When you come across a Google Map packed with useful placemarks — incident locations, field reports, points of interest — getting that data out is surprisingly annoying. Google doesn’t offer a native bulk export, and manually copying coordinates one by one is not realistic at scale.

Google Map Exporter solves this with two approaches: a Python CLI for repeatable, scriptable exports and a Chrome extension for one-click downloads straight from your browser.

The project is on GitHub: salaheldinaz/google-map-exporter

How It Works

Google Maps stores all map data in a JavaScript variable called window._pageData embedded in the page source. This includes placemarks (coordinates, names, descriptions), layer definitions, and marker icon references.

Both the CLI and the extension read this raw data, parse it, and reconstruct the map as standard GIS formats.

window._pageData in the browser source — the raw payload the exporter parses.

Output Formats

All three formats preserve:

• Placemark name, coordinates, and description
• Layer/folder grouping
• Marker icon metadata (and optionally the icon files themselves)

Python CLI

The CLI is the right tool when you need automation, offline parsing, or want to integrate exports into a pipeline.

Setup

python3 -m venv .venv
source .venv/bin/activate
pip install -r requirements.txt
playwright install chromium

The CLI tries a plain HTTP fetch first. If the response is too thin (Google often returns a minimal page to scrapers), it falls back to a headless Playwright session.

Usage

# Export a live map URL
python main.py --url "https://www.google.com/maps/d/viewer?mid=..."

# Parse a saved HTML dump (no network needed)
python main.py path/to/saved_page.html

# Set output directory and filename prefix
python main.py --url "..." --output-dir output --prefix my_map

# Skip icon downloading (use remote URLs in the KML instead)
python main.py --url "..." --no-download-icons

Output lands in a timestamped folder under output/ by default. Downloaded icons go into icons/ inside that folder and are automatically packaged into the KMZ.

CLI output after a successful export — timestamped folder, KML/KMZ/GeoJSON files, and downloaded icons.

Chrome Extension

The extension is the faster path when you already have the map open in Chrome and just want to grab the data.

Install

Option A — Download the release (no Node.js required)

1. Go to the Releases page and download the latest .zip.
2. Unzip it anywhere on your machine.
3. Go to chrome://extensions, enable Developer mode, click Load unpacked, and point it at the unzipped folder.

Option B — Build from source

cd extension
npm install
npm run build

Then load the extension/ folder the same way: chrome://extensions → Developer mode → Load unpacked.

Use

1. Open a Google Map in Chrome (viewer or editor URL).
2. Click the extension icon.
3. Select your formats (KML, KMZ, GeoJSON — any combination).
4. Hit Download.

The extension reads window._pageData directly from the live page, runs the same parser as the CLI, and downloads the selected files instantly — no server, no API key, no clipboard gymnastics.

The extension popup — pick your formats, click Download.

Exported files ready to open in Google Earth or QGIS.

Opening the Export in Google Earth

Once you have a KMZ, drop it into Google Earth Pro (File → Open) or drag it into the web version. Layers map to folders, placemarks retain their names and descriptions, and if you exported icons they’ll render with the original markers.

Exported KMZ loaded in Google Earth — original layers, names, and marker icons intact.

Opening the Export in QGIS

GeoJSON drops straight into QGIS via Layer → Add Layer → Add Vector Layer, or just drag the file onto the canvas. The layerName property on each feature lets you filter or style by the original map layer.

GeoJSON export in QGIS — each feature carries the original layer name, name, description, and icon URL.

Notes and Limitations

• Map structure can change. Google occasionally updates the _pageData format. If the CLI produces zero placemarks, try saving the page as HTML and passing the file path instead, or switch playwright_headless to False to watch what the browser loads.
• Extension needs a live page. The popup reads window._pageData from the active tab. If the popup spins forever, reload the map tab and reopen the extension.
• Terms of service. This tool works on any map you can view in a browser. Use it for maps you have the right to access and export.

Repo

github.com/salaheldinaz/google-map-exporter

The QGIS plugin featured in this guide was developed by Salaheldinaz. It was tested extensively over the past few days by Mostafa. We put together this walkthrough to help others get started.

What Is This About?

Imagine you could look at any place on Earth and ask: “Has something changed here in the last few months?” — a building destroyed, a new structure built, a road carved through a forest. That is exactly what the PWTT QGIS Plugin lets you do, for free, from your own computer.

PWTT stands for Pixel-Wise T-Test. It was originally developed by researcher Ollie Ballinger and used by Bellingcat to map war damage in places like Ukraine, Gaza, and Iran — places where governments often block access to optical satellite imagery. The method was published as a peer-reviewed paper in Remote Sensing of Environment and validated across over 2 million labeled buildings in 30 cities.

The plugin featured in this guide takes that same technology and makes it more practical for everyday use: you can save your areas of interest, create monitoring projects, run batch analysis, and view time-series data — all inside QGIS on your own machine.

How PWTT Works?

(The Simple Version)

The European Space Agency operates a satellite called Sentinel-1. Instead of taking photos like a camera, it sends pulses of microwave energy toward the ground and measures what bounces back — like sonar, but from space.

Buildings, roads, and structures bounce the signal back in a specific way. When a building is destroyed, or a new one is built, the bounce pattern changes.

The PWTT method works in three simple steps:

What This Looks Like in Practice

To give you a sense of what the plugin can actually reveal, here are two real examples. In both cases, the PWTT plugin flagged areas of change from radar data alone — then optical satellite imagery from Planet Labs was used to confirm what happened on the ground.

Example 1: Detecting change in a desert compound

Before (28 August 2025) / After (3 October 2025) comparison Drag to compare Before (28 August 2025) on the left with After (3 October 2025) on the right.

Matan As Sarra, Libya | 21.688°N, 21.828°E.

The PWTT time series chart for this location shows slight deviations in the VV radar signal on approximately 2 April 2025 and 12 September 2025 - both data points dip noticeably below the cluster of neighboring readings. Optical satellite imagery from Planet Labs confirms a visible change on the ground around that date. Imagery source: Planet Labs.

In this example, the plugin’s time series chart showed a subtle dip in the VV radar signal around September 2025. The deviation was small — not enough to cross the tool’s statistical significance threshold on its own — but it stood out from the otherwise stable baseline. A closer look using optical imagery confirmed a visible change at the site between August and October 2025.

Example 2: Tracking new construction near an airstrip

Before (16 May 2025) / After (11 April 2026) comparison Drag to compare Before (16 May 2025) on the left with After (11 April 2026) on the right.

Asosa airport, Ethiopia.

New construction detected. The PWTT plugin flagged several change clusters (red/yellow pixels) near an airstrip. The optical imagery confirms new structures appeared between May 2025 and April 2026. The plugin detected these changes using radar data alone; the optical imagery serves as ground-truth confirmation. Imagery source: Planet Labs.

In this second example, the plugin flagged several clusters of change (shown in red and yellow) near an airstrip in a rural area. Comparing optical imagery from May 2025 (before) and April 2026 (after) shows that the detected changes correspond to new structures and ground disturbance — evidence of construction activity that would have been difficult to spot without monitoring.

These examples illustrate the two sides of the plugin’s value: it can detect both destruction (things disappearing) and construction (things appearing). For journalists and researchers, this means you can use a single tool to monitor any kind of physical change in an area of interest — from conflict damage to clandestine building activity.

What You Need Before Starting

Before installing the plugin, you will need three things. All of them are free.

Detailed Walkthrough

Setting Up Google Earth Engine

Google Earth Engine requires a bit more setup than just creating an account. You need to create a Google Cloud project, enable the Earth Engine API, set up OAuth credentials, and register the project with Earth Engine. It sounds complicated, but it is mostly clicking through forms. Follow these steps exactly.

Part A: Enable the Earth Engine API

Registering Your Project with Earth Engine

Navigate to Earth Engine → Configuration in your Google Cloud Console. You will see two options: Register for commercial use and See if you are eligible for noncommercial use. For journalism and research, click “Get started” under noncommercial use.

The registration walks you through five steps:

1. Organization type: Select what best describes you (e.g., “Other” for individual journalists).
2. Noncommercial eligibility: Choose “Individual research or noncommercial use.” In the description field, briefly describe your use (e.g., “OSINT research” or “PWTT damage assessment”).
3. Plan: Select “Community” — this is the free tier with 150 EECU-hour limit, which is sufficient for most investigative work. No billing account is required.
4. Describe your work: Check the category that fits (e.g., “Human Rights”).
5. Review and Register: Review your selections and click Register.

Part B: Configure OAuth Consent Screen

Before you can create credentials, Google requires you to set up an “OAuth consent screen.” This is a one-time setup for your project.

Part C: Create OAuth Client Credentials

Setting Up Copernicus account

Setting up a Copernicus account is quick and straightforward. Simply visit the Copernicus registration page to create your account. Once registered and logged in, you can easily generate your OAuth credentials by going to the account settings section.

Installing the Plugin in QGIS

Installing the PWTT plugin in QGIS can be done in two ways. If the plugin is not available in the repository or you need a specific version, you can also install it manually by downloading the plugin as a .zip file and installing it via the “Install from ZIP” option in the QGIS Plugin Manager.

1 official QGIS plugin repository

The easiest and recommended method is to install it directly from the official QGIS plugin repository. Plugin page on QGIS plugins website _

After installing the Plugin

Open the PWTT panel by clicking the new PWTT icon in your toolbar (or go to Plugins → PWTT). If the plugin tells you that some Python packages are missing, click the “Install Dependencies” button. This downloads small helper libraries the plugin needs to talk to the satellite data servers.

