Course duration: 18 hours (18 CPE points) 

Course is self-paced and pre-recorded

What will you learn? 

• A range of skills and techniques to assist in the incident response stages
• The six stages of incident response
• Open source toolsets to assist in incident response
• How to report the incident response to management

What skills will you gain? 

• Techniques for searching and obtaining artifacts critical to aid in incident response
• Open source toolsets for searching and obtaining artifacts critical to aid in incident response
• The six stages of incident response
• Techniques for building system and network defenses
• Swapping out infected systems and rerouting network traffic on the fly
• Malware analysis  
• Memory analysis
• Network protocol analysis
• Host behaviour analysis

What will you need?

• Laptop or Desktop with minimum 4gb of RAM
• VirtualBox (latest version to run image) to run Windows and Linux operating systems interchangeably

What should you know before you join?

• Networking knowledge and pcap dissection (including theoretical knowledge, programming languages, software & hardware)
• Linux system architecture (administration), Windows architecture (administration), network analysis, common network & system attack types
• Comfortable with Linux command line instruction
• Comfortable with Windows command line instruction
• Background or interest in information security technical roles, e.g., network, system administration, engineering, devops

Your intructor: O'Shea Bowens

O’Shea Bowens is an information security enthusiast with a decade of information security experience. His primary focus is incident response, malware analysis, and blue teaming functions. O'Shea has worked and consulted for companies and clients in the federal government, U.S. and international firms in various information security roles, including security analyst, incident response, network & systems forensics, architecture and network engineering.

Syllabus

Before the start

• VirtualBox
• Networking in VirtualBox (Students will need to setup a virtual environment for this course)
• Linux command line knowledge
• Windows command line knowledge
• Networking TCP Ipv4 knowledge
• Common malware traits

Module 1: Introduction to Incident Response
Why Are We Here?

Module 1 covered topics: The Six Stages of Incident Response

• Preparation
• Identification
• Containment
• Eradication
• Recovery
• Lessons Learned
• Legal Problems
• Cyber Laws as they Currently Stand

Module 1 exercises:

• Understanding of incident response forms
• Introduction to incident response stages
• Setting up a lab environment to analyze malware (never use your production systems)

Module 2: Preparation & Identification
Understanding of incident response stages - Preparation & Identification

Module 2 covered topics:

• Events versus Incidents
• Incident Response Parties Involved
• Network Intrusion Detection Systems
• Host based intrusion detection
• ** Logs of system events vs incidents- participants  will need an open source NIDS & HIDS tool, for analyzing malicious activity

Module 2 exercises: 

• System logs provided to assist in exercise
• Vulnerable image of OS provided to perform exercises
• Introduction of OSSEC
• Introduction of Bro
• Leveraging of Windows event logs (security) & Windows log auditing
• Leveraging Linux auditd logs
• Pcap Analysis Tutorial

Module 3: Containment & Eradication
Understanding of incident response stages - Containment & Eradication  

Module 3 covered topics:

• Establishing short/long-term containment
• Enhancement of defensive posture for network, servers, and endpoints
• Indicators of compromise creation and usage in incident response
• Indicators of attack correlation

Module 3 exercises: 

• System and network logs provided to assist in exercise
• Vulnerable image of OS to perform exercises
• How to create a secure forensic image guide
• How to craft an indicator of compromise
• Searching across your environment for malware
• Creating correlation to spot malicious activity
• Taking advantage of IP tables
• Obtaining stings to hunt for activity

Module 4: Recovery & Lessons Learned
Understanding of Incident Response Stages - Recovery & Lessons

Module 4 covered topics:

• Procedure to test, monitor, and confirm system behavior
• How to define scope of incident
• Injecting backups
• Conducting roundtable discussions for lessons learned

Module 4 exercises: 

• System and network logs provided to assist in exercise
• Vulnerable image of OS to perform exercises
• Searching across the environment for threats based on IOC
• Provide summary of attack based on artifacts
• Leveraging “Regshot” to compare registry for normalization
• Conducting vulnerability assessments with OpenVas
• Creating executive summary of incident

