corpus.blog
56,966 blogs · 4,417,066 posts Claim your blog
Record · corpus.blog/posts/01a0878d-be1a-728d-b309-3508342a7fa5

SANS 2019 Holiday Hack Challenge

jhalon.github.io · published 23 January 2020

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at jhalon.github.io Wayback capture
0blogs citing
First cited
—
Most recent
—
Rank this month
not ranked
Links from this post
148
Words captured
42,737

Cited by

No blog we hold has cited this post yet.

Links from this post

Link
Host
https://www.holidayhackchallenge.com/2019/
holidayhackchallenge.com
https://downloads.elfu.org/Security.evtx.zip
downloads.elfu.org
https://downloads.elfu.org/sysmon-data.json.zip
downloads.elfu.org
https://downloads.elfu.org/elfu-zeeklogs.zip
downloads.elfu.org
https://fridosleigh.com/
fridosleigh.com
https://studentportal.elfu.org/
studentportal.elfu.org
https://downloads.elfu.org/elfscrow.exe
downloads.elfu.org
https://downloads.elfu.org/elfscrow.pdb
downloads.elfu.org
https://downloads.elfu.org/ElfUResearchLabsSuperSledOMaticQuickStartGuideV1.2.pdf.enc
downloads.elfu.org
https://downloads.elfu.org/http.log.gz
downloads.elfu.org
https://srf.elfu.org/
srf.elfu.org
https://www.gnu.org/software/ed/manual/ed_manual.html
gnu.org
http://www.climagic.org/txt/how-to-quit-vi-emacs-nano-pico-joe-jed-etc.dyn
climagic.org
https://www.sans.org/reading-room/whitepapers/logging/evtx-windows-event-logging-32949
sans.org
https://www.ericconrad.com/2016/09/deepbluecli-powershell-module-for-hunt.html
ericconrad.com
https://www.coalfire.com/The-Coalfire-Blog/March-2019/Password-Spraying-What-to-Do-and-How-to-Avoid-It
coalfire.com
https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4648
ultimatewindowssecurity.com
https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4672
ultimatewindowssecurity.com
http://linuxcommand.org/lc3_man_pages/ls1.html
linuxcommand.org
http://www.linfo.org/executable.html
linfo.org
https://linux.die.net/man/1/whereis
linux.die.net
https://www.darkoperator.com/blog/2014/8/8/sysinternals-sysmon
darkoperator.com
https://pen-testing.sans.org/blog/2019/12/10/eql-threat-hunting/
pen-testing.sans.org
https://www.endgame.com/our-experts/ross-wolf
endgame.com
https://github.com/endgameinc/eql
github.com
https://github.com/endgameinc/eqllib
github.com
https://eql.readthedocs.io/en/latest/query-guide/index.html
eql.readthedocs.io
https://en.wikipedia.org/wiki/Local_Security_Authority_Subsystem_Service
en.wikipedia.org
https://docs.microsoft.com/en-us/sysinternals/downloads/procdump
docs.microsoft.com
https://ss64.com/nt/ntdsutil.html
ss64.com
https://blogs.sans.org/pen-testing/files/2016/05/PowerShellCheatSheet_v41.pdf
blogs.sans.org
https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/get-history?view=powershell-7
docs.microsoft.com
https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/format-list?view=powershell-7
docs.microsoft.com
https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-childitem?view=powershell-7
docs.microsoft.com
https://en.wikipedia.org/wiki/Environment_variable
en.wikipedia.org
https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_environment_variables?view=powershell-7
docs.microsoft.com
https://docs.microsoft.com/en-us/dotnet/api/system.io.filesysteminfo.lastwritetime?view=netframework-4.8
docs.microsoft.com
https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/select-object?view=powershell-7
docs.microsoft.com
https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.archive/expand-archive?view=powershell-7
docs.microsoft.com
https://www.computerhope.com/unix/uchmod.htm
computerhope.com
https://stackoverflow.com/questions/30200655/what-does-the-n-and-e-represent-in-this-select-statement
stackoverflow.com
https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-process?view=powershell-7
docs.microsoft.com
