rename a File: mv

Use the mv (move) command to rename a file. Provide the original filename as the first argument and the new name as the second.

For example, mv example.txt newname.txt renames the file in the same directory. Include a different path in the second argument to move the file to another location. Below, the file “example.txt” was renamed to newname.txt, and then was moved to the “/” directory using mv newname.txt /newname.txt.

Copy a File: cp

Use the cp (copy) command to duplicate a file. Specify the original filename first and the name of the copy second. For example, cp example.txt copy.txt creates a duplicate named “copy.txt” in the same directory.

Remove a File: rm

Use the rm (remove) command to delete a file. Specify the filename as the first argument as follows: rm example.txt. This action is permanent and bypasses recovery options like the Recycle Bin. Restoring deleted files typically requires forensic tools.

Tutorial Video

Watch our full Tutorial Video to learn more specifics about the Linux command line.

NCL Summer Live - Linux Command Line - Sep 14, 2021

Watch this live demonstration, especially for beginners, on Linux Command Line, presented by popular demand by the National Cyber League organizer Cyber Skyline CEO Franz Payer. Reach out with questions on NCL at info@nationalcyberleague.org. The National Cyber League, powered by Cyber Skyline, is a bi-annual, all-virtual cybersecurity student competition, advancing hands-on skills and knowledge. Check the website at nationalcyberleague.org for details.

www.youtube.com

Topic: Basic Commands

Objective

Use open source tools and Linux command line knowledge to string Linux commands together.

Prompt

Learn the common basic commands used on the Linux command line.

NOTE: The terminal session is logged. Please do not perform any denial of service attacks on the Linux server provided, malicious attempts to attack the Cyber Skyline platform will result in disqualification.

Questions & Answers

1. What character can you use to redirect the output of one program as the input to another program?

How to solve: Search online for this question as-is. Make sure to find an answer that is specific to redirecting from output from one program to another program (and not to a file). See the Trove for additional guidance.

Answer: |

2. What character can you use the redirect the output of a program to a file?

How to solve: Search online for this question as-is. Make sure to find an answer that is specific to redirecting from output from one program to a file (and not to another program). See the Trove for additional guidance.

Answer: >

3. How many people have a first name of Jordan in names.csv?

How to solve: Use cut to grab only the column of first names, then use grep to search for “Jordan” and then use wc -l to get a line count.

cut -d "," -f 1 < names.csv | grep Jordan | wc -l

Answer: 2

Extension Activities

This challenge will give you experience running basic Linux commands. To solve these challenges, you will be using a Linux Command Line Interface (aka terminal or shell).

Background

When running a Linux command, different options can be provided to get a specific behavior. One of these is arguments. Arguments always follow the name of the program and could provide information such as the file you wish to run the program on. You may also see arguments referred to as “options” or “flags”.

The syntax for arguments is set by the author of the program. You can often type in the name of the command followed by --help to get information on how to use the program.

For some programs, you can use the man (manual) program to pull up the instructions. If a program has a manual entry, you can open the manual by typing man followed by the name of the program.

Below is the man page for the ls command. You can view it by entering man ls into the command line:

If the -a argument is used with the ls command, all of the files, even the hidden ones which start with . , will be listed.

Multiple arguments can be added together. The -l argument will list the read, write, execute permissions, the users who can access the file, the file size, and the date modified.

Guide

Standard Streams

The output of one program can be used as the input to another program. This utilizes a system in Linux called standard streams. There are three standard streams in Linux:

standard input (stdin) - data going into a program

standard output (stdout) - data coming out of a program

standard error (stderr) - errors coming out of a program

The greater than symbol is used to redirect stdout data of a command to a file. For example, echo “I Love Linux” > linux.txt will create a file named “linux.txt” (if it doesn’t already exist) and add “I Love Linux” to it.

Entering echo “Penguins are Cool” > linux.txt will overwrite the pre-existing linux.txt file with the new contents.

Using two greater than symbols will allow contents to be added to the current file contents. echo “I Love Linux” >> linux.txt

The less than symbol can be used in a variety of ways. One is to redirect contents of a file (or stdin) to a certain command. Shown below is the stdout of names.csv using the cat command. But the contents of the names.csv file can be re-directed to the cut command. cut -d ',' -f 1 is used below to show the contents of the first column of a file which is determined by using a comma and the separator, or delimiter, of the columns.

Stringing Commands

The stdout of one program can be made into the stdin of another program. This is done by using the pipe operator ( | ), which is represented with the vertical bar, and allows you string commands together.

For example, to find the number of people with the first name of “Jordan” from the names.csv file, try using cut -d "," -f 1 < names.csv | grep Jordan. Here, the grep command takes the output from the first portion of the command and only outputs strings that match “Jordan”:

It would be easier if a number was given as an output instead of needing to count. What if there were thousands of people named Jordan in the file? The number of lines that are output can be counted using wc -l:

Chaining multiple Linux commands can become useful in manipulating and analyzing data. Practice running different commands using these different customization tools. Below is a table of common Linux commands.

Tutorial Video

Watch our full Tutorial Video to learn more specifics about the Linux command line.

Topic: Strings

Objective

Use the strings command to find hidden information in a file.

Prompt

The hackers have hidden a message in this image. Find out what it is.

Questions & Answers

1. What is the hidden flag in the image?

How to solve: Run the strings command on the image and search for text that contains “SKY”.

strings STEG1.jpg | grep SKY

Answer: SKY-RCLO-4839

Extension Activities

This challenge involves using the strings Linux command to find a hidden message. A random portion of the image file was modified to insert the message, which is why there is a distortion in the image. The horizontal distortion that occurs near the eye is a result of the corruption caused by inserting the hidden message randomly within the image data.

Background

Recall from the bases challenge about how data can be converted from one form to another. Some values in binary that are used in files are not convertible to text characters. strings will pull any binary data out of the file that corresponds to a text character. Text characters would include letters (abc), numbers (123), or symbols (&^,*).

Here is the output of the strings command used on the STEG.jpg file:

Guide

Searching Standard Output (stdout) : grep

The output of the strings command can be searched with another command; grep.

grep is a powerful search command that looks for characters matching the exact string entered by the user. grep is often used with the pipe character ( | ) to search the output of other commands or to format the output of grep.

