I'm on the train on the way home from USCC IL. I'm thinking about what I've learned this week. I really appreciate the effort that everyone involved with this program put into it. The material was much the same as it was last year, but the repetitiveness actually reinforces what we learned last year. So, I still feel like it was worth the effort coming here. We're supposed to open the books and study them after the camp, but having someone to ask questions around is nice.
It was nice to see people that I saw last year, and I was happy to meet new people. Considering the boot camp nature of the course, maybe we didn't exactly absorb all we could have last year. I look forward to (hopefully) attending next year.
I was disappointed that there weren't forensics courses per say. They are kind of at the mercy of what instructors are available, and maybe that isn't the target audience of this camp. I don't know much about the inner workings of it. However, I did become better acquainted with how to set up a home lab with VMs. It's nice to know that the way I was taught before was the right way. Also, I didn't pay very good attention to Scapy last year. I tried, but I really haven't studied packets all that much. I learned a little more this year. My brain started going fuzzy right around lab 5 this time around. Not saying that I completely understood everything else, but it was closer than I was last year. Anyway, Scapy can be used to learn a little bit about Intrusion Detection, Monitoring, and Forensics. I learned how to use Scapy to craft pcaps that I could examine so that I can see how those attacks work. I know that there are pcaps everywhere for this purpose, but how do I know which ones to trust? Also, this cuts out some of the extraneous traffic that may hinder analysis to see what it does. I could also monitor traffic while I use the different options in Metasploit to exploit machines. I could probably do the same with the Web App Pen Testing as well, run captures while I'm working with the vulnerable web apps. So, while I didn't directly learn Forensics, I learned a little about how to make stuff to examine. If you are interested in learning, I highly recommend doing the Cyber Quest so that you can potentially be invited to this camp. Even if you don't feel like you can win the ctf, it is well worth your time.
Showing posts with label USCC. Show all posts
Showing posts with label USCC. Show all posts
Saturday, June 25, 2016
Wednesday, April 6, 2016
United States Cyber Challenge (USCC) Cyber Quest
The USCC Cyber Quest will be starting soon. Registration starts April 11th. I encourage anyone who is interested in cyber security to apply. The requirements and what the assessment covers is best read on their website. I did this last year and was invited to a week-long cyber camp with a capture the flag at the end. The capture the flag was light hearted and fun. It did show what a person learned, and what they need to work on-that's if you give it a shot. I attended and was given day long courses that were similar to SANS courses. I was given materials that covered Scapy, Metasploit, and Hacking Web Applications using SamuraiWTF. I think that the classes offered may change based on the Cyber Quest Assessment and who teaches each day. I have no prior experience to base that on, but this year's assessment appears to be based more on forensics. Last year's was catching vulnerabilities in programs. Here's the web site: http://uscc.cyberquests.org
Friday, July 17, 2015
What Did I Learn From My First Live Cyber Challenge
I’m writing this post in hopes that it helps people who are afraid to try these cyber challenges because they think that they don’t know enough.
I got into this challenge, not necessarily because of my knowledge, but because of my ability to find answers when I need them. I could read a little code, I could understand a little bit about what was going on, but I can’t write code very well anymore. It’s been 9 years since I graduated college. As anyone knows, in tech time, that’s a long time. There are version changes and new languages being made. Sure, the basic things that I had learned still apply, but it’s not exactly the same. I’ve been out of the workforce for nearly that long as well. So if you’re in that same boat, don’t let it discourage you.
You’d be surprised how much of a distance in learning I’ve made since I started doing these online cyber challenges and this live challenge just by giving them a shot. My first attempts weren’t very elegant. So just try them, you might surprise yourself.
Once you make it to a camp:
Listen to the instructors. This seems obvious, but sometimes we get distracted by minor glitches, like having connectivity issues, or taking notes, so we don’t pay attention to their message.
Take advice from other students and the TA’s. Another student who was more experienced than I told me to not worry so much and to open notepad or bring a notebook, and make notes of page numbers of important info as we go along. He’s absolutely correct. Indexing is a great idea.
Use every avenue within legal means. I tried a little social engineering and recon before the challenge. I'm going to put a disclaimer on this. This does not mean send a phishing e-mail to your instructor and attempt to own their machine. This means, ask them what they've been reading. Ask them what projects they've been working on, ask them what ctf's that they've done before. Here is why. People are busy. Many times, they will reuse material from things that they are working on, reading, or doing. Sometimes, they even reuse the same challenges. If you've read my previous blog posts, Shmoocon, and the SANS 2014 Brochure challenge were pretty much the same with minor changes. Yes, the target may say, “No, I can’t help you,” but it never hurts to ask in a respectful manner. You never know, they may go for it because that is part of the lesson that they are trying to teach you. Know human behavior. If they aren't willing to answer, read their blogs. You can usually find those things on their blogs.
DO NOT SKIMP on RECON and SCANNING. People quickly dismiss this part of the process without realizing that the creators of the challenge will make the contest much like the real world. People in the real world make mistakes. If you focus on the exploits, you’ll never see the easy solutions sitting right in front of you. Sure, it feels awesome to pop that first shell, but in the real world, we are on a time-limit, we have a scope of what we are allowed to do, and we can’t afford to chase down exploits that could easily be accomplished in other ways like finding a plain text password from a search of user logs that takes about five seconds. During my research last night, I uncovered this blog:
https://blog.g0tmi1k.com/2011/08/basic-linux-privilege-escalation/
Notice that many of the privilege “exploits” are actually just social engineering, in other words, knowing human behavior.
I also looked up one of the hostnames because people commonly name their machine whatever OS they are running, and/or the version number. I didn’t understand the significance of it until today. I wasn’t entirely wrong. I just didn’t think that I had all the info that I needed.
I looked up the other OS versions, as well, looking for vulnerabilities for those particular OS's. If you have notes, for heaven’s sake, share them. I was so nervous today, that I forgot to share my research. I spent a long time last night doing research, and that effort wasn’t exactly wasted, because I learned, but it could’ve been more useful.
Don’t expect metasploit to find everything for you. You can help narrow down results the night before. I suggest not waiting until the last night to study and research.
Know your tools. There were a couple of questions I'm sure that we could have found the answer to if we knew how to use the tools. We were okay with the tools we learned in class, but lacked skills in other useful tools.
When you find out who your teammates are, make a plan of attack. Find out what each others strengths and weaknesses are, and play to your strengths. I suggest having each person take one section of what you have learned and research it extensively.
On the Challenge Day, listen to what the instructors and challenge creators say. I know, you want to dig right in, but sometimes they give hints on challenge days that you may miss if you’re trying to attack. Their first advice, go for the low hanging fruit. Don’t spend hours going into the machine and trying to do the exploits because you might end up losing a lot of points if you’re chasing a tangent that may or may not be the correct solution.
The ctfs, any of them, so I'm not giving anything specific away, have different sections. Pick a section that you are good at and go for it. That being said, plan with your teammates on who does what, accordingly. You do not want to waste time answering the same questions. It only counts for points one time.
Google your heart out. You may find the answer that way.
Don’t give up. Keep trying until that last call. You may learn something in the process.
I got into this challenge, not necessarily because of my knowledge, but because of my ability to find answers when I need them. I could read a little code, I could understand a little bit about what was going on, but I can’t write code very well anymore. It’s been 9 years since I graduated college. As anyone knows, in tech time, that’s a long time. There are version changes and new languages being made. Sure, the basic things that I had learned still apply, but it’s not exactly the same. I’ve been out of the workforce for nearly that long as well. So if you’re in that same boat, don’t let it discourage you.
You’d be surprised how much of a distance in learning I’ve made since I started doing these online cyber challenges and this live challenge just by giving them a shot. My first attempts weren’t very elegant. So just try them, you might surprise yourself.
Once you make it to a camp:
Listen to the instructors. This seems obvious, but sometimes we get distracted by minor glitches, like having connectivity issues, or taking notes, so we don’t pay attention to their message.
Take advice from other students and the TA’s. Another student who was more experienced than I told me to not worry so much and to open notepad or bring a notebook, and make notes of page numbers of important info as we go along. He’s absolutely correct. Indexing is a great idea.
Use every avenue within legal means. I tried a little social engineering and recon before the challenge. I'm going to put a disclaimer on this. This does not mean send a phishing e-mail to your instructor and attempt to own their machine. This means, ask them what they've been reading. Ask them what projects they've been working on, ask them what ctf's that they've done before. Here is why. People are busy. Many times, they will reuse material from things that they are working on, reading, or doing. Sometimes, they even reuse the same challenges. If you've read my previous blog posts, Shmoocon, and the SANS 2014 Brochure challenge were pretty much the same with minor changes. Yes, the target may say, “No, I can’t help you,” but it never hurts to ask in a respectful manner. You never know, they may go for it because that is part of the lesson that they are trying to teach you. Know human behavior. If they aren't willing to answer, read their blogs. You can usually find those things on their blogs.
