Students will learn how to deploy, configure and customize a Zeek Network Intrusion Detection System (NIDS). They will customize Zeek to generate enterprise specific logs and to send email notifications of events of interest. They will also create a simple Zeek plugin, using the Zeek scripting language, to detect and block brute force ssh login attempts.

Students will configure a network firewall using the standard Linux IPtables module. The exercise will include both ingress and egress filtering, stateful packet inspection, and best practices. More advanced techniques such as port knocking will also be introduced. Evaluation will include network probes from both inside and outside the firewall to ensure proper rules are configured.

Students will learn to configure and set up an OpenVPN server. OpenVPN is an open-source Virtual Private Network (VPN) solution. VPNs extend a private network over a public network, allowing users to send and receive data the public networks as if they are directly connected to the private network.

Students will learn to set up a Certificate Authority to create the keys and certificates needed to (1) authenticate users (VPN clients) and the VPN server and, (2) encrypt communication between the two. They will also learn how to revoke client certificates when needed.

In this exercise students must configure the firewalls and routers of an enterprise network in accordance with the security policies of the organization. The computers and network devices in the network have been physically connected but the firewalls and routers have not been configured. You must configure these firewalls and routers to implement policies related to how traffic to/from the Internet and traffic between the different subnets is handled. This exercise is brought to you by the Rochester Institute of Technology-Global Cybersecurity Institute.

This exercise uses pfSense, an open-source firewall and router that is used by thousands of enterprises and officially supported by Netgate. Students must be familiar with the pfSense console and web interfaces. Those not familiar with pfSense are encouraged to complete the CYRIN Firewall Configuration with pfSense lab before attempting this exercise.

Students learn the proper setup of the OpenSSH remote administration tool, including security-relevant settings. During the exercise, students will learn best practices such as host filtering, public-key or Kerberos authentication, and PAM integration.

Students will use tools such as nmap, unicornscan, and fping to identify systems on a local network, including both Unix and Windows targets. Students will identify the operating systems these systems are running, as well as the types of network services they are providing.

Students will build on the Service Identification I exercise to use service-specific information-gathering tools. Students will gather vendor, software, and version information, as well as any configuration information available remotely. Students will then use scripting tools to automate this process.

In this lab the student will learn how to configure and securely run the Splunk Enterprise security information collection and analysis platform. The objective of the lab is to deploy multiple instances of Splunk data forwarders through a deployment server and analyze the logs received from the servers. The student will write custom scripts to generate logs, create both visual and textual reports, organize these reports into a single dashboard, and learn to recognize malicious activity.

Students will gain experience with the widely-used open source Metasploit^® framework and related tools for exploiting vulnerable software and insecure system configurations. The exercise leads students through the entire process, from scanning the network to getting remote shells and accessing sensitive information. By seeing the tools available to potential attackers, students will gain a greater appreciation for the need to keep software up-to-date and securely configured.

Students will build on the results of labs in the Web Application Security Analysis and Network Monitoring categories by using the SPARTA network infrastructure penetration testing tool, a graphical application that automates many common vulnerability assessment tasks. Students will use SPARTA within a graphical Kali Linux environment, scanning multiple unknown target systems and exploring found weaknesses.

Students will build on the basic Apache configuration exercise to configure Secure Sockets Layer (SSL) encryption for the Apache HTTP Server^®. Students will learn and implement best security practices and strong cryptography guarantees while avoiding vulnerabilities such as Heartbleed.

Students will use the OWASP program’s ZAP tool suite from within Kali Linux to scan multiple web services and document vulnerabilities. Students will see ZAP in action on a vulnerable web site where entire database tables are available to potential attackers.

Students will use the Vega scanning tool, within a graphical Kali Linux environment, to test web services over the network and document vulnerabilities. Students will then use network packet capture tools such as Wireshark to verify their understanding of the vulnerabilities and testing procedures.

Students will learn how to detect and exploit SQL injection vulnerabilities. By using several SQL injections techniques students will gather information about a remote database such as server operating system, database type, table names, and most importantly, table content. Students will then use sqlmap, a tool for SQL injection, to automate this process.

This lab teaches three different Denial of Service attacks and techniques to mitigate them:

1. A TCP SYN Flood attack that exploits a weakness in the design of the TCP transport protocol,
2. A slow HTTP attack called Slowloris that takes advantage of how HTTP servers work,
3. A DNS amplification attack that exploits misconfigured DNS servers, of which there are plenty on the Internet.

Build on what you learned in Protocol Analysis I, this time using command line tools and techniques. You will use the ubiquitous tcpdump program, starting with simple capture tasks and then building up to complex filtering and display options. In the process, you will dig deeply into TCP and IP header fields, learning how these can be used to find the traffic you're interested in. You will examine ICMP, SSH, and HTTP traffic, including that from web shells commonly used in attacks. With the techniques learned in this exercise, you will be able to gather and filter packet capture data from server systems, then later process it on graphical security operations workstations.

Examine packet captures from actual intrusions and dive deeper into how attackers operate! Students will learn the details of protocols such as SMB and SSH by examining network traffic captures in Wireshark^®, then will proceed to build network packets "by hand" in order to tunnel secret data in normal-looking traffic. Finally, students will learn the details of "web shell" payloads commonly used by attackers.

Continue your exploration into malware's behavior on the network! Students will analyze network captures containing real, malicious network traffic, both by hand and using tools such as Security Onion and Sguil. Both malware spreading methods and command and control operations will be explored. In addition, students will create web shell payloads of their own to see how they operate from the inside.

GRR Rapid Response is an open source live forensics tool originally created by Google. GRR allows an investigator to collect data about running systems on a network, anywhere from one system to thousands. In this lab, students will perform live remote forensic investigations against running systems. Without having to take the systems offline for imaging, students will examine running processes and network connections, files and disk artifacts, and registry keys across multiple target machines in a forensically-sound manner.

Analyzing a suspect system "live", before disconnecting it and imaging the disks, often yields valuable forensic evidence. Further, it can help you determine whether a crime has been committed at all, or whether the system contains evidence at all, thereby avoiding time-consuming examination of irrelevant machines. The Volatility^® framework is the dominant open-source memory analysis framework, examining RAM snapshots from a large variety of operating systems in multiple formats. This lab introduces students to the process of capturing a live RAM image and analyzing it using Volatility. Students will learn about several Volatility plugins for analyzing a Windows memory image, then analyze actual RAM images, including one with active malware, and view the results.

A security analyst will likely be asked some time in his or her career to conduct a forensic analysis of a Windows workstation or server. In this lab the student will learn about forensic artifacts commonly found on Windows computers. Forensic artifacts are traces of user activity left behind on a computer even after the user logs out or the computer is shut down.

In this lab, students will investigate a suspected data breach by an employee of an organization. They will be given a disk image of the employee's Windows workstation. They will learn where to look for forensic artifacts and the use of tools such as Autopsy^®, Registry Editor, RegRipper, LECmd, JumpList Explorer, RecentFileCacheParser, PECmd, and ShellBags Explorer to extract information from these artifacts.

This course provides a deep dive into the eMule peer-to-peer file sharing system and client software. Students will learn how eMule stores forensically-relevant data on disk. The course concludes with a hands-on practical using Architecture Technology Corporation’s P2P Marshal™ and provided forensic disk images using Microsoft Windows^®.

A copy of the P2P Marshal software is available free of charge to anyone enrolled in this course.

The ability to read and write shell scripts is an essential skill for system administrators. They are used to automate frequently executed tasks, saving system administrators time and reducing the likelihood of mistakes. This lab is brought to you by the Rochester Institute of Technology Global Cybersecurity Institute.

In this lab students will learn to write a simple Bash script that automates the task of creating user accounts, adding accounts to a group, and creating a shared workspace for this group.

This lab teaches concepts that are fundamental to using and administering a system running the Linux operating system. The lab teaches the basics of the Linux file system and how to navigate it, the use of permissions on files and directories to manage access, command output redirection and pipes, and commands that will help an administrator be more efficient.

Knowledge of Linux is often essential for IT roles because it powers a significant portion of enterprise web and database servers, cloud infrastructures, and Internet of Things (IoT) devices.

This lab will introduce students to MariaDB and MySQL by having them create a database, add tables to the database, populate data tables, and retrieve information from the database. They will do this using the MySQL command line interface. This lab is brought to you by the Rochester Institute of Technology Global Cybersecurity Institute.

MariaDB is a fork for the widely used MySQL database management system (DBMS). Both are open-source software and are largely compatible.

Active Directory (AD) is part of the Windows Domain Controller (DC).  It is a service that stores information about users and network resources such as computers on the network.  AD simplifies network management: Security policies can be defined on the AD and applied to all computers in the domain.  User accounts can be created and managed centrally using the Active Directory Administrative Center.  This lab is brought to you by the Rochester Institute of Technology-Global Cybersecurity Institute.

In this lab students will learn to install AD on a Windows DC, join computers to the domain, and create domain user accounts.  After completing this lab, students are encouraged to do the CYRIN Using Active Directory to Manage Domain User Accounts lab, where they will learn to set up AD security policies and assign them to users and organizational units.

One of the most important skills in cyber defense is the ability to think like an attacker. How will an adversary break in to your systems? Are your sensitive files properly hidden from prying eyes? Can a dedicated attacker steal encryption keys that would allow them to impersonate you? Knowing how such attacks might work helps you securely configure and defend your systems.