In the PWTT panel, select your preferred backend (e.g., Google Earth Engine). Click Authenticate. A browser window will open asking you to log in with your Google account and authorize access. Follow the prompts.

For Copernicus/openEO: enter your Copernicus credentials directly or use the browser-based OIDC login.

Running Your First Analysis

What the Plugin Can Do

This plugin is a QGIS implementation of the original PWTT tool. Here is what it adds for everyday monitoring:

Tips for Beginners

Start small. For your first run, pick a well-known location where you already know something changed (a documented demolition, a construction site). This lets you verify the results and build confidence in the tool.

Use longer baselines. The default 12-month pre-event window works well in most cases. A longer baseline gives the statistical test more data to establish “normal,” which reduces false positives.

Cross-reference everything. This tool is a starting point for investigation, not a final verdict. Always compare your findings with optical satellite imagery (Google Earth, Sentinel-2), news reports, and other open-source intelligence.

The T-statistic cutoff is your sensitivity dial. The default of 3.3 is a good balance. Lower it (e.g., 2.5) to catch more subtle changes (but more noise). Raise it (e.g., 4.0 or 5.0) to only see the most dramatic changes.

Further Reading

The original research paper explaining the PWTT method in detail: “Open access battle damage detection via Pixel-Wise T-Test on Sentinel-1 imagery” — published in Remote Sensing of Environment, 2025.

Bellingcat’s practical application of the tool: “When Satellite Imagery Goes Dark: New Tool Shows Damage in Iran and the Gulf” — April 2026.

The original PWTT code repository by Ollie Ballinger: github.com/oballinger/PWTT

The original project requires manually setting up PostgreSQL with PostGIS, a Flask API, a Vue.js frontend, and Firebase authentication. That’s a lot of moving parts to coordinate before you can run a single query. My modified version of Turnstone adds a Docker-based deployment that brings it all together with a single command.

What Changed

The PR adds Docker Compose orchestration for the entire stack, optional Firebase-free (“local”) mode, support for an external Postgres database, improved data loading scripts, and updated documentation.

Everything persistent lives under a single data/ directory in the repo root — heatmap files, Postgres data, modes CSV, query history backups, and optionally your Firebase service account key.

Quick Start (Local Postgres, No Firebase)

This is the easiest path. You get a fully self-contained stack with no Google accounts required.

1. Clone and configure

git clone https://github.com/salaheldinaz/adsb-history.git
cd adsb-history
cp docker/.env.example docker/.env

Both DISABLE_AUTH=1 and VITE_DISABLE_AUTH=1 are set by default in .env.example, so no changes are needed for a Firebase-free setup. All other defaults work out of the box.

2. Download heatmap data

The heatmap data comes from adsblol/globe_history. The download script handles fetching and extracting the split .tar.aa/.tar.ab archive:

./scripts/download-globe-history.sh data

When run from a terminal, the script is interactive — it shows a numbered catalog of all available prod releases and lets you pick by index, a date, or a date range:

When piped or run non-interactively (e.g. in CI), it downloads the latest release automatically. The script extracts each release into data/<tag>/ — note the directory name for step 4.

3. Start the stack

docker compose -f docker/docker-compose.yml up -d

This starts Postgres (with PostGIS), the Flask API, and the Nginx-fronted Vue frontend.

4. Load the heatmap data

To load all downloaded releases at once (bulk):

docker compose -f docker/docker-compose.yml run --rm data-loading /data

Or to load a single specific release:

docker compose -f docker/docker-compose.yml run --rm data-loading \
  /data/<RELEASE_DIR>/heatmap

Replace <RELEASE_DIR> with the tag directory from step 2 (e.g. v2026.04.15-planes-readsb-prod-0). The loader accepts gzip-compressed and raw binary files, handles big-endian format, and supports both YYYY-MM-DD and YYYY.MM.DD date directory naming.

5. Open the app

• Frontend: http://localhost:8080
• API: http://localhost:5000

Using an External Postgres Database

If you already have a PostGIS-enabled Postgres instance (e.g. on a NAS, a VPS, or a managed cloud database), you can point the stack at it instead of running a local container.

1. Set DOCKER_DATABASE_URL in your .env

Docker containers can’t reach localhost — use the actual host address. On Docker Desktop (Mac/Windows) that’s host.docker.internal; on Linux the compose file already sets extra_hosts for you:

DOCKER_DATABASE_URL=postgresql://user:password@host.docker.internal:5432/adsb

2. Initialize the external database (once)

./scripts/init-external-db.sh

This script is idempotent — safe to run multiple times. It applies docker/postgres/01_schema.sql and loads data/modes.csv if present. It also checks that PostGIS is installed and exits clearly if it isn’t.

3. Start with the external-db override

docker compose \
  -f docker/docker-compose.yml \
  -f docker/docker-compose.external-db.yml \
  up -d

The override file stubs out the local Postgres container so depends_on chains still work, while the API and data-loading containers connect via DOCKER_DATABASE_URL.

4. Load data the same way

# Bulk — all releases under data/
docker compose \
  -f docker/docker-compose.yml \
  -f docker/docker-compose.external-db.yml \
  run --rm data-loading /data

# Or single release
docker compose \
  -f docker/docker-compose.yml \
  -f docker/docker-compose.external-db.yml \
  run --rm data-loading /data/<RELEASE_DIR>/heatmap

Optional: Firebase Authentication

If you want to enable user accounts and Firestore-backed query history (the original upstream behaviour), add Firebase credentials:

1. Create a project at console.firebase.google.com and enable Authentication.
2. Download a service account JSON key and place it in data/firebase-service-account.json.
3. In docker/.env, set:

   FIREBASE_SERVICE_ACCOUNT_KEY=/data/firebase-service-account.json
   FIREBASE_PROJECT_ID=your-project-id
   VITE_FIREBASE_API_KEY=...
   # (plus the other VITE_FIREBASE_* vars from .env.example)
   

4. Set DISABLE_AUTH=0 and VITE_DISABLE_AUTH=0 (overriding the defaults).

When Firebase is disabled, the frontend uses a stub user and stores query history in the browser’s IndexedDB instead of Firestore.

Query History Backup & Restore

Whether you use Firebase or not, you can back up and restore your saved queries through the UI. Look for the “Save to data folder” and “Restore from data folder” buttons in the Query History panel. These write to/from data/query-history-backup.json via the API, so backups survive container restarts.

Environment Variables Reference

Copy docker/.env.example to docker/.env to see all available options with comments.

Data Format Notes

The data loader was updated to handle a few quirks in the wild:

• modes.csv format: Both the original 7-column format and the newer 11-column format (with owner and aircraft fields) are supported via a staging table and mapped insert.
• Heatmap filenames: The loader accepts both 0–47 (no extension) and 00.bin.ttf–47.bin.ttf.
• Compression: Gzip-compressed binary input is handled transparently.
• Byte order: Big-endian binaries are supported.
• Date directories: Both YYYY-MM-DD and YYYY.MM.DD naming conventions work.

The repo is at github.com/salaheldinaz/adsb-history. If you run into issues with the Docker setup, open an issue or leave a comment.

Downloadable Version of this list 🧰 Click here

Future of Asset Management - Ben Sadeghipour

Where to find Domains/subdomains:

• Acquisitions https://acquiredby.co/apple-acquisitions/
• ViewDNS https://viewdns.info
• Certificate Transparency services
  • Shodan https://shodan.io
  • Censys https://censys.io/
  • Crt.sh https://Crt.sh
  • Certspotter https://sslmate.com/certspotter/
  • Google Transparency Report https://transparencyreport.google.com/https/certificates
  • Facebook Certificate Transparency Monitoring https://developers.facebook.com/tools/ct/

Mentioned Tools

• Amass https://github.com/OWASP/Amass
• Subfinder https://github.com/projectdiscovery/subfinder
• Sublist3r https://github.com/aboul3la/Sublist3r
• Findomain https://github.com/Findomain/Findomain
• Sudomy https://github.com/screetsec/Sudomy

Passive DNS - Andy Dennis

Passive DNS Providers

• RiskIQ https://community.riskiq.com/home
• Cisco Umbrella https://umbrella.cisco.com/
• SecurityTrails https://securitytrails.com/
• CIRCL Passive DNS https://www.circl.lu/services/passive-dns/
• SpamHaus Passive DNS https://www.spamhaus.com/product/passive-dns/

Mentioned Tools

• Word Generator https://wordsmith.org/anagram

So you Want OpSec, eh? - Ritu Gill

Device/Browser info

• https://coveryourtracks.eff.org
• AmIUnique https://www.amiunique.org
• Whoer https://whoer.net
• WhatU https://whatu.info

Browser Add-ons

• HTTPS everywhere https://addons.mozilla.org/en-US/firefox/addon/https-everywhere/
• Privacy badger https://addons.mozilla.org/en-US/firefox/addon/privacy-badger17/
• User agent switcher https://addons.mozilla.org/en-US/firefox/addon/user-agent-string-switcher/

Useful sites

• https://haveibeenpwned.com
• https://tosdr.org
• https://privacytools.io
• https://justgetmydata.com
• https://justdeleteme.xyz
• https://accountkiller.com
• https://www.securemessagingapps.com/

Data Removal

• https://inteltechniques.com/data/workbook.pdf
• https://webbreacher.com/2017/04/24/removing-yourself-from-the-internet/
• https://www.learnallthethings.net/blog/2018/1/23/opting-out-like-a-boss-the-osint-way
• https://tisiphone.net/2017/01/25/thwart-my-osint-efforts-while-binging-tv/

