DOCSEARCHbyAlgolia
Submit Docs

Casos Prácticos de Hardening y Ciberseguridad

website·Indexed 29 days ago

https://sergioausach.github.io

Practical guides and case studies on server hardening, focusing on security reinforcement using SSH, Fail2Ban, UFW, and network scanning tools like Nmap and Wireshark.

Tokens
745
Snippets
7
Records
11
Agent score
25%

What's inside Casos Prácticos

  1. Harden SSH on Linux servers

    Implement security measures on Linux servers to mitigate brute-force attacks. This includes hardening the SSH configuration and deploying automatic blocking systems such as Fail2Ban.
    # Install Fail2Ban to mitigate SSH brute force
sudo apt-get install fail2ban

  2. Conduct web application pentesting

    Evaluate security in web applications within controlled environments. Focus on identifying and exploiting common vulnerabilities, such as SQL Injection (SQLi), to understand the impact of validation failures. Recommended tools: Nmap, Burp Suite.

  3. Perform network reconnaissance and enumeration

    Analyze networks by enumerating active services, identifying hosts, and capturing traffic to understand the attack surface in internal environments. Recommended tools: Nmap, Wireshark.

  4. Perform RAM memory analysis for digital forensics

    Investigate malicious processes in volatile memory (RAM) using digital forensic techniques to identify indicators of compromise (IoC) and suspicious behavior in compromised systems. Recommended tool: Volatility.
    # Example usage of Volatility for memory analysis
volatility -f memory.dmp --profile=ProfileName windows.pslist

  5. Perform disk forensic analysis

    Analyze evidence on storage systems by inspecting disks and recovering relevant information for security incident investigations. Recommended tools: Autopsy, FTK Imager.

  6. Analyze authentication and firewall logs

    Monitor SSH login attempts and firewall activity by inspecting /var/log/auth.log for authentication failures and /var/log/syslog for UFW-blocked connection attempts.
    # Filter SSH related events in auth.log
cat /var/log/auth.log | grep ssh

# View the last 3 entries of auth.log to check for recent failures
tail -n 3 /var/log/auth.log

# Filter UFW related events in syslog
cat /var/log/syslog | grep UFW

  7. Implement SIEM monitoring with Splunk and Wazuh

    Configure a monitoring and event correlation environment by integrating SIEM tools for centralized threat detection and log analysis using Splunk and Wazuh.

  11. Scan server ports and services using Nmap

    Use Nmap to identify open ports, running services, and their versions on a target server. This is useful for auditing the attack surface before and after applying firewall rules.
    # Basic scan to list open ports, services, and protocols
sudo nmap -sS -Pn <target_ip>

# Version detection scan to identify specific service versions for vulnerability assessment
sudo nmap -sV <target_ip>