Resources
BHIS Blog
Current cybersecurity commentary and technical guidance.
elasticLabLocal
Elastic Local Lab Please go though the documenation and setup for the Local Version Now that we have set up Elastic , Kibana and Filebeat , we can finally get our hands dirty and learn how a SOC…
elasticLabCloud
Please go though the documenation and setup for the Cloud Version Elastic Cloud Lab GOAL Set up and use Elastic SIEM on your system Learn how to ingest logs and visualize them Learn how to use SIEM…
logAnalysis basics
Log Analysis Basics Hands-On Lab : Log Analysis Hayabusa Lab Log analysis involves reviewing system and security logs to detect unusual or malicious activity. Each log entry typically includes a…
welcome
Welcome! Future defenders, welcome! The fundamental abilities required to be a successful Security Operations Center (SOC) analyst will be covered in this course. You will participate in practical…
WireGuardLab
Dissecting WireGuard Traffic Capture file: Topology: Role IP Address UDP Port Initiator (Peer 1) Responder (Peer 2) Both peers use port 51820 - this is a symmetric peer-to-peer setup, not a…
Port Knocking Lab
Port Knocking on the Wire Capture file: Topology Role IP Address MAC Address Notes Knocking client (valid) 10.42.0.7 00:11:22:33:44:55 Completes correct sequence Protected server 192.0.2.55…
fragroute lab
IP Packet Fragmentation via Fragroute - Hands-On Lab Capture file: Topology Role IP Address MAC Address Notes Victim / IDS 192.168.20.10 00:11:22:33:44:AA Runs a shallow-inspection IDS/firewall…
ospf lab
OSPF Packet Analysis Capture file: Topology Role Router-ID IP Address MAC Address Designated Router (DR) 192.168.100.1 192.168.100.1/24 00:00:00:aa:00:01 Backup DR (BDR) 192.168.100.2 192.168.100.2/24…
IPSec & IKEv2
IPSec & IKEv2 Learning Objectives By the end of this lab you will be able to: Explain the IKEv2 two-phase negotiation process at the packet level Identify and interpret , , , and exchanges Recognise…
Covert TCP Lab
CovertTCP - IP Identification Covert Channel Capture file: Topology Role IP Address MAC Address Notes Sender (covert encoder) 10.1.1.10 00:AA:BB:CC:DD:01 Encodes secret data in outbound IPID fields…
ARP Cache Poisoning Lab
ARP Cache Poisoning - Wireshark Hands-On Lab Capture file: Topology Role IP Address MAC Address Notes Victim 192.168.10.5 00:11:22:33:44:55 Client trying to reach the gateway Gateway 192.168.10.1…
vsagent c2
C2 Traffic Analysis - vsagent HTTP Beaconing Capture file: Step 1 - Open The Capture Open in Wireshark Take a moment to scroll through the packet list. You will see a mix of traffic types - ARP, DNS,…