OSINT and the Hermit Kingdom - Nick Roy

North Korea on the internet

• https://bgpview.io/asn/131279
• https://github.com/nknetobserver/nknetobserver.github.io
• RedStar OS
  • https://github.com/takeshixx/redstar-tools
  • https://c3subtitles.de/talk/501/
• Foreign Trade of the DPRK http://www.korean-books.com.kp/en/search/?page=periodic-trade
• NK websites
  • dprkportal.kp
  • portal.net.kp
  • webmail.star.net.kp
  • sns.star.net.kp

Mentioned Tools

• Bellingcat tools: http://bit.ly/bcattools
• Torrent Tracking https://iknowwhatyoudownload.com
• Strava HeatMap https://www.strava.com/heatmap

Commandline tools

• dig a example.com +short > IPs
• whois -h whois.cymru.com x.x.x.x > ASN, company name

Hidden Gems via URL Shorteners - Utku Sen

Mentioned Tools

• https://github.com/lc/gau
• https://github.com/OJ/gobuster
• https://github.com/utkusen/urlhunter
• https://shorteners.grayhatwarfare.com/
• https://wiki.archiveteam.org/index.php?title=URLTeam
• https://tracker.archiveteam.org:1338/

Commandline tools

• Unshort URL: curl https://xx.xx/xxx --head

Search dorks

• docs.google.com/a/CompanyName
• docs.google.com/a/CompanyName.com
• drive.google.com/a/CompanyName
• drive.google.com/a/CompanyName.com
• Includes “trello.com” AND “Company Name”
• Include “company.com” AND “admin” OR “private”
• Include “company.com” AND “resetToken”
• Include “company.com” AND “PHPSESSIONID”
• Include “google.com/maps/place” AND “39.9,32.3”

Using OSINT to Combat Human Trafficking & Smuggling - Rae Baker

• https://www.marinetraffic.com

Hunting & Smashing Trolls on Twitter - Mauro Eldritch & Santiago Montaño

Propaganda Social Media Networks

• https://counter.social
• https://www.facepopular.net/

Tracking Trolls

• Tracking Trends
  • https://getdaytrends.com/
  • https://www.trendinalia.com
• Block Trolls
  • MegaBlock https://megablock.xyz/
  • Twitter Block Chain https://chrome.google.com/webstore/detail/twitter-block-chain/dkkfampndkdnjffkleokegfnibnnjfah
  • Block together https://twitter.com/blocktogether
• Venator tool: https://github.com/mauroeldritch/venator

People Hunting, a Pentester’s Perspective - Mishaal Khan

Mentioned Tools

• Ripgrep Tool https://github.com/BurntSushi/ripgrep
• People search
  • https://www.allbiz.com/
  • https://www.advancedbackgroundchecks.com/
  • https://www.fastpeoplesearch.com/
  • https://thatsthem.com/
  • https://peopledatalabs.com
• Search NPI Records https://npiregistry.cms.hhs.gov/
• Vehicle Search https://www.vehiclehistory.com/
• Search Bluetooth devices https://wigle.net/
• Voter Search https://www.sec.state.ma.us/VoterRegistrationSearch/MyVoterRegStatus.aspx
• Burp suit tool https://portswigger.net/burp
• Breach lookup
  • https://haveibeenpwned.com/
  • https://breachdirectory.tk/
• Hashcat tool https://github.com/hashcat/hashcat/
• Carrier lookup https://scammerblaster.com/carrier-lookup/
• Doctor search https://www.vitals.com/
• Classmates https://classmates.com
• Instagram tool https://github.com/megadose/toutatis
• Holehe - Registered Account Checking tool https://github.com/megadose/holehe
• https://socialbearing.com/

Tracking Infrastructure with Mihari - Manabu Niseki

Presentation

• https://ninoseki.github.io/presentations/Adversary%20Infrastructure%20Tracking%20with%20Mihari.pdf

Mentioned Tools

• MMhdan
  • https://github.com/ninoseki/mmhdan
  • https://mmhdan.herokuapp.com/
• Mihari https://github.com/ninoseki/mihari
• Active Tracking
  • Nmap https://nmap.org/
  • Masscan https://github.com/robertdavidgraham/masscan
  • Zmap https://github.com/zmap/zmap
  • httpx https://github.com/projectdiscovery/httpx
  • JARM https://github.com/salesforce/jarm
• Passive Tracking
  • Internet-wide scanning
    • Shodan https://shodan.io
    • Censys https://censys.io/
    • BinaryEdge https://www.binaryedge.io/
    • Onyphe https://www.onyphe.io/
    • Spyse https://spyse.com/
    • ZoomEye https://www.zoomeye.org/
  • Passive DNS services
    • VirusTotal https://www.virustotal.com/
    • PassiveTotal (RiskIQ) https://community.riskiq.com/home
    • SecurityTrails https://securitytrails.com/
    • DomainTools https://domaintools.com
  • CT logs
    • Crt.sh https://Crt.sh
    • Censys https://censys.io/

Bug Hunter’s Methodology - Tushar Verma

• ReconFTW https://github.com/six2dez/reconftw
• Bheem https://github.com/harsh-bothra/Bheem
• Osmedeus https://github.com/j3ssie/Osmedeus

Creating a Social Threat Score - Masterchen

• https://github.com/MasterChenb0x/SocialThreatScore
• https://us-cert.cisa.gov/CISA-National-Cyber-Incident-Scoring-System
• https://merics.org/en/report/chinas-social-credit-system-2021-fragmentation-towards-integration
• https://www.myfico.com/credit-education/whats-in-my-credit-report

Build Cloud-Based Recon Automation - Ryan Elkins

• Brevityrecon https://github.com/brevityinmotion/brevityrecon
• Blog https://www.brevityinmotion.com/automated-cloud-based-recon/
• Arkadiyt https://github.com/arkadiyt

Uncovering APT Attacks - Ladislav Baco

Malware Samples

• https://vx-underground.org/
• https://bazaar.abuse.ch/

Malware Feed

• Hybrid Analysis https://www.hybrid-analysis.com/
• Any.Run https://any.run/
• Tria.ge https://tria.ge/
• VirusTotal https://www.virustotal.com/

Threat Intel Platform / Tools

• Yeti https://yeti-platform.github.io/
• Tweettico http://tweettioc.com/
• Twint https://github.com/twintproject/twint

Advanced Search

• Shodan https://shodan.io
• Censys https://Censys.io
• Webarchive https://archive.org/web/
• Search by hash on Shodan http.favicon.hash

Domainsquatting with Different TLD’s - Anthony Kava

• https://impostor.domains/

OSINT for Workers - Kala Kinyon

Mentioned Tools

• Thatsthem https://Thatsthem.com
• GeoCreepy https://geocreepy.com
• SunCalc https://SunCalc.net
• OsintFramework https://osintframework.com/
• Wiki of Social Media Monitoring Solutions http://wiki.kenburbary.com/

My talk at NCPTF 2021 conference.

This talk is about alternative social media networks/apps/websites that kids are interacting with these days, especially Gen Z and Alpha. In this talk, we will learn how we can find them, what data are being shared online, what to look for when we search from an investigation perspective, and more.

🗂 Slides

You can download slides here: https://github.com/qomplx/ncptf2021/raw/main/Where%20the%20kids%20hangout%20-%20Salaheldinaz.pdf

📟 Resources

Understanding Generations

• https://www.kasasa.com/articles/generations/gen-x-gen-y-gen-z
• https://www.verywellfamily.com/a-teen-slang-dictionary-2610994

Apps collections

• https://www.ovrdrv.com/knowledge/social-media-map/
• https://conversationprism.com/

Finding the unknown

• https://play.google.com/store/apps/top
• https://appgallery.huawei.com/
• https://www.appannie.com/en/apps/ios/top/
• https://appfigures.com/top-apps/
• https://alternativeto.net/

Games Communities

• https://drive.google.com/file/d/1xZ8n5PiEviB70aOLDtKZ2GrduKY8GWEq/view

Social Media Privacy research

• https://en.panoptykon.org/articles/three-layers-your-digital-profile

Flowcharts

• https://github.com/sinwindie/OSINT

Open Source Intelligence (OSINT) has grown significantly in recent years. In a world awash with data, more and more organizations are starting to recognize the benefits of using openly available information to better understand the world.

Government agencies, investigative journalists, financial institutions, law enforcement, and other agencies are increasingly making use of open information to gain business insights, expose wrongdoing, and tell compelling stories. At QOMPLX our own OSINT Team works to gather and analyze open-source information to help our clients better understand and reduce their own cybersecurity risk.

In the first of what we hope will become an annual series, we have asked leading OSINT practitioners from a range of backgrounds to discuss what they felt were the biggest changes and emerging trends over the last 12 months.

Project Website

https://stateofosint.com

Project Team

To learn about Wigle basics, check this OSINTCurious blog post

Getting the Wigle data in JSON format

We will start by using Wigle API to download the data:

1. Go to https://wigle.net/account and log to your account:

2. Click show my tokens

3. In new tab open https://api.wigle.net/swagger

4. Click Authorize button on the right

5. Copy the API Name and API Token from first tab into the username and password inputs (respectively) in the Basic Authentication dialog then click Authorize.

