digital-forensics-labs/SecGen
1
0
Fork 0
mirror of https://github.com/cliffe/SecGen.git synced 2026-02-21 11:18:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

CyBOK

Browse Source
This commit is contained in:
Z. Cliffe Schreuders
2021-04-28 11:00:27 +01:00
parent 0f6bacbb6e
commit 045401d2d1
10 changed files with 997 additions and 120 deletions
Download Patch File Download Diff File Expand all files Collapse all files

337
README-CyBOK-Lecture-Videos.md
View File

@@ -4,7 +4,7 @@ The Cyber Security Body of Knowledge (CyBOK) is a body of knowledge that aims to
This file is an autogenerated index of the lecture videos referenced by scenarios -- with CyBOK metadata.
There are 48 videos with CyBOK metadata.
There are 65 videos with CyBOK metadata.
> Cyber Securtiy Body of Knowledge (CyBOK) Issue 1.0 is Crown Copyright, The National Cyber Security Centre 2021, licensed under the Open Government Licence http://www.nationalarchives.gov.uk/doc/open-government-licence/.
@@ -25,7 +25,7 @@ There are 48 videos with CyBOK metadata.
| KA | Topics | Keywords |
| --- | --- | --- |
| Authentication, Authorisation & Accountability (AAA) | Authentication | user authentication |
| (OSVS) | Primitives for Isolation and Mediation | authentication and identification; Linux authentication; Types of user accounts |
| Operating Systems & Virtualisation (OSV) | Primitives for Isolation and Mediation | authentication and identification; Linux authentication; Types of user accounts |
@@ -42,7 +42,7 @@ There are 48 videos with CyBOK metadata.
| KA | Topics | Keywords |
| --- | --- | --- |
| Authentication, Authorisation & Accountability (AAA) | Authentication | user authentication; Cryptography and authentication (hashes and attacks against authentication schemes / passwords) |
| (OSVS) | Primitives for Isolation and Mediation | authentication and identification; Linux authentication |
| Operating Systems & Virtualisation (OSV) | Primitives for Isolation and Mediation | authentication and identification; Linux authentication |
@@ -59,7 +59,7 @@ There are 48 videos with CyBOK metadata.
| KA | Topics | Keywords |
| --- | --- | --- |
| Authentication, Authorisation & Accountability (AAA) | Authentication | user authentication; Cryptography and authentication (hashes and attacks against authentication schemes / passwords) |
| (OSVS) | Primitives for Isolation and Mediation | authentication and identification; Linux authentication |
| Operating Systems & Virtualisation (OSV) | Primitives for Isolation and Mediation | authentication and identification; Linux authentication |
@@ -76,7 +76,7 @@ There are 48 videos with CyBOK metadata.
| KA | Topics | Keywords |
| --- | --- | --- |
| Authentication, Authorisation & Accountability (AAA) | Authentication | user authentication; Cryptography and authentication (hashes and attacks against authentication schemes / passwords) |
| (OSVS) | Primitives for Isolation and Mediation | authentication and identification; Linux authentication |
| Operating Systems & Virtualisation (OSV) | Primitives for Isolation and Mediation | authentication and identification; Linux authentication |
@@ -93,7 +93,7 @@ There are 48 videos with CyBOK metadata.
| KA | Topics | Keywords |
| --- | --- | --- |
| Authentication, Authorisation & Accountability (AAA) | Authentication | identity management; user authentication; facets of authentication |
| (OSVS) | Primitives for Isolation and Mediation | authentication and identification; Linux authentication |
| Operating Systems & Virtualisation (OSV) | Primitives for Isolation and Mediation | authentication and identification; Linux authentication |
@@ -212,8 +212,8 @@ There are 48 videos with CyBOK metadata.
| KA | Topics | Keywords |
| --- | --- | --- |
| Authentication, Authorisation & Accountability (AAA) | Authorisation | access control; enforcing access control; theory |
| (OSVS) | Primitives for Isolation and Mediation | Access controls and operating systems |
| (OSVS) | Role of Operating Systems | mediation; TRUSTED COMPUTING BASE (TCB); REFERENCE MONITOR |
| Operating Systems & Virtualisation (OSV) | Primitives for Isolation and Mediation | Access controls and operating systems |
| Operating Systems & Virtualisation (OSV) | Role of Operating Systems | mediation; TRUSTED COMPUTING BASE (TCB); REFERENCE MONITOR |
@@ -230,8 +230,8 @@ There are 48 videos with CyBOK metadata.
| KA | Topics | Keywords |
| --- | --- | --- |
| Authentication, Authorisation & Accountability (AAA) | Authorisation | access control; enforcing access control; ACCESS CONTROL - DAC (DISCRETIONARY ACCESS CONTROL) |
| (OSVS) | Primitives for Isolation and Mediation | Access controls and operating systems; Linux security model; Unix File Permissions; filesystems; inodes; and commands |
| (OSVS) | Role of Operating Systems | mediation |
| Operating Systems & Virtualisation (OSV) | Primitives for Isolation and Mediation | Access controls and operating systems; Linux security model; Unix File Permissions; filesystems; inodes; and commands |
| Operating Systems & Virtualisation (OSV) | Role of Operating Systems | mediation |
@@ -248,7 +248,7 @@ There are 48 videos with CyBOK metadata.
| KA | Topics | Keywords |
| --- | --- | --- |
| Authentication, Authorisation & Accountability (AAA) | Authorisation | access control; theory; ACCESS CONTROL - DAC (DISCRETIONARY ACCESS CONTROL); ACCESS CONTROL - MAC (MANDATORY ACCESS CONTROL); ACCESS CONTROL - NDAC (NON-DISCRETIONARY ACCESS CONTROL); ACCESS CONTROL - ROLE-BASED |
| (OSVS) | OS Security Principles | security models |
| Operating Systems & Virtualisation (OSV) | OS Security Principles | security models |
@@ -265,7 +265,7 @@ There are 48 videos with CyBOK metadata.
| KA | Topics | Keywords |
| --- | --- | --- |
| Authentication, Authorisation & Accountability (AAA) | Authorisation | access control; Elevated privileges; Real and effective identity; Vulnerabilities and attacks on access control misconfigurations |
| (OSVS) | Primitives for Isolation and Mediation | Access controls and operating systems; Linux security model; Unix File Permissions; setuid/setgid |
| Operating Systems & Virtualisation (OSV) | Primitives for Isolation and Mediation | Access controls and operating systems; Linux security model; Unix File Permissions; setuid/setgid |
@@ -282,7 +282,7 @@ There are 48 videos with CyBOK metadata.
| KA | Topics | Keywords |
| --- | --- | --- |
| Authentication, Authorisation & Accountability (AAA) | Authorisation | access control; ACCESS CONTROL - MATRIX; ACCESS CONTROL LIST (ACL); Vulnerabilities and attacks on access control misconfigurations |
| (OSVS) | Primitives for Isolation and Mediation | capabilities |
| Operating Systems & Virtualisation (OSV) | Primitives for Isolation and Mediation | capabilities |
@@ -299,7 +299,7 @@ There are 48 videos with CyBOK metadata.
| KA | Topics | Keywords |
| --- | --- | --- |
| Authentication, Authorisation & Accountability (AAA) | Authorisation | access control; ACCESS CONTROL LIST (ACL); Vulnerabilities and attacks on access control misconfigurations |
| (OSVS) | Primitives for Isolation and Mediation | Access controls and operating systems; Linux security model; Linux Extended Access Control Lists (facl) |
| Operating Systems & Virtualisation (OSV) | Primitives for Isolation and Mediation | Access controls and operating systems; Linux security model; Linux Extended Access Control Lists (facl) |
@@ -316,9 +316,9 @@ There are 48 videos with CyBOK metadata.
| KA | Topics | Keywords |
| --- | --- | --- |
| Authentication, Authorisation & Accountability (AAA) | Authorisation | SANDBOX; Application-based access controls: user-based access controls insufficiently limit privileges |
| (OSVS) | Primitives for Isolation and Mediation | capabilities; Container-based sandboxes: chroot; Docker; Rule-based controls: Course grained: Linux capabilities; System-level sandboxes (complete OS; Qubes); hardware-emulation and paravirtualisation; Copy on write sandboxes |
| (OSVS) | Role of Operating Systems | isolation; CONTAINERS |
| (WMS) | Fundamental Concepts and Approaches | sandboxing; permission dialog based access control |
| Operating Systems & Virtualisation (OSV) | Primitives for Isolation and Mediation | capabilities; Container-based sandboxes: chroot; Docker; Rule-based controls: Course grained: Linux capabilities; System-level sandboxes (complete OS; Qubes); hardware-emulation and paravirtualisation; Copy on write sandboxes |
| Operating Systems & Virtualisation (OSV) | Role of Operating Systems | isolation; CONTAINERS |
| Web & Mobile Security (WAM) | Fundamental Concepts and Approaches | sandboxing; permission dialog based access control |
@@ -335,7 +335,7 @@ There are 48 videos with CyBOK metadata.
| KA | Topics | Keywords |
| --- | --- | --- |
| Authentication, Authorisation & Accountability (AAA) | Authorisation | ACCESS CONTROL - MAC (MANDATORY ACCESS CONTROL); ACCESS CONTROL - NDAC (NON-DISCRETIONARY ACCESS CONTROL); Application-based access controls: user-based access controls insufficiently limit privileges; Rule-based sandboxes; System call interposition; Integrity level access controls |
| (OSVS) | Primitives for Isolation and Mediation | Rule-based controls: Fine grained: AppArmor |
| Operating Systems & Virtualisation (OSV) | Primitives for Isolation and Mediation | Rule-based controls: Fine grained: AppArmor |
| Software Security (SS) | Mitigating Exploitation | limiting privileges |
@@ -369,7 +369,7 @@ There are 48 videos with CyBOK metadata.
| KA | Topics | Keywords |
| --- | --- | --- |
| Authentication, Authorisation & Accountability (AAA) | Authorisation | access control; Protecting integrity |
| (OSVS) | Primitives for Isolation and Mediation | Linux read only protections: ro mounts; file attributes |
| Operating Systems & Virtualisation (OSV) | Primitives for Isolation and Mediation | Linux read only protections: ro mounts; file attributes |
@@ -387,7 +387,7 @@ There are 48 videos with CyBOK metadata.
| --- | --- | --- |
| Forensics (F) | Artifact Analysis | cryptographic hashing |
| Security Operations & Incident Management (SOIM) | Monitor: Data Sources | MONITORING - FILE INTEGRITY CHECKERS |
| (OSVS) | OS Hardening | code and data integrity checks |
| Operating Systems & Virtualisation (OSV) | OS Hardening | code and data integrity checks |
@@ -403,8 +403,8 @@ There are 48 videos with CyBOK metadata.
| KA | Topics | Keywords |
| --- | --- | --- |
| (OSVS) | Fundamental Concepts | workflows and vocabulary; architectural principles |
| (OSVS) | Human Factors: Incident Management | prepare: incident management planning; handle: actual incident response; follow up: post incident activities; BUSINESS CONTINUITY PLAN - AND INCIDENT RESPONSE; incident response methodologies |
| Operating Systems & Virtualisation (OSV) | Fundamental Concepts | workflows and vocabulary; architectural principles |
| Operating Systems & Virtualisation (OSV) | Human Factors: Incident Management | prepare: incident management planning; handle: actual incident response; follow up: post incident activities; BUSINESS CONTINUITY PLAN - AND INCIDENT RESPONSE; incident response methodologies |
| Law & Regulation (LR) | Data Protection | investigation and prevention of crime; personal data breach notification; enforcement and penalties |
@@ -421,7 +421,7 @@ There are 48 videos with CyBOK metadata.
| KA | Topics | Keywords |
| --- | --- | --- |
| (OSVS) | Human Factors: Incident Management | prepare: incident management planning; BUSINESS CONTINUITY PLAN - AND INCIDENT RESPONSE |
| Operating Systems & Virtualisation (OSV) | Human Factors: Incident Management | prepare: incident management planning; BUSINESS CONTINUITY PLAN - AND INCIDENT RESPONSE |
@@ -438,7 +438,7 @@ There are 48 videos with CyBOK metadata.
| KA | Topics | Keywords |
| --- | --- | --- |
| Security Operations & Incident Management (SOIM) | Execute: Mitigation and Countermeasures | Recover data and services after an incident |
| (OSVS) | Human Factors: Incident Management | prepare: incident management planning; BUSINESS CONTINUITY PLAN - AND INCIDENT RESPONSE |
| Operating Systems & Virtualisation (OSV) | Human Factors: Incident Management | prepare: incident management planning; BUSINESS CONTINUITY PLAN - AND INCIDENT RESPONSE |
@@ -455,7 +455,7 @@ There are 48 videos with CyBOK metadata.
| KA | Topics | Keywords |
| --- | --- | --- |
| Security Operations & Incident Management (SOIM) | Execute: Mitigation and Countermeasures | Recover data and services after an incident; BACKUP - DIFFERENTIAL; BACKUP - INFERENTIAL |
| (OSVS) | Human Factors: Incident Management | prepare: incident management planning |
| Operating Systems & Virtualisation (OSV) | Human Factors: Incident Management | prepare: incident management planning |
@@ -473,7 +473,7 @@ There are 48 videos with CyBOK metadata.
| --- | --- | --- |
| Security Operations & Incident Management (SOIM) | Execute: Mitigation and Countermeasures | DATA REDUNDANCY; REDUNDANCY IN NETWORK SERVICES |
| Distributed Systems Security (DSS) | CLOUD - COMPUTING - SERVICES | CLOUD COMPUTING - DEPLOYMENT MODELS; CLOUD COMPUTING - RESOURCE POOLING; CLOUD COMPUTING - SERVICE MODELS - IAAS; CLOUD COMPUTING - SERVICE MODELS - PAAS; CLOUD COMPUTING - SERVICE MODELS - SAAS; CLOUD COMPUTING - STORAGE |
| (OSVS) | CLOUD - COMPUTING - SERVICES | CLOUD COMPUTING - VIRTUALIZATION |
| Operating Systems & Virtualisation (OSV) | CLOUD - COMPUTING - SERVICES | CLOUD COMPUTING - VIRTUALIZATION |
| Privacy & Online Rights (POR) | Confidentiality | CLOUD COMPUTING - PRIVACY CONCERNS |
@@ -601,7 +601,7 @@ There are 48 videos with CyBOK metadata.
| KA | Topics | Keywords |
| --- | --- | --- |
| Forensics (F) | Main Memory Forensics | process information; file information; network connections; artifacts and fragments; challenges of live forensics |
| (OSVS) | OS Hardening | anomaly detection |
| Operating Systems & Virtualisation (OSV) | OS Hardening | anomaly detection |
| Authentication, Authorisation & Accountability (AAA) | Accountability | The fallibility of digital evidence to tampering |
| Malware & Attack Technology (MAT) | Malware Detection | identifying the presence of malware |
@@ -620,7 +620,7 @@ There are 48 videos with CyBOK metadata.
| KA | Topics | Keywords |
| --- | --- | --- |
| Forensics (F) | Main Memory Forensics | process information; file information; network connections; artifacts and fragments; challenges of live forensics |
| (OSVS) | OS Hardening | anomaly detection |
| Operating Systems & Virtualisation (OSV) | OS Hardening | anomaly detection |
| Authentication, Authorisation & Accountability (AAA) | Accountability | The fallibility of digital evidence to tampering |
| Malware & Attack Technology (MAT) | Malware Detection | identifying the presence of malware |
@@ -722,7 +722,7 @@ There are 48 videos with CyBOK metadata.
| KA | Topics | Keywords |
| --- | --- | --- |
| Malware & Attack Technology (MAT) | Malware Taxonomy | potentially unwanted programs |
| (OSVS) | Attacker Model | attack surface; threats to security for modern OSs |
| Operating Systems & Virtualisation (OSV) | Attacker Model | attack surface; threats to security for modern OSs |
@@ -838,3 +838,282 @@ There are 48 videos with CyBOK metadata.
## Software, Vulnerabilities and Exploits
by Tom Shaw
![thumbnail](http://img.youtube.com/vi/jo_07iOplzA/mqdefault.jpg)
https://youtu.be/jo_07iOplzA
| KA | Topics | Keywords |
| --- | --- | --- |
| Malware & Attack Technology (MAT) | Attacks and exploitation | EXPLOITATION |
## Software Vulnerabilities
by Tom Shaw
![thumbnail](http://img.youtube.com/vi/1Hy_166CwRk/mqdefault.jpg)
https://youtu.be/1Hy_166CwRk
| KA | Topics | Keywords |
| --- | --- | --- |
| Malware & Attack Technology (MAT) | Attacks and exploitation | EXPLOITATION |
## Structured Output Generation Vulnerabilities
by Z. Cliffe Schreuders
![thumbnail](http://img.youtube.com/vi/nVpqjsfii6c/mqdefault.jpg)
https://youtu.be/nVpqjsfii6c
| KA | Topics | Keywords |
| --- | --- | --- |
| Software Security (SS) | Categories of Vulnerabilities | structured output generation vulnerabilities |
| Software Security (SS) | Prevention of Vulnerabilities | structured output generations mitigations |
## Race Conditions and Time of Check to Time of Use TOCTTOU Vulnerabilities
by Z. Cliffe Schreuders
![thumbnail](http://img.youtube.com/vi/PH73lpG2B1M/mqdefault.jpg)
https://youtu.be/PH73lpG2B1M
| KA | Topics | Keywords |
| --- | --- | --- |
| Software Security (SS) | Categories of Vulnerabilities | race condition vulnerabilities |
| Software Security (SS) | Prevention of Vulnerabilities | race condition mitigations |
## The Format String Vulnerability
by Tom Shaw
![thumbnail](http://img.youtube.com/vi/Du3fVc_ZLiI/mqdefault.jpg)
https://youtu.be/Du3fVc_ZLiI
| KA | Topics | Keywords |
| --- | --- | --- |
| Software Security (SS) | Categories of Vulnerabilities | Format string attacks |
## Fuzzing Part 1
by Z. Cliffe Schreuders
![thumbnail](http://img.youtube.com/vi/nwxtlR31hvw/mqdefault.jpg)
https://youtu.be/nwxtlR31hvw
| KA | Topics | Keywords |
| --- | --- | --- |
| Software Security (SS) | Detection of Vulnerabilities | dynamic detection |
## Fuzzing Part 2
by Z. Cliffe Schreuders
![thumbnail](http://img.youtube.com/vi/vT2PP7VnSNw/mqdefault.jpg)
https://youtu.be/vT2PP7VnSNw
| KA | Topics | Keywords |
| --- | --- | --- |
| Software Security (SS) | Detection of Vulnerabilities | dynamic detection |
## Overflows and Stack Smashing Buffer Overflows
by Z. Cliffe Schreuders
![thumbnail](http://img.youtube.com/vi/Zh7IdmnCfy0/mqdefault.jpg)
https://youtu.be/Zh7IdmnCfy0
| KA | Topics | Keywords |
| --- | --- | --- |
| Software Security (SS) | Categories of Vulnerabilities | memory management vulnerabilities |
## Writing Exploits (Buffer Overflows Part 2)
by Z. Cliffe Schreuders
![thumbnail](http://img.youtube.com/vi/WU06L-u0t2Q/mqdefault.jpg)
https://youtu.be/WU06L-u0t2Q
| KA | Topics | Keywords |
| --- | --- | --- |
| Software Security (SS) | Categories of Vulnerabilities | memory management vulnerabilities |
## Memory Vulnerabilities
by Tom Shaw
![thumbnail](http://img.youtube.com/vi/j2S-XgY-Fyg/mqdefault.jpg)
https://youtu.be/j2S-XgY-Fyg
| KA | Topics | Keywords |
| --- | --- | --- |
| Software Security (SS) | Categories of Vulnerabilities | memory management vulnerabilities |
## The Stack (part 1)
by Tom Shaw
![thumbnail](http://img.youtube.com/vi/Lf1UPaqPJMM/mqdefault.jpg)
https://youtu.be/Lf1UPaqPJMM
| KA | Topics | Keywords |
| --- | --- | --- |
| Software Security (SS) | Categories of Vulnerabilities | memory management vulnerabilities |
| (N/A) | Technical details underpinning exploit development | The stack |
## The Stack (part 2)
by Tom Shaw
![thumbnail](http://img.youtube.com/vi/5OUQ7ExlgKI/mqdefault.jpg)
https://youtu.be/5OUQ7ExlgKI
| KA | Topics | Keywords |
| --- | --- | --- |
| Software Security (SS) | Categories of Vulnerabilities | memory management vulnerabilities |
| (N/A) | Technical details underpinning exploit development | The stack |
## Threat modeling using STRIDE and Attack Trees
by Z. Cliffe Schreuders
![thumbnail](http://img.youtube.com/vi/oi_CfBe_umU/mqdefault.jpg)
https://youtu.be/oi_CfBe_umU
| KA | Topics | Keywords |
| --- | --- | --- |
| (SSL) | Prescriptive Processes | Microsoft SDL |
| Risk Management & Governance (RMG) | THREAT ANALYSIS | THREAT MODEL; ATTACK TREES |
## STRIDE Threat Modeling using Microsoft Threat Modeling Tool
by Z. Cliffe Schreuders
![thumbnail](http://img.youtube.com/vi/Wry2get_RRc/mqdefault.jpg)
https://youtu.be/Wry2get_RRc
| KA | Topics | Keywords |
| --- | --- | --- |
| (SSL) | Prescriptive Processes | Microsoft SDL |
| Risk Management & Governance (RMG) | THREAT ANALYSIS | THREAT MODEL; ATTACK TREES |
## Secure Design Principles
by Z. Cliffe Schreuders
![thumbnail](http://img.youtube.com/vi/ywLXfSR5YWk/mqdefault.jpg)
https://youtu.be/ywLXfSR5YWk
| KA | Topics | Keywords |
| --- | --- | --- |
| Operating Systems & Virtualisation (OSV) | OS Security Principles | Saltzer and Schroeder’s principles; newer principles |
## Secure Development Lifecycles
by Z. Cliffe Schreuders
![thumbnail](http://img.youtube.com/vi/v2rChKDAmFg/mqdefault.jpg)
https://youtu.be/v2rChKDAmFg
| KA | Topics | Keywords |
| --- | --- | --- |
| (SSL) | Motivations for Secure Software Lifecycle | vulnerabilities can be exploited without being noticed |
| (SSL) | Prescriptive Processes | Microsoft SDL; SAFECode; Touchpoints |
## Open source development and security practices
by Z. Cliffe Schreuders
![thumbnail](http://img.youtube.com/vi/xwsBaNQZozg/mqdefault.jpg)
https://youtu.be/xwsBaNQZozg
| KA | Topics | Keywords |
| --- | --- | --- |
| (SSL) | Prescriptive Processes | Open source secure development |

