Resources
BHIS Blog
Current cybersecurity commentary and technical guidance.
BMPP medium
Medium CTF - NTLM Relay Attack You are investigating a security incident. A junior analyst flagged some strange authentication logs on an internal file server ( ). You pull the relevant logs and also…
BMPP hard
Hard CTF - Full Network Takeover via DHCPv6 You are a senior analyst responding to an incident. An endpoint detection tool flagged unusual outbound traffic from multiple workstations to an internal IP…
BMPP easy 2
Easy CTF 2 - Identifying Poisoning Traffic You are a defender reviewing a Wireshark capture from your internal network. You filter for LLMNR traffic and find the following exchange: You check your…
BMPP easy 1
Easy CTF 1 - Capturing a Hash You are on a penetration test inside a corporate Windows network. You run Responder on your machine and wait. A few minutes later, you see the following output in your…
Credential Harvesting
Credential Harvesting When attackers get into a network, one of the first things they go after is credentials - usernames and passwords. Not because they need one account, but because one account…
Broadcast Multicast Protocol Poisoning
Broadcast / Multicast Protocol Poisoning Networks rely on broadcast and multicast protocols to do things like resolve hostnames, find services, and route traffic. The problem is that these protocols…
Unauthorized Cloud Access
Unauthorized Cloud Access When an attacker accesses SaaS platforms or cloud infrastructure without authorization, it is known as unauthorized cloud access. Cloud servers, storage, identities, and…
Trusted Relationship
Compromised Trusted Relationship A trusted relationship issue happens when attackers abuse access that already exists between an organization and a third party - for example a vendor, contractor, or…
Social Engineering
Social Engineering Social engineering is when an attacker targets people instead of systems . Instead of breaking technical defenses directly, they convince someone to help them - often without the…
Phishing
Phishing Phishing is an attack in which users are duped into divulging login information, opening infected files, or clicking on malicious links. It typically arrives via email, but it can also arrive…
sqlmap
SQLMap Ubuntu VM Lab Goal The goal of this lab is to introduce sqlmap , a tool used to automate the detection and exploitation of SQL injection vulnerabilities. In this lab you will Understand the…
SocialEngineerToolkit
Social Engineering Toolkit (SET) Ubuntu VM In this lab we will Clone a real website to create a credential harvester Send a simulated phishing payload using SET's built-in tools Understand how…