Snubbie Skill Assessment

Courtesy of American Fighting Revolver on Facebook, I came across this Snub Skill Assessment from The Shooting Wire.

In connection with a shot timer, this is a nice way to see how competent you are with a snubbie revolver. Methinks it would work as well with pocket autos like the Ruger LCP and Keltec P32.

The assessment uses NRA B8 centers for targets. You can download a couple variants of the B8 center from Targets4Free, here.

Many trainers are now using B8 centers in classes, because it approximates the size of where you want to place shots on an adult male in a defensive shooting encounter.

Passed the GIAC GCIH Certification Exam Today

Today I passed the GIAC Certified Incident Handler (GCIH) exam. I previously reviewed the SANS Course, SEC504, which is the prep class for this exam.

In my previous career I was an attorney. After switching into IT, I took several certifications including COMPTIA's A+, Network+, and Linux+, along with getting my MCSE in Windows NT4 (yeah, I'm old). The GCIH exam was the most difficult test I've taken since the Pennsylvania Bar Exam.

The test consists of 106 multiple choice questions, about 10 or 11 of which require the use of a "CyberLive" virtual machine to perform a task. The test is open book with a minimum passing score of 70%, and there's a four hour time limit. I used up about 3 hours, with one very brief bathroom break.

If you search online for tips on passing GIAC exams, the one common theme is that you need to prepare a really good index of the course materials. SANS actually includes a course material index in their downloadable materials but you want to create your own, because the primary value of the index is the absorbtion of knowledge you get while creating it.

The way I built my index was as follows:

1. Created a MS Excel spreadsheet with one tab for each of the five course books, plus a "Combined" tab.
2. I then went through each book and indexed concepts and terms.
3. Next, I assigned a different color to each book.
4. Copied the contents of each book's tab over to the Combined tab.
5. Used the Excel Sort function to sort the entries alphabetically.
6. Copied this sorted table into MS Word and printed it.
7. I put the printed index along with a bunch of cheat sheets into a 1/2" 3-ring binder.

I also used color-coded Post-It notes to make tabs for key sections in each book. The colors of the Post-Its matched the colors in my index. So, for example if I looked in the index for a term and it was color-coded yellow, I knew immediately to grab the book with yellow Post-Its sticking out.

Overall, I think I reviewed the SEC504 books three times, and did the labs at least twice each.  Another thing I did was sign up for a TryHackMe.com account and worked through some exercises relating to topics that the GIAC practice tests showed needed more attention from me, especially Metasploit and SQL injection. 

I'm currently working my way through TryHackMe's Junior Penetration Tester learning path, but that'll be the subject for another post.

SANS SEC504: Hacker Tools, Techniques, and Incident Handling Course Review

Yesterday I finished up the SANS SEC504 Hacker Tools, Techniques, and Incident Handling training course. This was paid for by my employer as part of an internal cybersecurity training program that I'm in.

I first learned about the SANS Institute shortly after changing careers into IT. However, they've always been too expensive for me to take if I had to pay out of pocket. When I first learned of them a 5 or 6 day class cost around $2500. Nowadays, they are north of $8000 and it's another $949 if you want to take the related certification exam. Way too rich for my blood.

Anyway, the agenda for the course I took was as follows:

• 9/26 - Incident Response
• 9/27 - Recon, Scanning, and Enumeration Attacks
• 9/28 - Password and Access Attacks
• 9/29 - Public-Facing and Drive-By Attacks
• 9/30 - Evasion and Post-Exploitation Attacks
• 10/1 - Capture the Flag event capstone

On Monday class ran from 0830 to 1915 but I tapped out at 1830. By that point we were looking at bonus material related to Linux and PowerShell, both of which I'll go through again in preparation for the certification exam.

Tuesday through Friday class ran from 0900 through about 1730, and the CTF event on Saturday was 0900 to about 1500. Of course, we got breaks in the morning and afternoon, and for lunch.

Although the days were long and by Thursday I was feeling it, they went by quickly.

The session I took was presented live at SANS Baltimore made available for remote students via Zoom and Slack for text chatting. This approach worked extremely well except for an hour or so on Thursday afternoon when the hotel hosting the convention lost its Internet connection, and they had to fail over to a backup connection. Rather than losing any productive time, we just worked on labs.

I've been lucky enough to take a lot of training classes over the years, paid for by my employer. Vendors have included Nortel (yeah, I'm old), Alcatel, Red Hat, and Cisco, among others. I have to say this was probably the best out of all of them.