584
README-CyBOK-Scenarios-Indexed.md
View File

@@ -2,7 +2,7 @@
The Cyber Security Body of Knowledge (CyBOK) is a body of knowledge that aims to encapsulate the various knowledge areas present within cyber security. Scenarios within SecGen now contain XML elements linking them to CyBOK knowledge areas and specific topics within those knowledge areas. Additionally, video lectures for scenarios are tagged with CyBOK associations.
This file is an autogenerated index and cross referencing of the 91 SecGen scenarios that have CyBOK metadata (mostly practical labs) .
This file is an autogenerated index and cross referencing of the 103 SecGen scenarios that have CyBOK metadata (mostly practical labs) .
You can browse the list below in terms of the [CyBOK Knowledge Areas, and Topics](#scenarios-indexed-by-cybok-knowledge-area-ka). The [list of scenarios](#scenario-cybok-keywords) in the second half of this document includes keywords (also known as "indicative topics" in CyBOK terminology).
@@ -18,78 +18,83 @@ You can browse the list below in terms of the [CyBOK Knowledge Areas, and Topics
### AAA Scenarios
[labs/authentication_and_access_controls/ads_1_authentication.xml](#labsauthentication_and_access_controlsads_1_authenticationxml)</br>[labs/authentication_and_access_controls/ads_2_pam.xml](#labsauthentication_and_access_controlsads_2_pamxml)</br>[labs/authentication_and_access_controls/ads_3_access_controls.xml](#labsauthentication_and_access_controlsads_3_access_controlsxml)</br>[labs/authentication_and_access_controls/ads_4_suid.xml](#labsauthentication_and_access_controlsads_4_suidxml)</br>[labs/authentication_and_access_controls/ads_5_facls.xml](#labsauthentication_and_access_controlsads_5_faclsxml)</br>[labs/authentication_and_access_controls/ads_6_containers.xml](#labsauthentication_and_access_controlsads_6_containersxml)</br>[labs/authentication_and_access_controls/ads_7_apparmor.xml](#labsauthentication_and_access_controlsads_7_apparmorxml)</br>[labs/labtainers/acl-hackerbot-flags.xml](#labslabtainersacl-hackerbot-flagsxml)</br>[labs/labtainers/acl.xml](#labslabtainersaclxml)</br>[labs/labtainers/file-integrity.xml](#labslabtainersfile-integrityxml)</br>[labs/labtainers/ldap.xml](#labslabtainersldapxml)</br>[labs/labtainers/macs-hash.xml](#labslabtainersmacs-hashxml)</br>[labs/labtainers/nix-commands.xml](#labslabtainersnix-commandsxml)</br>[labs/labtainers/onewayhash.xml](#labslabtainersonewayhashxml)</br>[labs/labtainers/radius.xml](#labslabtainersradiusxml)</br>[labs/labtainers/setuid-env.xml](#labslabtainerssetuid-envxml)</br>[labs/response_and_investigation/1_integrity_protection.xml](#labsresponse_and_investigation1_integrity_protectionxml)</br>[labs/response_and_investigation/7_live_analysis.xml](#labsresponse_and_investigation7_live_analysisxml)</br>[labs/response_and_investigation/8_dead_analysis.xml](#labsresponse_and_investigation8_dead_analysisxml)</br>
[labs/authentication_and_access_controls/ads_1_authentication.xml](#labsauthentication_and_access_controlsads_1_authenticationxml)</br>[labs/authentication_and_access_controls/ads_2_pam.xml](#labsauthentication_and_access_controlsads_2_pamxml)</br>[labs/authentication_and_access_controls/ads_3_access_controls.xml](#labsauthentication_and_access_controlsads_3_access_controlsxml)</br>[labs/authentication_and_access_controls/ads_4_suid.xml](#labsauthentication_and_access_controlsads_4_suidxml)</br>[labs/authentication_and_access_controls/ads_5_facls.xml](#labsauthentication_and_access_controlsads_5_faclsxml)</br>[labs/authentication_and_access_controls/ads_6_containers.xml](#labsauthentication_and_access_controlsads_6_containersxml)</br>[labs/authentication_and_access_controls/ads_7_apparmor.xml](#labsauthentication_and_access_controlsads_7_apparmorxml)</br>[labs/labtainers/acl-hackerbot-flags.xml](#labslabtainersacl-hackerbot-flagsxml)</br>[labs/labtainers/acl.xml](#labslabtainersaclxml)</br>[labs/labtainers/cyberciege.xml](#labslabtainerscyberciegexml)</br>[labs/labtainers/file-integrity.xml](#labslabtainersfile-integrityxml)</br>[labs/labtainers/ldap.xml](#labslabtainersldapxml)</br>[labs/labtainers/macs-hash.xml](#labslabtainersmacs-hashxml)</br>[labs/labtainers/nix-commands.xml](#labslabtainersnix-commandsxml)</br>[labs/labtainers/onewayhash.xml](#labslabtainersonewayhashxml)</br>[labs/labtainers/radius.xml](#labslabtainersradiusxml)</br>[labs/labtainers/setuid-env.xml](#labslabtainerssetuid-envxml)</br>[labs/response_and_investigation/1_integrity_protection.xml](#labsresponse_and_investigation1_integrity_protectionxml)</br>[labs/response_and_investigation/7_live_analysis.xml](#labsresponse_and_investigation7_live_analysisxml)</br>[labs/response_and_investigation/8_dead_analysis.xml](#labsresponse_and_investigation8_dead_analysisxml)</br>
### AAA Scenarios by Topics
| Topic | Scenario |
| --- | --- |
Authentication | [labs/authentication_and_access_controls/ads_1_authentication.xml](#labsauthentication_and_access_controlsads_1_authenticationxml)</br>[labs/authentication_and_access_controls/ads_2_pam.xml](#labsauthentication_and_access_controlsads_2_pamxml)</br>[labs/labtainers/file-integrity.xml](#labslabtainersfile-integrityxml)</br>[labs/labtainers/ldap.xml](#labslabtainersldapxml)</br>[labs/labtainers/macs-hash.xml](#labslabtainersmacs-hashxml)</br>[labs/labtainers/onewayhash.xml](#labslabtainersonewayhashxml)</br>[labs/labtainers/radius.xml](#labslabtainersradiusxml)</br>
Authorisation | [labs/authentication_and_access_controls/ads_3_access_controls.xml](#labsauthentication_and_access_controlsads_3_access_controlsxml)</br>[labs/authentication_and_access_controls/ads_4_suid.xml](#labsauthentication_and_access_controlsads_4_suidxml)</br>[labs/authentication_and_access_controls/ads_5_facls.xml](#labsauthentication_and_access_controlsads_5_faclsxml)</br>[labs/authentication_and_access_controls/ads_6_containers.xml](#labsauthentication_and_access_controlsads_6_containersxml)</br>[labs/authentication_and_access_controls/ads_7_apparmor.xml](#labsauthentication_and_access_controlsads_7_apparmorxml)</br>[labs/labtainers/acl-hackerbot-flags.xml](#labslabtainersacl-hackerbot-flagsxml)</br>[labs/labtainers/acl.xml](#labslabtainersaclxml)</br>[labs/labtainers/ldap.xml](#labslabtainersldapxml)</br>[labs/labtainers/nix-commands.xml](#labslabtainersnix-commandsxml)</br>[labs/labtainers/setuid-env.xml](#labslabtainerssetuid-envxml)</br>[labs/response_and_investigation/1_integrity_protection.xml](#labsresponse_and_investigation1_integrity_protectionxml)</br>
Authentication | [labs/authentication_and_access_controls/ads_1_authentication.xml](#labsauthentication_and_access_controlsads_1_authenticationxml)</br>[labs/authentication_and_access_controls/ads_2_pam.xml](#labsauthentication_and_access_controlsads_2_pamxml)</br>[labs/labtainers/cyberciege.xml](#labslabtainerscyberciegexml)</br>[labs/labtainers/file-integrity.xml](#labslabtainersfile-integrityxml)</br>[labs/labtainers/ldap.xml](#labslabtainersldapxml)</br>[labs/labtainers/macs-hash.xml](#labslabtainersmacs-hashxml)</br>[labs/labtainers/onewayhash.xml](#labslabtainersonewayhashxml)</br>[labs/labtainers/radius.xml](#labslabtainersradiusxml)</br>
Authorisation | [labs/authentication_and_access_controls/ads_3_access_controls.xml](#labsauthentication_and_access_controlsads_3_access_controlsxml)</br>[labs/authentication_and_access_controls/ads_4_suid.xml](#labsauthentication_and_access_controlsads_4_suidxml)</br>[labs/authentication_and_access_controls/ads_5_facls.xml](#labsauthentication_and_access_controlsads_5_faclsxml)</br>[labs/authentication_and_access_controls/ads_6_containers.xml](#labsauthentication_and_access_controlsads_6_containersxml)</br>[labs/authentication_and_access_controls/ads_7_apparmor.xml](#labsauthentication_and_access_controlsads_7_apparmorxml)</br>[labs/labtainers/acl-hackerbot-flags.xml](#labslabtainersacl-hackerbot-flagsxml)</br>[labs/labtainers/acl.xml](#labslabtainersaclxml)</br>[labs/labtainers/cyberciege.xml](#labslabtainerscyberciegexml)</br>[labs/labtainers/ldap.xml](#labslabtainersldapxml)</br>[labs/labtainers/nix-commands.xml](#labslabtainersnix-commandsxml)</br>[labs/labtainers/setuid-env.xml](#labslabtainerssetuid-envxml)</br>[labs/response_and_investigation/1_integrity_protection.xml](#labsresponse_and_investigation1_integrity_protectionxml)</br>
Accountability | [labs/response_and_investigation/7_live_analysis.xml](#labsresponse_and_investigation7_live_analysisxml)</br>[labs/response_and_investigation/8_dead_analysis.xml](#labsresponse_and_investigation8_dead_analysisxml)</br>
## (OSVS)
## Operating Systems &amp; Virtualisation (OSV)
### OSVS Scenarios
### OSV Scenarios
[labs/authentication_and_access_controls/ads_1_authentication.xml](#labsauthentication_and_access_controlsads_1_authenticationxml)</br>[labs/authentication_and_access_controls/ads_2_pam.xml](#labsauthentication_and_access_controlsads_2_pamxml)</br>[labs/authentication_and_access_controls/ads_3_access_controls.xml](#labsauthentication_and_access_controlsads_3_access_controlsxml)</br>[labs/authentication_and_access_controls/ads_4_suid.xml](#labsauthentication_and_access_controlsads_4_suidxml)</br>[labs/authentication_and_access_controls/ads_5_facls.xml](#labsauthentication_and_access_controlsads_5_faclsxml)</br>[labs/authentication_and_access_controls/ads_6_containers.xml](#labsauthentication_and_access_controlsads_6_containersxml)</br>[labs/authentication_and_access_controls/ads_7_apparmor.xml](#labsauthentication_and_access_controlsads_7_apparmorxml)</br>[labs/labtainers/acl-hackerbot-flags.xml](#labslabtainersacl-hackerbot-flagsxml)</br>[labs/labtainers/acl.xml](#labslabtainersaclxml)</br>[labs/labtainers/capabilities.xml](#labslabtainerscapabilitiesxml)</br>[labs/labtainers/setuid-env.xml](#labslabtainerssetuid-envxml)</br>[labs/response_and_investigation/1_integrity_protection.xml](#labsresponse_and_investigation1_integrity_protectionxml)</br>[labs/response_and_investigation/2_integrity_detection.xml](#labsresponse_and_investigation2_integrity_detectionxml)</br>[labs/response_and_investigation/7_live_analysis.xml](#labsresponse_and_investigation7_live_analysisxml)</br>
### OSVS Scenarios by Topics
[labs/authentication_and_access_controls/ads_1_authentication.xml](#labsauthentication_and_access_controlsads_1_authenticationxml)</br>[labs/authentication_and_access_controls/ads_2_pam.xml](#labsauthentication_and_access_controlsads_2_pamxml)</br>[labs/authentication_and_access_controls/ads_3_access_controls.xml](#labsauthentication_and_access_controlsads_3_access_controlsxml)</br>[labs/authentication_and_access_controls/ads_4_suid.xml](#labsauthentication_and_access_controlsads_4_suidxml)</br>[labs/authentication_and_access_controls/ads_5_facls.xml](#labsauthentication_and_access_controlsads_5_faclsxml)</br>[labs/authentication_and_access_controls/ads_6_containers.xml](#labsauthentication_and_access_controlsads_6_containersxml)</br>[labs/authentication_and_access_controls/ads_7_apparmor.xml](#labsauthentication_and_access_controlsads_7_apparmorxml)</br>[labs/labtainers/acl-hackerbot-flags.xml](#labslabtainersacl-hackerbot-flagsxml)</br>[labs/labtainers/acl.xml](#labslabtainersaclxml)</br>[labs/labtainers/capabilities.xml](#labslabtainerscapabilitiesxml)</br>[labs/labtainers/cyberciege.xml](#labslabtainerscyberciegexml)</br>[labs/labtainers/setuid-env.xml](#labslabtainerssetuid-envxml)</br>[labs/response_and_investigation/1_integrity_protection.xml](#labsresponse_and_investigation1_integrity_protectionxml)</br>[labs/response_and_investigation/2_integrity_detection.xml](#labsresponse_and_investigation2_integrity_detectionxml)</br>[labs/response_and_investigation/7_live_analysis.xml](#labsresponse_and_investigation7_live_analysisxml)</br>
### OSV Scenarios by Topics
| Topic | Scenario |
| --- | --- |
Primitives for Isolation and Mediation | [labs/authentication_and_access_controls/ads_1_authentication.xml](#labsauthentication_and_access_controlsads_1_authenticationxml)</br>[labs/authentication_and_access_controls/ads_2_pam.xml](#labsauthentication_and_access_controlsads_2_pamxml)</br>[labs/authentication_and_access_controls/ads_3_access_controls.xml](#labsauthentication_and_access_controlsads_3_access_controlsxml)</br>[labs/authentication_and_access_controls/ads_4_suid.xml](#labsauthentication_and_access_controlsads_4_suidxml)</br>[labs/authentication_and_access_controls/ads_5_facls.xml](#labsauthentication_and_access_controlsads_5_faclsxml)</br>[labs/authentication_and_access_controls/ads_6_containers.xml](#labsauthentication_and_access_controlsads_6_containersxml)</br>[labs/authentication_and_access_controls/ads_7_apparmor.xml](#labsauthentication_and_access_controlsads_7_apparmorxml)</br>[labs/labtainers/acl-hackerbot-flags.xml](#labslabtainersacl-hackerbot-flagsxml)</br>[labs/labtainers/acl.xml](#labslabtainersaclxml)</br>[labs/labtainers/capabilities.xml](#labslabtainerscapabilitiesxml)</br>[labs/labtainers/setuid-env.xml](#labslabtainerssetuid-envxml)</br>[labs/response_and_investigation/1_integrity_protection.xml](#labsresponse_and_investigation1_integrity_protectionxml)</br>
Role of Operating Systems | [labs/authentication_and_access_controls/ads_3_access_controls.xml](#labsauthentication_and_access_controlsads_3_access_controlsxml)</br>[labs/authentication_and_access_controls/ads_6_containers.xml](#labsauthentication_and_access_controlsads_6_containersxml)</br>[labs/labtainers/acl-hackerbot-flags.xml](#labslabtainersacl-hackerbot-flagsxml)</br>[labs/labtainers/acl.xml](#labslabtainersaclxml)</br>
Related Areas | [labs/labtainers/cyberciege.xml](#labslabtainerscyberciegexml)</br>
OS Hardening | [labs/response_and_investigation/2_integrity_detection.xml](#labsresponse_and_investigation2_integrity_detectionxml)</br>[labs/response_and_investigation/7_live_analysis.xml](#labsresponse_and_investigation7_live_analysisxml)</br>
## (WMS)
## Web &amp; Mobile Security (WAM)
### WMS Scenarios
### WAM Scenarios
[labs/authentication_and_access_controls/ads_6_containers.xml](#labsauthentication_and_access_controlsads_6_containersxml)</br>[labs/labtainers/sql-inject.xml](#labslabtainerssql-injectxml)</br>[labs/web_security/websec_lab.xml](#labsweb_securitywebsec_labxml)</br>
### WMS Scenarios by Topics
[labs/authentication_and_access_controls/ads_6_containers.xml](#labsauthentication_and_access_controlsads_6_containersxml)</br>[labs/labtainers/cyberciege.xml](#labslabtainerscyberciegexml)</br>[labs/labtainers/iptables-ics.xml](#labslabtainersiptables-icsxml)</br>[labs/labtainers/iptables.xml](#labslabtainersiptablesxml)</br>[labs/labtainers/iptables2.xml](#labslabtainersiptables2xml)</br>[labs/labtainers/sql-inject.xml](#labslabtainerssql-injectxml)</br>[labs/labtainers/webtrack.xml](#labslabtainerswebtrackxml)</br>[labs/labtainers/xforge.xml](#labslabtainersxforgexml)</br>[labs/labtainers/xsite.xml](#labslabtainersxsitexml)</br>[labs/web_security/websec_lab.xml](#labsweb_securitywebsec_labxml)</br>
### WAM Scenarios by Topics
| Topic | Scenario |
