Visit the Cyber Security Body of Knowledge course recordings page
United Arab Emirates - Cyber Security Body of Knowledge (CyBOK)
WEBVTT
-->
Daniel, I think I am in your machine now, can you show me the, sorry, yeah, see, 7 complete
-->
lines, that's good, yeah, this is the correct one, that's good, yeah, this is the correct
-->
that's it, nice, that's all, and, so, that's great, so we can, what we can tell you with
-->
the user agent is that he is using Daniel, that's a question for you, if you're willing
-->
to answer, like, no pressure, only, sorry, sorry, I didn't hear you, I was looking
-->
at the next question, what did you say, right, so, by looking at the user agent, what can
-->
you tell about the machine that the administrator was using, so, it was the internet and they
-->
are using Mac OS, Mac OS, Mac operating system, yeah, but then Intel Core, that
-->
means that's an old model, not the M1 model or the M2 model, right, yeah, right, that's
-->
great, and they are working on Chrome and Safari both, so, that's good, nice, great
-->
work Daniel, so, I think our time is over, I will be sharing my screen and I'll try
-->
to go through it with you guys, let's go through it together, we need this, that's
-->
just my calendar on my school life, so, we have the password, now we need to look
-->
for this one, the user agent of the administrator, now, sorry, if you guys remember, we also
-->
talked about that user agent can be found easily in the access log, because that is
-->
what it records, so, let's just open it, let's just get into the file explorer
-->
and open our access log, okay, so, we have this, and, but, but, but, but we
-->
are looking for the administrator, user agent of the administrator user, so, administrator,
-->
and we also know that the first, first one, how can we uniquely identify that who is
-->
trying to do this, the first one is the IP address, so, we can just go back, we
-->
can just, we can just go back to our, this, this page, and we can search and
-->
go for users, we are trying to look that, this is the admin, let's, let's just copy
-->
this stuff, and let's go to our page, which is access log now, and well, this
-->
is open on mousepad, yeah, that's the access, Ctrl F, let's find, let's go and
-->
find the IP for this one, and enter, okay, so, this is the one, my bad, yeah, this is the one, yeah, so, we can
-->
see, let me, let me zoom this, okay, so, we can see that the administrator is using
-->
Mozilla Firefox, and he's on a Macintosh with Intel Mac, so, the Intel Mac were
-->
discontinued after 2020, or something like that, I don't remember exactly, but,
-->
yeah, and this one is old, and then, KHTML, it's Gecko, Gecko might be some
-->
other service, and he's using both Chrome and Safari, so, we get so much
-->
information by just looking at the user agent, so, we have that flag, and it looks
-->
beautiful when it's completed, yeah, seven lines complete, only three more to go,
-->
so, let's just go straight through, these are on the easier end of the
-->
scale, what time did, what time did the contractor add themselves to the
-->
administrator group, so, administrator group is present in the forum, you
-->
remember, there was a group, so, let's see, let's go and check the logs,
-->
because this is what it kind of gets into, when, what time did the
-->
contractor add themselves, so, this information must have been logged,
-->
or it might, it is not present in the configuration file, because
-->
configuration file is you configure something in the end, and then you
-->
don't usually change it, but these kind of things, adding and
-->
subtracting, or deleting from the administrator group, these kind of
-->
things go into the log side, not the configuration side, so, the LDAP
-->
password went to the configuration side, this might easily go to the log
-->
side, let's, like, I'm just speaking out loud, so that, so that my thought
-->
process of how I reached that conclusion, you know, that is conveyed,
-->
so, let's go straight forward, and let's, yeah, it was the logs, logs,
-->
logs, logs, logs, and we have, we have this one, administrator,
-->
yeah, you see, log user added, and where he is added, he is added
-->
in the administrators, and who is added, Apoli is added, so, that
-->
is an alarm bell for all of us, I think, yeah, that is the alarm
-->
bell for the organization, you see this one, so, we have been asked
-->
that what is the timestamp, again, nothing new, just control C, go
-->
to the epoch, converter, control A, control B, just timestamp it,
-->
and yeah, this is a good tool, and yeah, yep, we have that with us
-->
now, okay, what time will the contractor download the database
-->
backup, now, I want you guys to try the last two, like, last two
-->
are related, so, if you do one, you have already done the other
-->
one, and we have also been doing this lab to us, so, yeah, let's
-->
give five minutes to us, and let's see who figures this one
-->
out, last year, it was Daniel, who did the right one,
-->
we have the seven, before that it was Lucy, I think, yeah,
-->
let's see who gets it this one, who gets it this time, so,
-->
complete this one, last name.
-->
Okay, just need to come in, I'm going, I have to jump off,
-->
so, it's been really nice going through the five days,
-->
so, I really appreciate everyone spending all the time,
-->
and I'm actually super surprised that our attendance
-->
for the class did not drop throughout the day, every day,
-->
normally with these classes, there's somebody who doesn't
-->
show up, at least one, with this small group as well,
-->
so, at least two maybe even, so, I'm really surprised that
-->
you've gone through the entire course, and I see the
-->
engagement level is really high as well, so, well done,
-->
everyone, and, yeah, I think we might see each other
-->
at some point, so, all the best, I will be in touch with
-->
emails, I'll be still here for the next one hour for
-->
you, you know, to go through the lab, and be on the
-->
email support, if you can somehow manage to come on to
-->
this Microsoft channel, then you can chat with us for
-->
the next few days as well, I'll keep it open, otherwise,
-->
it's going to be the email channel for communication,
-->
and, yeah, we will be sending out the solutions for
-->
these labs as well, so, you can go and do them again,
-->
and I did get a confirmation that these particular labs
-->
will be available for all of you, for an extended period
-->
of time, normally, it isn't the case, it actually
-->
finishes right on the day of the training, so, he's
-->
going to be extending it until Tuesday, so, you do
-->
have like three, four days to play along with,
-->
the other thing I wanted to add to that, if you go
-->
to Hack the Box, or Try Hack Me, there is a attacker
-->
machine and other machines that you can access
-->
virtually right from within that platform, and most of
-->
these labs are available for free, I mean, at
-->
least the beginner levels and the other ones, and then
-->
if you do feel like you want to get into these and
-->
try a bit more, then there's a paid version on each
-->
of these websites, and they give you that
-->
environment, so you don't have to be tied down
-->
to what we are providing here, like this is just
-->
for the labs we have, but then if you do want
-->
to continue, they have a really good, you know,
-->
platform to go through and try every single,
-->
you know, scenarios that they're presenting, so,
-->
all the best everyone, you know, happy learning,
-->
thumbs up, if you enjoyed, and catch you all later,
-->
yeah. Thanks so much, it was really good.
-->
Thank you, take care, bye bye.
-->
Oh yeah, so that leaves us, let's try to
-->
finish this one off, and then I'm here for
-->
doubts across all the full labs, and if you
-->
want, then I can, yeah.
-->
Can you please go to my, to my VMS, I'm trying
-->
to close this one, okay, maybe.
-->
Okay, I'm in the, my audible, have I muted
-->
myself? Yeah, I can hear you.
-->
Okay, that's good.
-->
I don't know, can you see what's happening?
-->
Yeah, it is, it is showing that connection
-->
was reset.
-->
Oh, on my machine.