Module 5 Putting it together - Attack Scenario #1
Attack scenario walkthrough with reporting form for incident to be completed

Module 5 covered topics:

• Objective: Complete executive summary with incident response
• Track attack via pcaps, logs, and disk analysis

Module 5 exercises:

• With image supplied of exploited server/endpoint, objective is for participants to utilize  supplied log sources, memory images, and pcaps to establish report of root cause analysis. (Supply IR forms, i.e., communication form, incident report - how were IOC/artifacts gathered)

Module 5 Tools: Students may use tools listed below or tools of choice:

• Wireshark
• Process Explorer
• Regshot
• Sysinternals
• NIDS – BRO, Snort
• HIDS- OSSEC
• Memory Analysis- Volatility
• IDA
• Event Log Viewer
• ApateDns

Module 5 Malicious activity:

• Malware introduced to system via covered attack vector
• Provided network traffic of malware sample
• Provided system events via Windows logs to verify activity  
• Provided memory image

Module 6 title: Putting it together - Attack Scenario #2
Attack scenario walkthrough with reporting form for incident to be completed.

Module 6 covered topics:

• Objective: Complete executive summary of incident. Note: There are different methods of obtaining artifacts and interpreting the incident. So be creative.
• Track attack via pcaps, logs, and disk analysis

Module 6 exercises:

• With image supplied of exploited server/endpoint, objective is for participants to utilize  supplied log sources, memory images, and pcaps to establish report of root cause analysis. (Supply IR forms i.e. communication form, incident report - how were IOC/artifacts gathered)

Module 6 Tools: Students may use tools listed below or tools of choice:

• Wireshark
• Process Explorer
• Regshot
• Sysinternals
• NIDS - BRO
• HIDS - OSSEC
• Memory Analysis - Volatility
• IDA
• Event Logs

Module 6 Malicious activity

• Malware introduced to system via covered attack vector
• Provided network traffic of malware sample
• Provided system events via Windows logs to verify activity  
• Provided memory image

Course format: 

• The course is self-paced – you can visit the training whenever you want and your content will be there.
• Once you’re in, you keep access forever, even when you finish the course.
• There are no deadlines, except for the ones you set for yourself.
• We designed the course so that a diligent student will need about 18 hours of work to complete the training.
• Your time will be filled with reading, videos, and exercises. 

QUESTIONS? 

If you have any questions, please contact our eLearning Manager at h9.courses@hakin9.org.

The courses below were all published in 2015 or earlier. While we stand by pubishing them then, we’ve grown so much since. We recognize that these workshops don’t exactly meet our standards, as we understand them today. 

All classes are available within our premium membership, and have adjusted CPE awards to reflect their respective contents. If you join, please keep in mind that some of the information inside might be outdated or not relevant. We’ll be adding notes at the beginning of each course to let you know what’s worth checking out in each! 

The access to this course is restricted to Hakin9 Premium or IT Pack Premium Subscription

Certificate of completion, 9 CPE credits

Course is self-paced

Course format

• The course is self-paced – you can visit the training whenever you want and your content will be there.
• Once you’re in, you keep access forever, even when you finish the course. 
• There are no deadlines, except for the ones you set for yourself. 
• Your time will be filled with reading and exercises. 

Module 1 (introduction):

• Why python?
• Introduction about python programming language.
• Learning the strengths of the language and what’s good with python.
• Learning where to use Python and why.
• Python as an interpreted language
• How to choose correct interpreter, install it, run it.
• Python virtual environments.
• Text editor (kate, gedit, brackets).
• How to create Hello world, from interpreter and with .py script.
• Standards and batteries included
• Standards and PEP8.
• Batteries included (just to show the most useful python core libraries and link to the official
• documentation).