This challenge specifies that a flag is contained in the image, therefore, grep could be used to look for binary data that converts to characters resembling the standard flag format. This can be done using the command below:

strings STEG1.jpg | grep SKY

Pro Tip

Using strings is a quick way to see if a flag is hidden within the file without needing to open other programs. However, this challenge could also be solved using a hex editor and searching for SKY in the ASCII data as shown below:

🪵 Module: Log Analysis

Topic: SSH

Objective

Students will analyze the contents of an SSH log to identify adversarial behavior.

Prompt

Analyze this SSH log file to answer the following questions.

Questions & Answers

1. What is the hostname of the ssh server that was compromised?

Answer: myraptor

Copy

Oct 11 10:12:00 myraptor sshd[29459]: Server listening on 0.0.0.0	port 22.

2. What was the first IP address to attack the server?

Answer: 169.139.243.218

Copy

Oct 11 10:12:25 myraptor sshd[29465]: Failed password for harvey from 169.139.243.218 port 57273	ssh2

3. What was the second IP address to attack the server?

Answer: 56.13.188.38

4. What was the third IP address to attack the server?

Answer: 30.167.206.91

5. Which user was targeted in the attack?

Answer: harvey

Copy

Oct 11 10:12:25 myraptor sshd[29465]: Failed password for harvey from 169.139.243.218 port 57273	ssh

6. From which IP address was the attacker able to successfully log in?

Answer: 30.167.206.91

Copy

Oct 11 10:36:59 myraptor sshd[30003]: Accepted password for harvey from 30.167.206.91 port 55326	ssh2

Extension Activities

This challenge will give you experience doing a manual analysis of an SSH (Secure Shell Protocol) log file. SSH is a service that allows a device to provide remote terminal access. No additional tools are required to solve this challenge, only the ability to infer the meaning of the data in the log.

To start, look at the content of the log. If you’re unfamiliar with SSH logs, you can query the internet to find out more about how they are structured and what different terms used in the log mean.

The message field will often include warnings or errors. The event details field will include when sessions initiate or authentication attempts.

Guide

The questions for this challenge imply that there is an attack on the server. To understand what that could mean, look at more of the log file. There seem to be a lot of failed password attempts for a certain account trying to connect to the server.

Looking more closely at the messages, it’s evident that connections are coming from various IP addresses for the same user in a very short amount of time. That seems like odd behavior for a legitimate user trying to login; therefore, looking at the “Failed password” attempts is critical to finding which IP addresses are attacking the server and which account is being targeted.

In order to determine which IP address the attacker was successfully able to login from, we need to find a message that communicates a login attempt was successful. Scroll through the log file to find the line that includes “Accepted password”.

Topic: Login

Objective

Students will use command line tools to analyze a custom application log format.

Prompt

Analyze a custom application login event log to help us understand user behavior.

Questions & Answers

1. How many total login attempts were made in this log?

How to solve: Get the line count of the log. (Reminder: at the end of the command, that is a lower case ‘L’ not a number 1)

cat login.log | wc -l

Answer: 6063

2. How many unique usernames appear in this log?

How to solve: Extract the third field (with the usernames) of the log, sort the usernames, get the unique usernames, and then get a line count of the number of unique usernames.

cat login.log | cut -f 3 | sort | uniq | wc -l

Answer: 1879

3. What is the username with the most login attempts?

How to solve: Extract the third field (with the usernames) of the log, sort the usernames, get a frequency count of each unique username, and then sort the unique usernames by frequency.

cat login.log | cut -f 3 | sort | uniq -c |sort -n

Answer: ntory

4. How many attempts were made for the username with the most login attempts?

cat login.log | cut -f 3 | sort | uniq -c |sort -n

Answer: 124

5. What is the date with the most login attempts?

How to solve: Extract the first field (with the date+time) of the log, extract just the date, sort the dates, get a frequency count of each unique date, and then sort the unique dates by frequency.

cat login.log | cut -f 1 | cut -d " " -f 1 | sort | uniq -c | sort -n

Answer: 2011-03-23

6. What is the username that had logins from the most unique IP addresses?

How to solve: Extract the second field (with the IP address) and third field (with the username) of the log, sort the IP/username pairs, get the unique IP/username pairs, then extract just the usernames from each pair, sort the usernames, get a frequency count of how many unique pairs each username has, and then sort by frequency.

cat login.log | cut -f 2,3 | sort | uniq | cut -f 2 | sort | uniq -c | sort -n

Answer: wlfla0190

Extension Activities

This challenge involves analyzing a custom application log format that uses tab-delineated columns. The tab-delineated format is well-suited for the cut tool to extract specific columns from the log. cut can be used in combination with several other Linux command line utilities to obtain the answers to the questions.

To start, use ls to list the files in the directory, you should see login.log. The cat command can be used to display the contents of the file. Sometimes, log files can be quite long, so to avoid having to scroll back up through several lines, use head or tail to just see the first few lines or the last few lines. Used with no arguments, they will display 10 lines by default:

Guide

The guide for this challenge will use the head command to only output the first few lines of data to avoid giving away the answers to this challenge while also demonstrating what the rest of the command does. Replacing the head command with the cat command will apply the rest of the command to the contents of the entire file.

Piping the wc command (short for word count), along with the -l flag (lower case ‘L’ for “lines”) will count the lines in the output:

Display only one column with cut:

To display only the usernames, use the cut command with the -f flag to extract field 3 (the username column).

Sorting a list alphabetically and displaying unique output:

The usernames can be sorted alphabetically by piping the output through the command sort:

Some usernames are listed twice. To list only the unique entries, use the uniq command.

The -c flag will show the number of times an entry occurs in the output:

This list can be sorted again, this time numerically, with the -n flag:

Other features of cut:

The output can be piped throughcut -f 1,3 to display the first column (Date and Time) and the third column (usernames):

To display only the date (without the timestamp), add cut -d " " -f 1. This tells cut to split the line by spaces (instead of the default tab) and extract the first field. In other words, this changes the default delimiter that cut uses and allows you to specify whatever you like to divide the file.

Topic: VSFTPD

Objective

Students will analyze a VSFTPD log file.

Prompt

Analyze a VSFTPD log file that we obtained.

