Capstone-Engagement - Red vs Blue Project

项目说明

Unit README: Red Vs. Blue Team Project

Unit Description

In the second project week, you will work on a Red Team vs. Blue Team scenario in which you will play the role of both pentester and SOC analyst.

As the Red Team, you will attack a your en, ultimately gaining root access to the machine. As Blue Team, you will use Kibana to review logs taken during their Day 1 engagement. You'll use the logs to extract hard data and for their report.

Then, you will interpret your log data to suggest mitigation measures for each exploit that you' performed.

The class slides are a on Google Drive here: 20 Slides

Unit Objectives

<details>
<summary>Click here to view the daily unit objectives.</summary>
<br>

This week's project will prompt you to apply knowledge of the following skills and tools:

Penetration testing with Kali Linux.

Log and incident analysis with Kibana.

System hardening and configuration.

Reporting, documentation, and communication.

</details>

Lab En

<details>

<summary>Click here to view the lab en.</summary>

<br>

In this unit, you will be using the Red vs Blue lab en located in Windows Azure Lab Services. RDP into the Windows RDP host machine using the following credentials:

Username: azadmin
Password: p4ssw0rd*

Open the Hyper- to access the nested machines:

ELK machine credentials: The same ELK setup that you created in Project 1. It holds the Kibana dashboards.

- Username:
- Password:
- IP Address: 192.168.1.100

Kali: A standard Kali Linux machine for use in the penetration test on Day 1.

- Username: root
- Password: toor
- IP Address: 192.168.1.90

Capstone: Filebeat and Metricbeat are installed and will forward logs to the ELK machine.

- IP Address: 192.168.1.105
- Please note that this VM is in the network solely for the purpose of testing alerts.

Next Week's Lab En: At the end of 20.3, we will set up a new Azure Lab En for the Forensics unit.

</details>

What to Be Aware Of:

Throughout Day 2, it is important that you take screen shots of each step they complete. These screen shots will be used in their Day 3 Report.

Security+ Domains

This unit covers portions of the following domains on the Security+ exam:

1.0 Attacks, Threats, and

2.0 Architecture and Design

3.0 Implementation

4.0 Operations and Incident Response

For more information about these Security+ domains, refer to the following resource: Security+ Exam Objectives.pdf?sfvrsn=8c5889ff_2)

Additional Reading and Resources

<details>
<summary> Click here to view additional reading materials and resources. </summary>
</br>

Day 1:

Red Team Vs Blue Team

What is Scanning

What is a reverse shell

Day 2:

Kibana: Disco

Kibana: Documentation

Elasticsearch Reference Documentation

</details>

---

Looking Forward

In the next week, we will cover the specialized field of digital forensics. We will cover a new set of skills and tools that allow us to analyze e on digital technology after an security incident or crime occurs.

---

© 2020 Trilogy Education Services, a 2U, Inc. brand. All Rights Reserved.

项目信息

开发语言：未知

Star 数：2

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Red vs Blue Project展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。