6. Scroll down until you find “Network search and information” tools and click it

7. Select /api/v2/network/search then Click Try it out button:

8. Fill the search details:

   You can use https://wigle.net/mapsearch to find search and get specific address longitude and Latitude

9. Click Execute

   The result per request is limited: Defaults to 25 for COMMAPI, 100 for site. Bounded at 1000 for COMMAPI, 100 for site.

   You can use searchAfter parameter to download multiple result pages.

10. Click Download

Now You have the result in JSON format file and we need to convert it to KML/KMZ to use it in Google earth.

KML

KML is an acronym for Keyhole Markup Language developed by Google and Keyhole, Inc. KMZ is the zipped version of a KML file. ¹

KML and KMZ are file extensions used in Google applications, specifically Google Earth and Google Maps. ²

The code below shows a minimal KML file:

<?xml version="1.0" encoding="UTF-8"?>
    <kml xmlns="http://www.opengis.net/kml/2.2">
    <Document>
      <Placemark>
        <name>New York City</name>
        <description>New York City</description>
        <Point>
          <coordinates>-74.006393,40.714172,0</coordinates>
        </Point>
      </Placemark>
    </Document>
    </kml>

Magic

To convert JSON to KML, we will convert each parameter as following:

• ssid > name
• trilat, trilong > coordinates
• All the remaining details > description

Also we can add shared style to change the default icon for the placemark. I usually use https://www.iconfinder.com/ for icons as it’s easy to just copy icon URL .

Example of shared style code:

    <Style id="SharedStyle">
        <IconStyle>
            <Icon>
                <href>http://maps.google.com/mapfiles/kml/shapes/shaded_dot.png</href>
            </Icon>
        </IconStyle>
    </Style>

Method 1 :

1. Convert JSON to CSV using this tool: http://convertcsv.com/json-to-csv.htm

2. Copy or download the result (CSV) to use it in the next tool.

3. Convert CSV to KMl using this tool: http://convertcsv.com/csv-to-kml.htm

   Enter fields number as following:

Method 2:

Using python module simplekml, I wrote a script to convert Wigle JSON to KML :

https://github.com/salaheldinaz/wiglejson2kml

Enjoy!

https://kringlecon2.salaheldinaz.com/

🗺 Map

This a preview of a very high quality map for ELF University.

To zoom and check the details please download the full quality. click here:

🏵 Objectives

Check the objectives in your badge, You will have the 6 objectives then unlock new objective by talking to the elves you find in the university:

🎗Helping the elves Challenges

As we walk around, we can find various challenges, and as we talk to the elves standing near them, we get some hints.

Resources

Virtual Machines I used:

• Slingshot from SANS.

• Windows 10 VM

Recording terminal:

• asciinema

I was looking at advanced Twitter search page because I needed to search for tweets posted by a specific source. Also, I found this description on Twitter help without any details on how to use it in search:

Also, a link to list of common third-party sources: https://partners.twitter.com/en/find-a-partner.html

Then I found Twitter search home page with a list of operators can be used in search including tweet source.

Searching by tweet source label

To search for tweets by a specific source, add source: to your search keywords

news source:TwitterFeed Search for tweets containing news and entered via TwitterFeed

To exclude a source, add - before source:

news -source:TwitterFeed Search for tweets containing news and not entered via TwitterFeed

To reveal tweet source on a desktop browser (web), add m. in URL before twitter.com :

https://m.twitter.com/jack/status/1075896805882118144

List of tested sources

I started testing & searching random tweets for sources :

Devices:

• iPhone > source:“Twitter for iPhone”
• iPhone* > source:iOS (used to capture all Tweets sent from within iOS7)
• Android > source:“Twitter for Android”
• iPad > source:“Twitter for iPad”
• Mac > source:“Twitter for Mac”
• Windows Phone > source:“Twitter for Windows Phone”

Twitter Apps :

• Twitter Ads > source:“Twitter Ads Composer”
• Tweetdeck > source:Tweetdeck
• Twitter.com > source:web (the Twitter web)
• Twitter.com > source:“Twitter Web Client”
• Twitter.com > source:“Twitter Web App”

Third-party Apps :

• Hootsuite > source:Hootsuite
• Seesmic > source:seesmic
• Buffer > source:buffer
• IFTTT > source:IFTTT
• SocialFlow > source:SocialFlow
• Epsilon > source:Epsilon
• Instagram > source:Instagram
• Facebook > source:Facebook
• Echofon > source:Echofon

Unknown sources :

These labels are resulting in unrecognized sources

• source:Microsoft
• source:iPhone
• source:Android
• source:iPad
• source:Mac
• source:Linux
• source:apple

Tools to Analysis Profile to find sources

If you want to Analysis sources from one account you can use tools like:

• https://accountanalysis.lucahammer.com
• https://foller.me

Manipulating the source [Not Tested]

If you are interested in manipulating the source you can use Tweepy API but this will required a twitter developer account.

Is it valuable ?

I was able to use tweet source label in my case to find how my target used his twitter account, he was using Facebook which led me to try to find his Facebook account by searching Facebook using the same words from his tweet .

Sources:

• https://www.youtube.com/watch?v=cZIso9uqNls
• https://www.cnet.com/how-to/use-twitters-search-operators-to-find-specific-tweets/
• http://thesocialchic.com/2013/10/01/how-to-master-twitter-search-searching-for-tweets-by-device/

This Cyber Quest covers a wide range of topics on networking, including firewalls, routers, Wi-Fi, and packet analysis.

Tools that you may need include Wireshark, aircrack-ng, and exiftool (all of which are included in many security-focused Linux distributions, including Kali Linux).

Some questions refer to files contained within this ZIP file : 🔗 Spring 2019 Cyber Quest Resources. Let’s start the fun.

The following questions based on 🔗 Wifi.pcap :

2️⃣7️⃣ You are part of a wireless penetration test and have acquired the 🔗 WiFi.pcapfile.

What is the BSSID of the WAP (colon delimited)?

✅ Answer:

We will use aircrack-ng to analysis the file and get BSSID of the WAP.

1. Install Aircrack-ng\

https://www.aircrack-ng.org/doku.php?id=install_aircrack

2. Open terminal and run aircrack-ng command as following :

   aircrack-ng WiFi.pcap

$ aircrack-ng WiFi.pcap
Opening WiFi.pcapplease wait...
Read 53337 packets.

   #  BSSID              ESSID                     Encryption

   1  24:F5:A2:11:F7:6A  Home_Net                  WEP (0 IVs)

Choosing first network as target.

Opening WiFi.pcapplease wait...
Read 53337 packets.

1 potential targets

Attack will be restarted every 5000 captured ivs.
Starting PTW attack with 15273 ivs.


                                   Aircrack-ng 1.5.2 


                      [00:00:03] Tested 2792 keys (got 15273 IVs)

   KB    depth   byte(vote)
    0    1/  5   6B(21760) 0B(19968) CF(19968) B5(19712) 98(19200) E8(19200) 
    1    0/  2   F7(23808) 17(21760) 19(20224) BB(19968) 10(19968) 9F(19712) 
    2    1/  6   F7(21760) 60(20992) 1B(20736) 98(20480) 0E(20224) 91(19456) 
    3    7/ 11   3F(19456) 1A(19200) C3(19200) E6(19200) 91(18944) 6B(18944) 
    4    3/  5   A6(20224) 94(19968) C2(19456) BE(19456) 8D(19200) 2A(19200) 

                         KEY FOUND! [ 6B:F7:F7:3F:FC ] 
    Decrypted correctly: 100%

The BSSID of the WAP 24:F5:A2:11:F7:6A

2️⃣8️⃣ Analyze the WiFi.pcap file.** How many seconds long is the packet capture, from beginning to end (round to the nearest second)?

Select one:

• 462
• 595
• 126
• 745

✅ Answer:

1. Open the file in Wireshark.

2. Select from upper menu Statistics Capture File Properties :

Capture length is 595 sec

2️⃣9️⃣ What is the WEP key of the WAP** (without colons) ?

✅ Answer:

From our Q27 using aircrack-ng tool:
WEP key 6BF7F73FFC

3️⃣0️⃣ Use the WEP key to decrypt the traffic in** 🔗WiFi.pcap.

What is the session _id assigned to the administrator of the network device?

✅ Answer:

1. Open file in Wireshark.

2. To add WEP Key to decrypt the traffic, From upper menu select Wireshark Preferences. You should see a window that looks like this:

Select Protocols IEEE 802.11 Decryption keys [edit]\

then add the WEP key from previous answer without colons 6BF7F73FFC

​03) Let’s search for all packets contains session_id and word admin using this filter:

tcp contains "session_id" && tcp contains "admin"

Notice the packet info POST /login.cgi HTTP/1.1 which is a login packet.

​04) Let’s examine this packet, go to packet details tab expand HTML Form URL Encoded: application/x-www-form-urlencoded , you will find admin login details:

Form item: "http_username" = "admin"

Form item: "http_passwd" = "ba41d75ebd1339f3a420da1db2c48dc2"

expand Hypertext Transfer Protocol

You will find that admin granted a session_id after successful login with session_id=f29e8307513709b98b88b8e029bb7f53

Let’s check the rest of the packages, try this filter to view POST method packets:

http.request.method == "POST"

You will find admin applying some configuration to the device with same session id, to view packets data right click on packet follow TCP Stream

You will find admin applying some configuration with same session

Session_id assigned to the administrator of the network device f29e8307513709b98b88b8e029bb7f53

References :
https://wiki.wireshark.org/HowToDecrypt802.11

This Cyber Quest covers a wide range of topics on networking, including firewalls, routers, Wi-Fi, and packet analysis.