https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/stop-process?view=powershell-7
docs.microsoft.com
https://docs.microsoft.com/en-us/sysinternals/downloads/sysmon
docs.microsoft.com
https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/group-object?view=powershell-7
docs.microsoft.com
https://www.activecountermeasures.com/free-tools/rita/
activecountermeasures.com
https://www.zeek.org/
zeek.org
https://github.com/activecm/rita/blob/master/docs/Manual%20Installation.md
github.com
https://docs.mongodb.com/manual/tutorial/install-mongodb-on-debian-tarball/
docs.mongodb.com
https://golang.org/
golang.org
https://splunk.elfu.org/en-US/app/SA-elfusoc/search
splunk.elfu.org
http://elfu-soc.s3-website-us-east-1.amazonaws.com/
elfu-soc.s3-website-us-east-1.amazonaws.com
https://www.splunk.com/en_us/blog/security/a-salacious-soliloquy-on-sysmon.html
splunk.com
https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=90003
ultimatewindowssecurity.com
https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=90001
ultimatewindowssecurity.com
https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4688
ultimatewindowssecurity.com
https://support.office.com/en-us/article/command-line-switches-for-microsoft-office-products-079164cd-4ef5-4178-b235-441737deb3a6
support.office.com
https://stoq.punchcyber.com/
stoq.punchcyber.com
https://www.sans.org/cyber-security-summit/archives/file/summit_archive_1492181136.pdf
sans.org
https://attack.mitre.org/techniques/T1193/
attack.mitre.org
https://docs.microsoft.com/en-us/archive/msdn-magazine/2008/april/office-dev-managing-metadata-with-document-information-panels
docs.microsoft.com
https://en.wikipedia.org/wiki/Prime_number
en.wikipedia.org
https://python-reference.readthedocs.io/en/latest/docs/operators/modulus.html
python-reference.readthedocs.io
https://en.wikipedia.org/wiki/Combinatorics
en.wikipedia.org
https://docs.python.org/3/tutorial/datastructures.html
docs.python.org
https://www.hackerrank.com/challenges/itertools-product/problem
hackerrank.com
https://en.wikipedia.org/wiki/Cartesian_product
en.wikipedia.org
https://www.tutorialspoint.com/python/python_tuples.htm
tutorialspoint.com
https://docs.python.org/3/reference/simple_stmts.html
docs.python.org
https://docs.python.org/3/library/functions.html
docs.python.org
https://docs.python.org/3/library/stdtypes.html
docs.python.org
https://youtu.be/0T6-DQtzCgM
youtu.be
https://en.wikipedia.org/wiki/The_Oregon_Trail_(1985_video_game
en.wikipedia.org
https://owasp.org/www-community/attacks/Web_Parameter_Tampering
owasp.org
https://youtu.be/KU6FJnbkeLA
youtu.be
https://developers.google.com/web/tools/chrome-devtools
developers.google.com
https://www.lockpicks.com/key-cutting-machines-punches.html
lockpicks.com
https://linux.die.net/man/1/chattr
linux.die.net
https://linux.die.net/man/1/lsattr
linux.die.net
https://downloads.elfu.org/capteha_images.tar.gz
downloads.elfu.org
https://downloads.elfu.org/capteha_api.py
downloads.elfu.org
https://youtu.be/jmVPLwjm_zs
youtu.be
https://github.com/chrisjd20/img_rec_tf_ml_demo
github.com
https://www.tensorflow.org/
tensorflow.org
https://colab.research.google.com/notebooks/welcome.ipynb
colab.research.google.com
http://docs.graylog.org/en/3.1/pages/queries.html
docs.graylog.org
https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/
ultimatewindowssecurity.com
https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/5d5588b51fd81f0001471db4/1565886646582/Windows+Sysmon+Logging+Cheat+Sheet_Aug_2019.pdf
static1.squarespace.com
https://webexec.org/
webexec.org
https://www.exploit-db.com/exploits/46479
exploit-db.com
https://docs.microsoft.com/en-us/windows/win32/secauthz/access-control-lists
docs.microsoft.com
https://github.com/gentilkiwi/mimikatz
github.com
https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4624
docs.microsoft.com
