Lab 03 from Practical Malware Analysis covers four samples, each demonstrating a different flavor of Windows persistence and command and control. The set includes a minimal HTTP beacon, a service-i...

This post covers the initial static and dynamic analysis pass for the four samples in Practical Malware Analysis Lab 01: Lab01-01.dll, Lab01-01.exe, Lab01-02.exe, Lab01-03.exe, and Lab01-04.exe. Th...

Overview SOC104 - EventID 36 is a practice challenge on the letsdefend.io site. These challenges are designed to test a defender’s ability to spot and investigate malicious activity based on the in...

Overview Markup is a vulnerable machine from Hack the Box that requires some web app enumeration and using an xxe injection to read files. The foothold is accomplished after gaining access to a log...

Overview Base is a vulnerable machine from Hack the Box that requires some web app enumeration and a unique type juggling with php. The foothold is accomplished after digging into a unique file and...

Overview Querier is a vulnerable machine from Hack the Box that requires some smb enumeration and using SQL server authentication. The foothold is accomplished after logging into SQL Server, dumpin...

Overview Bastard is a vulnerable machine from Hack the Box that requires some web app enumeration and using a public exploit for remote code execution on a vulnerable service. The foothold is accom...

Overview Bastion is a vulnerable machine from Hack the Box that requires some deeper smb enumeration, with exploring some unique files, and mounting the smb share locally to take a closer look. The...

Overview Arctic is a vulnerable machine from Hack the Box that requires some basic web enumeration with using exploits to grab credentials and get a shell. The foothold is accomplished after using ...

Overview SecNotes is a vulnerable machine from Hack the Box that requires some basic web enumeration and file reading, with using SQL Injection on the login page. The foothold is accomplished after...