| --- | --- |
Fundamental Concepts and Approaches | [labs/authentication_and_access_controls/ads_6_containers.xml](#labsauthentication_and_access_controlsads_6_containersxml)</br>[labs/web_security/websec_lab.xml](#labsweb_securitywebsec_labxml)</br>
Server-Side Vulnerabilities and Mitigations | [labs/labtainers/sql-inject.xml](#labslabtainerssql-injectxml)</br>[labs/web_security/websec_lab.xml](#labsweb_securitywebsec_labxml)</br>
Client-Side Vulnerabilities and Mitigations | [labs/web_security/websec_lab.xml](#labsweb_securitywebsec_labxml)</br>
Fundamental Concepts and Approaches | [labs/authentication_and_access_controls/ads_6_containers.xml](#labsauthentication_and_access_controlsads_6_containersxml)</br>[labs/labtainers/cyberciege.xml](#labslabtainerscyberciegexml)</br>[labs/labtainers/webtrack.xml](#labslabtainerswebtrackxml)</br>[labs/web_security/websec_lab.xml](#labsweb_securitywebsec_labxml)</br>
Client-Side Vulnerabilities and Mitigations | [labs/labtainers/cyberciege.xml](#labslabtainerscyberciegexml)</br>[labs/web_security/websec_lab.xml](#labsweb_securitywebsec_labxml)</br>
FIREWALLS | [labs/labtainers/iptables-ics.xml](#labslabtainersiptables-icsxml)</br>[labs/labtainers/iptables.xml](#labslabtainersiptablesxml)</br>[labs/labtainers/iptables2.xml](#labslabtainersiptables2xml)</br>
Server-Side Vulnerabilities and Mitigations | [labs/labtainers/sql-inject.xml](#labslabtainerssql-injectxml)</br>[labs/labtainers/xforge.xml](#labslabtainersxforgexml)</br>[labs/labtainers/xsite.xml](#labslabtainersxsitexml)</br>[labs/web_security/websec_lab.xml](#labsweb_securitywebsec_labxml)</br>
## Software Security (SS)
### SS Scenarios
[labs/authentication_and_access_controls/ads_7_apparmor.xml](#labsauthentication_and_access_controlsads_7_apparmorxml)</br>[labs/introducing_attacks/6_exploitation.xml](#labsintroducing_attacks6_exploitationxml)</br>[labs/labtainers/bufoverflow.xml](#labslabtainersbufoverflowxml)</br>[labs/labtainers/formatstring.xml](#labslabtainersformatstringxml)</br>[labs/labtainers/pass-crack.xml](#labslabtainerspass-crackxml)</br>[labs/labtainers/retlibc.xml](#labslabtainersretlibcxml)</br>[labs/labtainers/sql-inject.xml](#labslabtainerssql-injectxml)</br>[labs/software_security_exploitation/1_c_asm_iof.xml](#labssoftware_security_exploitation1_c_asm_iofxml)</br>[labs/software_security_exploitation/2_race_conditions_format_str.xml](#labssoftware_security_exploitation2_race_conditions_format_strxml)</br>[labs/software_security_exploitation/3_bug_hunting_and_fuzzing.xml](#labssoftware_security_exploitation3_bug_hunting_and_fuzzingxml)</br>[labs/software_security_exploitation/4_exploit_development.xml](#labssoftware_security_exploitation4_exploit_developmentxml)</br>[labs/software_security_exploitation/5_linux_bof_format.xml](#labssoftware_security_exploitation5_linux_bof_formatxml)</br>[labs/software_security_exploitation/6_linux_stack_bof.xml](#labssoftware_security_exploitation6_linux_stack_bofxml)</br>[labs/software_security_exploitation/7_linux_nx_bypass.xml](#labssoftware_security_exploitation7_linux_nx_bypassxml)</br>[labs/software_security_exploitation/8_linux_aslr_bypass.xml](#labssoftware_security_exploitation8_linux_aslr_bypassxml)</br>[labs/web_security/websec_lab.xml](#labsweb_securitywebsec_labxml)</br>
[labs/authentication_and_access_controls/ads_7_apparmor.xml](#labsauthentication_and_access_controlsads_7_apparmorxml)</br>[labs/introducing_attacks/6_exploitation.xml](#labsintroducing_attacks6_exploitationxml)</br>[labs/labtainers/bufoverflow.xml](#labslabtainersbufoverflowxml)</br>[labs/labtainers/formatstring.xml](#labslabtainersformatstringxml)</br>[labs/labtainers/pass-crack.xml](#labslabtainerspass-crackxml)</br>[labs/labtainers/retlibc.xml](#labslabtainersretlibcxml)</br>[labs/labtainers/sql-inject.xml](#labslabtainerssql-injectxml)</br>[labs/labtainers/xforge.xml](#labslabtainersxforgexml)</br>[labs/labtainers/xsite.xml](#labslabtainersxsitexml)</br>[labs/software_security_exploitation/1_c_asm_iof.xml](#labssoftware_security_exploitation1_c_asm_iofxml)</br>[labs/software_security_exploitation/2_race_conditions_format_str.xml](#labssoftware_security_exploitation2_race_conditions_format_strxml)</br>[labs/software_security_exploitation/3_bug_hunting_and_fuzzing.xml](#labssoftware_security_exploitation3_bug_hunting_and_fuzzingxml)</br>[labs/software_security_exploitation/4_exploit_development.xml](#labssoftware_security_exploitation4_exploit_developmentxml)</br>[labs/software_security_exploitation/5_linux_bof_format.xml](#labssoftware_security_exploitation5_linux_bof_formatxml)</br>[labs/software_security_exploitation/6_linux_stack_bof.xml](#labssoftware_security_exploitation6_linux_stack_bofxml)</br>[labs/software_security_exploitation/7_linux_nx_bypass.xml](#labssoftware_security_exploitation7_linux_nx_bypassxml)</br>[labs/software_security_exploitation/8_linux_aslr_bypass.xml](#labssoftware_security_exploitation8_linux_aslr_bypassxml)</br>[labs/web_security/websec_lab.xml](#labsweb_securitywebsec_labxml)</br>
### SS Scenarios by Topics
| Topic | Scenario |
| --- | --- |
Mitigating Exploitation | [labs/authentication_and_access_controls/ads_7_apparmor.xml](#labsauthentication_and_access_controlsads_7_apparmorxml)</br>[labs/labtainers/bufoverflow.xml](#labslabtainersbufoverflowxml)</br>[labs/labtainers/retlibc.xml](#labslabtainersretlibcxml)</br>[labs/software_security_exploitation/7_linux_nx_bypass.xml](#labssoftware_security_exploitation7_linux_nx_bypassxml)</br>[labs/software_security_exploitation/8_linux_aslr_bypass.xml](#labssoftware_security_exploitation8_linux_aslr_bypassxml)</br>
Categories of Vulnerabilities | [labs/introducing_attacks/6_exploitation.xml](#labsintroducing_attacks6_exploitationxml)</br>[labs/labtainers/bufoverflow.xml](#labslabtainersbufoverflowxml)</br>[labs/labtainers/formatstring.xml](#labslabtainersformatstringxml)</br>[labs/labtainers/retlibc.xml](#labslabtainersretlibcxml)</br>[labs/labtainers/sql-inject.xml](#labslabtainerssql-injectxml)</br>[labs/software_security_exploitation/1_c_asm_iof.xml](#labssoftware_security_exploitation1_c_asm_iofxml)</br>[labs/software_security_exploitation/2_race_conditions_format_str.xml](#labssoftware_security_exploitation2_race_conditions_format_strxml)</br>[labs/software_security_exploitation/4_exploit_development.xml](#labssoftware_security_exploitation4_exploit_developmentxml)</br>[labs/software_security_exploitation/5_linux_bof_format.xml](#labssoftware_security_exploitation5_linux_bof_formatxml)</br>[labs/software_security_exploitation/6_linux_stack_bof.xml](#labssoftware_security_exploitation6_linux_stack_bofxml)</br>[labs/software_security_exploitation/7_linux_nx_bypass.xml](#labssoftware_security_exploitation7_linux_nx_bypassxml)</br>[labs/software_security_exploitation/8_linux_aslr_bypass.xml](#labssoftware_security_exploitation8_linux_aslr_bypassxml)</br>[labs/web_security/websec_lab.xml](#labsweb_securitywebsec_labxml)</br>
Authentication | [labs/labtainers/pass-crack.xml](#labslabtainerspass-crackxml)</br>
Prevention of Vulnerabilities | [labs/labtainers/sql-inject.xml](#labslabtainerssql-injectxml)</br>[labs/software_security_exploitation/1_c_asm_iof.xml](#labssoftware_security_exploitation1_c_asm_iofxml)</br>[labs/software_security_exploitation/2_race_conditions_format_str.xml](#labssoftware_security_exploitation2_race_conditions_format_strxml)</br>[labs/web_security/websec_lab.xml](#labsweb_securitywebsec_labxml)</br>
Prevention of Vulnerabilities | [labs/labtainers/sql-inject.xml](#labslabtainerssql-injectxml)</br>[labs/labtainers/xforge.xml](#labslabtainersxforgexml)</br>[labs/labtainers/xsite.xml](#labslabtainersxsitexml)</br>[labs/software_security_exploitation/1_c_asm_iof.xml](#labssoftware_security_exploitation1_c_asm_iofxml)</br>[labs/software_security_exploitation/2_race_conditions_format_str.xml](#labssoftware_security_exploitation2_race_conditions_format_strxml)</br>[labs/web_security/websec_lab.xml](#labsweb_securitywebsec_labxml)</br>
Detection of Vulnerabilities | [labs/software_security_exploitation/3_bug_hunting_and_fuzzing.xml](#labssoftware_security_exploitation3_bug_hunting_and_fuzzingxml)</br>
## Network Security (NS)
### NS Scenarios
[labs/introducing_attacks/1_intro_linux.xml](#labsintroducing_attacks1_intro_linuxxml)</br>[labs/introducing_attacks/4_dns_footprinting.xml](#labsintroducing_attacks4_dns_footprintingxml)</br>[labs/introducing_attacks/5_scanning.xml](#labsintroducing_attacks5_scanningxml)</br>[labs/labtainers/arp-spoof.xml](#labslabtainersarp-spoofxml)</br>[labs/labtainers/denyhost.xml](#labslabtainersdenyhostxml)</br>[labs/labtainers/dmz-example.xml](#labslabtainersdmz-examplexml)</br>[labs/labtainers/dmz-lab.xml](#labslabtainersdmz-labxml)</br>[labs/labtainers/iptables-ics.xml](#labslabtainersiptables-icsxml)</br>[labs/labtainers/iptables.xml](#labslabtainersiptablesxml)</br>[labs/labtainers/iptables2.xml](#labslabtainersiptables2xml)</br>[labs/labtainers/local-dns.xml](#labslabtainerslocal-dnsxml)</br>[labs/labtainers/nix-commands.xml](#labslabtainersnix-commandsxml)</br>[labs/labtainers/nmap-discovery.xml](#labslabtainersnmap-discoveryxml)</br>[labs/labtainers/nmap-ssh.xml](#labslabtainersnmap-sshxml)</br>[labs/labtainers/pcapanalysis.xml](#labslabtainerspcapanalysisxml)</br>[labs/labtainers/pubkey.xml](#labslabtainerspubkeyxml)</br>[labs/labtainers/radius.xml](#labslabtainersradiusxml)</br>[labs/labtainers/remote-dns.xml](#labslabtainersremote-dnsxml)</br>[labs/labtainers/routing-basics.xml](#labslabtainersrouting-basicsxml)</br>[labs/labtainers/routing-basics2.xml](#labslabtainersrouting-basics2xml)</br>[labs/labtainers/snort.xml](#labslabtainerssnortxml)</br>[labs/response_and_investigation/4_ids.xml](#labsresponse_and_investigation4_idsxml)</br>[labs/response_and_investigation/5_ids_rules.xml](#labsresponse_and_investigation5_ids_rulesxml)</br>[labs/response_and_investigation/6_exfiltration_detection.xml](#labsresponse_and_investigation6_exfiltration_detectionxml)</br>
[labs/introducing_attacks/1_intro_linux.xml](#labsintroducing_attacks1_intro_linuxxml)</br>[labs/introducing_attacks/4_dns_footprinting.xml](#labsintroducing_attacks4_dns_footprintingxml)</br>[labs/introducing_attacks/5_scanning.xml](#labsintroducing_attacks5_scanningxml)</br>[labs/labtainers/arp-spoof.xml](#labslabtainersarp-spoofxml)</br>[labs/labtainers/cyberciege.xml](#labslabtainerscyberciegexml)</br>[labs/labtainers/denyhost.xml](#labslabtainersdenyhostxml)</br>[labs/labtainers/dmz-example.xml](#labslabtainersdmz-examplexml)</br>[labs/labtainers/dmz-lab.xml](#labslabtainersdmz-labxml)</br>[labs/labtainers/grfics.xml](#labslabtainersgrficsxml)</br>[labs/labtainers/iptables-ics.xml](#labslabtainersiptables-icsxml)</br>[labs/labtainers/iptables.xml](#labslabtainersiptablesxml)</br>[labs/labtainers/iptables2.xml](#labslabtainersiptables2xml)</br>[labs/labtainers/local-dns.xml](#labslabtainerslocal-dnsxml)</br>[labs/labtainers/nix-commands.xml](#labslabtainersnix-commandsxml)</br>[labs/labtainers/nmap-discovery.xml](#labslabtainersnmap-discoveryxml)</br>[labs/labtainers/nmap-ssh.xml](#labslabtainersnmap-sshxml)</br>[labs/labtainers/pcapanalysis.xml](#labslabtainerspcapanalysisxml)</br>[labs/labtainers/pubkey.xml](#labslabtainerspubkeyxml)</br>[labs/labtainers/radius.xml](#labslabtainersradiusxml)</br>[labs/labtainers/remote-dns.xml](#labslabtainersremote-dnsxml)</br>[labs/labtainers/routing-basics.xml](#labslabtainersrouting-basicsxml)</br>[labs/labtainers/routing-basics2.xml](#labslabtainersrouting-basics2xml)</br>[labs/labtainers/snort.xml](#labslabtainerssnortxml)</br>[labs/labtainers/tcpip.xml](#labslabtainerstcpipxml)</br>[labs/labtainers/telnetlab.xml](#labslabtainerstelnetlabxml)</br>[labs/labtainers/vpnlab.xml](#labslabtainersvpnlabxml)</br>[labs/labtainers/vpnlab2.xml](#labslabtainersvpnlab2xml)</br>[labs/response_and_investigation/4_ids.xml](#labsresponse_and_investigation4_idsxml)</br>[labs/response_and_investigation/5_ids_rules.xml](#labsresponse_and_investigation5_ids_rulesxml)</br>[labs/response_and_investigation/6_exfiltration_detection.xml](#labsresponse_and_investigation6_exfiltration_detectionxml)</br>
### NS Scenarios by Topics
| Topic | Scenario |
| --- | --- |
Network Protocols and Vulnerability | [labs/introducing_attacks/1_intro_linux.xml](#labsintroducing_attacks1_intro_linuxxml)</br>[labs/labtainers/arp-spoof.xml](#labslabtainersarp-spoofxml)</br>[labs/labtainers/local-dns.xml](#labslabtainerslocal-dnsxml)</br>[labs/labtainers/remote-dns.xml](#labslabtainersremote-dnsxml)</br>
Network Protocols and Vulnerability | [labs/introducing_attacks/1_intro_linux.xml](#labsintroducing_attacks1_intro_linuxxml)</br>[labs/labtainers/arp-spoof.xml](#labslabtainersarp-spoofxml)</br>[labs/labtainers/local-dns.xml](#labslabtainerslocal-dnsxml)</br>[labs/labtainers/remote-dns.xml](#labslabtainersremote-dnsxml)</br>[labs/labtainers/tcpip.xml](#labslabtainerstcpipxml)</br>
PENETRATION TESTING | [labs/introducing_attacks/4_dns_footprinting.xml](#labsintroducing_attacks4_dns_footprintingxml)</br>[labs/introducing_attacks/5_scanning.xml](#labsintroducing_attacks5_scanningxml)</br>[labs/labtainers/nix-commands.xml](#labslabtainersnix-commandsxml)</br>[labs/labtainers/nmap-discovery.xml](#labslabtainersnmap-discoveryxml)</br>[labs/labtainers/nmap-ssh.xml](#labslabtainersnmap-sshxml)</br>
Network Defence Tools | [labs/labtainers/denyhost.xml](#labslabtainersdenyhostxml)</br>[labs/labtainers/dmz-example.xml](#labslabtainersdmz-examplexml)</br>[labs/labtainers/dmz-lab.xml](#labslabtainersdmz-labxml)</br>[labs/labtainers/iptables-ics.xml](#labslabtainersiptables-icsxml)</br>[labs/labtainers/iptables.xml](#labslabtainersiptablesxml)</br>[labs/labtainers/iptables2.xml](#labslabtainersiptables2xml)</br>[labs/labtainers/snort.xml](#labslabtainerssnortxml)</br>[labs/response_and_investigation/4_ids.xml](#labsresponse_and_investigation4_idsxml)</br>[labs/response_and_investigation/5_ids_rules.xml](#labsresponse_and_investigation5_ids_rulesxml)</br>[labs/response_and_investigation/6_exfiltration_detection.xml](#labsresponse_and_investigation6_exfiltration_detectionxml)</br>
Internet Architecture | [labs/labtainers/iptables-ics.xml](#labslabtainersiptables-icsxml)</br>[labs/labtainers/iptables.xml](#labslabtainersiptablesxml)</br>[labs/labtainers/iptables2.xml](#labslabtainersiptables2xml)</br>[labs/labtainers/pubkey.xml](#labslabtainerspubkeyxml)</br>[labs/labtainers/radius.xml](#labslabtainersradiusxml)</br>[labs/labtainers/routing-basics.xml](#labslabtainersrouting-basicsxml)</br>[labs/labtainers/routing-basics2.xml](#labslabtainersrouting-basics2xml)</br>
Internet Architecture | [labs/labtainers/cyberciege.xml](#labslabtainerscyberciegexml)</br>[labs/labtainers/iptables-ics.xml](#labslabtainersiptables-icsxml)</br>[labs/labtainers/iptables.xml](#labslabtainersiptablesxml)</br>[labs/labtainers/iptables2.xml](#labslabtainersiptables2xml)</br>[labs/labtainers/pubkey.xml](#labslabtainerspubkeyxml)</br>[labs/labtainers/radius.xml](#labslabtainersradiusxml)</br>[labs/labtainers/routing-basics.xml](#labslabtainersrouting-basicsxml)</br>[labs/labtainers/routing-basics2.xml](#labslabtainersrouting-basics2xml)</br>[labs/labtainers/tcpip.xml](#labslabtainerstcpipxml)</br>