Questions & Answers

1. What IP address did "ftpuser" first log in from?

How to solve: Search for any entries that include “ftpuser”. One of these lines should include an IP address. cat vsftpd.log | grep ftpuser

Answer: 10.0.0.123

2. What is the first directory that ftpuser created?

cat vsftpd.log | grep ftpuser | grep -i mkdir | head -n 1

Answer: TreeSizeFree

3. What is the last directory that ftpuser created?

cat vsftpd.log | grep ftpuser | grep -i mkdir | tail -n 1

Answer: 110D300S

4. What file extension was the most used by ftpuser?

How to solve: Search for successful file upload entries from ftpuser, extract the file extension for those uploads, and then get the frequency count for each unique file extension

cat vsftpd.log | grep ftpuser | grep 'OK UPLOAD' | awk -F ',' '{print $2 }' | awk -F "." '{print $2}' | sort | uniq -c | sort

Possible Answers: jpeg, jpg, Joint Photographic Experts Group

5. What is the username of the other user in this log?

cat vsftpd.log | awk '{print $8}' | sort | uniq

Answer: jimmy

6. What IP address did this other user log in from?

cat vsftpd.log | grep jimmy

Answer: 10.0.0.214

7. How many total bytes did this other user upload?

How to solve: Search for successful file upload entries from jimmy, extract the number of bytes transferred, then sum the bytes cat vsftpd.log | grep jimmy | grep 'OK UPLOAD' | awk -F ',' '{print $3 }' | awk '{s+=$1} END {print s}’

Answer: 105750628 bytes

8. How many total bytes did ftpuser upload?

cat vsftpd.log | grep ftpuser | grep 'OK UPLOAD' | awk -F ',' '{print $3 }' | awk '{s+=$1} END {print s}’

Answer: 13980839165 bytes

9. How many total bytes did ftpuser download?

cat vsftpd.log | grep ftpuser | grep 'OK DOWNLOAD' | awk -F ',' '{print $3 }' | awk '{s+=$1} END {print s}’

Answer: 6008032 bytes

10. Identify the IP address of the suspicious login (the login with no subsequent activity).

How to solve: Search for all of the successful login attempts, extract the IP address used to log in, then sort and unique the IP addresses to identify IP addresses for manual inspection

cat vsftpd.log | grep 'OK LOGIN' | awk -F '"' '{print $2 }' | sort | uniq

Answer: 10.3.0.6

Extension Activities

This challenge involves analyzing the log file of a VSFTPD server. The questions can be solved through manual inspection of the file and by using basic Linux commands to parse the log.

VSFTPD stands for “Very Secure FTP Daemon” and is used on Linux servers to create a secure way to users to upload and download files. This type of server is implemented for different purposes, but the logs created from its use convey similar information like timestamps, process IDs (PID), event types, client IP addresses, as well as usernames.

The guide below will demonstrate how to solve this challenge building on skills from the previous log challenges. While the cut command could be used for some of this challenge, this guide will demonstrate solution paths using a similar command called awk.

awk and cut can sometimes be used interchangeably, however, awk has additional capabilities involving complex formatting and conditional logic which will be helpful for this challenge.

Guide

To find an IP address of a specific user, use grep as shown:cat vsftpd.log | grep ftpuser

The actions performed by ftpuser (like making directories) can be filtered by searching the output of the previous command and using the head command to see the first results. Using -i with grep will ignore the case of what you want to search for. cat vsftpd.log | grep ftpuser | grep -i mkdir | head -n 1

The same can be done with tail to see actions performed by the user at a later time:

cat vsftpd.log | grep ftpuser | grep -i mkdir | tail -n 1

Using awk and custom delimiters:

Questions 4, and 7- 10 involve the use of custom delimiters. This allows awk to use whatever you desire as a separator between fields of data.

The default delimiter for awk is a space. This challenge only uses awk with custom delimiters.

To determine what file type was most commonly uploaded, use grep to get an idea of what the uploads look like. This will help determine how to structure a command to filter the log down such that only file extensions are output. cat vsftpd.log | grep ftpuser | grep 'OK UPLOAD'

As shown below, the file path where the file was uploaded contains the file extension. There is a comma used after the file path— this can be used to set a custom delimiter with the awk command. Using awk, the specific column of data segmented by the commas can be printed. The second column has the file path with the file extension.

To use a custom delimiter with awk, use the -F option and enter the keyboard character you want to use as a delimiter between two single quotes (awk -F ',' ). Use single quotes, curly brackets and a dollar sign to indicate what field awk should print, or output ( '{print $2}’ ).

cat vsftpd.log | grep ftpuser | grep 'OK UPLOAD' | awk -F ',' '{print $2}' | head

From that output, lets isolate the file extension using the period as the delimiter. All we need to do is add another use of awk to the previous command. The output needed (the file extension) will come after the period, so be sure to use to tell awk to print the second field. cat vsftpd.log | grep ftpuser | grep 'OK UPLOAD' | awk -F ',' '{print $2}' | awk -F '.' '{print $2}' | head

From here, all that’s needed is to sort and print the unique file types using the following command:

cat vsftpd.log | grep ftpuser | grep 'OK UPLOAD' | awk -F ',' '{print $2 }' | awk -F "." '{print $2}' | sort | uniq -c | sort

To find other users that might be in this log file, look at what column contains the username field— this is in the 8th column. Use awk to filter all log entries for this field. Be sure to use sort and uniq so you can more easily see how many different users are in the log file.

cat vsftpd.log | awk '{print $8}' | sort | uniq

Enter a different command using grep and the username in question to find that user’s IP address.

To identify the IP address associated with a suspicious login, or logins without any other activity, lets grep for successful logins, and then filter out the field with IP addresses.

Use a double quote (”) as the delimiter. Syntax-wise this is used between two single quotes. Don’t forget to sort for unique IP addresses and count the total.

cat vsftpd.log | grep 'OK LOGIN' | awk -F '"' '{print $2 }' | sort | uniq -c

Using awk to calculate a total:

To determine how many bytes are uploaded or downloaded by a particular user, lets grep for the desired user, use grep to determine if we’re looking for uploaded or downloaded files, and then use the commas as a delimiter to see the file size.