Tools that you may need include Wireshark, aircrack-ng, and exiftool (all of which are included in many security-focused Linux distributions, including Kali Linux).

Some questions refer to files contained within this ZIP file : 🔗 Spring 2019 Cyber Quest Resources. Let’s start the fun.

The following questions based on 🔗 attack.pcap :

2️⃣2️⃣ Analyze the 🔗 attack.pcap file.

What is most likely occurring?

• An SMB brute force attack
• An SSH brute force attack
• An SSH Man-in-the-Middle attack
• An SMB Replay attack

✅ Answer:

1. Let’s begin with understanding of each attack:

In general a brute force attack is an attempt to crack a password or username or find a hidden web page, or find the key used to encrypt a message, using a trial and error approach and hoping, eventually, to guess correctly.

• An SMB brute force attack
  Server Message Block (SMB) is the Internet standard protocol Windows uses to share files, printers, and serial ports. In a networked environment, servers make file systems and resources available to clients. Clients make SMB requests for resources, and servers make SMB responses in what’s described as a client server, request-response protocol.

• An SSH brute force attack
  Secure Shell (SSH) is a cryptographic network protocol for operating network services securely over an unsecured network. Typical applications include remote command-line login and remote command execution, but any network service can be secured with SSH.

• An SSH Man-in-the-Middle attack
  A man-in-the-middle attack (MITM) is an attack where the attacker secretly relays and possibly alters the communications between two parties who believe they are directly communicating with each other.

• An SMB Replay Relay attack
  SMB Relay Attack is a type of attack which relies on NTLM Version 2 authentication. it’s a Man-In-The-Middle attack in which a malicious user on the local network poisons network traffic to trick the target machine/user into thinking that it is the authentication server.

2. open attack.pcap file in Wireshark :

3. Look over the sequence of packet transfer between source and destination captured through Wireshark.
   The attacker 10.1.1.165 do ports scanning for victim 10.1.1.133 :

• Closed ports :
  Source sent SYN packet on the specific port then if the port is closed then the destination will reply by sending RST packet.this scan for close ports.\

• Open ports:
  • Source sent SYN packets to the destination
  • Destination sent SYN, ACK packets to the source (An SYN, ACK indicates the port is listening (open))
  • Source sent RST packets to the destination\

The attacker found port 445 is open.\

According to Microsoft port 445 is the microsoft-ds (NetBios helper) port and also used for ( SMB Fax Service - SMB Print Spooler - SMB Server - SMB Remote Procedure Call Locator - SMB Distributed File System - SMB Net Logon)

4. Using filter smb2 , We can see that brute-force attempts have been performed by the hacker :

The attacker has tried the user KgHZQMzV but is granted a logon failure (STATUS_LOGON_FAILURE).

After that we can see that the user larry has been attempted, but a logon failure has occurred as well STATUS_LOGON_FAILURE.

But he continue brute-force attempts until he get in and try different locations at same domain : Tree: \\10.1.1.133\admin$, Tree: \\10.1.1.133\IPC$ but failed ERROR (STATUS_ACCESS_DENIED).

Then he trying different domain Domain: oqdwzfFX

Until he get access at Domain: LARRY-PC

Attack type An SMB brute force attack

References :
https://www.1337pwn.com/how-to-detect-nmap-smb-brute-force-attack-using-wireshark/
https://intrinium.com/smb-relay-attack-tutorial/
https://www.youtube.com/watch?v=ctLVMi1_zBc
https://www.hackingarticles.in/understanding-nmap-scan-wireshark/

2️⃣3️⃣ Whose account is being targeted in the aforementioned attack?

• Larry
• John
• Michael
• Sarah

✅ Answer:

From previous answer we know the account targeted is Larry

2️⃣4️⃣ According to the traffic in 🔗 attack.pcap,

which ports are open on 10.1.1.133?

• 135, 139, 443, 2103, 5360
• 21, 22, 53, 139, 2103
• 135, 139, 445, 2103, 5357
• 21, 22, 53, 80, 445

✅ Answer:

1. Open attack.pcap file in Wireshark .

2. As we learned from Q22 that destination send a SYN, ACK packets to the source which indicates the port is listening open

We need to filter our packets based on this concept, we will use the following filter in Wireshark :

(tcp.flags==0x12) and not tcp.analysis.initial_rtt and ip.src==10.1.1.133

tcp.flags==0x12 looks for SYN/ACK packets (you could also use tcp.flags.syn==1 and tcp.flags.ack==1 ).

The trick is using not tcp.analysis.initial_rtt, because that checks if Wireshark calculated the initial round trip time for the conversation

• and that’s something it only does if the handshake is complete. So if the field is missing, and the SYN/ACK was seen, you have a half open connection (assuming the SYN is there).

of course ip.src==10.1.1.133 is to set this host as source of packet.

You can go to upper menu and select statistics Conversations for better view and select limit to display filter which we applied.

So the open ports from options above on host 10.1.1.133 are 135, 139, 445, 2103, 5357

References :
https://www.youtube.com/watch?v=Zi1aaEJg5YI
https://osqa-ask.wireshark.org/questions/60995/how-do-i-filter-tcp-connection-with-syn-and-syn-ack-without-ack-response \

2️⃣5️⃣ Continue to analyze 🔗 attack.pcap.

Who is the author of the exfiltrated file?

• Michael
• Sarah
• John
• Larry

✅ Answer:

If you Examine the packets you will find the hacker downloaded this file: larry\Documents\files\file.jpg

To extract the file:

• Select this packet by click on it .
• Go to upper menu and select File Extract Objects SMB...\

• Select the file then click save .\

Nice photo :)

Now let’s open the file with exiftool to examine the metadata:

Note: ExifTool does not need to be installed to run. Just download and extract either the full Perl distribution on Mac/Linux, or the Windows EXE version on Windows, and run it directly.

Open terminal and run the following command after change path/to/file.jpg to where you saved the file

exiftool /path/to/file.jpg > data.txt

data.txt where we will save the file metadata, you can run the command without extract the data to file.

ExifTool Version Number         : 11.30
File Name                       : file.jpg
Directory                       : .
File Size                       : 41 kB
File Modification Date/Time     : 2019:06:22 21:31:01+03:00
File Access Date/Time           : 2019:06:22 21:43:43+03:00
File Inode Change Date/Time     : 2019:06:22 21:41:54+03:00
File Permissions                : rw-r--r--
File Type                       : JPEG
File Type Extension             : jpg
MIME Type                       : image/jpeg
JFIF Version                    : 1.02
Resolution Unit                 : inches
X Resolution                    : 96
Y Resolution                    : 96
DCT Encode Version              : 100
APP14 Flags 0                   : (none)
APP14 Flags 1                   : (none)
Color Transform                 : YCbCr
Exif Byte Order                 : Big-endian (Motorola, MM)
Artist                          : Sarah
Date/Time Original              : 2018:05:29 10:46:42
Create Date                     : 2018:05:29 10:46:42
Sub Sec Time Original           : 46
Sub Sec Time Digitized          : 46
XP Title                        : New York City skyline
XP Author                       : Sarah
Padding                         : (Binary data 2108 bytes, use -b option to extract)
Quality                         : 60%
About                           : uuid:faf5bdd5-ba3d-11da-ad31-d33d75182f1b
Creator                         : Sarah
Rating                          : 5
Warning                         : [minor] Fixed incorrect URI for xmlns:MicrosoftPhoto
Rating Percent                  : 99
Title                           : New York City skyline
Description                     : New York City skyline
Image Width                     : 580
Image Height                    : 387
Encoding Process                : Baseline DCT, Huffman coding
Bits Per Sample                 : 8
Color Components                : 3
Y Cb Cr Sub Sampling            : YCbCr4:4:4 (1 1)
Image Size                      : 580x387
Megapixels                      : 0.224
Create Date                     : 2018:05:29 10:46:42.46
Date/Time Original              : 2018:05:29 10:46:42.46

The file author is Sarah

References :
https://www.youtube.com/watch?v=1rc88RyvCnE
https://www.sno.phy.queensu.ca/~phil/exiftool/install.html \

2️⃣6️⃣ What is the title of the exfiltrated file?

• San Francisco Golden Gate Bridge
• New York City skyline
• Chicago Cloud Gate
• Boston Fenway Park

✅ Answer:

From extracted metadata the file title is > New York City skyline

This Cyber Quest covers a wide range of topics on networking, including firewalls, routers, Wi-Fi, and packet analysis.

Tools that you may need include Wireshark, aircrack-ng, and exiftool (all of which are included in many security-focused Linux distributions, including Kali Linux).

Some questions refer to files contained within this ZIP file : 🔗 Spring 2019 Cyber Quest Resources. Let’s start the fun.

The following questions focus on General Networking:

1️⃣ You are analyzing files created under RFC 5424.

What is the Priority value of a mail system message (Facility=2) with a Severity of Error (Severity=3)?

• 19
• 12
• 35
• 5

✅ Answer : The Priority value is calculated by first multiplying the Facility number by 8 and then adding the numerical value of the Severity.

(2*8) + 3 = 19

Reference : https://tools.ietf.org/html/rfc5424#page-11

2️⃣ A junior network administrator in your organization has alerted you to a possible security incident.

She shows you the below query she performed.

What has occurred?

• An attacker accessed NetBIOS on 192.168.2.1
• An attacker probed NetBIOS on 172.16.7.94
• The router ACL denied packets destined for ephemeral ports
• The router ACL dropped packets destined for port 137

✅ Answer :

The query she performed Router#show logging | include 172.16.7.94. *\-\>.*\(137\) is to identify logs for which the source IP address was 172.16.1.92 and the destination port was 137 .

The router logs show the following:

• Connection
  • Source IP address : 172.16.7.94
  • Source port : 17587, 585564, 17755
  • Destination IP address : 192.168.2.1
  • Destination port : 137
• Log message Identifier %SEC-6-IPACCESSLOGP which is identify a packet matching the log criteria for the given access list has been detected (TCP or UDP).
• ACL : list 155
• ACL action: denied tcp

The router ACL dropped packets destined for port 137

References:
https://www.cisco.com/c/en/us/about/security-center/access-control-list-logging.html
https://www.cisco.com/c/en/us/about/security-center/identify-incidents-via-syslog.html

3️⃣ Your organization is highly dependent on the confidentially, integrity and availability of a database used by several financial core operations.

Which of the following defenses will provide the best protection to the database from attacks such as SQL injection or Application bypass?

• Network Firewall with Stateful Packet Inspection
• Packet Filtering Host Firewall
• Application Firewall
• Virtual Private Network (VPN)

✅ Answer :

First let’s understand each option:

• Network Firewall with Stateful Packet Inspection : Inspect each packet individually, without considering the trends of the data you’re receiving, and they also consider the connection states of streams of data. Stateful firewalls will collect a series of packets before it determines their connection state, and then compares those findings to the firewall rules, rather than applying the rules to each individual packet of data.

• Packet Filtering Host Firewall: Analyzes network traffic at the transport protocol layer. Each IP network packet is examined to see if it matches one of a set of rules defining what data flows are allowed. The rules determine whether communication is allowed based upon the information contained within the Internet and transport layer headers and the direction that the packet is headed ( any combination of source IP address, destination IP address, source port, or destination port.)

• Application Firewall: Generally do everything that stateful firewalls do, and they also analyze the actual data content of the packets, not just the headers. Application firewalls allow you to set firewall rules for individual applications.The application firewall is typically built to control all network traffic on any OSI layer up to the application layer.

• Virtual Private Network (VPN): A virtual private network (VPN) extends a private network across a public network, and enables users to send and receive data across shared or public networks as if their computing devices were directly connected to the private network. Encryption is a common though not an inherent part of a VPN connection.

So we need application layer protocol inspection to perform a deep packet inspection of traffic that transits the firewall to mitigate SQL attacks & Application bypass Application Firewall.

References :
https://www.alienvault.com/blogs/security-essentials/explain-how-firewalls-work-to-me
https://www.sciencedirect.com/topics/computer-science/packet-filtering-firewall
https://www.owasp.org/index.php/Web_Application_Firewall
https://en.wikipedia.org/wiki/Virtual_private_network
https://en.wikipedia.org/wiki/Stateful_firewall
https://en.wikipedia.org/wiki/Application_firewall

4️⃣ You are configuring wireless equipment at a customer location.

Which of the following protocols will provide the most security for managing access to the devices? (Select all that apply)

• Secure Shell
• Telnet
• SNMP-Secure
• HTTP
• HTTPS
• SNMPv3

✅ Answer :

First let’s understand each option:

• Secure Shell
  The SSH protocol (also referred to as Secure Shell) is a method for secure remote login from one computer to another. It provides several alternative options for strong authentication, and it protects the communications security and integrity with strong encryption.

• Telnet
  A network protocol that allows a user on one computer to log into another computer that is part of the same network.

  • Telnet, by default, does not encrypt any data sent over the connection (including passwords), and so it is often feasible to eavesdrop on the communications and use the password later for malicious purposes; anybody who has access to a router, switch, hub or gateway located on the network between the two hosts where Telnet is being used can intercept the packets passing by and obtain login, password and whatever else is typed with a packet analyzer.
  • Most implementations of Telnet have no authentication that would ensure communication is carried out between the two desired hosts and not intercepted in the middle.
  • Several vulnerabilities have been discovered over the years in commonly used Telnet daemons.
    Experts in computer security, such as SANS Institute, recommend that the use of Telnet for remote logins should be discontinued under all normal circumstances, for the above reasons.

• SNMP-Secure
  I didn’t find any term or protocol with this name.

• HTTP
  The Hypertext Transfer Protocol (HTTP) is a protocol which allows the fetching of resources. No Data Encryption Implemented. As an “application layer protocol”, HTTP remains focused on presenting the information, but cares less about the way this information travels from one place to another. Unfortunately, this means that HTTP can be intercepted and potentially altered, making both the information and the information receiver vulnerable.

• HTTPS: Hypertext Transfer Protocol Secure (HTTPS) is an extension of the Hypertext Transfer Protocol (HTTP). It is used for secure communication over a computer network. In HTTPS, the communication protocol is encrypted using Transport Layer Security (TLS), or, formerly, its predecessor, Secure Sockets Layer (SSL).

• SNMPv3 : Simple Network Management Protocol (SNMP) is an Internet Standard protocol for collecting and organizing information about managed devices on IP networks and for modifying that information to change device behavior. SNMPv3 provides security with authentication and privacy, and its administration offers logical contexts, view-based access control, and remote configuration.

we will use this protocols Secure Shell, HTTPS, SNMPv3 to provide the most security for managing access to the devices.

References :
https://en.wikipedia.org/wiki/Simple_Network_Management_Protocol
http://www.snmp.com/snmpv3/snmpv3_intro.shtml
https://www.globalsign.com/en/blog/the-difference-between-http-and-https/
https://en.wikipedia.org/wiki/Telnet
https://www.ssh.com/ssh/protocol/

5️⃣ You are investigating multiple complaints of intermittent wireless signal at several locations within your organization.

The network team validates that the access point is transmitting at 2 mW, which is too low for the footprint of the organization. You recommend that the signal strength be increased by 9dBm. What should the new transmit power be?

• 16 mW
• 6 mW
• 12 mW
• 10 mW

✅ Answer :

The gain of antennas is expressed in decibels (dB). In the wireless communication sector, the power output and input are in milliWatts (mW).

The first thing to understand about dBm is that we’re working in negatives. -30 is a higher signal than -80, because -80 is a much lower number.

Next, it’s important to know that dBm does not scale in a linear fashion like you’d expect, instead being logarithmic. That means that signal strength changes aren’t smooth and gradual. The Rule of 3s and 10s highlights the logarithmic nature of dBm. To be simple, let’s see the so-called Rule of 10s and 3s, that allows us to calculate output power of an access point:

• For every gain of 3 dB, the power in mW is doubled
• For every loss of 3 dB, the power in mW is halved
• For every gain of 10 dB, the power in mW is multiplied by 10
• For every loss of 10 dB, the power in mW is divided by 10

So based on data provided:

9 dB = 3 + 3 + 3

2 mW + 9 dB = (((2 x 2) x 2) x 2 = 16 mW 

The new transmit power should be 16 mW

References :
https://www.tanaza.com/blog/understand-the-power-gain-with-the-rule-of-10s-and-3s/
https://www.youtube.com/watch?v=VqoUS-ecw4Y

6️⃣ A junior threat analyst in your organization has alerted you to some potential nefarious activity in your network.

Analyze the ping.pcap packet capture. Which location is referenced in the message?

• Mount Everest
• Great Barrier Reef
• Niagara Falls
• Grand Canyon

✅ Answer :

1. Open ping.pcap file in Wireshark

2. Basic analysis for the file you will find the following:

• It’s communication between 10.1.1.153 and 10.1.1.159
• Protocol type ICMP type 8 Echo Request

3. If you select any connection and expanded Internet Control Message Protocol > Data , you will find same Payload (96 bytes) transmitted in all connections.

4. Let’s grab & analysis this payload to get the message:

Right click on data value a from previous step > show packet bytes..

Select Decode as > Base64

The message : the next drop off location will be @ 43.0828201,-79.0763516. Good luck!

5. Convert latitude and longitude to location using Google Maps

Location Niagara Falls

References :
[http://www.networksorcery.com/enp/protocol/icmp/msg8.htm](http://www.networksorcery.com/enp/protocol/icmp/msg8.htm https://en.wikipedia.org/wiki/Ping_(networking_utility)#ECHO-REQUEST

7️⃣ You are working on installing a new Linux e-mail server.** Which of

the following ports should you open on the host firewall?

• 120
• 280
• 143
• 125

✅ Answer:

Let’s lookup the typical mail ports for hosts which will be using mail client:

• 110: POP3
• 995: SSL-POP
• 143: IMAP
• 993: IMAPS
• 25: SMTP
• 587: SMTP
• 465: SMTP

Also check other ports usage:

• 280 http-mgmt

The port we should open on the host firewall is 143

References :
[https://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers#Well-known_ports](https://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers#Well-known_ports [https://www.linode.com/docs/email/running-a-mail-server/](https://www.linode.com/docs/email/running-a-mail-server/

8️⃣ You are given the task of modifying iptables to accept TCP packets

on destination ports 6881-6890.** Which rule will accomplish this?

• # iptables -A FORWARD -p tcp --dport 6881:6890 -j ACCEPT
• # iptables -A OUTPUT -p tcp --dport 6881:6890 -j ACCEPT
• # iptables -A INPUT -p tcp --dport 6881:6890 -j ACCEPT
• # iptables -A OUTPUT -p tcp --dport 6881:6890 -j ALLOW

✅ Answer:

Let’s begin with understanding Iptables Basics :

Linux kernel provides an interface to filter both incoming and outgoing traffic packets using tables of packet filters.