DO NOT SKIMP on RECON and SCANNING. People quickly dismiss this part of the process without realizing that the creators of the challenge will make the contest much like the real world. People in the real world make mistakes. If you focus on the exploits, you’ll never see the easy solutions sitting right in front of you. Sure, it feels awesome to pop that first shell, but in the real world, we are on a time-limit, we have a scope of what we are allowed to do, and we can’t afford to chase down exploits that could easily be accomplished in other ways like finding a plain text password from a search of user logs that takes about five seconds. During my research last night, I uncovered this blog:
https://blog.g0tmi1k.com/2011/08/basic-linux-privilege-escalation/
Notice that many of the privilege “exploits” are actually just social engineering, in other words, knowing human behavior.
I also looked up one of the hostnames because people commonly name their machine whatever OS they are running, and/or the version number. I didn’t understand the significance of it until today. I wasn’t entirely wrong. I just didn’t think that I had all the info that I needed.
I looked up the other OS versions, as well, looking for vulnerabilities for those particular OS's. If you have notes, for heaven’s sake, share them. I was so nervous today, that I forgot to share my research. I spent a long time last night doing research, and that effort wasn’t exactly wasted, because I learned, but it could’ve been more useful.
Don’t expect metasploit to find everything for you. You can help narrow down results the night before. I suggest not waiting until the last night to study and research.
Know your tools. There were a couple of questions I'm sure that we could have found the answer to if we knew how to use the tools. We were okay with the tools we learned in class, but lacked skills in other useful tools.
When you find out who your teammates are, make a plan of attack. Find out what each others strengths and weaknesses are, and play to your strengths. I suggest having each person take one section of what you have learned and research it extensively.
On the Challenge Day, listen to what the instructors and challenge creators say. I know, you want to dig right in, but sometimes they give hints on challenge days that you may miss if you’re trying to attack. Their first advice, go for the low hanging fruit. Don’t spend hours going into the machine and trying to do the exploits because you might end up losing a lot of points if you’re chasing a tangent that may or may not be the correct solution.
The ctfs, any of them, so I'm not giving anything specific away, have different sections. Pick a section that you are good at and go for it. That being said, plan with your teammates on who does what, accordingly. You do not want to waste time answering the same questions. It only counts for points one time.
Google your heart out. You may find the answer that way.
Don’t give up. Keep trying until that last call. You may learn something in the process.
Cyber Camp CTF
I survived this week and the ctf. I'm not allowed to give out any answers for this until the other challenges have been done. I was fortunate to be assigned to a team of brilliant people. We ended up in 3rd place. We were all first year Cyber Camp CTF Competitors, meaning that this was our first time attending this event. Other teams had the advantage because it was their second+ year. Thanks for doing such an excellent job, guys! Thanks to the creators for such a great ctf. Thanks to the instructors and everyone who took time out of their jobs to run the event.
I was a little disappointed with myself. The guys knew a bit more Linux than I did, so I stayed off of the boxes and manned the scoreboard, trying to get little 5, 10, and 15 point questions. Some of the guys didn't have the online challenge experience that I had, though, so I should've at least checked out the file systems because even though I might not know that much, I may know that one thing from other challenges that I have done that would answer higher point questions. My reasoning for staying off the machines: We had a limited amount of resources, so I didn't want to slow down their attempts to scan or attack. There are also a couple of questions that I knew the answer to, but didn't trust myself to answer properly, so I wasted time googling, even though I knew the answer. Alex Rams told me to believe in myself. I should've taken his advice. I'm still happy with the result, but unhappy that I didn't challenge myself this time around. I had to think of what was best for the team though, and sometimes, what's best is to be the research person.
I think that this challenge was well worth the investment that my family made in it. I have new resources to hone my skills. I met a lot of interesting people.
I was a little disappointed with myself. The guys knew a bit more Linux than I did, so I stayed off of the boxes and manned the scoreboard, trying to get little 5, 10, and 15 point questions. Some of the guys didn't have the online challenge experience that I had, though, so I should've at least checked out the file systems because even though I might not know that much, I may know that one thing from other challenges that I have done that would answer higher point questions. My reasoning for staying off the machines: We had a limited amount of resources, so I didn't want to slow down their attempts to scan or attack. There are also a couple of questions that I knew the answer to, but didn't trust myself to answer properly, so I wasted time googling, even though I knew the answer. Alex Rams told me to believe in myself. I should've taken his advice. I'm still happy with the result, but unhappy that I didn't challenge myself this time around. I had to think of what was best for the team though, and sometimes, what's best is to be the research person.