Those are just the bytes for each individual file, not the total. awk can be used to get the total bytes using this command: awk '{s+=$1} END {print s}' . This will take the value of the first column ($1) and add it to variable s — creating a running total through each line of the log. When the log file ends (END), awk will print the value of s—the sum of the bytes. cat vsftpd.log | grep ftpuser | grep 'OK UPLOAD' | awk -F ',' '{print $3}'| awk '{s+=$1} END {print s}’

Topic: Nginx

Objective

Students will analyze an nginx access log.

Prompt

Analyze an nginx access log and answer questions about what happened.

Questions & Answers

1. How many different IP addresses reached the server?

Answer: 47

2. How many requests yielded a 200 code?

How to solve: Extract the third field after double quotes as the delimiter (which includes the HTTP codes), sort the codes, get the unique values with a count of the occurrences of each. Optional: sort in descending numeric order.

cat access.log | cut -d '"' -f3 | cut -d ' ' -f2 | sort | uniq -c | sort -rn

Answer: 19

3. How many requests yielded a 400 code?

cat access.log | cut -d '"' -f3 | cut -d ' ' -f2 | sort | uniq -c | sort -rn

Answer: 38

4. What IP address rang at the doorbell?

cat access.log | grep "bell"

Answer: 186.64.69.141

5. What version of the Googlebot visited the website?

cat access.log | grep "Googlebot"

Answer: 2.1

6. Which IP address attempted to exploit the shellshock vulnerability?

How to solve: Search online for details about the Shellshock vulnerability. You should be able to find that the presence of this sequence of characters () { :; }; is an indication of an attempted exploitation of this vulnerability. With this knowledge, search the log for any lines with that sequence of characters.

cat access.log | grep '() { :; };'

Answer: 61.161.130.241

7. What was the most popular version of Firefox used for browsing the website?

How to solve: Search the log for all lines that contain “Firefox” and the following characters which make up the version number, sort those values, and then get a unique count.

cat access.log | grep -o "Firefox/.*" | sort | uniq -c

Answer: Firefox/31.0

8. What is the most common HTTP method used?

How to solve: Extract the 6th field (with the HTTP method), sort, get the unique values with a count of the occurrences of each value, and then sort in descending numeric order.

cat access.log | awk -F " " '{print $6}' | sort | uniq -c | sort -rn

Answer: GET

Incorrect: POST, PUT, HEAD, DELETE, CONNECT

9. What is the second most common HTTP method used?

cat access.log | awk -F " " '{print $6}' | sort | uniq -c | sort -rn

Answer: CONNECT

Incorrect: GET, POST, PUT, HEAD, DELETE

10. How many requests were for \x04\x01\x00P\xC6\xCE\x0Eu0\x00?

Note that that command requires two backslashes for each original backslash to perform a proper escape sequence for the backslash.

cat access.log | grep '\\x04\\x01\\x00P\\xC6\\xCE\\x0Eu0\\x00' | wc -l

Answer: 6

Extension Activities

This challenge involves analyzing an nginx access log. The questions can be solved through manual inspection of the file and by using basic Linux commands to parse the log.

Looking through the first few lines of the log, it is apparent that the IP addresses are the first field in each line:

Guide

To answer the first question, the IPs from the first field (or column) need to be extracted, sorted to filter for only unique ones, and counted. This can be done with cut, sort, uniq and wc :

cat access.log | cut -d “ “ -f 1 | sort | uniq | wc -l

Extracting data from a column in a log file:

Looking at the first screenshot, the HTTP return codes are in the fourth field from the last:

The field right before it is enclosed in double quotes, so " can be used as a delimiter with cut. The first field before the " will contain data from the IP address to the timestamp. The second field, starting with GET, is the actual HTTP request. Therefore, the return codes will be the third field when a double quote is used as the delimiter.

A portion of the output of cat access.log | cut -d '"' -f3 is shown here :

To eliminate the second column from this output, the output can be piped through another cut command using a space as the delimiter. It looks like there is a space before the HTTP return codes as well, so the codes will be the second field after the first “space”:

Now that we are working with the HTTP return codes, we can sort and count the code occurrences:

Matching patterns with grep:

The remaining parts of this challenge require using grep , a tool that can be used to search entries for a keyword. Refer to the Linux: Basic Commands Walkthrough for more information on using grep.

Using grep with the -o flag tells grep to print only the part of the line that matches the pattern, instead of the entire line.

cat access.log | grep -o "Firefox/.*" | sort | uniq -c

Extracting columnar data with awk

Before answering the questions about HTTP methods is may be helpful to learn more about them here. Solving the questions about the HTTP methods used can be approached in two ways; using cut or awk.

cut can be used to extract the field containing the HTTP request methods ( the second field enclosed in double quotes). Then cut will be used to extract the first field of that output (which contains the actual HTTP request method). The output of that will be sorted, and counted using uniq.

sort -rn will list the output in reverse numeric order, so the term with the highest number of occurrences is listed at the top.

awk can also be used to get the desired output. It is a powerful text processing tool that treats any amount of whitespace as a single field separator by default, as compared to cut, which treats only a tab space as a default field separator.

For awk, the HTTP Request Method would be the 6th field from the left.

Backslash - Escape character:

The last question prompts us to look for a raw byte sequence in the log file. If grep '\41' access.log was used, the Linux shell is going to convert the byte to ASCII, and look for ‘A’ instead. To prevent the shell from interpreting the backslash as an escape character, it needs to be escaped with another backslash as follows: grep ‘\\41’ access.log. This ensures grep receives the full byte sequence and not the translated character.

Tutorial Video

Watch our full Tutorial Video to learn more specifics about crafting SQL queries and injections and see a walkthrough of how to solve this challenge:

NCL Summer Live - Log Analysis 1 - July 8 2021

Learn tips and tools of the trade with the National Cyber League's NCL Summer Live video tutorial series. This episode covers a demo of how to solve a problem in Log Analysis, one of the 9 NCL competition categories. Perfect for beginners! The National Cyber League, powered by Cyber Skyline, is a bi-annual, all-virtual cybersecurity student competition, advancing hands-on skills and knowledge. Check the website at nationalcyberleague.org for details.

www.youtube.com

Topic: History

Objective

Students will use SQL commands to analyze a SQlite database.

