🧪 Cyber Security 10 — Blue Team Home Lab

1. Safe Lab Architecture

Host Machine (Windows/macOS/Linux)
  │
  ├─ VirtualBox / VMware (Host-Only Network: 192.168.56.0/24)
  │
  ├─ Kali Linux VM        192.168.56.10
  │   ├─ nmap, tcpdump, Wireshark
  │   ├─ Metasploit (for testing your own VMs ONLY)
  │   └─ Burp Suite Community
  │
  ├─ Ubuntu Server VM     192.168.56.20
  │   ├─ Apache/Nginx (log practice)
  │   ├─ SSH (brute force detection practice)
  │   └─ Fail2ban, UFW, Auditd
  │
  ├─ DVWA / WebGoat VM    192.168.56.30
  │   └─ Vulnerable web app (SQLi, XSS, CSRF practice)
  │
  └─ Windows 10/11 VM     192.168.56.40
      ├─ Sysmon (enhanced Windows logging)
      └─ Event Viewer + PowerShell logging

Optionally: Security Onion VM (SIEM for your lab)
            Splunk Free / Graylog / ELK Stack

2. Setting Up Logging (Ubuntu VM)

# Install and configure auditd
sudo apt install auditd -y
sudo systemctl enable auditd

# Watch login events
sudo tail -f /var/log/auth.log

# Watch for failed logins (brute force simulation)
sudo grep "Failed password" /var/log/auth.log | \
  awk '{print $11}' | sort | uniq -c | sort -rn

# Fail2ban — auto-ban repeated failed SSH logins
sudo apt install fail2ban -y
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
# jail.local settings:
# [sshd]
# enabled  = true
# maxretry = 5
# bantime  = 600

sudo systemctl enable fail2ban
sudo fail2ban-client status sshd   # check banned IPs

# Auditd — track file access
sudo auditctl -w /etc/passwd -p wa -k passwd_change
sudo ausearch -k passwd_change      # review events

3. Sysmon on Windows VM

# Sysmon = enhanced Windows event logging
# Download from Sysinternals

# Install with community config (SwiftOnSecurity)
# sysmon64.exe -accepteula -i sysmonconfig.xml

# Key Sysmon Event IDs:
# Event 1  - Process Create (command line + hash!)
# Event 3  - Network Connection
# Event 7  - Image Loaded (DLL)
# Event 11 - File Created
# Event 13 - Registry Value Set
# Event 22 - DNS Query

# Search in PowerShell
Get-WinEvent -LogName "Microsoft-Windows-Sysmon/Operational" |
  Where-Object {$_.Id -eq 1} | Select-Object -First 20 |
  ForEach-Object { $_.Message }

# Filter for PowerShell process creates:
Get-WinEvent -LogName "Microsoft-Windows-Sysmon/Operational" |
  Where-Object {$_.Id -eq 1 -and $_.Message -match "powershell"}

4. DVWA Practice — Web Vulnerabilities

# Setup DVWA (Docker — easiest)
docker pull vulnerables/web-dvwa
docker run -d -p 8080:80 vulnerables/web-dvwa
# Open: http://localhost:8080 | admin / password

# Set security level to "Low" first, then "Medium"

# SQLi Practice (Low level):
# Input in login/search field:
1' OR '1'='1         -- basic bypass
1' UNION SELECT null, version() -- #  -- DB version
1' UNION SELECT user(), database() -- #  -- user + DB name

# Watch the MySQL log while you do this:
# (in Ubuntu VM where MySQL is running)
sudo tail -f /var/log/mysql/general.log

# XSS Practice (Low level):
<script>alert('XSS')</script>
<img src=x onerror="alert(document.cookie)">

# Command Injection (Low level):
127.0.0.1; whoami
127.0.0.1; cat /etc/passwd

# Then flip to "High" / "Impossible" to see the defenses

5. Detection Ideas — Write Your Own Rules

# Scenario 1: SSH Brute Force Detection
# Trigger: >10 failed logins from same IP in 60 seconds
grep "Failed password" /var/log/auth.log | \
  awk '{print $11}' | sort | uniq -c | sort -rn | awk '$1>10'

# Scenario 2: New Admin User Created (Linux)
grep "useradd" /var/log/auth.log
grep "usermod.*sudo" /var/log/auth.log

# Scenario 3: Suspicious Outbound Connection
# Use Wireshark / tcpdump to capture:
sudo tcpdump -i eth0 'dst port not 80 and dst port not 443 and
  dst port not 22 and dst port not 53' -nn -v

# Scenario 4: Large File Transfer
sudo tcpdump -i eth0 -n 'tcp[tcpflags] & tcp-push != 0' |
  awk '{print $3}' | sort | uniq -c | sort -rn

# Scenario 5: Web Application Attack Patterns
# Monitor Apache/Nginx access log:
sudo tail -f /var/log/nginx/access.log | \
  grep -E "(union|select|drop|insert|exec|script|onerror)" -i

# Write as Splunk SPL:
index=nginx_access
| regex _raw="(union|select|drop|insert|exec|

6. Patch Priority Framework

# How to prioritize what to patch first:

CRITICAL (fix within 24-72 hours):
  ✔ Internet-facing service
  ✔ CVSS >= 9.0
  ✔ On CISA KEV list (known exploited in wild)
  ✔ No authentication required to exploit
  Example: Apache Log4Shell, ProxyShell, MOVEit

HIGH (fix within 1-2 weeks):
  ✔ Internal critical service (DB, auth server)
  ✔ CVSS 7.0-8.9
  ✔ Public PoC exploit available

MEDIUM (fix within 30 days):
  ✔ Non-critical service
  ✔ CVSS 4.0-6.9
  ✔ No public exploit

LOW (next maintenance window):
  ✔ Low exposure
  ✔ Compensating controls in place
  ✔ CVSS < 4.0

# CISA KEV (Known Exploited Vulnerabilities):
# Free catalog at cisa.gov/known-exploited-vulnerabilities-catalog
# If your vulnerable software is on this list → patch NOW

7. Weekly Blue Team Practice Plan

8. Free Resources & Practice Platforms

9. Home Lab Hardening Checklist

# Ubuntu Server VM hardening
[ ] Disable root SSH login
    /etc/ssh/sshd_config: PermitRootLogin no

[ ] SSH key only (disable password auth)
    PasswordAuthentication no

[ ] Enable UFW firewall
    sudo ufw default deny incoming
    sudo ufw allow 22/tcp
    sudo ufw enable

[ ] Automatic security updates
    sudo apt install unattended-upgrades
    sudo dpkg-reconfigure unattended-upgrades

[ ] Enable auditd
    sudo systemctl enable auditd

[ ] Install Fail2ban
    sudo apt install fail2ban

[ ] Disable unused services
    sudo systemctl disable bluetooth
    sudo systemctl disable cups

[ ] Check listening services (minimize attack surface)
    ss -tulpen | grep LISTEN

[ ] Review sudoers (no NOPASSWD for sensitive commands)
    sudo visudo