Intrusion Detection

Prompts and answers

• What IDS detection methodology relies on rule sets?
  signature-based detection
• What widely implemented protocol has an adverse effect on the reliability of NIDS?
  TLS
• What scale is used to measure alert severity in Suricata? (*-*)
  1-3
• How many services is nmap able to fully recognise when the service scan (-sV) is performed?
  3
• Nikto, should find an interesting path when the first scan is performed, what is it called?
  /login
• What value is used to toggle denial of service vectors when using scan tuning (-T) in nikto?
  6
• Which flags are used to modify the request spacing in nikto? Use commas to separate the flags in your answer.
  6,A,B
• What version of Grafana is the server running?
  8.2.5
• What is the ID of the severe CVE that affects this version of Grafana?
  CVE-2021-43798
• If this server was publicly available, What site might have information on its services already?
  shodan
• How would we search the site "example.com" for pdf files, using advanced Google search tags?
  site:example.com filetype:pdf
• What is the password of the grafana-admin account?
  GraphingTheWorld32
• Is it possible to gain direct access to the server now that the grafana-admin password is known? (yay/nay)
  yay
• Are any of the attached IDS able to detect the attack if the file /etc/shadow is requested via the exploit, if so what IDS detected it?
  Suricata
• What category does Wazuh place HTTP 400 error codes in?
  web
• What tool does linPEAS detect as having a potential escalation vector?
  docker
• Is an alert triggered by Wazuh when linPEAS is added to the system, if so what its severity?
  5
• Perform the privilege escalation and grab the flag in /root/
  {SNEAK_ATTACK_CRITICAL}