Cosmas Saidi

Goal

Understand Linux file permissions and how to modify them for security hardening and exploitation.

My Approach

• Used ls -la to view file permissions in detail
• Identified permission bits (rwx for user, group, others)
• Used chmod to change permissions using octal and symbolic notation
• Understood SUID/SGID bits for privilege escalation research

Commands Used

ls -la                    # View detailed permissions
chmod 755 filename        # rwxr-xr-x (owner: full, others: read/execute)
chmod +x script.sh        # Add execute permission
chmod 600 secret.txt      # rw------- (owner only)
chmod u+x,g-w file        # Symbolic notation

Permission Reference

Concepts Learned

• Permissions are split into: owner, group, others
• r=4, w=2, x=1 (octal notation)
• chmod changes file permissions
• Execute permission needed to run scripts
• SUID (4000) runs program as file owner

Goal

Learn how environment variables work and affect program execution for both system administration and exploitation.

My Approach

• Viewed current variables with env
• Set variables with export
• Understood how PATH affects command lookup order
• Explored variable scope (parent vs child processes)

Commands Used

env                       # View all environment variables
echo $PATH                # View specific variable
export MYVAR="value"      # Set and export variable
printenv                  # Alternative to env
unset MYVAR               # Remove variable

Important Variables

Concepts Learned

• Environment variables store system and user settings
• PATH determines where shell looks for commands
• Variables can be temporary or exported to child processes
• export makes variable available to subprocesses

Goal

Learn basic shell scripting for automation of security tasks and enumeration.

My Approach

• Created scripts with shebang #!/bin/bash
• Made scripts executable with chmod +x
• Used command substitution for dynamic values
• Built enumeration automation scripts

Script Structure

#!/bin/bash
# Shebang specifies interpreter

echo "Hello, World!"

# Variables
VAR="value"
echo $VAR

# Command substitution
RESULT=$(whoami)
echo "Current user: $RESULT"

# Make executable and run
chmod +x script.sh
./script.sh

Concepts Learned

• Scripts need shebang line to specify interpreter
• Command substitution: $(command) or backticks
• Scripts need execute permission to run
• Variables: no $ when assigning, $ when reading

Goal

Learn to manage processes in Linux for system administration and security analysis.

My Approach

• Started background processes with &
• Used fg to bring to foreground
• Used bg to continue stopped processes
• Switched users with su
• Analyzed running processes for suspicious activity

Commands Used

command &                 # Run in background
fg                        # Bring to foreground
bg                        # Continue in background
jobs                      # List current jobs
Ctrl+Z                    # Suspend current process
ps aux                    # List all processes
ps auxf                   # Process tree
su username               # Switch user
kill PID                  # Terminate process
kill -9 PID               # Force kill

Key Process Information

Concepts Learned

• & runs command in background
• Ctrl+Z suspends current process
• fg brings background job to foreground
• jobs lists current shell jobs
• su switches user context

Goal

Understand how PATH affects command execution and how it can be exploited for privilege escalation.

My Approach

• Examined current PATH configuration
• Modified PATH to include custom directories
• Understood command resolution order (left to right)
• Practiced PATH hijacking techniques

Commands Used

echo $PATH                # View current PATH
export PATH=/my/dir:$PATH # Prepend directory
which command             # Find command location

# Dangerous: current directory in PATH
export PATH=".:$PATH"     # DON'T do this!

Concepts Learned

• PATH is searched left to right for commands
• First match is executed
• Adding directory to PATH allows running scripts without full path
• Prepending vs appending to PATH matters for security

Goal

Learn to chain commands using pipes and control input/output redirection.

My Approach

• Used | to send output of one command to another
• Combined with text processing tools
• Built command pipelines for data extraction
• Redirected output to files for logging

Commands Used

cat file | head           # Pipe to head
ls | grep pattern         # Filter output
cmd1 | cmd2 | cmd3        # Chain multiple commands
cat file | tr 'a' 'b'     # Translate characters

# Redirection
command > file            # Redirect output to file (overwrite)
command >> file           # Append to file
command < file            # Read input from file
2>&1                      # Redirect stderr to stdout

Concepts Learned

• | sends stdout of left command to stdin of right command
• Pipes allow chaining multiple commands
• head shows first lines/bytes
• tr translates characters
• Redirection controls where output goes

Goal

Understand encoding, data representation, and byte-level manipulation for binary analysis.

