immersive labs
159 TopicsApache Header Tampering
Can someone point me to the right track? On this one, I found the hidden directory, used an X-Forwarded-For: to see into that directory where scanning for files showed a lot of 404s, with just a few 403 response codes. I've tried everything I can think of with variations on X-Original-URL:, X-Rewrite-URL:, and X-Forwarded-Uri:, but none of them get me able to see into any of the files/directories. I've even tried a few variations instead of X-Forwarded-For:, such as X-Client-IP: and a few others. I feel like I must be missing something. I didn't find any actual .php files in the hidden directory but the question seems to indicate that there are some in there. I found what I think are other directories within that first hidden directory.4Views0likes0CommentsRansomware: Darkside - Question 9
In terms of determining the name of the service that is installed after the ransomware was executed, there doesn't seem to be any service installation activities observed from the endpoint. Wondering if I should be focusing on a different code, slightly irrelevant towards service creation activities. when searching for file creation for possible service names "api-ms-win-service-management-l1-1-0.dll" is also showcased to not work. Wondering about what different area should I be looking into instead11Views0likes1CommentCross_site Scripting DOM-based XSS vulnerability
I am doing the Cross-Site Scripting (XSS) DOM-based XSS lab and I am trying to get the last step of the lab which is identifying the DOM-based XSS vulnerability. I am pretty sure it would not be something like <script> alert("xss") </script> since I do not think Javascript would handle it. I am leaning towards the event handlers like onerror but haven't gotten it figured out quite yet. Any clues or suggestions would be appreciated.Solved105Views0likes4CommentsRansomware: LockBit
I can't figure out what question 7 is looking for as the answer. I ensured I was looking at logs with an EventType of SetValue, I ensured it was LockBit.exe doing the event, but nothing I've tried from that works for the answer. Either I'm querying something wrong, or53Views0likes4CommentsImmersive Labs – APT29: Threat Hunting with Splunk
Hi everyone, I’m currently working through the Immersive Labs – APT29: Threat Hunting with Splunk lab and got stuck on Question 10. Question: A PowerShell script was initially executed to extract encoded data from an image file. What is the full ParentCommandLine field value used to execute this? What I’ve tried so far: Searched PowerShell logs (EventCode 4103 / 4104) in Splunk Looked for base64/encoded content indicators (e.g., FromBase64String, -enc, IEX) Filtered for image-related activity (e.g., .jpg, .png) Reviewed process creation context but struggling to identify the exact ParentCommandLine. Appreciate any guidance—trying to understand the hunting logic, not just the answer. Thanks in advance!73Views1like1CommentInvestigating IAM Incidents in AWS: Preparation - Question 7
For the question: The ‘MetrolioQA’ IAM role in your account grants write access to a ‘metrolio’ role from another account. What is the full name of the external principle? I can't seem to find insight onto the role. I am wondering about what is the location of the GUI I should be looking into more of. I have mostly been digging throughout the csv download for any possible insights as well as the IAM access analyzer but I cant seem to get any good leads. Done through the MetrolioIAMAnalyst AWS role account. Summary: I am wondering if there is any direction that can be provided in which I can look into more for finding external principles.Solved26Views0likes1CommentMobile Malware: Anubis Malware (Offensive) - Question 8,9
despite obtaining the encrypted value, seems like RC4 decryption doesn't work with zanubis as the password. I am wondering where should I pivot into? For question 9: where should I look into in order to get started?Solved19Views0likes1CommentNeed help in Splunk Lab!
I am attempting the Splunk collection under Upskill. In the final lab i.e. Demonstrate your skill lab, I am getting stuck at a particular task. This is the prompt that I need to solve. The problem is there is no field for Destination IP in the log. Whenever I search according to the prompt, no results are returned and the question won't take 0 as an answer. Please help me move forward.46Views0likes2Comments