Network Defence Tools | [labs/labtainers/cyberciege.xml](#labslabtainerscyberciegexml)</br>[labs/labtainers/denyhost.xml](#labslabtainersdenyhostxml)</br>[labs/labtainers/dmz-example.xml](#labslabtainersdmz-examplexml)</br>[labs/labtainers/dmz-lab.xml](#labslabtainersdmz-labxml)</br>[labs/labtainers/grfics.xml](#labslabtainersgrficsxml)</br>[labs/labtainers/iptables-ics.xml](#labslabtainersiptables-icsxml)</br>[labs/labtainers/iptables.xml](#labslabtainersiptablesxml)</br>[labs/labtainers/iptables2.xml](#labslabtainersiptables2xml)</br>[labs/labtainers/snort.xml](#labslabtainerssnortxml)</br>[labs/labtainers/vpnlab.xml](#labslabtainersvpnlabxml)</br>[labs/labtainers/vpnlab2.xml](#labslabtainersvpnlab2xml)</br>[labs/response_and_investigation/4_ids.xml](#labsresponse_and_investigation4_idsxml)</br>[labs/response_and_investigation/5_ids_rules.xml](#labsresponse_and_investigation5_ids_rulesxml)</br>[labs/response_and_investigation/6_exfiltration_detection.xml](#labsresponse_and_investigation6_exfiltration_detectionxml)</br>
OSI (OPEN SYSTEM INTERCONNECT) MODEL | [labs/labtainers/pcapanalysis.xml](#labslabtainerspcapanalysisxml)</br>
REMOTE ACCESS | [labs/labtainers/telnetlab.xml](#labslabtainerstelnetlabxml)</br>
TCP/IP | [labs/labtainers/telnetlab.xml](#labslabtainerstelnetlabxml)</br>
## Security Operations &amp; Incident Management (SOIM)
### SOIM Scenarios
[labs/introducing_attacks/1_intro_linux.xml](#labsintroducing_attacks1_intro_linuxxml)</br>[labs/introducing_attacks/2_malware_msf_payloads.xml](#labsintroducing_attacks2_malware_msf_payloadsxml)</br>[labs/introducing_attacks/3_vulnerabilities.xml](#labsintroducing_attacks3_vulnerabilitiesxml)</br>[labs/introducing_attacks/4_dns_footprinting.xml](#labsintroducing_attacks4_dns_footprintingxml)</br>[labs/introducing_attacks/5_scanning.xml](#labsintroducing_attacks5_scanningxml)</br>[labs/introducing_attacks/6_exploitation.xml](#labsintroducing_attacks6_exploitationxml)</br>[labs/introducing_attacks/7_post-exploitation.xml](#labsintroducing_attacks7_post-exploitationxml)</br>[labs/introducing_attacks/8_vulnerability_analysis.xml](#labsintroducing_attacks8_vulnerability_analysisxml)</br>[labs/labtainers/arp-spoof.xml](#labslabtainersarp-spoofxml)</br>[labs/labtainers/backups.xml](#labslabtainersbackupsxml)</br>[labs/labtainers/backups2.xml](#labslabtainersbackups2xml)</br>[labs/labtainers/capabilities.xml](#labslabtainerscapabilitiesxml)</br>[labs/labtainers/centos-log.xml](#labslabtainerscentos-logxml)</br>[labs/labtainers/centos-log2.xml](#labslabtainerscentos-log2xml)</br>[labs/labtainers/cyberciege.xml](#labslabtainerscyberciegexml)</br>[labs/labtainers/denyhost.xml](#labslabtainersdenyhostxml)</br>[labs/labtainers/file-integrity.xml](#labslabtainersfile-integrityxml)</br>[labs/labtainers/ldap.xml](#labslabtainersldapxml)</br>[labs/labtainers/metasploit.xml](#labslabtainersmetasploitxml)</br>[labs/labtainers/nmap-ssh.xml](#labslabtainersnmap-sshxml)</br>[labs/labtainers/packet-introspection.xml](#labslabtainerspacket-introspectionxml)</br>[labs/labtainers/pcapanalysis.xml](#labslabtainerspcapanalysisxml)</br>[labs/labtainers/snort.xml](#labslabtainerssnortxml)</br>[labs/response_and_investigation/2_integrity_detection.xml](#labsresponse_and_investigation2_integrity_detectionxml)</br>[labs/response_and_investigation/3_backups_and_recovery.xml](#labsresponse_and_investigation3_backups_and_recoveryxml)</br>[labs/response_and_investigation/4_ids.xml](#labsresponse_and_investigation4_idsxml)</br>[labs/response_and_investigation/5_ids_rules.xml](#labsresponse_and_investigation5_ids_rulesxml)</br>[labs/response_and_investigation/6_exfiltration_detection.xml](#labsresponse_and_investigation6_exfiltration_detectionxml)</br>
[labs/introducing_attacks/1_intro_linux.xml](#labsintroducing_attacks1_intro_linuxxml)</br>[labs/introducing_attacks/2_malware_msf_payloads.xml](#labsintroducing_attacks2_malware_msf_payloadsxml)</br>[labs/introducing_attacks/3_vulnerabilities.xml](#labsintroducing_attacks3_vulnerabilitiesxml)</br>[labs/introducing_attacks/4_dns_footprinting.xml](#labsintroducing_attacks4_dns_footprintingxml)</br>[labs/introducing_attacks/5_scanning.xml](#labsintroducing_attacks5_scanningxml)</br>[labs/introducing_attacks/6_exploitation.xml](#labsintroducing_attacks6_exploitationxml)</br>[labs/introducing_attacks/7_post-exploitation.xml](#labsintroducing_attacks7_post-exploitationxml)</br>[labs/introducing_attacks/8_vulnerability_analysis.xml](#labsintroducing_attacks8_vulnerability_analysisxml)</br>[labs/labtainers/arp-spoof.xml](#labslabtainersarp-spoofxml)</br>[labs/labtainers/backups.xml](#labslabtainersbackupsxml)</br>[labs/labtainers/backups2.xml](#labslabtainersbackups2xml)</br>[labs/labtainers/capabilities.xml](#labslabtainerscapabilitiesxml)</br>[labs/labtainers/centos-log.xml](#labslabtainerscentos-logxml)</br>[labs/labtainers/centos-log2.xml](#labslabtainerscentos-log2xml)</br>[labs/labtainers/cyberciege.xml](#labslabtainerscyberciegexml)</br>[labs/labtainers/denyhost.xml](#labslabtainersdenyhostxml)</br>[labs/labtainers/file-integrity.xml](#labslabtainersfile-integrityxml)</br>[labs/labtainers/grassmarlin.xml](#labslabtainersgrassmarlinxml)</br>[labs/labtainers/ldap.xml](#labslabtainersldapxml)</br>[labs/labtainers/metasploit.xml](#labslabtainersmetasploitxml)</br>[labs/labtainers/nmap-ssh.xml](#labslabtainersnmap-sshxml)</br>[labs/labtainers/packet-introspection.xml](#labslabtainerspacket-introspectionxml)</br>[labs/labtainers/pcapanalysis.xml](#labslabtainerspcapanalysisxml)</br>[labs/labtainers/snort.xml](#labslabtainerssnortxml)</br>[labs/labtainers/sys-log.xml](#labslabtainerssys-logxml)</br>[labs/labtainers/wireshark-intro.xml](#labslabtainerswireshark-introxml)</br>[labs/response_and_investigation/2_integrity_detection.xml](#labsresponse_and_investigation2_integrity_detectionxml)</br>[labs/response_and_investigation/3_backups_and_recovery.xml](#labsresponse_and_investigation3_backups_and_recoveryxml)</br>[labs/response_and_investigation/4_ids.xml](#labsresponse_and_investigation4_idsxml)</br>[labs/response_and_investigation/5_ids_rules.xml](#labsresponse_and_investigation5_ids_rulesxml)</br>[labs/response_and_investigation/6_exfiltration_detection.xml](#labsresponse_and_investigation6_exfiltration_detectionxml)</br>
### SOIM Scenarios by Topics
| Topic | Scenario |
| --- | --- |
PENETRATION TESTING | [labs/introducing_attacks/1_intro_linux.xml](#labsintroducing_attacks1_intro_linuxxml)</br>[labs/introducing_attacks/2_malware_msf_payloads.xml](#labsintroducing_attacks2_malware_msf_payloadsxml)</br>[labs/introducing_attacks/3_vulnerabilities.xml](#labsintroducing_attacks3_vulnerabilitiesxml)</br>[labs/introducing_attacks/4_dns_footprinting.xml](#labsintroducing_attacks4_dns_footprintingxml)</br>[labs/introducing_attacks/5_scanning.xml](#labsintroducing_attacks5_scanningxml)</br>[labs/introducing_attacks/6_exploitation.xml](#labsintroducing_attacks6_exploitationxml)</br>[labs/introducing_attacks/7_post-exploitation.xml](#labsintroducing_attacks7_post-exploitationxml)</br>[labs/introducing_attacks/8_vulnerability_analysis.xml](#labsintroducing_attacks8_vulnerability_analysisxml)</br>[labs/labtainers/metasploit.xml](#labslabtainersmetasploitxml)</br>
Monitor: Data Sources | [labs/labtainers/arp-spoof.xml](#labslabtainersarp-spoofxml)</br>[labs/labtainers/capabilities.xml](#labslabtainerscapabilitiesxml)</br>[labs/labtainers/centos-log.xml](#labslabtainerscentos-logxml)</br>[labs/labtainers/centos-log2.xml](#labslabtainerscentos-log2xml)</br>[labs/labtainers/cyberciege.xml](#labslabtainerscyberciegexml)</br>[labs/labtainers/file-integrity.xml](#labslabtainersfile-integrityxml)</br>[labs/labtainers/ldap.xml](#labslabtainersldapxml)</br>[labs/labtainers/packet-introspection.xml](#labslabtainerspacket-introspectionxml)</br>[labs/labtainers/pcapanalysis.xml](#labslabtainerspcapanalysisxml)</br>[labs/labtainers/snort.xml](#labslabtainerssnortxml)</br>[labs/response_and_investigation/2_integrity_detection.xml](#labsresponse_and_investigation2_integrity_detectionxml)</br>[labs/response_and_investigation/4_ids.xml](#labsresponse_and_investigation4_idsxml)</br>[labs/response_and_investigation/5_ids_rules.xml](#labsresponse_and_investigation5_ids_rulesxml)</br>[labs/response_and_investigation/6_exfiltration_detection.xml](#labsresponse_and_investigation6_exfiltration_detectionxml)</br>
Monitor: Data Sources | [labs/labtainers/arp-spoof.xml](#labslabtainersarp-spoofxml)</br>[labs/labtainers/capabilities.xml](#labslabtainerscapabilitiesxml)</br>[labs/labtainers/centos-log.xml](#labslabtainerscentos-logxml)</br>[labs/labtainers/centos-log2.xml](#labslabtainerscentos-log2xml)</br>[labs/labtainers/file-integrity.xml](#labslabtainersfile-integrityxml)</br>[labs/labtainers/grassmarlin.xml](#labslabtainersgrassmarlinxml)</br>[labs/labtainers/ldap.xml](#labslabtainersldapxml)</br>[labs/labtainers/packet-introspection.xml](#labslabtainerspacket-introspectionxml)</br>[labs/labtainers/pcapanalysis.xml](#labslabtainerspcapanalysisxml)</br>[labs/labtainers/snort.xml](#labslabtainerssnortxml)</br>[labs/labtainers/sys-log.xml](#labslabtainerssys-logxml)</br>[labs/labtainers/wireshark-intro.xml](#labslabtainerswireshark-introxml)</br>[labs/response_and_investigation/2_integrity_detection.xml](#labsresponse_and_investigation2_integrity_detectionxml)</br>[labs/response_and_investigation/4_ids.xml](#labsresponse_and_investigation4_idsxml)</br>[labs/response_and_investigation/5_ids_rules.xml](#labsresponse_and_investigation5_ids_rulesxml)</br>[labs/response_and_investigation/6_exfiltration_detection.xml](#labsresponse_and_investigation6_exfiltration_detectionxml)</br>
Execute: Mitigation and Countermeasures | [labs/labtainers/backups.xml](#labslabtainersbackupsxml)</br>[labs/labtainers/backups2.xml](#labslabtainersbackups2xml)</br>[labs/labtainers/denyhost.xml](#labslabtainersdenyhostxml)</br>[labs/labtainers/snort.xml](#labslabtainerssnortxml)</br>[labs/response_and_investigation/3_backups_and_recovery.xml](#labsresponse_and_investigation3_backups_and_recoveryxml)</br>[labs/response_and_investigation/4_ids.xml](#labsresponse_and_investigation4_idsxml)</br>
INCIDENT RESPONSE | [labs/labtainers/backups.xml](#labslabtainersbackupsxml)</br>[labs/labtainers/backups2.xml](#labslabtainersbackups2xml)</br>
Knowledge: Intelligence and Analysis | [labs/labtainers/cyberciege.xml](#labslabtainerscyberciegexml)</br>
CM (CONFIGURATION MANAGEMENT) | [labs/labtainers/denyhost.xml](#labslabtainersdenyhostxml)</br>[labs/labtainers/nmap-ssh.xml](#labslabtainersnmap-sshxml)</br>
Analyse: Analysis Methods | [labs/labtainers/snort.xml](#labslabtainerssnortxml)</br>[labs/response_and_investigation/4_ids.xml](#labsresponse_and_investigation4_idsxml)</br>[labs/response_and_investigation/5_ids_rules.xml](#labsresponse_and_investigation5_ids_rulesxml)</br>[labs/response_and_investigation/6_exfiltration_detection.xml](#labsresponse_and_investigation6_exfiltration_detectionxml)</br>
@@ -97,7 +102,7 @@ Analyse: Analysis Methods | [labs/labtainers/snort.xml](#labslabtainerssnortxml)
### MAT Scenarios
[labs/introducing_attacks/2_malware_msf_payloads.xml](#labsintroducing_attacks2_malware_msf_payloadsxml)</br>[labs/introducing_attacks/3_vulnerabilities.xml](#labsintroducing_attacks3_vulnerabilitiesxml)</br>[labs/introducing_attacks/5_scanning.xml](#labsintroducing_attacks5_scanningxml)</br>[labs/introducing_attacks/6_exploitation.xml](#labsintroducing_attacks6_exploitationxml)</br>[labs/introducing_attacks/7_post-exploitation.xml](#labsintroducing_attacks7_post-exploitationxml)</br>[labs/introducing_attacks/8_vulnerability_analysis.xml](#labsintroducing_attacks8_vulnerability_analysisxml)</br>[labs/labtainers/acl-hackerbot-flags.xml](#labslabtainersacl-hackerbot-flagsxml)</br>[labs/labtainers/acl.xml](#labslabtainersaclxml)</br>[labs/labtainers/bufoverflow.xml](#labslabtainersbufoverflowxml)</br>[labs/labtainers/formatstring.xml](#labslabtainersformatstringxml)</br>[labs/labtainers/gdblesson.xml](#labslabtainersgdblessonxml)</br>[labs/labtainers/ida.xml](#labslabtainersidaxml)</br>[labs/labtainers/metasploit.xml](#labslabtainersmetasploitxml)</br>[labs/labtainers/retlibc.xml](#labslabtainersretlibcxml)</br>[labs/labtainers/snort.xml](#labslabtainerssnortxml)</br>[labs/response_and_investigation/4_ids.xml](#labsresponse_and_investigation4_idsxml)</br>[labs/response_and_investigation/5_ids_rules.xml](#labsresponse_and_investigation5_ids_rulesxml)</br>[labs/response_and_investigation/7_live_analysis.xml](#labsresponse_and_investigation7_live_analysisxml)</br>[labs/response_and_investigation/8_dead_analysis.xml](#labsresponse_and_investigation8_dead_analysisxml)</br>[labs/software_and_malware_analysis/1_dynamic_and_static_analysis.xml](#labssoftware_and_malware_analysis1_dynamic_and_static_analysisxml)</br>[labs/software_and_malware_analysis/3_c_and_asm.xml](#labssoftware_and_malware_analysis3_c_and_asmxml)</br>[labs/software_and_malware_analysis/4_asm.xml](#labssoftware_and_malware_analysis4_asmxml)</br>[labs/software_and_malware_analysis/5_ghidra.xml](#labssoftware_and_malware_analysis5_ghidraxml)</br>[labs/software_and_malware_analysis/6_ghidra_analysis.xml](#labssoftware_and_malware_analysis6_ghidra_analysisxml)</br>[labs/software_and_malware_analysis/6_ghidra_with_live_malware_samples.xml](#labssoftware_and_malware_analysis6_ghidra_with_live_malware_samplesxml)</br>[labs/software_and_malware_analysis/7_dynamic.xml](#labssoftware_and_malware_analysis7_dynamicxml)</br>[labs/software_and_malware_analysis/8_anti_sre.xml](#labssoftware_and_malware_analysis8_anti_srexml)</br>[labs/software_and_malware_analysis/9_malware_behaviour.xml](#labssoftware_and_malware_analysis9_malware_behaviourxml)</br>[labs/software_security_exploitation/4_exploit_development.xml](#labssoftware_security_exploitation4_exploit_developmentxml)</br>[labs/software_security_exploitation/5_linux_bof_format.xml](#labssoftware_security_exploitation5_linux_bof_formatxml)</br>[labs/software_security_exploitation/6_linux_stack_bof.xml](#labssoftware_security_exploitation6_linux_stack_bofxml)</br>[labs/software_security_exploitation/7_linux_nx_bypass.xml](#labssoftware_security_exploitation7_linux_nx_bypassxml)</br>[labs/software_security_exploitation/8_linux_aslr_bypass.xml](#labssoftware_security_exploitation8_linux_aslr_bypassxml)</br>