Iptables is a command line application and a Linux firewall that you can use to set-up, maintain and inspect these tables. Multiple tables can be defined.

Each table can contain multiple chains. A chain is nothing but a set of rules. Each rule defines what to do with the packet if it matches with that packet.

When the packet is matched, it is given a TARGET. A target can be another chain to match with or one of the following special values:

• ACCEPT: It means the packet will be allowed to pass through.
• DROP: It means that packet will not be allowed to pass through.
• RETURN: It means to skip the current chain and go back to the next rule from the chain it was called in.
• REJECTis used to send back an error packet in response to the matched packet: otherwise it is equivalent to DROPso it is a terminating TARGET, ending rule traversal.]

One of the default tables called filter. Filters table has three chains ( sets of rules).

• INPUT – This chain is used to control incoming packets to the server. You can block/allow connections based on port, protocol or source IP address.
• FORWARD – This chain is used to filter packets that are incoming to the server but are to be forwarded somewhere else.
• OUTPUT – This chain is used to filter packets that are going out from your server.

Here’s the Iptables command formatted with regular options.

iptables -A -i <interface> -p <protocol (tcp/udp) > -s <source> --dport <port no.> -j <target>

-A stands for append. The chain refers to the chain we want to append our rules.
The interface is the network interface on which you want to filter the traffic.
The protocol refers to the networking protocol of packets you want to filter.
You can also specify the port no of the port on which you want to filter the traffic.

We want to accept TCP packets on destination ports 6881-6890

• -A INPUT
• -i <interface>
• -s <source>
• <protocol (tcp/udp) > tcp
• <port no.> 6881:6890
• <target> ACCEPT

Our rule will be iptables -A INPUT -p tcp --dport 6881:6890 -j ACCEPT

References :
[http://ipset.netfilter.org/iptables.man.html](http://ipset.netfilter.org/iptables.man.html https://www.hostinger.com/tutorials/iptables-tutorial

9️⃣ You are helping an intrusion analyst write a Snort rule that will

log any Telnet use within your network.**

log tcp any any <> any 23 (session:printable; sid:;)

What is a valid SID that you can assign the rule?

• 1543845
• 564243
• 125
• 235124

✅ Answer:

The signature id (sid) keyword is used to uniquely identify Snort rules:

• If the number is less than 1,000,000, it is a SourceFire rule (the company that maintains the snort source code). In this case, you can get more information about the rule by going to https://www.snort.org/rule_docs.
  • <100 Reserved for future use
  • 100-999,999 Rules included with the Snort distribution
• If the number is between 1,000,000 and 2,000,000, it is a snort community rule or can be used for local rules. .
• If the number is between 2,000,000 and 3,000,000, it comes from emergingthreats.net and you can get more information at http://doc.emergingthreats.net/bin/view/Main/ (sid number).

So we will use 1543845

References :
http://manual-snort-org.s3-website-us-east-1.amazonaws.com/node31.html#SECTION00444000000000000000 https://security.berkeley.edu/network-intrusion-detection-systems/more-information-about-snort-rules

1️⃣0️⃣** **You are analyzing some unusual HTTP proxy logs with time

stamps between 1439038269.433 and 1439135269.433.** When did some of the events take place?

• Saturday
• December
• 2013
• Tuesday

✅ Answer:

HTTP proxy logs uses the format: <UNIX timestamp>.<Centiseconds> .

Using Unix Timestamp Conversion Tool epochconverter.com :

1439038269.433 > Saturday, August 8, 2015 12:51:09.433 PM GMT

1439135269.433 > Sunday, August 9, 2015 3:47:49.433 PM GMT

Some of the events took place at Saturday .

1️⃣1️⃣ You are reviewing firewall rules and encounter the below

rule.**

# iptables -A INPUT -s -p tcp --dport 23 -j REJECT

What is the purpose of the rule?

• Deny TCP packets for SSH service
• Deny TCP packets for Telnet service
• Deny File Transfer Protocol (FTP) from your network
• Allow port 23 into the INPUT chain

✅ Answer:

let’s analysis the rule based knowledge we now from the answer of question no. 8 :

• -A INPUT This chain is used to control incoming packets to the server. You can block/allow connections based on port, protocol or source IP address.
• -s Source IP address
• -p tcp Networking protocol of packets you want to filter.
• --dport 23 number of the port on which you want to filter the traffic, port 23 used for Telnet protocol.
• -j REJECT is used to send back an error packet in response to the matched packet.

The purpose of this rule > Deny TCP packets for Telnet service.

References :
https://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers

1️⃣2️⃣A security engineer in your organization has just installed and

configured a new IPS.** Which action can an IPS take to prevent an exploit from succeeding?

• Enable bypass mode
• Deploy an antimalware agent
• Deny the connection inline
• Perform a Layer 6 rest

✅ Answer:

Intrusion prevention systems (IPS) control the access to an IT network and protect it from abuse and attack. These systems are designed to monitor intrusion data and take the necessary action to prevent an attack from developing.

The IPS performs real-time packet inspection, deeply inspecting every packet that travels across the network. If any malicious or suspicious packets are detected, the IPS will carry out one of the following actions:

• Terminate the TCP session that has been exploited and block the offending source IP address or user account from accessing any application, target hosts or other network resources unethically.
• Reprogram or reconfigure the firewall to prevent a similar attack occurring in the future.
• Remove or replace any malicious content that remains on the network following an attack. This is done by repackaging payloads, removing header information and removing any infected attachments from file or email servers.

To prevent an exploit from succeeding an IPS can take the following action:

• Deny the connection inline: The deny packet inline action is represented as a dropped packet action in the alert. When a deny connection inline occurs, the IPS also automatically sends a TCP one-way reset, which shows up as a TCP one-way reset sent in the alert.\
• Enable bypass mode : Will make exploit bypass IPS without any action.
• Deploy an antimalware agent: IPS doesn’t deploy antimalware .
• Perform a Layer 6 rest:
  IPS monitors traffic at Layer 3 & Layer 4, And only reset TCP connection.

References :
https://www.cisco.com/c/en/us/td/docs/security/ips/5-1/configuration/guide/cli/cliguide/cliEvAct.html
https://www.forcepoint.com/cyber-edu/intrusion-prevention-system-ips

1️⃣3️⃣ An intrusion analyst in your organization has detected an

attack in which a device’s burned-in address was changed in an attempt to circumvent a switch’s port-security.** What type of attack is being described?

• ARP poisoning
• MAC spoofing
• IP spoofing
• Gratuitous ARP

✅ Answer:

Let us begin by attacks definition:

• ARP poisoning: Address Resolution Protocol poisoning (ARP poisoning) is a form of attack in which an attacker changes the Media Access Control (MAC) address and attacks an Ethernet LAN by changing the target computer’s ARP cache with a forged ARP request and reply packets.

• MAC spoofing: The Media Access Control address, or MAC, or burned-in address (BIA) is virtually etched to the hardware by the manufacturer. Users are not able to change or rewrite the MAC address. But it is possible to mask it on the software side. This masking is what’s referred to as MAC spoofing which hackers use this method of attack to conceal their own identity and imitate another.

• IP spoofing
  IP Spoofing is a technique used to gain unauthorized access to machines, whereby an attacker illicitly impersonates another machine by manipulating IP packets.
  IP Spoofing involves modifying the packet header with a forged (spoofed) source IP address, a checksum, and the order value.

• Gratuitous ARP
  A gratuitous ARP request is an Address Resolution Protocol request packet where the source and destination IP are both set to the IP of the machine issuing the packet and the destination MAC is the broadcast address ff:ff:ff:ff:ff:ff. Ordinarily, no reply packet will occur. A gratuitous ARP reply is a reply to which no request has been made.

The type of attack is being described is MAC spoofing

Ethernet switches via port security provide the opportunity to filter network data traffic on the OSI layer 2.
Once a connection has been established from one segment to another, the intermediate coupling element checks the MAC address of the sender device and matches it with an administrator-created whitelist. If it’s an unknown address, the switch blocks the respective port and stops the communication attempt. But MAC spoofing enables hackers to get around security measures like this.

References:
https://www.techopedia.com/definition/27471/address-resolution-protocol-poisoning-arp-poisoning
https://www.ionos.com/digitalguide/server/know-how/what-is-mac-spoofing/
https://www.iplocation.net/ip-spoofing
https://wiki.wireshark.org/Gratuitous_ARP \

1️⃣4️⃣A network administrator in your organization encountered the

below account in one of your Cisco devices.** Analyze the output and submit the clear-text password as your answer.

DataCenter1(config)#do sh run | inc user

username administrator password 7 08314D1B5C0E550516

✅ Answer:

do sh run This command is show running-configuration command that shows the router, switch, or firewall’s current configuration. The running-configuration is the config that is in the router’s memory.

inc user to list all user accounts

password 7 08314D1B5C0E550516 password is type 7

Cisco password Type 7 is the Cisco proprietary method (Vigenere cypher) and is weak and can easily cracked w/ utilities that are available on the net. using online Cisco Type 7 Passwords Decrypt tool :

• Enter 08314D1B5C0E550516
• the clear-text password pa55w0rd

1️⃣5️⃣ The IPS in your organization is currently using only

signature-based detection.** You recommend adding statistical-based anomaly detection. What is one disadvantage to your recommendation?

