Adversary Techniques Tactics & Procedures and Incident Response - cfloquetprojects/homelab GitHub Wiki

Introduction:

• This is a series of guides and tutorials for penetration testing and incident response.
• For the purposes of making these labs easily replicable in a DIY lab environment, I will be attempting to create labs using the freely available Kali Linux, with some notable caveats that some if not most of the tools and packages we will be using won't be coming default on the systems we choose to deploy.
• In terms of the virtualization platform I'll be using, I prefer VMware Workstation Pro, however this does require a license key for any use beyond the scope of just 14 days.
  • I am now a multi-year subscriber to VMUG Advantage which essentially is a watered down VMWare license that gets you access to full-year long evaluation licenses for only around $120, this allows me to run fully licensed ESXi, vCenter, and VMWare Workstation products on my servers and workstation.

Pre-Flight Check:

• If you plan on running a virtualized environment on your own hardware, keep in mind that this can only be done on CPUs that support virtualization. I will be running my VMs on my local machine (using AMD Ryzen 5 2400G 3.60 GHz)

Overview of Labs:

• Incident Response Investigations:
  • Basics of Examining The Windows OS
  • Examining Network Forensics
  • Investigating Device Memory
  • Malware Investigation
  • Digital Forensics in the Cloud
• Reconnaissance, OSINT & Enumeration:
  • Using SpiderFoot for OSINT
  • Interrogating DNS
  • Network Mapping with Nmap
  • Scanning the Cloud
  • Manipulating the SMB Protocol
  • Detecting Windows Credential Spraying Attacks:
• Credential Manipulation & Access:
  • Password Guessing with Hydra and Metasploit
  • Cracking Credentials with John the Ripper
  • Using Hashcat
  • Leveraging the Domain Password Audit Tool (DPAT)
  • Cloud Bucket Discovery
  • Netcat: Opportunities Abound
• Exploiting Bastion Hosts and other External Assets:
  • Attacks & Analysis with the Metasploit Framework
  • Learning Browser Exploitation with BeEF
  • Examining System Resource Usage Database Statistics
  • Exploitation via Command Injection & XSS
  • Web Application Exploitation via SQL Injection
  • Cloud SSRF & IMDS Attacks
• Post Exploitation & Evasive Maneuvers:
  • Pivoting for Persistence
  • Responder Attacks
  • Leveraging Alternative Data Streams
  • Establishing Persistence using the Metasploit Framework
  • Threat Intelligence Analytics
  • Assessing Cloud Security Posture through Configuration