[labs/introducing_attacks/2_malware_msf_payloads.xml](#labsintroducing_attacks2_malware_msf_payloadsxml)</br>[labs/introducing_attacks/3_vulnerabilities.xml](#labsintroducing_attacks3_vulnerabilitiesxml)</br>[labs/introducing_attacks/5_scanning.xml](#labsintroducing_attacks5_scanningxml)</br>[labs/introducing_attacks/6_exploitation.xml](#labsintroducing_attacks6_exploitationxml)</br>[labs/introducing_attacks/7_post-exploitation.xml](#labsintroducing_attacks7_post-exploitationxml)</br>[labs/introducing_attacks/8_vulnerability_analysis.xml](#labsintroducing_attacks8_vulnerability_analysisxml)</br>[labs/labtainers/acl-hackerbot-flags.xml](#labslabtainersacl-hackerbot-flagsxml)</br>[labs/labtainers/acl.xml](#labslabtainersaclxml)</br>[labs/labtainers/bufoverflow.xml](#labslabtainersbufoverflowxml)</br>[labs/labtainers/cyberciege.xml](#labslabtainerscyberciegexml)</br>[labs/labtainers/formatstring.xml](#labslabtainersformatstringxml)</br>[labs/labtainers/gdblesson.xml](#labslabtainersgdblessonxml)</br>[labs/labtainers/ida.xml](#labslabtainersidaxml)</br>[labs/labtainers/metasploit.xml](#labslabtainersmetasploitxml)</br>[labs/labtainers/retlibc.xml](#labslabtainersretlibcxml)</br>[labs/labtainers/snort.xml](#labslabtainerssnortxml)</br>[labs/response_and_investigation/4_ids.xml](#labsresponse_and_investigation4_idsxml)</br>[labs/response_and_investigation/5_ids_rules.xml](#labsresponse_and_investigation5_ids_rulesxml)</br>[labs/response_and_investigation/7_live_analysis.xml](#labsresponse_and_investigation7_live_analysisxml)</br>[labs/response_and_investigation/8_dead_analysis.xml](#labsresponse_and_investigation8_dead_analysisxml)</br>[labs/software_and_malware_analysis/1_dynamic_and_static_analysis.xml](#labssoftware_and_malware_analysis1_dynamic_and_static_analysisxml)</br>[labs/software_and_malware_analysis/3_c_and_asm.xml](#labssoftware_and_malware_analysis3_c_and_asmxml)</br>[labs/software_and_malware_analysis/4_asm.xml](#labssoftware_and_malware_analysis4_asmxml)</br>[labs/software_and_malware_analysis/5_ghidra.xml](#labssoftware_and_malware_analysis5_ghidraxml)</br>[labs/software_and_malware_analysis/6_ghidra_analysis.xml](#labssoftware_and_malware_analysis6_ghidra_analysisxml)</br>[labs/software_and_malware_analysis/6_ghidra_with_live_malware_samples.xml](#labssoftware_and_malware_analysis6_ghidra_with_live_malware_samplesxml)</br>[labs/software_and_malware_analysis/7_dynamic.xml](#labssoftware_and_malware_analysis7_dynamicxml)</br>[labs/software_and_malware_analysis/8_anti_sre.xml](#labssoftware_and_malware_analysis8_anti_srexml)</br>[labs/software_and_malware_analysis/9_malware_behaviour.xml](#labssoftware_and_malware_analysis9_malware_behaviourxml)</br>[labs/software_security_exploitation/4_exploit_development.xml](#labssoftware_security_exploitation4_exploit_developmentxml)</br>[labs/software_security_exploitation/5_linux_bof_format.xml](#labssoftware_security_exploitation5_linux_bof_formatxml)</br>[labs/software_security_exploitation/6_linux_stack_bof.xml](#labssoftware_security_exploitation6_linux_stack_bofxml)</br>[labs/software_security_exploitation/7_linux_nx_bypass.xml](#labssoftware_security_exploitation7_linux_nx_bypassxml)</br>[labs/software_security_exploitation/8_linux_aslr_bypass.xml](#labssoftware_security_exploitation8_linux_aslr_bypassxml)</br>
### MAT Scenarios by Topics
| Topic | Scenario |
| --- | --- |
@@ -106,51 +111,94 @@ Malware Analysis | [labs/introducing_attacks/2_malware_msf_payloads.xml](#labsin
Attacks and exploitation | [labs/introducing_attacks/2_malware_msf_payloads.xml](#labsintroducing_attacks2_malware_msf_payloadsxml)</br>[labs/introducing_attacks/3_vulnerabilities.xml](#labsintroducing_attacks3_vulnerabilitiesxml)</br>[labs/introducing_attacks/6_exploitation.xml](#labsintroducing_attacks6_exploitationxml)</br>[labs/introducing_attacks/7_post-exploitation.xml](#labsintroducing_attacks7_post-exploitationxml)</br>[labs/introducing_attacks/8_vulnerability_analysis.xml](#labsintroducing_attacks8_vulnerability_analysisxml)</br>[labs/labtainers/bufoverflow.xml](#labslabtainersbufoverflowxml)</br>[labs/labtainers/formatstring.xml](#labslabtainersformatstringxml)</br>[labs/labtainers/metasploit.xml](#labslabtainersmetasploitxml)</br>[labs/labtainers/retlibc.xml](#labslabtainersretlibcxml)</br>[labs/software_security_exploitation/4_exploit_development.xml](#labssoftware_security_exploitation4_exploit_developmentxml)</br>[labs/software_security_exploitation/5_linux_bof_format.xml](#labssoftware_security_exploitation5_linux_bof_formatxml)</br>[labs/software_security_exploitation/6_linux_stack_bof.xml](#labssoftware_security_exploitation6_linux_stack_bofxml)</br>[labs/software_security_exploitation/7_linux_nx_bypass.xml](#labssoftware_security_exploitation7_linux_nx_bypassxml)</br>[labs/software_security_exploitation/8_linux_aslr_bypass.xml](#labssoftware_security_exploitation8_linux_aslr_bypassxml)</br>
Malicious Activities by Malware | [labs/introducing_attacks/5_scanning.xml](#labsintroducing_attacks5_scanningxml)</br>[labs/introducing_attacks/6_exploitation.xml](#labsintroducing_attacks6_exploitationxml)</br>[labs/introducing_attacks/7_post-exploitation.xml](#labsintroducing_attacks7_post-exploitationxml)</br>[labs/labtainers/metasploit.xml](#labslabtainersmetasploitxml)</br>
MALCODE/MALWARE | [labs/labtainers/acl-hackerbot-flags.xml](#labslabtainersacl-hackerbot-flagsxml)</br>[labs/labtainers/acl.xml](#labslabtainersaclxml)</br>
Malware Detection | [labs/labtainers/snort.xml](#labslabtainerssnortxml)</br>[labs/response_and_investigation/4_ids.xml](#labsresponse_and_investigation4_idsxml)</br>[labs/response_and_investigation/5_ids_rules.xml](#labsresponse_and_investigation5_ids_rulesxml)</br>[labs/response_and_investigation/7_live_analysis.xml](#labsresponse_and_investigation7_live_analysisxml)</br>[labs/response_and_investigation/8_dead_analysis.xml](#labsresponse_and_investigation8_dead_analysisxml)</br>
Malware Detection | [labs/labtainers/cyberciege.xml](#labslabtainerscyberciegexml)</br>[labs/labtainers/snort.xml](#labslabtainerssnortxml)</br>[labs/response_and_investigation/4_ids.xml](#labsresponse_and_investigation4_idsxml)</br>[labs/response_and_investigation/5_ids_rules.xml](#labsresponse_and_investigation5_ids_rulesxml)</br>[labs/response_and_investigation/7_live_analysis.xml](#labsresponse_and_investigation7_live_analysisxml)</br>[labs/response_and_investigation/8_dead_analysis.xml](#labsresponse_and_investigation8_dead_analysisxml)</br>
## Cryptography (C)
### C Scenarios
[labs/labtainers/cyberciege.xml](#labslabtainerscyberciegexml)</br>[labs/labtainers/macs-hash.xml](#labslabtainersmacs-hashxml)</br>[labs/labtainers/onewayhash.xml](#labslabtainersonewayhashxml)</br>[labs/labtainers/pubkey.xml](#labslabtainerspubkeyxml)</br>[labs/labtainers/ssh-agent.xml](#labslabtainersssh-agentxml)</br>[labs/labtainers/sshlab.xml](#labslabtainerssshlabxml)</br>[labs/labtainers/ssl.xml](#labslabtainerssslxml)</br>[labs/labtainers/symkeylab.xml](#labslabtainerssymkeylabxml)</br>
### C Scenarios by Topics
| Topic | Scenario |
| --- | --- |
Schemes | [labs/labtainers/cyberciege.xml](#labslabtainerscyberciegexml)</br>[labs/labtainers/pubkey.xml](#labslabtainerspubkeyxml)</br>[labs/labtainers/symkeylab.xml](#labslabtainerssymkeylabxml)</br>
Public-Key Cryptography | [labs/labtainers/macs-hash.xml](#labslabtainersmacs-hashxml)</br>[labs/labtainers/onewayhash.xml](#labslabtainersonewayhashxml)</br>[labs/labtainers/ssh-agent.xml](#labslabtainersssh-agentxml)</br>[labs/labtainers/sshlab.xml](#labslabtainerssshlabxml)</br>[labs/labtainers/ssl.xml](#labslabtainerssslxml)</br>
Symmetric Cryptography | [labs/labtainers/symkeylab.xml](#labslabtainerssymkeylabxml)</br>
## Cyber-Physical Systems Security (CPS)
### CPS Scenarios
[labs/labtainers/cyberciege.xml](#labslabtainerscyberciegexml)</br>[labs/labtainers/grassmarlin.xml](#labslabtainersgrassmarlinxml)</br>[labs/labtainers/grfics.xml](#labslabtainersgrficsxml)</br>[labs/labtainers/iptables-ics.xml](#labslabtainersiptables-icsxml)</br>[labs/labtainers/plc-app.xml](#labslabtainersplc-appxml)</br>[labs/labtainers/plc-forensics-adv.xml](#labslabtainersplc-forensics-advxml)</br>[labs/labtainers/plc-forensics.xml](#labslabtainersplc-forensicsxml)</br>[labs/labtainers/plc.xml](#labslabtainersplcxml)</br>[labs/labtainers/softplc.xml](#labslabtainerssoftplcxml)</br>[labs/labtainers/softplc2.xml](#labslabtainerssoftplc2xml)</br>[labs/labtainers/ssl.xml](#labslabtainerssslxml)</br>
### CPS Scenarios by Topics
| Topic | Scenario |
| --- | --- |
Cyber-Physical Systems | [labs/labtainers/cyberciege.xml](#labslabtainerscyberciegexml)</br>[labs/labtainers/grassmarlin.xml](#labslabtainersgrassmarlinxml)</br>[labs/labtainers/grfics.xml](#labslabtainersgrficsxml)</br>[labs/labtainers/iptables-ics.xml](#labslabtainersiptables-icsxml)</br>[labs/labtainers/plc-app.xml](#labslabtainersplc-appxml)</br>[labs/labtainers/plc-forensics-adv.xml](#labslabtainersplc-forensics-advxml)</br>[labs/labtainers/plc-forensics.xml](#labslabtainersplc-forensicsxml)</br>[labs/labtainers/plc.xml](#labslabtainersplcxml)</br>[labs/labtainers/softplc.xml](#labslabtainerssoftplcxml)</br>[labs/labtainers/softplc2.xml](#labslabtainerssoftplc2xml)</br>[labs/labtainers/ssl.xml](#labslabtainerssslxml)</br>
Policy and Political Aspects | [labs/labtainers/cyberciege.xml](#labslabtainerscyberciegexml)</br>
Cyber-Physical Systems Domains | [labs/labtainers/grassmarlin.xml](#labslabtainersgrassmarlinxml)</br>[labs/labtainers/grfics.xml](#labslabtainersgrficsxml)</br>[labs/labtainers/iptables-ics.xml](#labslabtainersiptables-icsxml)</br>[labs/labtainers/plc-app.xml](#labslabtainersplc-appxml)</br>[labs/labtainers/plc-forensics-adv.xml](#labslabtainersplc-forensics-advxml)</br>[labs/labtainers/plc-forensics.xml](#labslabtainersplc-forensicsxml)</br>[labs/labtainers/plc.xml](#labslabtainersplcxml)</br>[labs/labtainers/softplc.xml](#labslabtainerssoftplcxml)</br>[labs/labtainers/softplc2.xml](#labslabtainerssoftplc2xml)</br>[labs/labtainers/ssl.xml](#labslabtainerssslxml)</br>
## Hardware Security (HS)
### HS Scenarios
[labs/labtainers/cyberciege.xml](#labslabtainerscyberciegexml)</br>
### HS Scenarios by Topics
| Topic | Scenario |
| --- | --- |
Secure Platforms | [labs/labtainers/cyberciege.xml](#labslabtainerscyberciegexml)</br>
## Privacy &amp; Online Rights (POR)
### POR Scenarios
[labs/labtainers/cyberciege.xml](#labslabtainerscyberciegexml)</br>
### POR Scenarios by Topics
| Topic | Scenario |
| --- | --- |
Confidentiality | [labs/labtainers/cyberciege.xml](#labslabtainerscyberciegexml)</br>
## Risk Management &amp; Governance (RMG)
### RMG Scenarios
[labs/labtainers/cyberciege.xml](#labslabtainerscyberciegexml)</br>
### RMG Scenarios by Topics
| Topic | Scenario |
| --- | --- |
Risk Governance | [labs/labtainers/cyberciege.xml](#labslabtainerscyberciegexml)</br>
## Secure Software Lifecycle (SSL)
### SSL Scenarios
[labs/labtainers/cyberciege.xml](#labslabtainerscyberciegexml)</br>
### SSL Scenarios by Topics
| Topic | Scenario |
| --- | --- |
Motivations for Secure Software Lifecycle | [labs/labtainers/cyberciege.xml](#labslabtainerscyberciegexml)</br>
## Forensics (F)
### F Scenarios
[labs/labtainers/file-deletion.xml](#labslabtainersfile-deletionxml)</br>[labs/labtainers/file-integrity.xml](#labslabtainersfile-integrityxml)</br>[labs/labtainers/macs-hash.xml](#labslabtainersmacs-hashxml)</br>[labs/labtainers/onewayhash.xml](#labslabtainersonewayhashxml)</br>[labs/labtainers/packet-introspection.xml](#labslabtainerspacket-introspectionxml)</br>[labs/labtainers/pass-crack.xml](#labslabtainerspass-crackxml)</br>[labs/labtainers/pcapanalysis.xml](#labslabtainerspcapanalysisxml)</br>[labs/response_and_investigation/2_integrity_detection.xml](#labsresponse_and_investigation2_integrity_detectionxml)</br>[labs/response_and_investigation/6_exfiltration_detection.xml](#labsresponse_and_investigation6_exfiltration_detectionxml)</br>[labs/response_and_investigation/7_live_analysis.xml](#labsresponse_and_investigation7_live_analysisxml)</br>[labs/response_and_investigation/8_dead_analysis.xml](#labsresponse_and_investigation8_dead_analysisxml)</br>
[labs/labtainers/file-deletion.xml](#labslabtainersfile-deletionxml)</br>[labs/labtainers/file-integrity.xml](#labslabtainersfile-integrityxml)</br>[labs/labtainers/macs-hash.xml](#labslabtainersmacs-hashxml)</br>[labs/labtainers/onewayhash.xml](#labslabtainersonewayhashxml)</br>[labs/labtainers/packet-introspection.xml](#labslabtainerspacket-introspectionxml)</br>[labs/labtainers/pass-crack.xml](#labslabtainerspass-crackxml)</br>[labs/labtainers/pcapanalysis.xml](#labslabtainerspcapanalysisxml)</br>[labs/labtainers/webtrack.xml](#labslabtainerswebtrackxml)</br>[labs/response_and_investigation/2_integrity_detection.xml](#labsresponse_and_investigation2_integrity_detectionxml)</br>[labs/response_and_investigation/6_exfiltration_detection.xml](#labsresponse_and_investigation6_exfiltration_detectionxml)</br>[labs/response_and_investigation/7_live_analysis.xml](#labsresponse_and_investigation7_live_analysisxml)</br>[labs/response_and_investigation/8_dead_analysis.xml](#labsresponse_and_investigation8_dead_analysisxml)</br>
### F Scenarios by Topics
| Topic | Scenario |
| --- | --- |
Operating System Analysis | [labs/labtainers/file-deletion.xml](#labslabtainersfile-deletionxml)</br>[labs/labtainers/file-integrity.xml](#labslabtainersfile-integrityxml)</br>[labs/response_and_investigation/8_dead_analysis.xml](#labsresponse_and_investigation8_dead_analysisxml)</br>
Artifact Analysis | [labs/labtainers/macs-hash.xml](#labslabtainersmacs-hashxml)</br>[labs/labtainers/onewayhash.xml](#labslabtainersonewayhashxml)</br>[labs/labtainers/pass-crack.xml](#labslabtainerspass-crackxml)</br>[labs/response_and_investigation/2_integrity_detection.xml](#labsresponse_and_investigation2_integrity_detectionxml)</br>[labs/response_and_investigation/6_exfiltration_detection.xml](#labsresponse_and_investigation6_exfiltration_detectionxml)</br>
Main Memory Forensics | [labs/labtainers/packet-introspection.xml](#labslabtainerspacket-introspectionxml)</br>[labs/labtainers/pcapanalysis.xml](#labslabtainerspcapanalysisxml)</br>[labs/response_and_investigation/7_live_analysis.xml](#labsresponse_and_investigation7_live_analysisxml)</br>
WEB | [labs/labtainers/webtrack.xml](#labslabtainerswebtrackxml)</br>
## Cyber-Physical Systems Security (CPS)
## Adversarial Behaviours (AB)
### CPS Scenarios
### AB Scenarios
[labs/labtainers/iptables-ics.xml](#labslabtainersiptables-icsxml)</br>[labs/labtainers/plc-app.xml](#labslabtainersplc-appxml)</br>[labs/labtainers/plc-forensics-adv.xml](#labslabtainersplc-forensics-advxml)</br>[labs/labtainers/plc-forensics.xml](#labslabtainersplc-forensicsxml)</br>[labs/labtainers/plc.xml](#labslabtainersplcxml)</br>[labs/labtainers/softplc.xml](#labslabtainerssoftplcxml)</br>[labs/labtainers/softplc2.xml](#labslabtainerssoftplc2xml)</br>[labs/labtainers/ssl.xml](#labslabtainerssslxml)</br>
### CPS Scenarios by Topics
[labs/labtainers/grfics.xml](#labslabtainersgrficsxml)</br>
### AB Scenarios by Topics
| Topic | Scenario |
| --- | --- |
Cyber-Physical Systems Domains | [labs/labtainers/iptables-ics.xml](#labslabtainersiptables-icsxml)</br>[labs/labtainers/plc-app.xml](#labslabtainersplc-appxml)</br>[labs/labtainers/plc-forensics-adv.xml](#labslabtainersplc-forensics-advxml)</br>[labs/labtainers/plc-forensics.xml](#labslabtainersplc-forensicsxml)</br>[labs/labtainers/plc.xml](#labslabtainersplcxml)</br>[labs/labtainers/softplc.xml](#labslabtainerssoftplcxml)</br>[labs/labtainers/softplc2.xml](#labslabtainerssoftplc2xml)</br>[labs/labtainers/ssl.xml](#labslabtainerssslxml)</br>