Hone your skills and see how an attacker would exploit configuration weaknesses. This Capture the Flag (CTF) scenario lets you see first-hand an attacker's strategies for compromising your systems. Can you gain total control over a target system solely via a web application?

Test your skills against others as either an attacker attempting to compromise a system or a defender trying to prevent the attackers from doing damage. This is a head-to-head exercise, best played with two or more participants from your organization. Participants choose their own teams.

Students play the role of a network security administrator of an enterprise. They are told that a host on the Internet has been persistently scanning their network.

They will use an Incident Response Rack with intrusion detection systems and log analysis tools to determine:

1. The service being targeted by the attacker.
2. If the attackers succeeds in finding and exploiting a vulnerability in this service.

Finally, they must block the attacker from the network.

After the attack is blocked, students will learn to exploit the vulnerability in the service.

It only takes one user clicking on a phishing e-mail to launch a devastating attack. Successful phishing attempts give an attacker access to your IT network resources, and possibly your OT network as well.

This scenario presents just such an attack—one of the users on the IT side of the network has inadvertently opened a malicious e-mail attachment. What are the consequences to the IT and OT networks, and how can this be contained and neutralized?

A Denial of Service (DoS) attack can cripple your business operations, or do even worse to your physical infrastructure. How will you find and stop such an attack? How will your personnel perform when the system is in a degrated state?

This scenario presents just such an attack on the OT network—a DoS attack at the network layer, flooding your systems with bogus data and slowing operations to a crawl.

Automatically-created CYRIN exercise in development.

Automatically-created CYRIN exercise in development.

Automatically-created CYRIN exercise in development.

Automatically-created CYRIN exercise in development.

WorldSkills Ireland National Final 2023 Skill-54 Cybersecurity Module B Part 2. Part 1 is provided in a separate sheet. 

Module C - CTF

In this lab, you will use the Windows and Linux clients to complete your objectives. You will be performing the following tasks:

Lab 7a (Identifying Security Vulnerabilities):

1. Demonstrate vulnerabilities.
2. Mitigate the vulnerability with Authentication.

Lab 7b (Securing the Storage Infrastructure):

1. Create network access entries.
2. Setup LDAP server.
3. Create groups and users on LDAP server.
4. Configure network access and group authentication for NFS.
5. Configure network access and group authentication for SMB/CIFS.
6. Create LUN masking.

Automatically-created CYRIN exercise in development.

Automatically-created CYRIN exercise in development.

Automatically-created CYRIN exercise in development.

Automatically-created CYRIN exercise in development.

In this lab, you will use the Windows client to complete your objectives. You will be performing the following tasks:
1. Create RAID partitions
2. Configure RAID 0
3. Configure RAID 1
4. Configure RAID 5 with Hot Spare
5. Configure RAID 10

Automatically-created CYRIN exercise in development.

Automatically-created CYRIN exercise in development.

Automatically-created CYRIN exercise in development.

Automatically-created CYRIN exercise in development.

Automatically-created CYRIN exercise in development.

Automatically-created CYRIN exercise in development.

Automatically-created CYRIN exercise in development.

Automatically-created CYRIN exercise in development.

Automatically-created CYRIN exercise in development.

Automatically-created CYRIN exercise in development.

Automatically-created CYRIN exercise in development.

Automatically-created CYRIN exercise in development.

Automatically-created CYRIN exercise in development.

Automatically-created CYRIN exercise in development.

Automatically-created CYRIN exercise in development.

Automatically-created CYRIN exercise in development.

Cyber Range skills development environment for students taking the Cyber SKills module: Log Files and Event Analysis

Automatically-created CYRIN exercise in development.

This scenario presents an attack from the IT network to the OT network. The attack starts approximately 5 minutes after the exercise begins. Use the initial 5 minutes to understand pre-attack conditions. Your task is to determine the nature of the attack, find its source, and neutralize it.

Automatically-created CYRIN exercise in development.

Automatically-created CYRIN exercise in development.

MTU Cork CyberSec Soc Training Exercises 

Automatically-created CYRIN exercise in development.

Automatically-created CYRIN exercise in development.

Automatically-created CYRIN exercise in development.

Automatically-created CYRIN exercise in development.

Automatically-created CYRIN exercise in development.

Automatically-created CYRIN exercise in development.

Automatically-created CYRIN exercise in development.

Automatically-created CYRIN exercise in development.

Automatically-created CYRIN exercise in development.

Automatically-created CYRIN exercise in development.

Automatically-created CYRIN exercise in development.

Automatically-created CYRIN exercise in development.

Automatically-created CYRIN exercise in development.

Automatically-created CYRIN exercise in development.

Automatically-created CYRIN exercise in development.

Automatically-created CYRIN exercise in development.

Automatically-created CYRIN exercise in development.