Competences gained after module 1:

• understanding python and how to install it
• understanding python virtual environments
• using the interpreter and running a python script
• advanced text editors for coding

Module 2 (python basics):

• Python data types and flow control statements
• Ifs, fors, whiles
• Lists (slices), dictionaries (loop over items), sets
• Python internals
• Classes and object instances
• Everything is an object (docs strings, getters, setters, override)
• Exceptions handling
• Practical example
• Use twitter’s API to get some data and show it in the console

Competences gained after module 2:

• understanding basic python data types
• knowing what classes are and how to use them
• understanding exceptions and know how to handle them
• knowing how to get data from a publicly accessible API

Module 3 (files)

• Files
• Duck typing.
• Opening and reading from files.
• Csv files and csvreader.
• Practical exercise
• Read file with a sentence per line.
• Manipulate and gather metrics on each sentence.
• Output a file with metrics on each sentence.

Competences gained after module 3:

• understanding the concept of duck typing
• understanding how files work
• understanding the csv python module to read/write csv files

Module 4 (project):

• Practical project
• Get data from external source (https://openweathermap.org).
• Manipulate data to suit our needs.
• Plot a graph to show the data in a graphical and understandable way.

Competences gained after module 4

• understanding how to hit API’s to get information
• understanding how data should be structure to feed plot module
• using python plotting library to be able to show our data

Bonus: Workshop eBook

Instructors

Pedro Araujo was graduated from Computer Science of Universidade do Minho, after this, he had pursued his masters degree in Informatics course choosing Parallel and Distributed Computing and Formal Methods. Pedro Araujo has diverse professional experiences as he first worked at Eurotux, S.A. where he developed web sites using Plone and Zope in addition to some system administration functions like developing plugins for rails and several Android development performed on a personal base. Then, he moved to WeDo Technologies, a company that focuses in Revenue Assurance. There, he mainly worked on Java developments, Solaris and Linux servers. Presently, he is working in Network Locum, a promising startup and two additional projects, Novaweb and Atttentive. All in all, he is a complete supporter of Open Source and his most preferred programming language is  Python.

Rui Silva is a computer Scientist from Portugal. https://alfasite.org/

My name is Rui Silva and I'm a python developer who loves open source. I started working as a freelancer in 2008, while I finished my graduation in Computer Science in Universidade do Minho. After my graduation, I started pursuing a master's degree, choosing the field of parallel computation and mobile and ubiquitous computing. I ended up only finishing the mobile and ubiquitous computing course. In my 3 years of freelancing, i worked mostly with python, developing django websites, drupal websites and some magento stores. I also had to do some system administration. After that, I started working in Eurotux Informática, S.A. where I develop websites using Plone, django and drupal. I'm also an IOS developer and sometimes I perform some system administration tasks. Besides my job, I work as a freelancer using mainly django and other python frameworks.

QUESTIONS? 

If you have any questions, please contact our eLearning Manager at h9.courses@hakin9.org.

Course is self-paced

Course archive

The courses below were all published in 2015 or earlier. While we stand by pubishing them then, we’ve grown so much since. We recognize that these workshops don’t exactly meet our standards, as we understand them today. 

All classes are available within our premium membership, and have adjusted CPE awards to reflect their respective contents. If you join, please keep in mind that some of the information inside might be outdated or not relevant. We’ll be adding notes at the beginning of each course to let you know what’s worth checking out in each! 

 The access to this course is restricted to Hakin9 Premium or IT Pack Premium Subscription

Advanced Exploitation and Exploit Writing with Exploit Pack

This course will cover the following topics from a technical and practical perspective, starting from running and exploiting your first targets to gaining persistence and owning a whole network. This course builds deep background knowledge and expert-level skills and the ideal attendants will be penetration testers, security enthusiasts and network administrators.

Our instructor Juan Sacco has prepared a special gift. Every student who will successfully finish the course will receive a Professional Pack - This pack contains all the exploits you could find out there, this is a full set of 34000+ exploits and by using it you can be sure that your pentest will be come unstoppable. All the platform includeds: Windows, Linux, Unix, Minix, SCO, Solaris, OSX, etc. and even mobile and web attacks. 