• The rule-based file is only updated when new exploits are discovered and tested
• A new “low and slow” attack would not be detected
• Existing anomalous traffic would not be detected
• 0-day attacks would not be detected

✅ Answer:

Statistical anomaly detection takes samples of network traffic at random and compares them to a pre-calculated baseline performance level. When the sample of network traffic activity is outside the parameters of baseline performance, the IPS takes action to handle the situation.

It’s a two-step approach that involves first training a system with data based on statistical modeling, to establish some notion of normality and then use the established profile on real data to flag deviations.

Main disadvantage is Existing anomalous traffic would not be detected because it’s included in our baseline.

References:
https://www.symantec.com/connect/articles/statistical-based-intrusion-detection
https://www.paloaltonetworks.com/cyberpedia/what-is-an-intrusion-prevention-system-ips
https://ebrary.net/26723/computer_science/anomaly-based_detection
https://www.cloudflare.com/learning/ddos/ddos-low-and-slow-attack/

1️⃣6️⃣ As part of a wireless penetration test, you are performing

802.11 traffic reconnaissance with Wireshark.** You notice a packet that contains a management frame (type 0) accompanied by subtype 12 (0x0c) and reason code 4. What has just occurred?

• A De-Authentication between an AP and station due to inactivity
• A station transmitting authentication credentials to an AP
• A station attempting a Reassociation Request with an AP
• An Access Point (AP) beaconing out its Service Set Identifier (SSID)

✅ Answer:

There are 3 types of frames used in the 802.11 layer 2 communications happening over the air which manages and controls the wireless link.

Management frames are used by stations to join and leave a BSS (Basic Service Sets).

Station or AP can send a De-authentication Frame when all communications are terminated (When disassociated, still a station can be authenticated to the cell). It is subtype 12 (0x0c) management frame (type 0).

The 16-bit Reason Code field is part of the frame to indicate what the sender has done incorrectly.

Reason code 4 explanation: Inactivity timer expired and station was disassociated.

A De-Authentication between an AP and station due to inactivity

References:
https://mrncciew.com/2014/10/11/802-11-mgmt-deauth-disassociation-frames/
https://www.oreilly.com/library/view/80211-wireless-networks/0596100523/ch04.html \

1️⃣7️⃣ You need to perform a wireless packet capture on an Aruba Wi-Fi

AP that has been having authentication issues.** Which BSSID should you perform the capture on?

List of WiFi Access Point BSSIDs

• 24:f5:a2:11:f7:6a
• e0:55:3d:21:e5:5a
• 18:64:72:d3:d7:b0
• 00:01:e3:41:bd:6e

✅ Answer:

We will use MAC lookup to displays the name of the company that manufactured each network card, using this online tool https://macvendors.com/ :

• 24:f5:a2:11:f7:6a Belkin International Inc.
• e0:55:3d:21:e5:5a Cisco Meraki
• 18:64:72:d3:d7:b0 Aruba, a Hewlett Packard Enterprise Company
• 00:01:e3:41:bd:6e Siemens AG

The BSSID should perform the capture on 18:64:72:d3:d7:b0

1️⃣8️⃣ An analyst in your organization is attempting to execute the

following tcpdump command.**

# tcpdump -n -i eth0 -w analysis.pcap -C 100 'host 10.3.2.34'

What is her goal?

• Capture 100MB of rotating data to/from host 10.3.2.34
• Capture tcpdump data to/from host 10.3.2.34 every 100 seconds
• Display the first 100 packets in the analysis.pcap file
• Import tcpdump data from a file called analysis.pcap

✅ Answer:

Let’s analysis tcpdump command :

• -n Don’t convert addresses (i.e., host addresses, port numbers, etc.) to names.
• -i eth0 Listen on interface eth0.
• -w analysis.pcap Write the raw packets to file rather than parsing and printing them out.
• -C 100 Before writing a raw packet to a save file, check whether the file is currently larger than file_size and, if so, close the current save file and open a new one.
• 'host 10.3.2.34' dump traffic that’s going to or from this host

Capture 100MB of rotating data to/from host 10.3.2.34

References:
https://www.tcpdump.org/manpages/tcpdump.1.html
https://danielmiessler.com/study/tcpdump/

1️⃣9️⃣ While analyzing a packet capture file, you notice Transmission

Control Protocol (TCP) flag 0x018.** What does that flag signify?

• FIN, ACK
• RST, ACK
• SYN, ACK
• PSH, ACK

✅ Answer :

TCP flags are used within TCP packet transfers to indicate a particular connection state or provide additional information. Therefore, they can be used for troubleshooting purposes or to control how a particular connection is handled.

We need to do Hex conversion on TCP flag to get the semantic meaning of that value

Take the hexadecimal value 0x018 and convert it to binary value 0001 1000

Use the following layout of flags and bits set (0 is off, 1 is on) to get the flag:

|C|E|U|A|P|R|S|F|

|0 0 0 1 1 0 0 0| > PSH-ACK

This flag signify PSH, ACK

References:
http://rapid.web.unc.edu/resources/tcp-flag-key/
https://www.manitonetworks.com/flow-management/2016/10/16/decoding-tcp-flags
https://danielmiessler.com/study/tcpflags/
https://www.aqua-calc.com/convert/number/hexadecimal-to-binary \

2️⃣0️⃣ A junior network administrator in your organization has

requested Cisco Discovery Protocol (CDP) be enabled.** What is a disadvantage to his request?

• The protocol broadcasts authentication credentials of connected network devices
• CDP broadcast messages are sent using the User Datagram Protocol (UDP), which is known to be an unreliable protocol
• Spoofing can be used by an attacker to forge CDP packets and impersonate network devices
• The authentication mechanism used by CDP frames is vulnerable to a man-in-the-middle attack

✅ Answer:

The Cisco Discovery Protocol is a proprietary protocol that all Cisco devices can use by default. CDP discovers other Cisco devices that are directly connected, which makes possible to the devices to auto-configure their connection in some cases, simplifying configuration and connectivity.

CDP messages are not encrypted, This is a moderate security risk as you announce quite detailed information about your system to the network - info about software versions, hardware, and whether some protocols are enabled.

Spoofing can be used by an attacker to forge CDP packets and impersonate network devices

References:
https://howdoesinternetwork.com/2011/cdp-attack

2️⃣1️⃣ Analyze the packet capture network.pcap . What is occurring?

• Host 13.13.13.3 initiated 3 ICMP echo requests to host 13.13.13.1
• Host 13.13.13.1 initiated a Traceroute to host 24.24.24.2
• The network is congested, resulting in a Time-to-live exceeded in transit message
• Host 24.24.24.2 is down, resulting in a port unreachable message

✅ Answer

1. Open network.pcap file in Wireshark :

2. By doing a Basic analysis you will notice the host 13.13.13.1 sending UDP packet to 24.24.24.2 with different TTL.Also replies to source with ICMP message “Time to live exceeded” .

if you expanded packet details Internet Control Message Protocol > Destination Port :

[Expert Info (Chat/Sequence): Possible traceroute: hop #1, attempt #3]

This is a possible traceroute via UDP packets . So how traceroute works ?

• Traceroute sends a UDP packet with a TTL = 1 from the source to destination.
• When the first router receives the UDP packet it reduces the TTL value by 1 (1-1=0) then drop the packet and sends an ICMP message “Time exceeded” to the source. Thus Traceroute makes a list of the router’s address and the time taken for the round-trip.

Host 13.13.13.1 initiated a Traceroute to host 24.24.24.2

References:
https://www.hackingarticles.in/working-of-traceroute-using-wireshark/
https://samsymons.com/blog/how-traceroute-works/

SANS Holiday Hack Challenges : https://holidayhackchallenge.com/ \

Table of contents:

Challenge 1 | Orientation Challenge

• Hint Challenge | The Essential Editor Skills Cranberry Pi terminal challenge
• Main Challenge | Orientation Challenge

Challenge 2 | Directory Browsing

• Hint Challenge | The Name Game Cranberry Pi terminal challenge
• Main Challenge | Directory Browsing

Challenge 3 | de Bruijn Sequences

• Hint Challenge | Lethal ForensicELFication Cranberry Pi terminal challenge
• Main Challenge | de Bruijn Sequences

Challenge 4 | Data Repo Analysis

• Hint Challenge | Stall Mucking Report Cranberry Pi terminal challenge
• Main Challenge | Data Repo Analysis

Challenge 5 | AD Privilege Discovery

• Hint Challenge | The CURLing Master Cranberry Pi terminal challenge
• Main Challenge | AD Privilege Discovery

Challenge 6 | Badge Manipulation

• Hint Challenge | The Yule Log Analysis Cranberry Pi terminal challenge
• Main Challenge | Badge Manipulation

Challenge 7 | HR Incident Response

• Hint Challenge | The Dev Ops Fail Cranberry Pi terminal challenge
• Main Challenge | HR Incident Response

Challenge 8 | Network Traffic Forensics

• Hint Challenge | Python Escape from LA Cranberry Pi terminal challenge
• Main Challenge | Network Traffic Forensics

Challenge 9 | Ransomware Recovery

• Hint Challenge | The Sleigh Bell Lottery Cranberry Pi terminal challenge
• Main Challenge 9.1 | Catch the Malware
• Main Challenge 9.2 | Identify the Domain
• Main Challenge 9.3 | Stop the Malware
• Main Challenge 9.4 | Recover Alabaster’s Password

Challenge 10 | Who Is Behind It All ?

• Main Challenge | Piano Door Lock

Extra Challenge | Google Ventilation challenge