Prompt

Analyze a Firefox SQlite history database and answer questions about what happened. It you are not familiar with SQL you may want to learn more about SQL here: https://www.tutorialrepublic.com/sql-tutorial/

Questions & Answers

1. What did the user search for on craigslist?

Answer: bitcoin

2. What was the current price (USD) of bitcoin when the user was browsing?

Answer: $239.50

3. What Bitcoin exchange did the user log in to?

Answer: Coinbase

4. What is the email that was used to log into the exchange?

Answer: b1gbird@gmail.com

5. What was the ID of the Bitcoin transaction that the user looked at?

Answer: 5274cfba585a4b5681527a37f95c76340428916bb7480cef6c545f0a28dcd2d7 blockchain.info

6. What was the total BTC value of all the inputs of the Bitcoin transaction?

Answer: 0.22616302

7. Which Bitcoin address received the majority of the Bitcoin in the transaction?

Answer: 18z6bTFjxkXCmhfp8YBetR2wgmoVjXGJZz

Extension Activities

This challenge will give you experience analyzing a SQLite database. The answers can be obtained by using the sqlite3 Linux program or a GUI-based viewer. There are also browser-based SQLite viewers such as https://inloop.github.io/sqlite-viewer/. Below are some commands to get you started with sqlite3.

Use the command sqlite3 browser.sqlite to start the SQLite program.

Use the command .tables to see all of the database tables available to view.

Use the command SELECT * FROM moz_hosts; (or use any of the other table names) to view the information contained in the tables. The wildcard indicates to select all the columns, and the semicolon at the end of the query signals the end of the query.

Alternatively for this challenge, you can upload the SQLite database file to the

SQLite Viewer Web App

Guide

Searching the internet for information about “Firefox Sqlite Database” can help narrow down which tables to look through for some of the questions for this challenge. This site mentions that moz_places contains the sites visited, so that might be helpful for the first few questions:

Places.sqlite - MozillaZine Knowledge Base

There is a way to list of the columns in the moz_places table with PRAGMA table_info(moz_places); :

For the first question, look for the user’s search on craigslist. This information is most likely to be in the ‘url’ column, so we can display that with the query select url from moz_places;

The price of bitcoin when the user was browsing will show up in the “title” column in this table. Search for the $ sign with select * from moz_places where title like '%$%'; :

For question 3, run select url from moz_places; and scroll to see where the user signs in.

To find the user’s gmail account, query the table for any titles containing ‘gmail’ with select * from moz_places where title like '%gmail%'; :

Scrolling further down from the output of select url from moz_places; , we can see the transaction ID that the user looked at:

The remaining questions can be answers by visiting the URLs that are listed inside the database. The URL with id 290 is for a bitcoin transaction listed on blockchain.info. The main page displays the ID as well as the total value of the inputs.

The Bitcoin transaction ID and the amounts that were transferred are all listed on the blockchain.info page.

Useful resources for this challenge:

SQLite Viewer Web App

Tutorial Video

Watch our full Tutorial Video to learn more specifics about SQL databases and see a walkthrough of how to solve this challenge:

Cyber Skyline Live: Analyzing an SQL Database - Nov 3, 2022

Learn from Franz Payer, CEO of Cyber Skyline, about how to crack open a SQL database and extract the data you’re looking for. Reach out with questions at contact@cyberskyline.com. Cyber Skyline is the organizer of the National Cyber League, a bi-annual, all-virtual cybersecurity student competition, advancing hands-on skills and knowledge. Check the website at nationalcyberleague.org for details on NCL.

youtu.be

Topic: Squid

Objective

Students will analyze a Squid proxy log.

Prompt

Analyze this Squid proxy log to answer the following questions.

Questions & Answers

1. In what year was this log saved?

How to solve: Take any of the Epoch timestamps and convert them into a human-readable date. An online tool, such as Epoch Converter, can be used to do this.

Answer: 2010

2. How many milliseconds did the fastest request take?

How to solve: Extract the second field (the response time) and then sort the results numerically

cat squid_access.log | awk '{print $2}' | sort -n

Answer: 5

3. How many milliseconds did the longest request take?

How to solve: Same as the question above.

cat squid_access.log | awk '{print $2}' | sort -n

Answer: 41762

4. How many different IP addresses did the proxy service in this log?

How to solve: Extract the third field (the IP address of the proxy client), sort, get the unique values, and then get the line count.

cat squid_access.log | awk '{print $3}' | sort | uniq | wc -l

Answer: 4

5. How many GET requests were made?

How to solve: Extract the 6th field (the HTTP Request type), sort, and then get the unique values with a count of their occurrences. cat squid_access.log | awk '{print $6}' | sort | uniq –c

Answer: 35

6. How many POST requests were made?

Answer: 78

7. What company created the antivirus used on the host at 192.168.0.224?

How to solve: The name of the company is found within the URLs of the requests made 192.168.0.224 . cat squid_access.log | grep "192.168.0.224"

Answer: Symantec

8. What URL is used to download an antivirus update?

How to solve: Use the command from the question above and then find the URL that includes “virus” and “definitions”

Answer: http://liveupdate.symantecliveupdate.com/streaming/norton$202009$20streaming$20virus$20definitions_1.0_symalllanguages_livetri.zip

Extension Activities

This challenge involves analyzing a Squid proxy log. Basic scripting knowledge is necessary to complete the challenge in a reasonable amount of time.

Use head to see the first few lines of the log. The first field, commonly the time, is in an odd format of numbers and decimals. This is epoch time. Epoch time is the time in seconds from January 1 1970 at midnight.

Converting a timestamp from Epoch to Unix:

Online tools can be used to convert the timestamp to a human readable Unix format (see tools below) . or you can use the date command to convert it within linux:

Using awk to extract column data:

To answer questions about the speed of the request, looking up the format of a squid log (https://wiki.squid-cache.org/Features/LogFormat) shows that the field after the timestamp represents the time spent by the proxy in processing the client request, shown in milliseconds. To extract this field, use awk '{print $2}' and sort -n to sort numerically.

To answer how many different ip addresses that the proxy serviced in this log, use awk to output the ip addresses found in field 3. awk '{print $3}' | sort | uniq | wc -l.

