Comprehensive Emergency Response Strategies for Web3 Security Challenges
Participate in Emergency Response training, investigate Apache logs for attacker IP, and find flags hidden in tasks and user management.
Category: Network security
Optimizing Your Security Log Strategy: How to Prevent Overwrite Issues in Sysmon Logs During Cyber Attacks
1. Preparation 1.1 Enable Log Recording Enable logging by Sysmon according to the Security log strategy. /> 1.2 Optimize Log Strategy Optimize security…
Comprehensive Threat Detection and Mitigation with Muyun HIDS: A Case Study
Muyun HIDS detected and handled 4 malicious files on a server, addressing issues with processes and user accounts and updating security settings.
Enhancing Host Security: Handling Breaches with Muyun HIDS
Muyun HIDS detected a foreign IP creating a system account, indicating an attack. The root account displayed weak password issues and was restrained….
Optimizing Security Log Overwrite Strategy: Addressing Vulnerabilities in Apache, MySQL, and Sysmon Logs
Attackers exploited phpMyAdmin and RDP weak passwords. Multiple webshells (5d.php, dpvebhqgkc.php, vvmbhvehak.php) were deployed, executing commands and downloading malware (gauexjqv.exe). Sysmon logs and…
Detecting and Mitigating Trojan Webshells in Linux Web Directories
The web directory /var/www/html housed files like 1.php, identified as webshell Trojans. It is recommended to use D Shield for detection on Windows.
Understanding Ant Sword Webshell: Decoding and Analyzing Malware with Wireshark
Using Wireshark, trace HTTP requests to find Ant Sword webshell traits in 1.php traffic. Decoded payloads unveil commands like `cd`, `id`, and disclose…
Phishing Email Analysis: Uncovering the Source and Mitigation Strategies for Recent Cyber Attack on Xiao Zhang’s Company
A phishing email attack compromised a company’s network. Analysis of the Phishing Email revealed the attacker’s IP (121.204.224.15), a Trojan’s control IP (107.16.111.57),…
Master Web Application Hacking with BurpSuite: Overcoming Challenges and Cracking Success Using Hydra
Using BurpSuite, a slow password crack was attempted. Hydra, though 100x faster, initially failed due to indistinguishable login responses. Successful login was identified…
Comprehensive Guide to Network Reconnaissance, Initial Access, and Privilege Escalation Techniques
ARP protocol scanning revealed internal IP addresses. Website vulnerability allowed unauthorized access to all user passwords via a user_id parameter. These credentials enabled…
Load More