Timeline: 18th - 24th Due: 24th February 11pm
This was an extremely challenging week for everyone and especially for myself. This week was about applying our knowledge for the past 2 weeks and to try for ourselves to crack boxes. These boxes mainly revolve web penetrations where students will have to demonstrate their capabilities using the tools they have found and learnt to gain root access. Root is access is classified as the highest level of privilege a user can gain. This means a user can run any command or application they want.
An overview of the week includes:
To prevent myself from losing track of what tasks I needed to complete, I made a Kanban board. The screenshot below shows an overview of sprint 3.
Screenshot of Trello Kanban Board of Sprint 3
Group Presentation Preparing
Screenshot of my slide in the group presentation
OSI model from BMC blogs
UTS Security Analyst Intern Interview
By trade, I am a software engineering student however this does not stop me from learning outside of my technical field. This is proven enrolling in this subject and joining the Cyber Security Team. The downside of not studying a security related degree, I have very basic networking knowledge that I can use. The extent of my understanding is setting up simple port forwarding servers for games like Minecraft, routine maintenance on all devices updating software firmware, changing default credentials and assigning static IPs to desktop systems.
I had to learn basic networking from scratch however I had no clue where to start. I asked help from the tutors and friends who have completed network subjects what are the important aspects of networking I should start with. A good start with networking was learning the OSI model and subnetting.
This week was intense with the amount of self application to gain root access to the boxes that were demonstrated throughout this week.
SecTalks is a monthly seminar that is at PWC hosted by the real world industry security professionals. This week’s workshop was about Zigbee and 802 protocol.
Zigbee is an IEEE 802.15.4 high level communication protocol used to create small network with IoT devices. This talks revolved around using a Zigbee to receive packets. It is important to note it is illegal to transmit using a Zigbee without permission by the owner of the network it is scanning.
The zigbee was used to scan for packets that were openly transmitted over the zigbee protocol which accumulated a lot of a data in raw format. They proceded to convert the raw file in a pcap file that allows tools like WireShark to analyse that data was being transmitted to be destined to be received.
Prioritisation is difficult to manage when you have to many tasks to complete. Whether they may require alot of time to minimal amounts, the quantity of tasks to complete can be overwhelming. I expected to able to solve a minimum of 2 boxes however I was only able to solve Mr Robot CTF.
I hope next week I can fully devote 100% of my time and effort to continually hack more boxes including completing challenges in HackTheBox. As a software engineer, this next week will be intriging as I will be able to put some of my programming knowledge into reverse engineering web applications or anything our guest speaker will challenge us with.
This week as expected was the most challenging week yet due to having a limited amount of time to work on boxes and learn IT networking. I have developed a good basic understanding of networking which included subnetting calculating what submask address are allocated to a network or host, TCP/UDP ports and many more networking topics.
Zigbee 2019, ‘What is zigbee?’, Zigbee, viewed 24th February, https://www.zigbee.org/what-is-zigbee/ Wikipedia n.d., ‘OSI Model’, Wikipedia, viewed 24th February, https://en.wikipedia.org/wiki/OSI_model BMC n.d., ‘OSI Model 7 layers’, BMC, viewed 24th February, https://www.bmc.com/blogs/osi-model-7-layers/ Microsoft n.d., ‘Windows network architecture and the OSI model’, Microsoft, viewed 24th February, https://docs.microsoft.com/en-us/windows-hardware/drivers/network/windows-network-architecture-and-the-osi-model Network World n.d., ‘The OSI model explained how to understand and remember the 7 layer network’, Network World, viewed 24th February, https://www.networkworld.com/article/3239677/lan-wan/the-osi-model-explained-how-to-understand-and-remember-the-7-layer-network-model.html Cloudflare n.d., ‘Open systems interconnection model OSI’, Cloudflare, viewed on 24th February, https://www.cloudflare.com/learning/ddos/glossary/open-systems-interconnection-model-osi/ Geeks for Geeks n.d., ‘Layers OSI model’,Geeks for Geeks, viewed 24th February, https://www.geeksforgeeks.org/layers-osi-model/