For other examples of using awk, refer to Log Analysis challenge Nginx.

The GET and POST requests are found in the 6th column. Usecat squid_access.log | awk '{print $6}' | sort | uniq –c to see the number of GET and POST requests made.

To find information about the antivirus used on 192.168.0.224, use grep to find that ip address in the log file: cat squid_access.log | grep "192.168.0.224"

Tutorial Video

Watch our full Tutorial Video to learn more specifics about log analysis and see a walkthrough of how to solve this challenge:

NCL Summer Live - Log Analysis 2 - July 15 2021

Learn tips and tools of the trade with the National Cyber League's NCL Summer Live video tutorial series. This episode goes deep into Log Analysis, one of the 9 NCL competition categories. As a follow-up to the July 8 Log Analysis Tutorial, Franz Payer, CEO of Cyber Skyline, demonstrates: 1. How to convert an epoch timestamp into human-readable format 2. Identifying the smallest or largest value in a column 3. Counting unique number of values in a column 4. Counting number of times a value repeats 5. Searching for an IP address in a file 6. Counting how many times an event happens for each IP address. The National Cyber League, powered by Cyber Skyline, is a bi-annual, all-virtual cybersecurity student competition, advancing hands-on skills and knowledge. Check the website at nationalcyberleague.org for details.

youtu.be

📝Introduction Lab Kit CTF Questions & Answer Key

Open Source Intelligence

Meta (Easy)

This challenge has users find and identify information that is stored within pictures that are taken.

Reference: Introduction Lab Kit Instructor Guide - Topic: Meta

Questions

1. On what date was this image created? - How to solve: View the metadata using ExifTool or an online meta image viewer like https://exif.tools/ and look for the create date field

• Answer: 2020-10-22

2. What is the make of the camera that took the picture?

• How to solve: View the metadata using ExifTool or an online meta image viewer like https://exif.tools/ and look for the “make” field
• Answer: Hackercams

3. What is the model of the camera that took the picture?

• How to solve: View the metadata using ExifTool or an online meta image viewer like https://exif.tools/ and look for the “model” field
• Answer: Cyberlens 8400E

4. What is the flag hidden in the image?

• How to solve: View the metadata using ExifTool or an online meta image viewer like https://exif.tools/ and use grep to search for the flag
• Answer: SKY-YKFU-8855

Threat Intel

This challenge will give you experience conducting research on common security vulnerabilities. All that is required to solve these questions is to query online search engines and find multiple sources to confirm the answers.

Questions

1. What is the CVE for Dirty Cow?

• How to solve: Search google for “dirty cow cve”
• Answer: CVE-2016-5195

2. What company was affected by the Cloudbleed vulnerability?

• How to solve: Search google for “Cloudbleed”
• Answer: Cloudflare

3. What is the RFC number for TLS 1.2

• How to solve: Search google for “rfc number tls 1.2”
• Answer: 5246

4. What is the Metasploit module name that can be used to exploit the CVE-2017-6510 vulnerability?

• How to solve: Search google for “CVE-2017-6510 metasploit module”
• Answer: 15easy_file_sharing_ftp Easy File Sharing FTP

Codes

This is a challenge to look at the different types of barcode-type scannable resources.

Questions

1. What barcode format is being used by the first code?

• How to solve: The first Code #1 should be a familiar type of barcode called QR codes, these are commonly used on customer facing products such as flyers, restaurant menus, or general quick access to a website from your phone’s camera.
• Answer: QR (quick response)

2. What is the flag hidden in the first code?

• How to solve: Scan the QR code using your phone’s camera or use an online tool like https://zxing.org/w/decode.jspx or https://www.qrcoderaptor.com
• Answer: SKY-QRCD-4499

3. What barcode format is being used by the second code?

• How to solve: This is your more “standard” barcode used more primarily by businesses to track products and scan inventory. They can also be scanned by your phone’s camera or mobile apps or online tools like https://demo.dynamsoft.com/barcode-reader/
• Answer: code 128

4. What flag is hidden in the second code?

• How to solve: Use a tool like https://demo.dynamsoft.com/barcode-reader/
• Answer: SKY-EBIM-7920

5. What barcode format is being used by the third code?

• How to solve: This could be an unfamiliar barcode, so a quick way to find it would be to search “barcode types” and leading to sites like https://www.scandit.com/resources/guides/types-of-barcodes-choosing-the-right-barcode/. While looking through the “13 Common barcodes” you can see the familiar looking “Data Matrix” barcode. Or use a tool like this: https://demo.dynamsoft.com/barcode-reader/
• Answer: data matrix

6. What is the flag hidden in the third code?

• How to solve: Scan the barcode using your phone’s camera or mobile app or online tools like https://demo.dynamsoft.com/barcode-reader/
• Answer: SKY-LRVD-8573

Domain Recon

The challenge is to conduct reconnaissance on the cyberskyline.com domain.

Questions

1. What is the Registry Domain ID for the domain?

• How to solve: A good place to start for domain related lookups, ICANN is the place to go.https://lookup.icann.org/en/lookupYou can search by domain and in this case. The answer for this question is in the “Domain Information” grouping.
• Answer: cyberskyline.com

1854866838_DOMAIN_COM-VRSN

1854866838

2. Who is the registrar for the domain?

• How to solve: https://lookup.icann.org/en/lookup Contact Information > Registrant on the ICANN lookup tool
• Answer: Dynadot

Super Privacy Service

3. What is the IANA ID of the registrar for the domain?

• How to solve: https://lookup.icann.org/en/lookup. Registrar Information Grouping
• Answer: 472

4. When was the domain first registered (UTC)?

• How to solve: https://lookup.icann.org/en/lookup. In the Domain Information grouping at the top, the Created date will show when the domain was first registered, or created.
• Answer: 2014-04-15 19:03:26 UTC

Company Profile

You are given a company name and logo. The challenge is to gather information about the company to do reconnaissance.