The instructor, Jon Gorenflow was knowledgeable and engaging. The material was well organized and interesting, and reinforced with a large number of labs.

Labs were done using one or both of two virtual machines. One was Slingshot Linux, which is a hacking-oriented distro based on Ubuntu 18.04. The other was a Windows 10 Enterprise VM for which SANS arranged a four-month product key.

I ran the VMs using VMware Fusion on my work MacBook Pro. You can use Fusion or VMware Workstation to run the VMs. My Mac had plenty of power to run both VMs simultaneously, even after I increased the RAM on the Windows VM to 6GB from the default 4GB.

Note that if you plan to take this or other SANS classes, you need a computer with an Intel CPU. I would not have been able to run the VMs on my personal MacBook Air which has an M1 ARM CPU, even though otherwise it has plenty of horsepower to do so.

If you take a SANS course, do not use a laptop with less than 16 GB of RAM, a 512 GB solid state drive, and an Intel i5 CPU with an i7 being better. (I'm sure an AMD processor would be fine but I can't speak to specs.) If you can get a larger SSD it would be better. The SANS VMs and course materials take up a lot of space.

Your laptop's host OS should be Windows, Linux, or macOS if you have an Intel Mac. You'll need administrative rights on the machine and be able to access the network. If you're taking the class remotely and can connect to Ethernet that's better than WiFi.

My original plan was to run the VMs on my Intel NUC which runs the free version of VMware ESXi 7U3, and access their graphical desktops via NoMachine and Remote Desktop Protocol. However, I ran into a problem with the Windows VM. Because they were built on VMware Workstation they wouldn't boot without first converting their virtual disks into ESXi format*. That's not a problem with Linux but on Windows it breaks Windows activation because it sees that the hardware changed. I probably could have run the Windows VM with the OS not activated but I did not want to chance having problems during the class, so I just ran them on my laptop.

However, I learned in the class that running the VMs on a headless ESXi box would not have been optimal anyway. The VMs are configured to use a private network for most of the class, so that they cannot access or be accessed from other hosts on your LAN. This is done because they are in deliberately insecure configurations, especially the Windows VM.

Saturday's capture the flag event was a lot of fun and helped tie everything together. We broke up the class into teams of four people and accessed the CTF environment through a VPN from the Slingshot Linux VM, which was reconfigured to access the network for Internet access.

After the CTF event completed the instructor did a walkthrough, taking a bit of a different approach to hacking into the systems than the CTF instructions presented.

Two of the tools we learned about during the course that I plan to do deeper dives into were Metasploit and netcat. I've used the latter just a little but have only scratched the surface.

As you'd expect, we used nmap quite a bit. This is another tool I use regularly whether to do ping sweeps or for port scanning.

Another tool which we got exposure to is an old school UNIX/Linux utility: awk. We used it a few times in the class to extract useful fields such as email addresses and user names from text files and .csv files. I decided it would be good for me to get a copy of O'Reilly's sed & awk Pocket Reference.

As a long time Linux user, I'm familiar programs that can display the contents of a text file, such as less, more, and cat. The instructor showed us a way to use cat that I've never seen before.

Here's a demonstation done on my MacBook Air, which includes cat as a command line utility (macOS is UNIX under the hood). First, I'll create an empty file using touch, then add text to it using cat and a shell redirect:

Davids-Air:Documents dave$ touch foo.txt

Davids-Air:Documents dave$ cat > foo.txt

Hello

Hello

Hello

^C

Davids-Air:Documents dave$ 

Davids-Air:Documents dave$ 

Davids-Air:Documents dave$ cat foo.txt

Hello

Hello

Hello

Note how by issuing the cat command and immediately using the redirect ( > ), it presents you with a way to input text until you hit CTRL-C. I then used cat to show the contents of foo.txt on STDOUT.

Neat!

Another tool we learned about was RITA from Active Countermeasures for analyzing network traffic logs collected by Zeek. When used properly, this combination should help you spot network traffic indicating naughty behavior.

I've experimented with Zeek a bit and it's a part of Security Onion, which I've used on the job. To learn more about RITA I built a Debian 11 VM** on my Nuc running both of them. I may get this running on the networks I help to support.

To continue my learning I grabbed a copy of Metasploitable, another deliberately vulnerable Linux VM. As with the class VMs, it was built on VMware Workstation so you'll need to convert the disk to ESXi format if you want to run it on that platform.

For the past few years cybersecurity has been an increasingly important part of my job. It's also a rapidly growing field. I'm looking forward to immediately putting to use much of the info I learned SEC504.