Concepts Learned

• UTF-8 encoding and byte representation
• Encoding vs encryption (encoding is reversible, not secure)
• Base64 and hex encoding/decoding
• Obfuscation ≠ security
• Reading program logic to reverse transformations
• Handling raw bytes in CLI

Commands Used

# Base64
echo -n "hello" | base64          # Encode
echo "aGVsbG8=" | base64 -d       # Decode

# Hex
echo -n "hello" | xxd -p          # Encode
echo "68656c6c6f" | xxd -r -p     # Decode

Python Methods

# Python raw bytes
bytes.fromhex("68656c6c6f")

import sys
sys.stdout.buffer.write(data)

import base64
base64.b64decode("aGVsbG8=")

Goal

Understand HTTP communication, manual request crafting, and how clients interact with web servers.

My Approach

• Sent raw HTTP requests using netcat
• Used curl for quick HTTP interactions
• Automated requests with Python requests library
• Understood Host header for virtual host routing

Commands Used

# Netcat raw HTTP
nc example.com 80
GET / HTTP/1.1
Host: example.com

# Curl requests
curl http://example.com
curl -H "Host: app.example.com" http://target-ip
curl -v http://example.com            # Verbose output

# Python requests
import requests
r = requests.get("http://example.com", headers={"Host": "app.example.com"})
print(r.text)

HTTP Request Structure

Concepts Learned

• HTTP request structure (method, path, version, headers)
• Host header determines which virtual host responds
• Manual request crafting with netcat
• Response headers can contain sensitive data
• Virtual host enumeration for subdomain discovery

Overview

After gaining access, enumeration reveals escalation paths and valuable data. This is the foundation of post-exploitation.

System Information

uname -a                  # Kernel version
cat /etc/os-release       # OS details
hostname                  # System name
cat /proc/version         # Kernel info

User Enumeration

whoami                    # Current user
id                        # UID, GID, groups
sudo -l                   # Sudo permissions
cat /etc/passwd           # All users
cat /etc/shadow           # Password hashes (if readable)
history                   # Command history

Network Enumeration

ip a                      # Interfaces
netstat -tuln             # Listening ports
ss -tuln                  # Alternative
cat /etc/hosts            # Host mappings
arp -a                    # ARP cache

Interesting Files

# SUID binaries (potential escalation)
find / -perm -4000 2>/dev/null

# Writable directories
find / -writable -type d 2>/dev/null

# Recent files
find / -mtime -1 2>/dev/null

# Configuration files
find / -name "*.conf" 2>/dev/null

Credential Hunting

# SSH keys
ls -la ~/.ssh/
cat ~/.ssh/id_rsa

# Bash history
cat ~/.bash_history

# Config files with passwords
grep -r "password" /etc/ 2>/dev/null

Overview

User accounts and privileges are primary targets. Understanding user management helps identify misconfigurations and escalation paths.

Commands

# User information
whoami                    # Current user
id                        # User ID, groups
groups                    # Group memberships
cat /etc/passwd           # All users
cat /etc/shadow           # Password hashes (root only)
cat /etc/group            # All groups

# Switch users
su - username             # Switch user (need password)
sudo -l                   # List sudo privileges
sudo command              # Run as root
sudo -u user command      # Run as specific user

Important Files

/etc/passwd Format

username:x:UID:GID:comment:home:shell
root:x:0:0:root:/root:/bin/bash

Enumeration Techniques

# Users with shell access
grep -v "nologin\|false" /etc/passwd

# Users in sudo group
getent group sudo

# Check sudo permissions
sudo -l

Skills Practiced

• Identifying current user and permissions
• Inspecting network interfaces
• Understanding MTU configuration
• Mapping internal network structure

Commands Used

ip a                      # All interfaces with IPs
ip link                   # Link layer info
ifconfig                  # Legacy command
netstat -rn               # Routing table
cat /etc/resolv.conf      # DNS servers

Concepts Learned

• Network interface discovery
• Linux kernel version identification
• System architecture awareness
• Home directory structure

Scenario

Practiced directory enumeration to discover non-obvious web routes, then shifted to SOC response to investigate and mitigate a web discovery attack pattern.