Questions

1. How much money has this company raised in its first round of funding?

• How to solve: Searching for “StrongIntro funding rounds” can find the page https://tracxn.com/d/companies/strongintro/__5s_vdrCw--HO28DME7Xx5wZYJ6zZKC-yaM2LxDeoTq0/funding-and-investorsThis shows there only has been 1 round of funding and the amount it was for.
• Answer: $120k

$120,000

$120000

• Incorrect Answers: 120, $120

2. On what day did StrongIntro raise its first round of funding?

• How to solve: https://tracxn.com/d/companies/strongintro/__5s_vdrCw--HO28DME7Xx5wZYJ6zZKC-yaM2LxDeoTq0/funding-and-investors Shows the date of funding. Multiple answers are accepted due to potential information differing between sources.
• Answer: 2016-03-22

2016-03-23

2015-11-21

3. Who is the founder of StrongIntro?

• How to solve: On the same site, tracxn.com in the “Founders and & Board of Directors” sidebar will show the founder. https://tracxn.com/d/companies/strongintro/__5s_vdrCw--HO28DME7Xx5wZYJ6zZKC-yaM2LxDeoTq0/founders-and-board-of-directors
• Answer: Fouad Matin or Tieshun Roquerre (they are co-founders)

4. What programming language is StrongIntro's server written in?

• How to solve: Searching for “StrongIntro Github” is a good start to begin the search for any code they may have available.https://github.com/strongintro/docker-node repo shows their “StrongIntro node.js apps”.
• Answer: Javascript

NodeJS

Compromise Report

This challenge is to research around the malware that was found bundled in the CCleaner installer for version 5.33.

Questions

1. What is the name of the malware included in CCleaner?

• How to solve: Searching around for the name of malware can show a timeline of events which reveal the malware name: https://www.bleepingcomputer.com/news/security/avast-clarifies-details-surrounding-ccleaner-malware-incident/
• Answer:Floxif

Nyetya

2. How many seconds does the malware wait before starting malicious operations?

• How to solve: Looking at other reports, you can find a Talos Intelligence blog post that breaks down the technical aspects:https://blog.talosintelligence.com/avast-distributes-malware/In the CCBkrdr_GetShellcodeFromC2AndCall section, it shows the wait
• Answer: 601

601 seconds

3. What is the DLL that the malware infects?

• How to solve: In the same blog post, you can see it infects CBkrdr.dll https://blog.talosintelligence.com/avast-distributes-malware/
• Answer: CBkrdr.dll

4. What is the registry location where the malware stores the DGA IP address?

• How to solve: In the same blog post, in the Command and Control (C2) section, it breaks down the registry locations
• Answer: HKLM\SOFTWARE\Piriform\Agomo:NID

HKEY_LOCAL_MACHINE\SOFTWARE\Piriform\Agomo:NID

HKLM\SOFTWARE\Piriform\Agomo\NID

5. What specific IP address does the malware make HTTP POST requests to?

• How to solve: In the Talos Intelligence blog post, there is a diagram in the Command and Control (C2) section that shows the IP that is connected to.
• Answer: 216.126.225.148
• Incorrect Answer: 216.126.255.148

Cryptography

Bashes

This challenge has users identify and convert between different common number bases.

Reference: Introduction Lab Kit Instructor Guide - Topic: Number Bases

Questions

1. 01001001 00100000 01100110 01101111 01110101 01101110 01100100 00100000 00110001 00110010 00110110 00100000 01110000 01100001 01110011 01110011 01110111 01101111 01110010 01100100 00100000 01101000 01100001 01110011 01101000 01100101 01110011

• How to solve: Decode from binary
• Answer: I found 1** password hashes

Answer varies according to user, can be 1 followed by any two digits.

2. 54686572652061726520333138206f70656e20706f727473

• How to solve: Decode from Hex
• Reference: No access
• Answer: There are 3** open ports

Answer varies according to user, can be 3 followed by any two digits.

3. d2UndmUgcmV0cmlldmVkIHRoZSBwaG9uZQ==

• How to solve: Decode from base64
• Answer: we've retrieved the ______

The answer can be computer, iphone, laptop, desktop, table, phone.

4. NzQ2ODY1NzkyNzcyNjUyMDcyNzU2ZTZlNjk2ZTY3MjA2MTIwNjY3NDcwMjA3MzY1NzI3NjY5NjM2NTIwNmY2ZTIwNzA2ZjcyNzQyMDMyMzgzNDM5

• How to solve: Convert from base64 and then convert that output from Hex
• Answer: they're running a ftp service on port 2***

The answer can be http, http, ftp, mysql, ssh, smtp, imap, irc and a port number of 2 followed by any three digits.

Shift

This challenge has users identify transposition, or shift ciphers, to decode the ciphertext back into the plaintext.

Reference: Introduction Lab Kit Instructor Guide - Topic: Shift

Questions

1. guvf cebonoyl vfag frpher

• How to solve: Use Rot13 to decode it
• Answer: this probably isnt secure

2. bpqa qavb uckp jmbbmz

• How to solve: Use Rot18 to decode it
• Answer: this isnt much better

Alphabet

This is a simple letter-number substitution cipher that will have users converting the numerical alphabet positions to letters.

Questions

1. 9 19-5-5-13 20-15 8-1-22-5 12-15-19-20 13-25 6-12-1-19-8-4-18-9-22-5

• How to solve: Each letter represents the numerical alphabet character. ‘I’ is the 9th letter in the alphabet, ‘19’ is S and the grouped letter are the different words.
• Answer: I seem to have lost my flash drive

Polyalphabetic

This challenge is encoded using a simple polyalphabetic cipher. Users will have to try different ciphers to find the one that properly decodes the message.

Reference: Introduction Lab Kit Instructor Guide - Topic: @bash

Questions

1. gsv szmwluu droo yv yvsrmw gsv nlerv gsvzgvi

• How to solve: Decode using an atbash cipher
• Answer: the handoff will be behind the movie theater

ASCII

This challenge has users decode a hidden message that has been encoded using ASCII numbers.

Questions

1. 84 104 101 114 101 32 97 114 101 32 101 105 103 104 116 32 118 117 108 110 101 114 97 98 105 108 105 116 105 101 115 32 111 110 32 116 104 101 32 115 101 114 118 101 114

• How to solve: Each decimal number represents an ASCII character, for example ‘84’ in ASCII represents the letter T. Use a tool like Cyber Chef to convert from decimal to ASCII.
• Answer: There are eight vulnerabilities on the server

Phone

Questions

1. What is the plaintext of the message: 555-2-88-66-222-44 8-44-33 7-44-444-7777-44-444-66-4 2-8-8-2-222-55?

• How to solve: This is a Multitap Phone cipher used in mobile phones to type text/SMS on a keyboard with a numeric keypad. You can begin with running the cipher through a cipher identifier like this one: https://www.dcode.fr/cipher-identifier
• Answer: launch the phishing attack

Morse

What is the plaintext message?