* For this you need to ssh into your ESXi host and use vmkfstools to clone the disk. An overview of how to do so can be found here: https://thunderysteak.github.io/workstation-vmdk-2-esxi

** Most of the VMs I've built in the current iteration of my home lab have been based on Debian Linux 11. I find it easy to create a stripped-down VM and the dependency resolution is excellent. Ubuntu Linux is based on Debian but for my use it doesn't really add much value, so I go right to the source, so to speak.

Gun Training in Nasty Weather

Over on gundigest.com, Dave Morelli has an article in which he advocates gun training in bad weather.

I see nothing in the article with which I disagree. The author isn't advocating going out in crappy weather to learn the fundamentals. He's telling you to get out there in sub-optimal conditions to learn what your gun does -- and what you do -- when it's windy, rainy, or cold.

Based on my own experience in shooting practical rifle matches at my club, operating your gun in extreme weather conditions stresses the shooter in ways not experienced when it's 75 and sunny. If it's humid, lenses (both eye glasses and scope lenses when you accidentally breathe on them) get fogged. If it's snowing ice can form on your gun while you're waiting to shoot, rendering it slippery. When it's hot, your sweat gets in your eyes and on the gun.

Or step in a 10" deep puddle of ice water while your waterproof boots are only 8" high, then go on to finish the stage.

In cold weather your clothing limits your movement and makes working fine controls more difficult.

Get the basics down in good weather. Then go see what happens when it's shitty out.

It was about 12 degrees out when this pic of me was taken back in January.

Under stress you will default to the level of your training. If you train easy, you will fail get life gets hard.

Red Hat Training

The Red Hat Linux training class I took this week wrapped up early on Friday, allowing me to leave and work from home the rest of the day.  I'm currently on the back porch with Rohan, a glass of water (booze will wait for later), and an H. Uppman Vintage Cameroon cigar.  May as well take advantage of a beautiful Fall day, before they're gone.  ;-)

Overall the class -- Guru Labs GL250 Enterprise Linux System Administration was pretty good.  It could have been a bit more organized the first day or two.  E.g., the server in room needed the full Fedora Core 6 repository setup but otherwise it went well.

The exercises in our lab book were geared towards Red Hat Enterprise Linux 5 or Fedora Core 6.  This was my first time working with FC and it seems decent (I am aware that FC9 is the current release).

I'm considering going for RHCT and maybe RHCE certification.  I figure with the current state of the economy the more certs I have the better.  That means I'll need to setup a lab here at the house.  What I may do is rebuild Bagend -- currently sitting sans hard disk -- with additional RAM and a bigger disk than I had in it, loading CentOS 5.2, and installing a couple of different virtual Linux boxes under VirtualBox.  Earlier this week I did setup FC6 in VirtualBox on Rohan but for the purposes of lab exercises more machines would be beneficial.  Since I have limited physical space virtualized servers makes the most sense for me.

Bagend, which I build back in the Fall of 2004, currently has 1 GB of RAM, an AlthonXP at around 2 GHz, and had an 80 GB disk in it.  I have some old IDE disks I could add for additional space but recently, Microcenter advertised a 1 terabyte drive for about $129.  What I'll probably do is put the 80 GB disk back in and leave its XP Pro install alone, then add a large secondary disk and install CentOS on that, so I have a dual boot setup.  Then I'll add another gig or so of RAM and it should be good to go.

Signed up for Red Hat Training

I haven't taken any professional development training in a little while. I'd tried to get into my employer's Intro to Solaris course a couple time last year, but wasn't successful. In going through the training calendar on our intranet, I saw that we're having RHCT training in October. With my manager's approval, I signed up.

The course is scheduled to run in two sessions, a 5-day and a 3-day. I figure it'll fill in some holes in my personal Linux knowledge base, after which I should be ready to take the certification exam. I haven't picked up any new certs since 2001, so this will be a good thing.

Training this week

This week I'm fortunate to be in training. Interconnecting Cisco Network Devices, to be precise. Regular readers may recall that I took the prerequisite Introduction to CCNA course last summer. So, hopefully I'll be taking the CCNA exam sometime in the next month and a half or so.

So far the class is pretty good. We're using the CCNA Self-Study ICND book from Cisco Press, along with the Boson Netsim software, rather than having a lab setup with real equipment. This would be too expensive, as this course is being run in-house. The Netsim app has its quirks but it seems good. All the students are getting a Boson license, as well as a Transcender test prep software license, so they can install both programs on their home PC. So it's a good thing I haven't blown away XP on Bagend yet. {grin}