Cyber-Physical Systems | [labs/labtainers/iptables-ics.xml](#labslabtainersiptables-icsxml)</br>[labs/labtainers/plc-app.xml](#labslabtainersplc-appxml)</br>[labs/labtainers/plc-forensics-adv.xml](#labslabtainersplc-forensics-advxml)</br>[labs/labtainers/plc-forensics.xml](#labslabtainersplc-forensicsxml)</br>[labs/labtainers/plc.xml](#labslabtainersplcxml)</br>[labs/labtainers/softplc.xml](#labslabtainerssoftplcxml)</br>[labs/labtainers/softplc2.xml](#labslabtainerssoftplc2xml)</br>[labs/labtainers/ssl.xml](#labslabtainerssslxml)</br>
## Web &amp; Mobile Security (WAM)
### WAM Scenarios
[labs/labtainers/iptables-ics.xml](#labslabtainersiptables-icsxml)</br>[labs/labtainers/iptables.xml](#labslabtainersiptablesxml)</br>[labs/labtainers/iptables2.xml](#labslabtainersiptables2xml)</br>
### WAM Scenarios by Topics
| Topic | Scenario |
| --- | --- |
FIREWALLS | [labs/labtainers/iptables-ics.xml](#labslabtainersiptables-icsxml)</br>[labs/labtainers/iptables.xml](#labslabtainersiptablesxml)</br>[labs/labtainers/iptables2.xml](#labslabtainersiptables2xml)</br>
## Cryptography (C)
### C Scenarios
[labs/labtainers/macs-hash.xml](#labslabtainersmacs-hashxml)</br>[labs/labtainers/onewayhash.xml](#labslabtainersonewayhashxml)</br>[labs/labtainers/pubkey.xml](#labslabtainerspubkeyxml)</br>[labs/labtainers/ssh-agent.xml](#labslabtainersssh-agentxml)</br>[labs/labtainers/sshlab.xml](#labslabtainerssshlabxml)</br>[labs/labtainers/ssl.xml](#labslabtainerssslxml)</br>
### C Scenarios by Topics
| Topic | Scenario |
| --- | --- |
Public-Key Cryptography | [labs/labtainers/macs-hash.xml](#labslabtainersmacs-hashxml)</br>[labs/labtainers/onewayhash.xml](#labslabtainersonewayhashxml)</br>[labs/labtainers/ssh-agent.xml](#labslabtainersssh-agentxml)</br>[labs/labtainers/sshlab.xml](#labslabtainerssshlabxml)</br>[labs/labtainers/ssl.xml](#labslabtainerssslxml)</br>
Schemes | [labs/labtainers/pubkey.xml](#labslabtainerspubkeyxml)</br>
Models | [labs/labtainers/grfics.xml](#labslabtainersgrficsxml)</br>
## Human Factors (HF)
@@ -184,7 +232,7 @@ Fitting the Task to the Human | [labs/labtainers/ssl.xml](#labslabtainerssslxml)
| KA | Topic | Keywords
| --- | --- | --- |
| Authentication, Authorisation &amp; Accountability (AAA) | Authentication | identity management; user authentication; facets of authentication; Cryptography and authentication (hashes and attacks against authentication schemes / passwords) |
| (OSVS) | Primitives for Isolation and Mediation | authentication and identification; Linux authentication; Types of user accounts |
| Operating Systems &amp; Virtualisation (OSV) | Primitives for Isolation and Mediation | authentication and identification; Linux authentication; Types of user accounts |
Command to build VMs and start scenario:
@@ -213,7 +261,7 @@ Command to build VMs and start scenario:
| KA | Topic | Keywords
| --- | --- | --- |
| Authentication, Authorisation &amp; Accountability (AAA) | Authentication | identity management; user authentication; facets of authentication |
| (OSVS) | Primitives for Isolation and Mediation | authentication and identification; Linux authentication; Authentication frameworks (PAM) |
| Operating Systems &amp; Virtualisation (OSV) | Primitives for Isolation and Mediation | authentication and identification; Linux authentication; Authentication frameworks (PAM) |
Command to build VMs and start scenario:
@@ -242,8 +290,8 @@ Command to build VMs and start scenario:
| KA | Topic | Keywords
| --- | --- | --- |
| Authentication, Authorisation &amp; Accountability (AAA) | Authorisation | access control; enforcing access control; ACCESS CONTROL - DAC (DISCRETIONARY ACCESS CONTROL); Vulnerabilities and attacks on access control misconfigurations |
| (OSVS) | Primitives for Isolation and Mediation | Access controls and operating systems; Linux security model; Unix File Permissions; Filesystems; inodes; and commands; umask |
| (OSVS) | Role of Operating Systems | mediation |
| Operating Systems &amp; Virtualisation (OSV) | Primitives for Isolation and Mediation | Access controls and operating systems; Linux security model; Unix File Permissions; Filesystems; inodes; and commands; umask |
| Operating Systems &amp; Virtualisation (OSV) | Role of Operating Systems | mediation |
Command to build VMs and start scenario:
@@ -272,7 +320,7 @@ Command to build VMs and start scenario:
| KA | Topic | Keywords
| --- | --- | --- |
| Authentication, Authorisation &amp; Accountability (AAA) | Authorisation | access control; Elevated privileges; Real and effective identity; Vulnerabilities and attacks on access control misconfigurations |
| (OSVS) | Primitives for Isolation and Mediation | Access controls and operating systems; Linux security model; Unix File Permissions; setuid/setgid; Hardlink protections |
| Operating Systems &amp; Virtualisation (OSV) | Primitives for Isolation and Mediation | Access controls and operating systems; Linux security model; Unix File Permissions; setuid/setgid; Hardlink protections |
Command to build VMs and start scenario:
@@ -301,7 +349,7 @@ Command to build VMs and start scenario:
| KA | Topic | Keywords
| --- | --- | --- |
| Authentication, Authorisation &amp; Accountability (AAA) | Authorisation | access control; ACCESS CONTROL LIST (ACL); Vulnerabilities and attacks on access control misconfigurations |
| (OSVS) | Primitives for Isolation and Mediation | Access controls and operating systems; Linux security model; Linux Extended Access Control Lists (facl) |
| Operating Systems &amp; Virtualisation (OSV) | Primitives for Isolation and Mediation | Access controls and operating systems; Linux security model; Linux Extended Access Control Lists (facl) |
Command to build VMs and start scenario:
@@ -330,9 +378,9 @@ Command to build VMs and start scenario:
| KA | Topic | Keywords
| --- | --- | --- |
| Authentication, Authorisation &amp; Accountability (AAA) | Authorisation | SANDBOX; Application-based access controls: user-based access controls insufficiently limit privileges |
| (OSVS) | Primitives for Isolation and Mediation | capabilities; Container-based sandboxes: chroot; Docker; Rule-based controls: Course grained: Linux capabilities; Vulnerabilities and attacks on sandboxing misconfigurations |
| (OSVS) | Role of Operating Systems | isolation; CONTAINERS |
| (WMS) | Fundamental Concepts and Approaches | sandboxing |
| Operating Systems &amp; Virtualisation (OSV) | Primitives for Isolation and Mediation | capabilities; Container-based sandboxes: chroot; Docker; Rule-based controls: Course grained: Linux capabilities; Vulnerabilities and attacks on sandboxing misconfigurations |
| Operating Systems &amp; Virtualisation (OSV) | Role of Operating Systems | isolation; CONTAINERS |
| Web &amp; Mobile Security (WAM) | Fundamental Concepts and Approaches | sandboxing |
Command to build VMs and start scenario:
@@ -361,7 +409,7 @@ Command to build VMs and start scenario:
| KA | Topic | Keywords
| --- | --- | --- |
| Authentication, Authorisation &amp; Accountability (AAA) | Authorisation | ACCESS CONTROL - MAC (MANDATORY ACCESS CONTROL); ACCESS CONTROL - NDAC (NON-DISCRETIONARY ACCESS CONTROL); Application-based access controls: user-based access controls insufficiently limit privileges; Rule-based sandboxes |
| (OSVS) | Primitives for Isolation and Mediation | Rule-based controls: Fine grained: AppArmor; Vulnerabilities and attacks on sandboxing misconfigurations |
| Operating Systems &amp; Virtualisation (OSV) | Primitives for Isolation and Mediation | Rule-based controls: Fine grained: AppArmor; Vulnerabilities and attacks on sandboxing misconfigurations |
| Software Security (SS) | Mitigating Exploitation | limiting privileges |
@@ -630,9 +678,9 @@ Command to build VMs and start scenario:
| --- | --- | --- |
| Authentication, Authorisation &amp; Accountability (AAA) | Authorisation | access control; enforcing access control; ACCESS CONTROL - DAC (DISCRETIONARY ACCESS CONTROL); Vulnerabilities and attacks on access control misconfigurations |
| Malware &amp; Attack Technology (MAT) | MALCODE/MALWARE | trojan; backdoor; TROJANS - BACKDOOR |
| (OSVS) | Primitives for Isolation and Mediation | Access controls and operating systems; Linux security model; Unix File Permissions; filesystems; inodes; and commands; umask |
| (OSVS) | Primitives for Isolation and Mediation | Access controls and operating systems; Linux security model; Linux Extended Access Control Lists (facl) |
| (OSVS) | Role of Operating Systems | mediation |
| Operating Systems &amp; Virtualisation (OSV) | Primitives for Isolation and Mediation | Access controls and operating systems; Linux security model; Unix File Permissions; filesystems; inodes; and commands; umask |
| Operating Systems &amp; Virtualisation (OSV) | Primitives for Isolation and Mediation | Access controls and operating systems; Linux security model; Linux Extended Access Control Lists (facl) |
| Operating Systems &amp; Virtualisation (OSV) | Role of Operating Systems | mediation |
Command to build VMs and start scenario:
@@ -662,9 +710,9 @@ Command to build VMs and start scenario:
| --- | --- | --- |
| Authentication, Authorisation &amp; Accountability (AAA) | Authorisation | access control; enforcing access control; ACCESS CONTROL - DAC (DISCRETIONARY ACCESS CONTROL); Vulnerabilities and attacks on access control misconfigurations |
| Malware &amp; Attack Technology (MAT) | MALCODE/MALWARE | trojan; backdoor; TROJANS - BACKDOOR |
| (OSVS) | Primitives for Isolation and Mediation | Access controls and operating systems; Linux security model; Unix File Permissions; filesystems; inodes; and commands; umask |
| (OSVS) | Primitives for Isolation and Mediation | Access controls and operating systems; Linux security model; Linux Extended Access Control Lists (facl) |
| (OSVS) | Role of Operating Systems | mediation |
| Operating Systems &amp; Virtualisation (OSV) | Primitives for Isolation and Mediation | Access controls and operating systems; Linux security model; Unix File Permissions; filesystems; inodes; and commands; umask |
| Operating Systems &amp; Virtualisation (OSV) | Primitives for Isolation and Mediation | Access controls and operating systems; Linux security model; Linux Extended Access Control Lists (facl) |
| Operating Systems &amp; Virtualisation (OSV) | Role of Operating Systems | mediation |
Command to build VMs and start scenario:
@@ -809,7 +857,7 @@ Command to build VMs and start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| (OSVS) | Primitives for Isolation and Mediation | capabilities; Rule-based controls: Course grained: Linux capabilities |
| Operating Systems &amp; Virtualisation (OSV) | Primitives for Isolation and Mediation | capabilities; Rule-based controls: Course grained: Linux capabilities |
| Security Operations &amp; Incident Management (SOIM) | Monitor: Data Sources | network traffic |
@@ -894,7 +942,22 @@ Command to build VMs and start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| Security Operations &amp; Incident Management (SOIM) | Monitor: Data Sources | application logs: web server logs and files; system and kernel logs; Syslog |
| Authentication, Authorisation &amp; Accountability (AAA) | Authentication | PASSWORD-BASED |
| Authentication, Authorisation &amp; Accountability (AAA) | Authorisation | ACCESS CONTROL - MAC (MANDATORY ACCESS CONTROL) |
| Cryptography (C) | Schemes | TLS |
| Cyber-Physical Systems Security (CPS) | Cyber-Physical Systems | characteristics; security and privacy concerns |
| Cyber-Physical Systems Security (CPS) | Policy and Political Aspects | industry practices and standards |
| Hardware Security (HS) | Secure Platforms | secure element and smartcard |
| Malware &amp; Attack Technology (MAT) | Malware Detection | identifying the presence of malware; attack detection; attack detection |
| Network Security (NS) | Internet Architecture | transport layer security |
| Network Security (NS) | Network Defence Tools | DEMILITARISED ZONE (DMZ); packet filters; network architecture design; VIRTUAL - PRIVATE NETWORK (VPN) |
| Operating Systems &amp; Virtualisation (OSV) | Related Areas | databases |
| Privacy &amp; Online Rights (POR) | Confidentiality | data confidentiality |
| Risk Management &amp; Governance (RMG) | Risk Governance | risk perception factors; enacting security policy |
| Security Operations &amp; Incident Management (SOIM) | Knowledge: Intelligence and Analysis | situational awareness |
| Secure Software Lifecycle (SSL) | Motivations for Secure Software Lifecycle | customers don't apply patches |
| Web &amp; Mobile Security (WAM) | Client-Side Vulnerabilities and Mitigations | phishing; physical attacks |
| Web &amp; Mobile Security (WAM) | Fundamental Concepts and Approaches | frequent software updates |
Command to build VMs and start scenario:
@@ -1105,6 +1168,67 @@ Command to build VMs and start scenario:
[View source](scenarios/labs/labtainers/gdblesson.xml)
## labs/labtainers/grassmarlin.xml
### Details
| Key | Data |
| --- | --- |
|Name | Labtainers lab: grassmarlin |
|Description | A Labtainers lab.|
|Type | ctf-lab; lab-sheet |
|Author | Z. Cliffe Schreuders |
|Linked videos| |
|VM names| desktop |
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| Cyber-Physical Systems Security (CPS) | Cyber-Physical Systems | characteristics; security and privacy concerns |
| Cyber-Physical Systems Security (CPS) | Cyber-Physical Systems Domains | industrial control systems; SUPERVISORY CONTROL AND DATA ACQUISITION (SCADA) |
| Security Operations &amp; Incident Management (SOIM) | Monitor: Data Sources | network traffic |
Command to build VMs and start scenario:
```ruby secgen.rb -s scenario/labs/labtainers/grassmarlin.xml run```
[View source](scenarios/labs/labtainers/grassmarlin.xml)
## labs/labtainers/grfics.xml
### Details
| Key | Data |
| --- | --- |
|Name | Labtainers lab: grfics |
|Description | A Labtainers lab.|
|Type | ctf-lab; lab-sheet |
|Author | Z. Cliffe Schreuders |
|Linked videos| |
|VM names| desktop |
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| Adversarial Behaviours (AB) | Models | kill chains |
| Cyber-Physical Systems Security (CPS) | Cyber-Physical Systems | characteristics; protection against natural events and accidents; security and privacy concerns |
| Cyber-Physical Systems Security (CPS) | Cyber-Physical Systems Domains | industrial control systems |
| Network Security (NS) | Network Defence Tools | intrusion detection systems; network architecture design |
Command to build VMs and start scenario:
```ruby secgen.rb -s scenario/labs/labtainers/grfics.xml run```
[View source](scenarios/labs/labtainers/grfics.xml)
## labs/labtainers/ida.xml
### Details
@@ -1854,7 +1978,7 @@ Command to build VMs and start scenario:
| KA | Topic | Keywords