Offensive Workflow

• Ran dirb http://target-site with common wordlist-based endpoint discovery
• Interpreted HTTP status codes (200, 301, 404) during brute forcing
• Identified hidden endpoints that were not linked in the main interface
• Recognized business-logic weaknesses caused by missing authorization checks

Defensive Workflow

• Investigated a SIEM alert categorized as Web Discovery Attack
• Correlated suspicious traffic patterns to a single hostile source
• Applied temporary source blocking as immediate containment
• Applied rate limiting and updated WAF rules to reduce recurrence risk

Tools Used

• dirb
• Web browser
• Linux terminal
• SOC dashboard / SIEM interface

Core Skills Gained

• Web enumeration and hidden endpoint discovery
• Business logic vulnerability recognition
• SIEM-based threat investigation
• Incident response and layered defensive controls

Scope

Core computing concepts: hardware architecture, boot process, virtualization, cloud computing, client-server models, and OS security principles.

Hardware & Boot Concepts

• Core components: CPU, RAM, Storage, GPU, PSU, Motherboard
• Boot sequence: BIOS/UEFI → POST → Bootloader → OS
• Computer types and optimization for different tasks

Virtualization & Cloud

• Virtual Machine concepts and use cases
• Hypervisor types: Type 1 (bare-metal) vs Type 2
• Cloud providers: AWS, Azure, Google Cloud
• Cloud resources: VMs, storage, databases, networks

OS Security Concepts

• Kernel space vs user space separation
• User accounts, authentication, permissions
• Firewalls and security updates
• Endpoint security and threat detection

Client-Server Architecture

• Request/response communication model
• HTTP request and response flow
• Remote access via SSH

Scope

Expanded foundation across networking, DNS, HTTP communication, web architecture, and client-side web security concepts.

Networking & DNS Concepts

• DNS resolution flow and record types: A, MX, TXT, CNAME
• Connectivity testing with ping and ICMP metrics (latency, packet loss)
• Network topology models: star, ring, and bus
• OSI 7-layer model for communication and troubleshooting context

Web Communication Concepts

• HTTP request/response lifecycle and communication flow
• Methods: GET, POST, PUT, DELETE
• Status codes: 200, 301, 403, 404, 500
• Header roles: Host, User-Agent, Authorization, Cookie

Client-Side Security Concepts

• Cookie/session handling fundamentals
• Sensitive data exposure through client-visible source code
• HTML injection risk from unsafe rendering paths
• XSS fundamentals and browser-impact overview

Tools Used

• nslookup
• ping
• Wireshark
• Burp Suite
• Browser source/dev tools

Security Principles

• CIA triad: confidentiality, integrity, and availability as the basis for evaluating controls
• Encryption as a method for protecting data confidentiality during storage and transmission
• Difference between encryption, encoding, and hashing in security contexts

Cryptography Concepts

• Symmetric encryption uses a single shared key and is efficient for bulk data protection
• Asymmetric encryption uses public/private key pairs to support secure key exchange
• Modern secure communication often combines both models for performance and security

Reconnaissance & Analysis

• Packet capture and filtering for DNS, ICMP, and layered protocol inspection
• Service discovery and attack-surface mapping through safe reconnaissance workflows
• Technology fingerprinting using headers, framework indicators, and browser inspection
• Application route discovery concepts for identifying exposed paths and content

Software & Data Concepts

• Binary and hexadecimal representations for understanding stored and transmitted data
• Encoding formats such as Base64 and URL encoding in web and authentication workflows
• Programming awareness across Python, JavaScript, SQL, and Node.js for security analysis

Tools Used

• Wireshark
• Nmap
• WhatWeb
• Gobuster
• Hydra
• curl
• xxd / hexdump / base64

Methodology Checklist

# 1. User Context
whoami
id
sudo -l

# 2. System Info
uname -a
cat /etc/os-release

# 3. SUID Binaries
find / -perm -4000 2>/dev/null
# Check GTFOBins for exploitation

# 4. Writable Files
find / -writable -type f 2>/dev/null

# 5. Cron Jobs
cat /etc/crontab
ls -la /etc/cron.*

# 6. PATH Hijacking
echo $PATH
# Check if writable directories are in PATH

# 7. Credentials
cat ~/.bash_history
grep -r "password" /etc/ 2>/dev/null

Common Vectors

• Misconfigured sudo permissions
• SUID binaries (check GTFOBins)
• Writable scripts in cron
• Kernel exploits
• Credentials in config files

Tools

LinPEAS                   # Automated enumeration
GTFOBins                  # Binary exploitation reference
sudo -l                   # Check sudo rights
find -perm                # Find special permissions