Investigating Public-Facing Exploitation
Learn about detecting the exploitation of public-facing applications through log data and artifacts.
medium
To access material, start machines and answer questions login.
Public-facing applications, mail platforms, gateways, and other internet-exposed services are often an organization's first point of contact with the outside world. This makes them prime targets for attackers, who can exploit vulnerabilities and misconfigurations without having to rely on tricking users. This attack method is covered under the ATT&CK technique T1190, which describes the use of software, data, or commands to take advantage of a weakness in an internet-facing system for initial access. In this room, we will explore how attackers identify and exploit public-facing applications such as and Microsoft Exchange, gain hands-on experience recreating the attacks, and learn how to detect them using log and forensic data in a Windows environment.
Learning Objectives
- Learn how attackers exploit vulnerabilities and misconfigurations in IIS servers
- Investigate evidence of IIS exploitation through IIS and Windows event logs
- Explore how web shells are deployed and detected on compromised IIS servers
- Understand common Microsoft Exchange vulnerabilities and real-world exploitation campaigns
- Investigate evidence of Microsoft Exchange exploitation through log and event data
- Learn containment, prevention, and mitigation strategies for public-facing application abuse
- Explore other commonly targeted public-facing applications beyond IIS and Exchange
Prerequisites
- Cover Windows Event Logs to learn about important event types
- Check out to explore Event and important logging fields
- Go through Detecting Initial Access for common IIS and Exchange vulnerabilities
- Explore Detecting Web Shells for an overview of web shell detection within log data
Machine Access
Click the Start Machine button below. The machine will start in Split-Screen mode. Once you gain access, all necessary tools and files will be available on the machine's desktop.
Set up your virtual environment
If you prefer to connect using your own -connected machine, please use the credentials below to in:
Credentials
Only needed if you are using your own machine.
I understand the learning objectives and am ready to detect public-facing exploitation!
Ready to learn Cyber Security?
The Investigating Public-Facing Exploitation room is only available for Premium or Max subscribers. Signup now to access more than 500 free rooms and learn cyber security through a fun, interactive learning environment.
Already have an account? Log in