| --- | --- | --- |
| Authentication, Authorisation &amp; Accountability (AAA) | Authorisation | access control; Elevated privileges; Real and effective identity; Vulnerabilities and attacks on access control misconfigurations |
| (OSVS) | Primitives for Isolation and Mediation | Access controls and operating systems; Linux security model; Unix File Permissions; setuid/setgid |
| Operating Systems &amp; Virtualisation (OSV) | Primitives for Isolation and Mediation | Access controls and operating systems; Linux security model; Unix File Permissions; setuid/setgid |
Command to build VMs and start scenario:
@@ -1974,7 +2098,7 @@ Command to build VMs and start scenario:
| --- | --- | --- |
| Software Security (SS) | Categories of Vulnerabilities | Web vulnerabilities / OWASP Top 10; API vulnerabilities |
| Software Security (SS) | Prevention of Vulnerabilities | coding practices; Protecting against session management attacks; XSS; SQLi; CSRF; API design |
| (WMS) | Server-Side Vulnerabilities and Mitigations | injection vulnerabilities; server-side misconfiguration and vulnerable components; SQL-INJECTION |
| Web &amp; Mobile Security (WAM) | Server-Side Vulnerabilities and Mitigations | injection vulnerabilities; server-side misconfiguration and vulnerable components; SQL-INJECTION |
Command to build VMs and start scenario:
@@ -2071,6 +2195,292 @@ Command to build VMs and start scenario:
[View source](scenarios/labs/labtainers/ssl.xml)
## labs/labtainers/symkeylab.xml
### Details
| Key | Data |
| --- | --- |
|Name | Labtainers lab: symkeylab |
|Description | A Labtainers lab.|
|Type | ctf-lab; lab-sheet |
|Author | Z. Cliffe Schreuders |
|Linked videos| |
|VM names| desktop |
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| Cryptography (C) | Schemes | AES |
| Cryptography (C) | Symmetric Cryptography | symmetric primitives; symmetric encryption and authentication |
Command to build VMs and start scenario:
```ruby secgen.rb -s scenario/labs/labtainers/symkeylab.xml run```
[View source](scenarios/labs/labtainers/symkeylab.xml)
## labs/labtainers/sys-log.xml
### Details
| Key | Data |
| --- | --- |
|Name | Labtainers lab: sys-log |
|Description | A Labtainers lab.|
|Type | ctf-lab; lab-sheet |
|Author | Z. Cliffe Schreuders |
|Linked videos| |
|VM names| desktop |
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| Security Operations &amp; Incident Management (SOIM) | Monitor: Data Sources | application logs: web server logs and files; system and kernel logs; Syslog |
Command to build VMs and start scenario:
```ruby secgen.rb -s scenario/labs/labtainers/sys-log.xml run```
[View source](scenarios/labs/labtainers/sys-log.xml)
## labs/labtainers/tcpip.xml
### Details
| Key | Data |
| --- | --- |
|Name | Labtainers lab: tcpip |
|Description | A Labtainers lab.|
|Type | ctf-lab; lab-sheet |
|Author | Z. Cliffe Schreuders |
|Linked videos| |
|VM names| desktop |
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| Network Security (NS) | Internet Architecture | transport layer security |
| Network Security (NS) | Network Protocols and Vulnerability | common network attacks |
Command to build VMs and start scenario:
```ruby secgen.rb -s scenario/labs/labtainers/tcpip.xml run```
[View source](scenarios/labs/labtainers/tcpip.xml)
## labs/labtainers/telnetlab.xml
### Details
| Key | Data |
| --- | --- |
|Name | Labtainers lab: telnetlab |
|Description | A Labtainers lab.|
|Type | ctf-lab; lab-sheet |
|Author | Z. Cliffe Schreuders |
|Linked videos| |
|VM names| desktop |
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| Network Security (NS) | REMOTE ACCESS | TELNET |
| Network Security (NS) | TCP/IP | SSH (SECURE SHELL); TELNET; TERMINAL EMULATION PROTOCOL (TELNET) |
Command to build VMs and start scenario:
```ruby secgen.rb -s scenario/labs/labtainers/telnetlab.xml run```
[View source](scenarios/labs/labtainers/telnetlab.xml)
## labs/labtainers/vpnlab.xml
### Details
| Key | Data |
| --- | --- |
|Name | Labtainers lab: vpnlab |
|Description | A Labtainers lab.|
|Type | ctf-lab; lab-sheet |
|Author | Z. Cliffe Schreuders |
|Linked videos| |
|VM names| desktop |
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| Network Security (NS) | Network Defence Tools | VIRTUAL - PRIVATE NETWORK (VPN) |
Command to build VMs and start scenario:
```ruby secgen.rb -s scenario/labs/labtainers/vpnlab.xml run```
[View source](scenarios/labs/labtainers/vpnlab.xml)
## labs/labtainers/vpnlab2.xml
### Details
| Key | Data |
| --- | --- |
|Name | Labtainers lab: vpnlab2 |
|Description | A Labtainers lab.|
|Type | ctf-lab; lab-sheet |
|Author | Z. Cliffe Schreuders |
|Linked videos| |
|VM names| desktop |
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| Network Security (NS) | Network Defence Tools | VIRTUAL - PRIVATE NETWORK (VPN) |
Command to build VMs and start scenario:
```ruby secgen.rb -s scenario/labs/labtainers/vpnlab2.xml run```
[View source](scenarios/labs/labtainers/vpnlab2.xml)
## labs/labtainers/webtrack.xml
### Details
| Key | Data |
| --- | --- |
|Name | Labtainers lab: webtrack |
|Description | A Labtainers lab.|
|Type | ctf-lab; lab-sheet |
|Author | Z. Cliffe Schreuders |
|Linked videos| |
|VM names| desktop |
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| Forensics (F) | WEB | WEB BROWSERS |
| Web &amp; Mobile Security (WAM) | Fundamental Concepts and Approaches | BROWSER; cookies |
Command to build VMs and start scenario:
```ruby secgen.rb -s scenario/labs/labtainers/webtrack.xml run```
[View source](scenarios/labs/labtainers/webtrack.xml)
## labs/labtainers/wireshark-intro.xml
### Details
| Key | Data |
| --- | --- |
|Name | Labtainers lab: wireshark-intro |
|Description | A Labtainers lab.|
|Type | ctf-lab; lab-sheet |
|Author | Z. Cliffe Schreuders |
|Linked videos| |
|VM names| desktop |
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| Security Operations &amp; Incident Management (SOIM) | Monitor: Data Sources | network traffic |
Command to build VMs and start scenario:
```ruby secgen.rb -s scenario/labs/labtainers/wireshark-intro.xml run```
[View source](scenarios/labs/labtainers/wireshark-intro.xml)
## labs/labtainers/xforge.xml
### Details
| Key | Data |
| --- | --- |
|Name | Labtainers lab: xforge |
|Description | A Labtainers lab.|
|Type | ctf-lab; lab-sheet |
|Author | Z. Cliffe Schreuders |
|Linked videos| |
|VM names| desktop |
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| Web &amp; Mobile Security (WAM) | Server-Side Vulnerabilities and Mitigations | CROSS-SITE REQUEST FORGERY (CSRF) |
| Software Security (SS) | Prevention of Vulnerabilities | Protecting against session management attacks; XSS; SQLi; CSRF |
Command to build VMs and start scenario:
```ruby secgen.rb -s scenario/labs/labtainers/xforge.xml run```
[View source](scenarios/labs/labtainers/xforge.xml)
## labs/labtainers/xsite.xml
### Details
| Key | Data |
| --- | --- |
|Name | Labtainers lab: xsite |
|Description | A Labtainers lab.|
|Type | ctf-lab; lab-sheet |
|Author | Z. Cliffe Schreuders |
|Linked videos| |
|VM names| desktop |
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| Web &amp; Mobile Security (WAM) | Server-Side Vulnerabilities and Mitigations | CROSS-SITE SCRIPTING (XSS) |
| Software Security (SS) | Prevention of Vulnerabilities | Protecting against session management attacks; XSS; SQLi; CSRF |
Command to build VMs and start scenario:
```ruby secgen.rb -s scenario/labs/labtainers/xsite.xml run```
[View source](scenarios/labs/labtainers/xsite.xml)
## labs/response_and_investigation/1_integrity_protection.xml
### Details
@@ -2090,7 +2500,7 @@ Command to build VMs and start scenario:
| KA | Topic | Keywords
| --- | --- | --- |
| Authentication, Authorisation &amp; Accountability (AAA) | Authorisation | access control; Protecting integrity |
| (OSVS) | Primitives for Isolation and Mediation | Linux read only protections: ro mounts; file attributes |
| Operating Systems &amp; Virtualisation (OSV) | Primitives for Isolation and Mediation | Linux read only protections: ro mounts; file attributes |
Command to build VMs and start scenario:
@@ -2120,7 +2530,7 @@ Command to build VMs and start scenario:
| --- | --- | --- |
| Forensics (F) | Artifact Analysis | cryptographic hashing |
| Security Operations &amp; Incident Management (SOIM) | Monitor: Data Sources | MONITORING - FILE INTEGRITY CHECKERS |
| (OSVS) | OS Hardening | code and data integrity checks |
| Operating Systems &amp; Virtualisation (OSV) | OS Hardening | code and data integrity checks |
Command to build VMs and start scenario:
@@ -2271,7 +2681,7 @@ Command to build VMs and start scenario:
| KA | Topic | Keywords
| --- | --- | --- |
| Forensics (F) | Main Memory Forensics | process information; file information; network connections; artifacts and fragments; challenges of live forensics |
| (OSVS) | OS Hardening | anomaly detection |
| Operating Systems &amp; Virtualisation (OSV) | OS Hardening | anomaly detection |
| Authentication, Authorisation &amp; Accountability (AAA) | Accountability | The fallibility of digital evidence to tampering |
| Malware &amp; Attack Technology (MAT) | Malware Detection | identifying the presence of malware |
@@ -2577,7 +2987,7 @@ Command to build VMs and start scenario:
|Description | </br></br> A MetaCTF lab. In your home directory you will find some binaries that you need to reverse engineer in order to determine the password that the program expects. Once you determing the password, run the program and enter the password to receive the file.</br></br> [Lab sheet here](https://docs.google.com/document/d/1AxTve1RBzqvdPxt8Wziga2x2e3lZp4k5YsMq3KxkXzM/edit?usp=sharing).</br> |
|Type | ctf-lab; lab-sheet |
|Author | Z. Cliffe Schreuders |
|Linked videos| |
|Linked videos| https://youtu.be/jo_07iOplzA; https://youtu.be/1Hy_166CwRk|
|VM names| desktop |
@@ -2606,7 +3016,7 @@ Command to build VMs and start scenario:
|Description | </br></br> A MetaCTF lab. In your home directory you will find some binaries that you need to reverse engineer in order to determine the password that the program expects. Once you determing the password, run the program and enter the password to receive the file.</br></br> [Lab sheet here](https://docs.google.com/document/d/1GKmNARyF2-RQ-jK1_w4Y7V9vNtXsJvMmvXSbnadyEoE/edit?usp=sharing).</br> |
|Type | ctf-lab; lab-sheet |
|Author | Z. Cliffe Schreuders |
|Linked videos| |
|Linked videos| https://youtu.be/nVpqjsfii6c; https://youtu.be/PH73lpG2B1M; https://youtu.be/Du3fVc_ZLiI|
|VM names| desktop |
@@ -2635,7 +3045,7 @@ Command to build VMs and start scenario:
|Description | </br>[Lab sheet here](https://docs.google.com/document/d/1tsKUaCetdqwDmey4JK9DYrcO9XDx4EwE2RIvSbP6zQQ/edit?usp=sharing).</br> |
|Type | ctf-lab; lab-sheet |
|Author | Z. Cliffe Schreuders |
|Linked videos| |
|Linked videos| https://youtu.be/nwxtlR31hvw; https://youtu.be/vT2PP7VnSNw|
|VM names| windows_victim; kali; desktop |
@@ -2663,7 +3073,7 @@ Command to build VMs and start scenario:
|Description | </br>[Lab sheet here](https://docs.google.com/document/d/1tsKUaCetdqwDmey4JK9DYrcO9XDx4EwE2RIvSbP6zQQ/edit?usp=sharing).</br> |
|Type | ctf-lab; lab-sheet |
|Author | Z. Cliffe Schreuders |
|Linked videos| |
|Linked videos| https://youtu.be/Zh7IdmnCfy0; https://youtu.be/WU06L-u0t2Q; https://youtu.be/j2S-XgY-Fyg; https://youtu.be/Lf1UPaqPJMM; https://youtu.be/5OUQ7ExlgKI|
|VM names| windows_victim; kali; windows_victim_server |
@@ -2692,7 +3102,7 @@ Command to build VMs and start scenario:
|Description | </br> [Lab sheet here](https://docs.google.com/document/d/1Ap-h6YSDtfU4bLwiKhxP5x2nf1vjSJ2V2zEL5wzW84U/edit?usp=sharing).</br> |
|Type | ctf-lab; lab-sheet |
|Author | Thomas Shaw |
|Linked videos| |
|Linked videos| https://youtu.be/oi_CfBe_umU; https://youtu.be/Wry2get_RRc|
|VM names| metactf_desktop |
@@ -2721,7 +3131,7 @@ Command to build VMs and start scenario:
|Description | </br> [Lab sheet here](https://docs.google.com/document/d/1wgxLYHkdeLknRcbzZY73xZt36TWExuu-lfIJhRuHE-I/).</br> |
|Type | ctf-lab; lab-sheet |
|Author | Thomas Shaw |
|Linked videos| |
|Linked videos| https://youtu.be/ywLXfSR5YWk|
|VM names| metactf_desktop; kali |
@@ -2750,7 +3160,7 @@ Command to build VMs and start scenario:
|Description | </br> Similar to last week. Same C code, just compiled w/ stack protections and non-executable stack.</br></br> [Lab sheet here](https://docs.google.com/document/d/1eUOb1cR-D8qv0NmlGXYUN1JYwmgrwOBNtfsDVdxnPpw/).</br> |
|Type | ctf-lab; lab-sheet |
|Author | Thomas Shaw |
|Linked videos| |
|Linked videos| https://youtu.be/v2rChKDAmFg; https://youtu.be/xwsBaNQZozg|
|VM names| metactf_desktop; kali |
@@ -2818,10 +3228,10 @@ Command to build VMs and start scenario:
### CyBOK KAs, Topics, and Keywords
| KA | Topic | Keywords
| --- | --- | --- |
| (WMS) | Fundamental Concepts and Approaches | web PKI and HTTPS; authentication; cookies; passwords and alternatives; JAVASCRIPT / HYPERTEXT MARKUP LANGUAGE (HTML) / CASCADING STYLE SHEETS (CSS) / HYPERTEXT TRANSFER PROTOCOL (HTTP)\n\t\tCOOKIES; HYPERTEXT TRANSFER PROTOCOL (HTTP) - PROXYING; Broken Access Control / Insecure Direct Object References; SESSION HIJACKING; REPRESENTATIONAL STATE TRANSFER (REST) |
| (WMS) | Client-Side Vulnerabilities and Mitigations | client-side storage; CLIENT-SIDE VALIDATION; clickjacking |
| (WMS) | Client-Side Vulnerabilities and Mitigations | client-side storage; CLIENT-SIDE VALIDATION; clickjacking |
| (WMS) | Server-Side Vulnerabilities and Mitigations | injection vulnerabilities; server-side misconfiguration and vulnerable components; CROSS-SITE SCRIPTING (XSS); SAME ORIGIN POLICY (SOP); COMMAND INJECTION; SQL-INJECTION; CROSS-SITE REQUEST FORGERY (CSRF); CONFUSED DEPUTY ATTACKS |
| Web &amp; Mobile Security (WAM) | Fundamental Concepts and Approaches | web PKI and HTTPS; authentication; cookies; passwords and alternatives; JAVASCRIPT / HYPERTEXT MARKUP LANGUAGE (HTML) / CASCADING STYLE SHEETS (CSS) / HYPERTEXT TRANSFER PROTOCOL (HTTP)\n\t\tCOOKIES; HYPERTEXT TRANSFER PROTOCOL (HTTP) - PROXYING; Broken Access Control / Insecure Direct Object References; SESSION HIJACKING; REPRESENTATIONAL STATE TRANSFER (REST) |
| Web &amp; Mobile Security (WAM) | Client-Side Vulnerabilities and Mitigations | client-side storage; CLIENT-SIDE VALIDATION; clickjacking |
| Web &amp; Mobile Security (WAM) | Client-Side Vulnerabilities and Mitigations | client-side storage; CLIENT-SIDE VALIDATION; clickjacking |
| Web &amp; Mobile Security (WAM) | Server-Side Vulnerabilities and Mitigations | injection vulnerabilities; server-side misconfiguration and vulnerable components; CROSS-SITE SCRIPTING (XSS); SAME ORIGIN POLICY (SOP); COMMAND INJECTION; SQL-INJECTION; CROSS-SITE REQUEST FORGERY (CSRF); CONFUSED DEPUTY ATTACKS |
| Software Security (SS) | Categories of Vulnerabilities | Web vulnerabilities / OWASP Top 10; API vulnerabilities |
| Software Security (SS) | Prevention of Vulnerabilities | coding practices; Protecting against session management attacks; XSS; SQLi; CSRF; API design |

