Skip to content
PURPLEDUEL

Blue Team / Defense path

6 labs · Logs, incidents, hardening

Blue Team / Defense is the path of those who protect. You read access logs, count failed attempts to find out who is forcing a login, rebuild the timeline of an incident, compare an SSH configuration with the recommended one, shut down unnecessary services and handle incident response in four steps: detect, contain, clean up, document. The commands are the same as in the other paths, but used through the eyes of someone who must understand what happened and stop it from happening again.

The labs, in order

  1. Reading an access log

    easy · 300 XP

    First night watch at Bianchi Stationery. The office server keeps a record of who logs in (auth.log, in /var/log) and last night someone tried to force their way in. Read the log, work out who keeps failing again and again without ever getting in, and decode their report.

    Requires: Reading in pieces.

  2. Who keeps pushing?

    medium · 600 XP

    Il Forno Veloce sells bread online and its web server is under siege: last night the access log filled up with wrong passwords. Knowing that someone is pushing is not enough, you must know WHO pushes hardest. Count the failed attempts per address and decode the attacker's report.

    Requires: Reading an access log and Pipes and filters.

  3. Timeline of an incident

    medium · 600 XP

    Yesterday we reported 203.0.113.77; today Il Forno Veloce discovers that data has left the server. Rebuild the timeline across auth.log and access.log: at what exact time did the attacker GET IN for the first time after the failed attempts? Reports are named after the time of the event.

    Requires: Who keeps pushing?.

  4. Hardening SSH

    medium · 600 XP

    After the latest troubles, Bianchi Stationery wants a sturdier SSH. The server holds the configuration in use and, somewhere, the one recommended by the vendor. Compare them: how many settings are too weak? The right number points to the audit report to decode.

    Requires: Reading an access log and Finding files.

  5. Closing the unneeded ports

    medium · 600 XP

    The Magazzino Verdi server 'has always worked like this'. The more services listen, the more doors someone can knock on. Find out what is open on this machine, compare it with the inventory of authorised services and go and hear what the service that should not be there has to say.

    Requires: Service banners and Hardening SSH.

  6. Responding to an incident

    hard · 1000 XP

    Ortofrutta Rossi, last night: someone got into the management server. Understanding what happened is not enough, you need a four-step response. Detect the attack in the logs, find who really got in and with which account, find what the intruder left behind to come back, and document everything in the right report.

    Requires: Timeline of an incident, Closing the unneeded ports and Executables with the SUID bit.

Commands in this path

Along this path the simulated terminal has you use these commands: cat, grep, base64, head, cut, sort, uniq, ls, find, diff, wc, nmap, nc and tail. Each lab page explains what they are for.

Learn more with the guides

All guides

The other paths

The PurpleDuel labs