https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4624
ultimatewindowssecurity.com
https://pen-testing.sans.org/blog/2017/10/13/sqlmap-tamper-scripts-for-the-win
pen-testing.sans.org
https://www.owasp.org/index.php/SQL_Injection
owasp.org
http://sqlmap.org/
sqlmap.org
https://github.com/sqlmapproject/sqlmap/wiki/Usage
github.com
https://docs.mongodb.com/manual/reference/command/listDatabases/
docs.mongodb.com
https://linux.die.net/man/1/mongo
linux.die.net
https://linux.die.net/man/1/ps
linux.die.net
https://linux.die.net/man/1/awk
linux.die.net
https://docs.mongodb.com/manual/reference/method/db.collection.find/
docs.mongodb.com
https://docs.mongodb.com/manual/reference/glossary/
docs.mongodb.com
https://youtu.be/obJdpKDpFBA
youtu.be
https://www.hex-rays.com/products/ida/
hex-rays.com
https://www.immunityinc.com/products/debugger/
immunityinc.com
https://www.winehq.org/
winehq.org
http://www-verimag.imag.fr/~mounier/Enseignement/Software_Security/BH_Eagle_ida_pro.pdf
www-verimag.imag.fr
https://jhalon.github.io/2018-google-ctf-beginners-re-solutions/
jhalon.github.io
https://www.geeksforgeeks.org/time-function-in-c/
geeksforgeeks.org
https://c9x.me/x86/html/file_module_x86_id_35.html
c9x.me
https://c9x.me/x86/html/file_module_x86_id_147.html
c9x.me
https://c9x.me/x86/html/file_module_x86_id_176.html
c9x.me
https://c9x.me/x86/html/file_module_x86_id_138.html
c9x.me
https://c9x.me/x86/html/file_module_x86_id_5.html
c9x.me
https://x86.puri.sm/html/file_module_x86_id_12.html
x86.puri.sm
https://c9x.me/x86/html/file_module_x86_id_285.html
c9x.me
https://en.wikipedia.org/wiki/Bit_numbering
en.wikipedia.org
https://en.wikipedia.org/wiki/Linear_congruential_generator
en.wikipedia.org
https://en.wikipedia.org/wiki/Algorithm
en.wikipedia.org
https://en.wikipedia.org/wiki/Piecewise_linear_function
en.wikipedia.org
https://docs.microsoft.com/en-us/windows/win32/seccrypto/microsoft-enhanced-cryptographic-provider
docs.microsoft.com
https://en.wikipedia.org/wiki/Data_Encryption_Standard
en.wikipedia.org
https://rosettacode.org/wiki/Linear_congruential_generator
rosettacode.org
https://www.tutorialspoint.com/python/string_zfill.htm
tutorialspoint.com
https://docs.microsoft.com/en-us/windows/win32/api/wincrypt/nf-wincrypt-cryptimportkey
docs.microsoft.com
https://pycryptodome.readthedocs.io/en/latest/src/cipher/des.html
pycryptodome.readthedocs.io
https://pypi.org/project/filetype/
pypi.org
https://en.wikipedia.org/wiki/Magic_number_(programming
en.wikipedia.org
https://upcloud.com/community/tutorials/configure-iptables-centos/
upcloud.com
https://linux.die.net/man/8/iptables
linux.die.net
https://wiki.centos.org/HowTos/Network/IPTables
wiki.centos.org
https://www.geeksforgeeks.org/global-and-local-variables-in-javascript/
geeksforgeeks.org
https://developer.mozilla.org/en-US/docs/Web/API/Window/localStorage
developer.mozilla.org
https://developer.mozilla.org/en-US/docs/Web/CSS/perspective
developer.mozilla.org
https://developer.mozilla.org/en-US/docs/Web/CSS
developer.mozilla.org
https://developer.mozilla.org/en-US/docs/Web/API/EventListener
developer.mozilla.org
https://developer.mozilla.org/en-US/docs/Web/API/EventTarget
developer.mozilla.org
https://developer.mozilla.org/en-US/docs/Web/CSS/:active
developer.mozilla.org
https://developer.mozilla.org/en-US/docs/CSS/Pseudo-classes
developer.mozilla.org
https://docs.zeek.org/en/stable/script-reference/log-files.html
docs.zeek.org
https://stedolan.github.io/jq/
stedolan.github.io
https://pen-testing.sans.org/blog/2019/12/03/parsing-zeek-json-logs-with-jq-2
pen-testing.sans.org
https://www.owasp.org/index.php/Testing_for_Local_File_Inclusion
owasp.org
https://www.owasp.org/index.php/Cross-site_Scripting_(XSS
owasp.org
https://en.wikipedia.org/wiki/Shellshock_(software_bug
en.wikipedia.org
https://splunk.elfu.org/
splunk.elfu.org