Building a Threat Hunting Lab (Part 3): www.badguy.com

Malicious Website

Remember how in the last section I mentioned adding in DNS logs of a connection to www[.] badguy[.]com?  Well I needed a VM to host that webserver.  

Creating Badguy[.] com

Oh how I love the fact that Linux is free.  If Linux wasn't free I definitely wouldn't be building this training lab. I wouldn't have the money for it.

For this website I'm again using an Ubuntu 17.10 headless server hosted on a 1 Core 512MB VM with the IP address of 10.0.2.4. Interestingly enough Ubuntu 17.10 server doesn't actually come preinstalled with Apache2. Simple enough to fix.
sudo apt update && sudo apt install -y apache2
After the process of installing the apache2 server was installed I had to check to make sure it worked properly.
sudo service apache2 start
When it finished booting (a few seconds) I took my Windows 7 (I had installed it but haven't started configuring it yet) and navigated to 10.0.2.4 and was successfully created by the Apache test page "It Works".

My next step was to modify the .htm file to say something about www[.]badguy[.]com.
sudo nano /etc/apache2/apache2.conf
 I'm not a website designer by any means.  Nor do I have the time to make this website really pretty.  So I simply erased all the text and added the in some text about a modified host file.  This was really more of a give to the future students and analysts since I don't expect them to attempt to use Google while connected to a network that doesn't have internet. I'll cover this in the Windows configuration post but I modified the host file on the Windows 7 machine to send all connections to google to 10.0.2.4.

This was a simple and easy set up. When I was doing that I accidentally forgot to use sudo when I was modifying the conf file so it didn't save.  I managed to save it to the root directory and then sudo mv it to the right location.

Be sure to check out part 4 where I configure the Windows 7 VM.

Comments

Post a Comment

Popular posts from this blog

Fingbox Review: Simply not worth it.

Image
I'd like to open an honest public discourse on the Fingbox. First off I'd like to say that this isn't meant to be an attack on the product or the company. I actually really like the Fingbox but the marketing advertises a Corvette when the product is more of a Honda. I've been doing Network security and Forensics for a little over 7 years so the idea of a device like the Fingbox excited me; however, after having a Fingbox for a little while I'm ultimately disappointed. The bottom line up front: spend your $150 on an Asus RT-86U instead. You'll get 99% of the features and a powerful router with a Network intrusion prevention system built in. Devices Tab I'm going to go in order of the app when discussion its features. So up first is the network scan. I actually really like this scan and subsequent list in the app. It's clean, it's easy to read and search. Clicking on devices allows you to see some basic information about
Read more

Cypherpunk: A VPN review

Image
Those of you who know me know that I am a major advocate of VPNs. I think they're great security tools for keeping your public IP address less public. They're similar to a PO box in the sense that you give out that address instead of your actual home address, ideally making it less likely someone unwanted will show up at your front door. VPNs have many practical security applications. First and foremost they protect your information from prying eyes when you're using public Wi-Fi, but a lot of them also provide added features like DNS adblocking, Malware domain blocking, and IPv6 prevention. For this review, I'll be comparing the Cypherpunk to an industry standard Private Internet Access (PIA).  Right off the bat, you can see that Cypherpunk is very stylized. It certainly goes for the look of cyber. It's a simple button press to activate the VPN. Then you get this stylized graphic showing ciphertext moving across the screen. There are 35 ser
Read more

Simple Security: Moderate Difficulty Setup

A few days ago I posted Simple Security: The basics  to cover a few easy and cheap ways to ways to help secure your Windows environment. Today I am planning on going a step further and covering some more advanced techniques to help secure your environment. Given that this is a moderate set up I am going to be trying to keep things as cheap as possible.  On my advanced guide I will be talking about expensive high-quality security solutions like Cisco ASA, SonicWall, Pallo Alto, ESXI, Domain Controllers, enterprise level malware protection like SideWinder, VM servers, and Splunk. In today's guide I will be discussing how to set up tools like Host Level Intrusion Detection Systems (HIDS), Network Level IDS (NIDS),  System Information and Event Management servers, and Smart Firewalls.  I'll also talk about ways to automatically aggregate data from opensource intelligence (OSINT) and using that to feed the analysis systems that will be helping to protect your network. First, l
Read more