Welcome

Welcome to the SANS SEC504 Lab Workbook!

This electronic workbook is your guide to lab exercises in SANS SEC504. In order to keep labs current, to make them more accessible (cut and paste!), and to present the steps in color with rich context, we present the material here in HTML format.

Accessing the Digital Edition of the Lab Workbook

To access the digital edition of the lab workbook from the Slingshot Linux VM, open the Firefox browser. The home page will display this text and allow you to navigate to the course lab exercises.

Updating the Lab Workbook

To update the lab workbook, open a terminal and run the update-workbook command:

sec504@slingshot:~$ update-workbook

That's it! With this one step, you will always have the most current lab materials.

Conventions

The following typographical conventions are used throughout the labs:

  • Italic
    • Indicates new terms and items of emphasis
  • Constant width
    • Used for terminal output and within paragraphs to refer to tools or other elements such as variables, function names, statements, keywords, etc.
  • | (vertical bar)
    • The vertical bar is used to indicate steps necessary for navigating through menus (Edit | Paste)

Code blocks are used to denote output from tools. Content that is bold represents commands you type. For example:

sec504@slingshot:~$ run_this_command
output from the tool

In some cases, the commands you type will call for information that you supply (e.g., that we don't know). In these cases, the content that you supply is noted in italics: yourinput. Replace yourinput with the information you supply as described in the exercise.

This icon signifies a tip, suggestion, warning, or a general note.

Search Function

The lab workbook has a search function to quickly find commands or other content. You can search with basic keywords, or you can use search modifiers:

  • Wildcards: *net*, net*, etc.
  • Lab Sections: You can search the lab title or the body of the lab using a search modifier: title:Netcat*, body:*pivot*
  • Term Presence: Multiple keywords are treated as OR clauses, boosting hits that match both words. Use a + modifier to force an AND condition, or a - to exclude a term: +falsimentis -malware
  • Fuzzy Matches: If you aren't sure of a spelling, you can use a fuzzy match that will substitute different letters: DAPT~1 will match DPAT, metpreter~2 will match Meterpreter, etc.

Course and Lab Feedback

I am always excited to hear your feedback on the course materials. Is there a bug I need to squash? Do you have a suggestion for a new awesome tool that I just have to see? Please let me know.

https://www.sec504.org/feedback

You can also reach out to Josh directly: josh@willhackforsushi.com

Thank you!!

504 Challenge Coin

Update: 20211003-001