7
lib/CyBOK/generate_scenario_index.rb
View File

@@ -117,8 +117,7 @@ scenarios.each { |scenario|
# SCENARIOS_HASH[scenario]['VMs'] << scenario_hash['scenario']['system']['system_name']
# end
else
puts "Error reading scenario xml: #{scenario}"
logger.warn "Error reading scenario xml: #{scenario}"
Print.err "Error reading scenario xml: #{scenario}"
end
@@ -145,5 +144,5 @@ rescue StandardError => e
Print.err e.backtrace.inspect
end
puts "#{SCENARIOS_HASH.length} scenarios with CyBOK metadata"
puts "#{VIDEO_HASH.length} videos with CyBOK metadata"
Print.std "#{SCENARIOS_HASH.length} scenarios with CyBOK metadata"
Print.std "#{VIDEO_HASH.length} videos with CyBOK metadata"

22
scenarios/labs/software_security_exploitation/1_c_asm_iof.xml
View File

@@ -24,6 +24,28 @@
<keyword>language design and type systems</keyword>
</CyBOK>
<video>
<title>Software, Vulnerabilities and Exploits</title>
<by>Tom Shaw</by>
<url>https://youtu.be/jo_07iOplzA</url>
<type>lecture-prerecorded</type>
<CyBOK KA="MAT" topic="Attacks and exploitation">
<keyword>EXPLOITATION</keyword>
</CyBOK>
</video>
<video>
<title>Software Vulnerabilities</title>
<by>Tom Shaw</by>
<url>https://youtu.be/1Hy_166CwRk</url>
<type>lecture-prerecorded</type>
<CyBOK KA="MAT" topic="Attacks and exploitation">
<keyword>EXPLOITATION</keyword>
</CyBOK>
</video>
<system>
<system_name>desktop</system_name>
<base platform="linux" type="desktop" distro="Buster"/>

34
scenarios/labs/software_security_exploitation/2_race_conditions_format_str.xml
View File

@@ -27,6 +27,40 @@
<keyword>structured output generations mitigations</keyword>
</CyBOK>
<video>
<title>Structured Output Generation Vulnerabilities</title>
<by>Z. Cliffe Schreuders</by>
<url>https://youtu.be/nVpqjsfii6c</url>
<type>lecture-prerecorded</type>
<CyBOK KA="SS" topic="Categories of Vulnerabilities">
<keyword>structured output generation vulnerabilities</keyword>
</CyBOK>
<CyBOK KA="SS" topic="Prevention of Vulnerabilities">
<keyword>structured output generations mitigations</keyword>
</CyBOK>
</video>
<video>
<title>Race Conditions and Time of Check to Time of Use TOCTTOU Vulnerabilities</title>
<by>Z. Cliffe Schreuders</by>
<url>https://youtu.be/PH73lpG2B1M</url>
<type>lecture-prerecorded</type>
<CyBOK KA="SS" topic="Categories of Vulnerabilities">
<keyword>race condition vulnerabilities</keyword>
</CyBOK>
<CyBOK KA="SS" topic="Prevention of Vulnerabilities">
<keyword>race condition mitigations</keyword>
</CyBOK>
</video>
<video>
<title>The Format String Vulnerability</title>
<by>Tom Shaw</by>
<url>https://youtu.be/Du3fVc_ZLiI</url>
<type>lecture-prerecorded</type>
<CyBOK KA="SS" topic="Categories of Vulnerabilities">
<keyword>Format string attacks</keyword>
</CyBOK>
</video>
<system>
<system_name>desktop</system_name>
<base platform="linux" type="desktop" distro="Buster"/>

19
scenarios/labs/software_security_exploitation/3_bug_hunting_and_fuzzing.xml
View File

@@ -18,6 +18,25 @@
<keyword>dynamic detection</keyword>
</CyBOK>
<video>
<title>Fuzzing Part 1</title>
<by>Z. Cliffe Schreuders</by>
<url>https://youtu.be/nwxtlR31hvw</url>
<type>lecture-prerecorded</type>
<CyBOK KA="SS" topic="Detection of Vulnerabilities">
<keyword>dynamic detection</keyword>
</CyBOK>
</video>
<video>
<title>Fuzzing Part 2</title>
<by>Z. Cliffe Schreuders</by>
<url>https://youtu.be/vT2PP7VnSNw</url>
<type>lecture-prerecorded</type>
<CyBOK KA="SS" topic="Detection of Vulnerabilities">
<keyword>dynamic detection</keyword>
</CyBOK>
</video>
<system>
<system_name>windows_victim</system_name>
<base platform="windows" distro="7"/>

52
scenarios/labs/software_security_exploitation/4_exploit_development.xml
View File

@@ -25,6 +25,58 @@
<keyword>Metasploit Framework development</keyword>
</CyBOK>
<video>
<title>Overflows and Stack Smashing Buffer Overflows</title>
<by>Z. Cliffe Schreuders</by>
<url>https://youtu.be/Zh7IdmnCfy0</url>
<type>lecture-prerecorded</type>
<CyBOK KA="SS" topic="Categories of Vulnerabilities">
<keyword>memory management vulnerabilities</keyword>
</CyBOK>
</video>
<video>
<title>Writing Exploits (Buffer Overflows Part 2)</title>
<by>Z. Cliffe Schreuders</by>
<url>https://youtu.be/WU06L-u0t2Q</url>
<type>lecture-prerecorded</type>
<CyBOK KA="SS" topic="Categories of Vulnerabilities">
<keyword>memory management vulnerabilities</keyword>
</CyBOK>
</video>
<video>
<title>Memory Vulnerabilities</title>
<by>Tom Shaw</by>
<url>https://youtu.be/j2S-XgY-Fyg</url>
<type>lecture-prerecorded</type>
<CyBOK KA="SS" topic="Categories of Vulnerabilities">
<keyword>memory management vulnerabilities</keyword>
</CyBOK>
</video>
<video>
<title>The Stack (part 1)</title>
<by>Tom Shaw</by>
<url>https://youtu.be/Lf1UPaqPJMM</url>
<type>lecture-prerecorded</type>
<CyBOK KA="SS" topic="Categories of Vulnerabilities">
<keyword>memory management vulnerabilities</keyword>
</CyBOK>
<CyBOK KA="N/A" topic="Technical details underpinning exploit development">
<keyword>The stack</keyword>
</CyBOK>
</video>
<video>
<title>The Stack (part 2)</title>
<by>Tom Shaw</by>
<url>https://youtu.be/5OUQ7ExlgKI</url>
<type>demo-prerecorded</type>
<CyBOK KA="SS" topic="Categories of Vulnerabilities">
<keyword>memory management vulnerabilities</keyword>
</CyBOK>
<CyBOK KA="N/A" topic="Technical details underpinning exploit development">
<keyword>The stack</keyword>
</CyBOK>
</video>
<system>
<system_name>windows_victim</system_name>
<base platform="windows" distro="7"/>

27
scenarios/labs/software_security_exploitation/5_linux_bof_format.xml
View File

@@ -26,6 +26,33 @@
<keyword>Metasploit Framework development</keyword>
</CyBOK>
<video>
<title>Threat modeling using STRIDE and Attack Trees</title>
<by>Z. Cliffe Schreuders</by>
<url>https://youtu.be/oi_CfBe_umU</url>
<type>lecture-prerecorded</type>
<CyBOK KA="SSL" topic="Prescriptive Processes">
<keyword>Microsoft SDL</keyword>
</CyBOK>
<CyBOK KA="RMG" topic="THREAT ANALYSIS">
<keyword>THREAT MODEL</keyword>
<keyword>ATTACK TREES</keyword>
</CyBOK>
</video>
<video>
<title>STRIDE Threat Modeling using Microsoft Threat Modeling Tool</title>
<by>Z. Cliffe Schreuders</by>
<url>https://youtu.be/Wry2get_RRc</url>
<type>demo-prerecorded</type>
<CyBOK KA="SSL" topic="Prescriptive Processes">
<keyword>Microsoft SDL</keyword>
</CyBOK>
<CyBOK KA="RMG" topic="THREAT ANALYSIS">
<keyword>THREAT MODEL</keyword>
<keyword>ATTACK TREES</keyword>
</CyBOK>
</video>
<system>
<system_name>metactf_desktop</system_name>
<base platform="linux" type="desktop" distro="Buster"/>

11
scenarios/labs/software_security_exploitation/6_linux_stack_bof.xml
View File

@@ -25,6 +25,17 @@
<keyword>Metasploit Framework development</keyword>
</CyBOK>
<video>
<title>Secure Design Principles</title>
<by>Z. Cliffe Schreuders</by>
<url>https://youtu.be/ywLXfSR5YWk</url>
<type>lecture-prerecorded</type>
<CyBOK KA="OSV" topic="OS Security Principles">
<keyword>Saltzer and Schroeder’s principles</keyword>
<keyword>newer principles</keyword>
</CyBOK>
</video>
<system>
<system_name>metactf_desktop</system_name>
<base platform="linux" type="desktop" distro="Buster"/>

24
scenarios/labs/software_security_exploitation/7_linux_nx_bypass.xml
View File

@@ -31,6 +31,30 @@
<keyword>Mitigation bypass: non-executable memory</keyword>
</CyBOK>
<video>
<title>Secure Development Lifecycles</title>
<by>Z. Cliffe Schreuders</by>
<url>https://youtu.be/v2rChKDAmFg</url>
<type>lecture-prerecorded</type>
<CyBOK KA="SSL" topic="Motivations for Secure Software Lifecycle">
<keyword>vulnerabilities can be exploited without being noticed</keyword>
</CyBOK>
<CyBOK KA="SSL" topic="Prescriptive Processes">
<keyword>Microsoft SDL</keyword>
<keyword>SAFECode</keyword>
<keyword>Touchpoints</keyword>
</CyBOK>
</video>
<video>
<title>Open source development and security practices</title>
<by>Z. Cliffe Schreuders</by>
<url>https://youtu.be/xwsBaNQZozg</url>
<type>lecture-prerecorded</type>
<CyBOK KA="SSL" topic="Prescriptive Processes">
<keyword>Open source secure development</keyword>
</CyBOK>
</video>
<system>
<system_name>metactf_desktop</system_name>
<base platform="linux" type="desktop" distro="Buster"/>