Become a Better Hacker.

Learning objectives

Distinguish passive observation from active interaction, respect authorization and scope, and identify exposed information.

Key terminology

Passive reconnaissance: reviewing information already supplied. Active reconnaissance: interacting with a system to obtain information. Scope: the explicit boundaries of permission. Exposure: information available to others.

Beginner explanation and safe examples

Public information is not permission to test a system. In this simulation, read only the fictional records supplied below. Active checks require explicit approval; do not visit or probe real systems.

Authorized scenario

You are reviewing a fictional school’s supplied public inventory. Your authorization permits reading these records only. An outdated software label and an unnecessary staff contact may help outsiders infer system details.

Guided simulation: inspect the evidence

Read the supplied records, then work through each decision below. Nothing is executed or sent over the network.

SIMULATED PUBLIC INVENTORY — training.example (fictional; do not connect)
Record A: Public homepage says “Example Portal 1.0 — last updated 2020”
Record B: Staff directory includes helpdesk contact and office hours
Scope: review supplied records only; no scans, logins, or direct requests.

Recap

Gather only authorized information, document the source and uncertainty, and ask the owner to review unnecessary exposure.

Learning objectives

Read a traffic table, identify protocols and endpoints, and support a cautious conclusion with evidence.

Key terminology

TCP: connection-oriented transport. UDP: datagram transport. ICMP: network status/error messages, without TCP/UDP ports. DNS: maps names to addresses, commonly port 53. HTTP: web requests, commonly TCP port 80; HTTPS commonly uses 443.

Beginner explanation and safe examples

One unusual row is a clue, not proof. Compare timing, repetition, direction, service, and the expected baseline. Private addresses here describe fictional hosts. Do not capture or contact real traffic.

Authorized scenario

A fictional workstation normally sends a DNS query followed by a web request. Compare that pattern with repeated connection attempts to a server administration service.

Guided simulation: inspect the evidence

Read the supplied records, then work through each decision below. Nothing is executed or sent over the network.

SIMULATED TRAFFIC
Time      Source       Destination   Transport  Dest port  Detail
09:00:01  10.0.0.20    10.0.0.53     UDP        53         DNS query for training.example
09:00:02  10.0.0.20    10.0.0.80     TCP        80         HTTP GET /lesson
09:00:03  10.0.0.20    10.0.0.1      ICMP       —          status reply
09:01:00  10.0.0.99    10.0.0.10     TCP        22         60 attempts in 10 seconds; no approved maintenance

Recap

Identify endpoints, protocol and service first, then compare the observed sequence with a baseline. Record supporting evidence and uncertainty.

Learning objectives

Identify the current user, locate and inspect evidence, interpret permissions, and choose a safe next action.

Key terminology

User: an account identity. Group: a collection of accounts used for access control. Process: a running program with a PID. Permissions: read (r), write (w), execute (x) for owner, group and others.

Beginner explanation and safe examples

pwd shows the current directory; ls lists entries; cd changes directory; cat reads a file; grep selects matching lines; find locates files; whoami names the current user; id shows user/group IDs; ps lists processes. Example inspection sequence: pwd; ls; cd /training; cat notice.txt; grep "failed" /training/auth.log; find /training -name "*.log"; whoami; id; ps. These are explanations of fictional outputs, not commands to execute.

Authorized scenario

An authorized fictional training host has an unfamiliar notice file and an authentication log. Review the read-only outputs, preserve evidence and report concerns rather than changing files or stopping processes.

Guided simulation: inspect the evidence

Read the supplied records, then work through each decision below. Nothing is executed or sent over the network.

SIMULATED OUTPUTS
$ pwd
/training
$ whoami
learner
$ id
uid=1000(learner) gid=1000(learners) groups=1000(learners)
$ ls -l notice.txt
-rw-r----- 1 analyst defenders 120 notice.txt
$ cat notice.txt
Unapproved support request: share your password.
$ find /training -name "*.log"
/training/auth.log
$ grep "failed" /training/auth.log
10:05 failed logon for demo-admin
$ ps
PID USER COMMAND
2410 analyst log-viewer

Recap

Use identity, file metadata, content, logs and process context together. Preserve evidence and follow the authorized response plan.

Learning objectives

Build an event timeline, identify involved accounts and addresses, document evidence, and propose proportionate response.

Key terminology

Failed logon: rejected authentication. Successful logon: accepted authentication. Privilege change: altered access rights. Account creation: a new identity. Containment: approved steps to limit potential harm while preserving evidence.

Beginner explanation and safe examples

Correlate events rather than judging one alert in isolation. Check approved changes, account ownership and authentication context. Document timestamps, event IDs, actors, affected assets, observations and uncertainty.

Authorized scenario

You are an authorized analyst reviewing a fictional server. No account creation or privilege changes were scheduled. The record set may indicate account misuse; investigate through the incident-response plan.

Guided simulation: inspect the evidence

Read the supplied records, then work through each decision below. Nothing is executed or sent over the network.

FICTIONAL AUTH/EVENT LOG — server demo-01
10:00 E101 failed logon account=demo-admin source=192.0.2.44
10:01 E102 failed logon account=demo-admin source=192.0.2.44
10:02 E103 successful logon account=demo-admin source=192.0.2.44
10:03 E104 account created actor=demo-admin new=backup-helper
10:04 E105 privilege change actor=demo-admin target=backup-helper group=administrators
Baseline: no approved account/privilege changes during this period.

Recap

Write an evidence-based timeline, distinguish observation from inference, identify affected accounts, and preserve records before approved response.