Darknet 1.0

Several days ago I started the Darknet 1.0 challenge created by q3rv0 which was added to Vulnhub May 2nd. I didn't have much time the last week, but with the weekend up ahead I will try to dig deeper.

So far I found several minor things and after handling the SQLi I'm now facing a text field and it's content is apparently executed. At least if one can trust the friendly "Exec" button...

I'll get back with any progress.

CSSA Passed

I just passed my Certified SCADA Security Architect (CSSA) certification. The classes where hosted by the InfoSec Institute and the certification itself is offered by the Information Assurance Certification Review Board (IACRB). The IACRB is a non profit organisation that focuses on certifying individuals and their skills in various information security and ethical hacking related topics.

This is a short recap of the SCADA security online boot camp as offered by the InfoSec Institute and the exam itself.

The classes offered by InfoSec Institute are somewhat ordinary, the instructor is reading the slides to you without much commenting and the slides seam to be from one of the last decades. The labs which are mandatory, are offered through WindowsXP based virtual machines, which you will have to have a license key for. You will, among others, be writing policies, replaying Modbus packets and write some IDS signatures to detect Modbus attacks.

Nevertheless, the content provided can help you to get an understanding of the topic. So the class can be a great starting point for further research and learning. The class will also more or less ensure that you pass the exam, even if you fall asleep while watching the recorded training.

The exam itself is comprised of 100 multiple choice questions across all topics. You will have 150 minutes to answer them all, not answering a question counts as a wrong answer. One third of the questions are simple yes or no questions which will partially rule out each other, so they are very easy to answer, the other two thirds are more complex and sometimes not very precise but still doable.

Concluding, the training classes could be much better, the labs could use some renovation and the certification exam could be a little harder. It was fun doing the exam though. Nonetheless, I would suggest reading a good book on the topic and do the exam straight away without taking any training classes to anyone interested in the SCADA security.

A first post

Hello there traveler,

I assume, and I think that I'm not mistaken, you are here by accident.
There is nothing to see right now, and probably won't be for the near future as I have a ton of work piled up in front of me.

Nonetheless, I will try to tell you my plans for this blog.

I will try to publish write-ups of hacking challenges, IT-security related training and useful tools or code and obviously anything I learn on the way here. Sometimes even some unrelated topics like traveling, food or other things may be published.

The blog is partly used some sort of notebook for myself, but of course the posts are also intended for any inclined reader stumbling through.

While there is nothing here to read, I can recommend this blog which I'm also contributing to.

Cheers,
derDuffy