I think that this challenge was well worth the investment that my family made in it. I have new resources to hone my skills. I met a lot of interesting people.
Tuesday, July 14, 2015
Cyber Camp-Day 2
Today was a decent day. I had a connectivity issue with a couple of my VM's because I had to use a bridged connection in VMWare Fusion. I'm using a MAC. That was a headache. Fortunately someone helped me figure it out. Thanks person who I-don't-know-if you-want-a-shout-out-or-not. Also, thanks to the other person that helped me change the config files yesterday to facilitate communication via my VM's. That course, yesterday, was made for Windows hosts.
I thought that I would post for future me or anyone else who may find it useful.
In order for the bridged connection to work for my VM's, I had to go to Virtual Machine Settings>Network Adapter>Wi-Fi>Adapter>System Preferences>Advanced Button>Set Elevator Box to "Manually">Type in an IP Address in the same range as my VM's Network IP's>Type in the same subnet mask as my VM's>Make sure that the Wi-Fi is connected to a Wireless Access Point and is on
Then I followed the directions in my lab to set the IP's and subnet masks of the VM's.
Note: It does not have to be a Wi-Fi Adapter. Later I configured a wired adapter in the same manner. The key is to make sure that whatever medium you are using is plugged in to a working port on a nework switch or that the Wi-Fi is connected to a wireless access point. Also, make sure that your VM Firewalls and host firewalls are not getting in the way of communication.
After that the course went fairly smoothly with the exception of one minor glitch that was not my fault. One lab went pear shaped when we couldn't connect to the machines that we were supposed to. They got it up and running fairly quickly.
These courses seem to be previews for SANS courses. It's nice that we are doing different courses each day, but there is some material that I wish we had time to study more in depth.
I thought that I would post for future me or anyone else who may find it useful.
In order for the bridged connection to work for my VM's, I had to go to Virtual Machine Settings>Network Adapter>Wi-Fi>Adapter>System Preferences>Advanced Button>Set Elevator Box to "Manually">Type in an IP Address in the same range as my VM's Network IP's>Type in the same subnet mask as my VM's>Make sure that the Wi-Fi is connected to a Wireless Access Point and is on
Then I followed the directions in my lab to set the IP's and subnet masks of the VM's.
Note: It does not have to be a Wi-Fi Adapter. Later I configured a wired adapter in the same manner. The key is to make sure that whatever medium you are using is plugged in to a working port on a nework switch or that the Wi-Fi is connected to a wireless access point. Also, make sure that your VM Firewalls and host firewalls are not getting in the way of communication.
After that the course went fairly smoothly with the exception of one minor glitch that was not my fault. One lab went pear shaped when we couldn't connect to the machines that we were supposed to. They got it up and running fairly quickly.
These courses seem to be previews for SANS courses. It's nice that we are doing different courses each day, but there is some material that I wish we had time to study more in depth.
Monday, July 13, 2015
Cyber Camp-Day 1
Today was an interesting day.
1). Never rely on public transport. Being stuck in an unfamiliar area, in the pouring down rain is not my idea of a good time.
2). Don't buy a computer with an unfamiliar OS right before a class. I was tempted by the shiny specs. I ended up okay, but it made me a bit nervous.
3). Make sure that you come prepared. Our class material was destributed on CD's. Fortunately, I packed an external dvd player, patch cable, and an ethernet adapter. I did not have something to decompress a 7z file on my host OS. I had to open my SIFT VM, decompress the file, and move it to the host machine. It took longer than necessary.
I'm not exactly sure what I'm allowed to discuss about the class. I will say that it was extensive. I'm not sure how much will sink in. It was well worth doing Cyber Quest. They were not kidding when they said that the instructors are top notch.
1). Never rely on public transport. Being stuck in an unfamiliar area, in the pouring down rain is not my idea of a good time.
2). Don't buy a computer with an unfamiliar OS right before a class. I was tempted by the shiny specs. I ended up okay, but it made me a bit nervous.
3). Make sure that you come prepared. Our class material was destributed on CD's. Fortunately, I packed an external dvd player, patch cable, and an ethernet adapter. I did not have something to decompress a 7z file on my host OS. I had to open my SIFT VM, decompress the file, and move it to the host machine. It took longer than necessary.
I'm not exactly sure what I'm allowed to discuss about the class. I will say that it was extensive. I'm not sure how much will sink in. It was well worth doing Cyber Quest. They were not kidding when they said that the instructors are top notch.
Subscribe to:
Posts (Atom)