To receive Professional Pack, send me a message with your certificate code.

Email address: sienicka.marta@hakin9.org

Course format:

• The course is self-paced – you can visit the training whenever you want and your content will be there.
• Once you’re in, you keep access forever, even when you finish the course.
• There are no deadlines, except for the ones you set for yourself.
• Your time will be filled with reading, videos, and exercises.

Topics covered:

• Concepts and basics
• Attacker Decision Making
• Getting started with Exploit Pack and Setup
• Internals of Exploit Pack
• Enumeration of Targets
• Exploiting the LAN
• Exploiting Windows Hosts
• Exploiting Linux Hosts
• Exploiting Web Servers
• Basic Exploit Writing
• Advanced technics and real world examples
• Post Exploitation

Student requirements:

• Basic understanding of Exploit development
• TCP/IP basics
• Network configuration in Windows and Linux/OSX

About Exploit Pack:

Exploit Pack uses an advanced software-defined interface that supports rapid reconfiguration to adapt exploit codes to the constantly evolving threat environment. Our technologies allow you to rapidly tests and defend against hostile remote targets.

The mission of Exploit Pack is to process and exploit security issues, gain access and report incidents in a technical report to help defend against hostile systems.

About the instructor:

Juan Sacco: 

Author of the Exploit Pack.

Exploit Writer and Reverse Engineer, worked at Core Security, NOD32, Homeland Security (ARG) and others security related organizations.

QUESTIONS? 

If you have any questions, please contact our eLearning Manager at h9.courses@hakin9.org.

The courses below were all published in 2015 or earlier. While we stand by pubishing them then, we’ve grown so much since. We recognize that these workshops don’t exactly meet our standards, as we understand them today. 

All classes are available within our premium membership, and have adjusted CPE awards to reflect their respective contents. If you join, please keep in mind that some of the information inside might be outdated or not relevant. We’ll be adding notes at the beginning of each course to let you know what’s worth checking out in each! 

The access to this course is restricted to Hakin9 Premium or IT Pack Premium Subscription

This online course is for you and you will learn how to build your own virtual lab and install the pre-requisites. You will also build your Own Kali Linux customize build with Nessus as Vulnerability Scanner. You should be using your new build of Kali Linux for attacking the vulnerable machine in this workshop.

The idea behind this workshop is basically nothing new but we will learn something new that’s the whole agenda. The workshop would be simple and will go quickly. Do not feel that I will explain how certain tools works or what is exploit blah blah. However a bit of them!

You will gain the new SUPER SKILL you will know how to create your own Virtual Lab to hack what you need or want to HACK!

We will be focusing on how to do some research on actually discovering vulnerabilities in software and then putting more efforts to write some proof of concepts for those vulnerabilities. The value added of this workshop would be a quick guide on how to rebuild Kali Linux as per your requirement. As we have listed down “Nessus” to be used in this workshop for the vulnerability assessment phase, what if you can rebuild Kali Linux and add some security tools in it, which you always wanted. Kali Linux is customizable and we will add Nessus in our new build of Kali Linux.

Certificate of completion, no CPE credits

Pre-requisites

• A vulnerable program
• Programming concepts
• Expertise in any one programming language (python preferred)
• Knowledge on vulnerability assessment tools

Course format

• The course is self-paced – you can visit the training whenever you want and your content will be there.
• Once you’re in, you keep access forever, even when you finish the course. 
• There are no deadlines, except for the ones you set for yourself. 

INSTRUCTOR Raheel Ahmad (RA) is an information security professional with in depth experience in Ethical Hacking & Penetration Testing. He has performed many penetration testing engagements for well known top ten Banks and enterprises while working for Big4 and other consulting firms. He is Bachelors in Computer Engineering and hold almost decade of experience in Information Security across multiple countries. Best way to reach out RA is via hakin9 messages for any question regarding the workshops.

QUESTIONS? 

If you have any questions, please contact our eLearning Manager at h9.courses@hakin9.org.