• How to solve: This can be done by ear or by looking at the graph of the audio using a tool like audacity. You can also use online tools such as https://morsecode.world/international/decoder/audio-decoder-adaptive.html to decode.
• Reference: Introduction Lab Kit Instructor Guide - Topic: Beep
• Answer: send the bitcoin

Fencing

This challenge has users decode transposition ciphers. This one in particular is a rail fence cipher, the name fencing is a hint toward a rail fence cipher.

Reference: Introduction Lab Kit Instructor Guide - Topic: Fencing

Questions

1. whydue r vhc e i o s oecyttedieikdyutnphr

• How to solve:  rail fence cipher decode key 3 offset 0
• Answer: which key did you use to encrypt the drive

2. u epelh lhotsotg era oredtv

• How to solve: rail fence cipher decode key 6 offset 0
• Answer: upload the log to the server

Linux + Log Analysis

Directories

This challenge involves looking traversing a Linux file system. Starting from the user's home directory and eventually changing the user to view other directories.

Reference: Introduction Lab Kit Instructor Guide - Module: Linux

Questions

1. What is the absolute file path of the directory you start in when you connect to the terminal? (You can use the "exit" command to quit the terminal and re-enter)

• How to solve: Using the command pwd you can print out the directory that you start in.
• Answer: /home/basic-user/start

2. What is flag1, the flag that is in the home directory?

• How to solve: It solves this first change into the user's home directory using the cd command. You can then use ls to see any files in the directory and cat to view the contents of the flag file.
• Answer: SKY-HBHD-9913

3. What is flag2, the flag that is in a "temporary" location?

• How to solve: Linux stores temporary files in the /tmp/ directory. You can change into the directory using cd /tmp then use ls and cat to find and view the file.
• Answer: SKY-YDBJ-9262

3. What is flag3, the flag that is located where the logs are?

• How to solve: Linux stores log files in the /var/log/ directory. Navigate to this directory using cd and then use ls and cat to find and view the file:

cd /var/log/

ls

cat flag3.txt

• Answer: SKY-IKCW-2336

4. What is flag4, the flag that is in root's home?

• How to solve: You need to be able to switch to the root user. In the starting directory there is a file called README.md Its contents container the root password. Use su root and use the password in this file to login as root. Afterwards use the same process as solving question number 2.
• Answer: SKY-WIQA-1402

5. What is flag5, the flag that is hiding in root's home?

• How to solve: Use ls -la to show all the files in the root directory. Files that begin with a . (Example .bashrc ) are hidden files and not shown by default. Using -a with the ls command shows these files.
• Answer: SKY-WPEJ-2171

DPKG

This challenge requires analyzing a dpkg log. This log container information about what software has been installed and removed from the system.

Reference: Introduction Lab Kit Instructor Guide - Topic: Nginx

Questions

1. What version number of mongodb was installed on the machine?

• How to solve: In the /var/log directory there is a dpkg.log file. If you use grep mongodb /var/log/dpkg.log you will see all mongodb related entries. This information includes any version information.
• Answer: 3.4.15

2. What version of gnupg-utils was installed on the machine?

• How to solve: Use grep gnupg-utils /var/log/dpkg.log And look specifically for when a package is fully installed. This means the line will not include the half-installed indicator.
• Answer: 2.10

2.5-1

2.20

• Incorrect: 2.2.5-1 2.2.10-1

3. What distribution of Linux is the machine running?

• How to solve: Looking at the /etc/apt/sources.list file shows that this distribution is kali, or cat /etc/os-release
• Answer: kali

4. When was mongodb uninstalled from the machine (round up to the nearest minute)?

• How to solve: Again looking at the dpkg log you can tell when the package is uninstalled by looking for the remove action and using the timestamp at the start of the line.
• Answer: 2018-11-16 04:18

Breach Prevention

The point of the challenge is to extract important data out of a security appliance log file.

Reference: Introduction Lab Kit Instructor Guide - Topic: Nginx

Questions

1. How many total attacks were blocked by the breach prevention software?

• How to solve: Run the following command grep "Blocking reason" breach.log | wc -l This looks for each block that occurred and gets a total of the number of occurrences
• Answer: 340

2. What IP address attempted the most attacks?

• How to solve: grep "IP" breach.log | sort | uniq -c This commands looks for each IP field, sorts them, and then gets the amount of times each IP occurs.
• Answer: 172.16.4.27

3. How many remote file inclusion attacks were prevented?

• How to solve: grep "Blocking reason" breach.log | sort | uniq -c This command looks at the amount of times each type of prevention worked
• Answer: 12

4. How many different types of attacks are listed in this log?

• How to solve: grep "Blocking reason" breach.log | sort | uniq -c This command looks at the amount of times each type of prevention worked.
• Answer: 3

5. What software was used by 172.16.4.27 against this server?

• How to solve: How to solve: Since this log file has its entries split across multiple lines, the easiest way to solve this challenge is to open the log file into a text editor, like notepad++, and search for the ip and look at a given entry for it.
• Answer: OpenVAS

Open Vulnerability Assessment System

Open VAS

6. How many different IP addresses attempted an attack on this server?

• How to solve: grep "IP" breach.log | sort | uniq | wc -l

This command will get the total number of unique ip address that attacked the server.

• Answer: 5

7. What URL was blocked the most often by the direct file inclusion defense?

• How to solve:

cat breach.log | grep -A 3 'Blocking reason: dfishield' | grep 'URL.*:' | sort | uniq -c | sort -n | tail

This will get the counts for how many time each URL appeared in the log.

• Answer: https://www.dc4-web-portal.cityinthe.cloud/uploadify/uploadify.php?folder=/
• Incorrect: https://dc4-web-portal.cityinthe.cloud/index.php?url=http://116.125.126.111/page.php

https://dc4-web-portal.cityinthe.cloud/index.php