Forum Widgets
Recent Discussions
Incident Response Introduction to Detection Engineering: Ep.5 – Custom Alerting
Task 3 - Note: It may take a couple of minutes for the token to appear in the index. I'm struggling with the python that it's been taking too long to create a custom_alert_index to autimatically complete it. it's in Task 3 and I need the good code for the task to be completed and the token as well.
Snort Rules Ep.10 Q7
Stuck in Q7: Identify the suspicious domain that appears in both PCAP files. Create a Snort Rule to detect packets using this domain from the IP address in question 2. I've identified the domain used by the IP address in Q2. I've tried different ways but can't seem to narrow it down. Already spent so much time with this one question. I've answered 12 of 13. This is the only one left and I don't know what I'm missing. Am I misunderstanding the question? Here's my rule: alert tcp any any -> any 80 (msg: "Testing Alert" ; sid:1000001; content:"7b2cdd48.ngrok.io";) I've tried modifiers, I tried narrowing filter to just GET methods, actually specifying the destination or source IP and ports, adding "http://" to content. Sometimes I would narrow it down to matching 4 packets which is still "too many", or down to two packets, which is "not enough"... which tells me I need to match three packets. Any hints would be much appreciated at this point. Thanks!
Cross_site Scripting DOM-based XSS vulnerability
I am doing the Cross-Site Scripting (XSS) DOM-based XSS lab and I am trying to get the last step of the lab which is identifying the DOM-based XSS vulnerability. I am pretty sure it would not be something like <script> alert("xss") </script> since I do not think Javascript would handle it. I am leaning towards the event handlers like onerror but haven't gotten it figured out quite yet. Any clues or suggestions would be appreciated.Create Teams for Students and assign tasks to be completed
Dear community, being a professor at a university, I'm trying to create a group where i can invite students in order to complete the tasks of a laboratory that are important to the subject we are learning. I have had the experience on the past but as I see a lot has changed and I cant find how to do that now. Can someone guide me through process please?Microsoft Sentinel Deployment & Log Ingestion: Ingesting Platform Logs via Diagnostic Settings
Hello Immersive Labs community, I’ve been working through the lab tasks and successfully completed tasks 1 through 6. However, I’m stuck on task 7, which asks: "A storage account has been deleted. What would be the data type of the generated log?" The task seems oddly described, and I can’t find any clear hints in the lab briefing or online resources. I’ve tried querying various data types like AzureActivity, AuditLogs, StorageBlobLogs, StorageFileLogs, and others, but none seem to fit correctly. Could anyone provide guidance or confirm which data type is actually relevant for this scenario? Are there any specific tips or resources I might be missing? Thanks in advance for your help!
Threat Research: Dependency Confusion lab -Listener not showing a successful connection with target server
Hello Community, In the lab, I could see that listener is not showing "connection received message". Hence unable to execute any command there. Any help would be appreciated. Below are the screenshots from terminal listener and terminal .
If your question has been answered, help others by clicking:
