Table des matières

Week1 ..................................................................................................................................................... 3
Stateless Inspection ............................................................................................................................ 3
Stateful Inspection .............................................................................................................................. 5
Firewall Filters- IDS and IPS Systems ................................................................................................. 6
The Difference between IDS and IPS Systems ................................................................................... 9
Network Address Translation ............................................................................................................. 9
An Introduction to Local Area Networks ......................................................................................... 11
Ethernet and LAN - Ethernet Operations .......................................................................................... 16
Ethernet and LAN - Network Devices ................................................................................................ 20
Introduction to Basic Network Routing ............................................................................................. 25
Layer 2 and Layer 3 Network Addressing......................................................................................... 26
Address Resolution Protocol ............................................................................................................ 28
Routers and Routing Tables, Part 1 .................................................................................................. 30
Routers and Routing Tables, Part 2 .................................................................................................. 30
Routers and Routing Tables, Part 3 .................................................................................................. 31
Research Network Vendor Training ................................................................................................. 33
Week 2 .................................................................................................................................................. 33
IP Addressing - The Basics of Binary................................................................................................. 33
IP Address Structure and Network Classes ...................................................................................... 37
IP Protocol and Traffic Routing ........................................................................................................ 39
Introduction to the IPv6 Address Schema ....................................................................................... 44
Application and Transport Protocols UDP and TCP, Part 1 ............................................................. 46
Application and Transport Protocols UDP and TCP, Part 2 ............................................................. 50
DNS and DHCP................................................................................................................................... 56
Syslog Message Logging Protocol ..................................................................................................... 61
Flows and Network Analysis ............................................................................................................ 65
Port Mirroring and Promiscuous Mode ........................................................................................... 66
Next Generation Firewalls - Overview ............................................................................................. 67
NGFW and the OSI Model ................................................................................................................ 69
NGFW Packet Flow Example and NGFW Comparisons ................................................................... 70
Intrusion Detection and Intrusion Prevention Systems .................................................................. 73
High Availability and Clustering ....................................................................................................... 80
Week 3 .................................................................................................................................................. 84
 Data Source Types Part 1 .................................................................................................................. 84
Data Source Types Part 2 .................................................................................................................. 85
Data Model Types ............................................................................................................................. 87
Structured Data................................................................................................................................. 89
Securing the Crown Jewels ............................................................................................................... 92
Leveraging Security Industry Best Practices .................................................................................... 93
Structured Data and Relational Databases ...................................................................................... 93
Anatomy of a Vulnerability Assessment Test Report ...................................................................... 95
Securing Data Sources by Type ........................................................................................................ 95
Securing Databases Wrap Up ........................................................................................................... 97
Data Monitoring ............................................................................................................................... 97
Data Alerts ...................................................................................................................................... 101
Data Activity Reporting ................................................................................................................... 106
Attributes to Include in Logging ..................................................................................................... 111
Failed Access Monitoring................................................................................................................ 115
Failed Access Monitoring................................................................................................................ 117
Suspicious Access Events, Part 1 .................................................................................................... 119
Data Breach Feeds ........................................................................................................................... 122
Data Breach Feeds....................................................................................................................... 122
Week 4 ................................................................................................................................................ 123
Introduction to Injection Flaws ...................................................................................................... 123
OS Command Injection Part 1 ........................................................................................................ 125
OS Command Injection Part 2 ........................................................................................................ 128
OS Command Injection Part 3 ........................................................................................................ 129
SQL Injection Part 1 ........................................................................................................................ 131
SQL Injection Part 2 ........................................................................................................................ 133
Other Types of Injection ................................................................................................................. 137
Additional Resources ...................................................................................................................... 140
Additional Resources ................................................................................................................... 140
OWASP Cheat Sheets ................................................................................................................. 141
pentestmonkey .............................................................................................................................. 141
Database Hacker's Handbook: Defending Database Servers .......................................................... 141
Software Vulnerabilities .................................................................................................................. 141
Common Attacks ............................................................................................................................ 141
Prevention Measures ..................................................................................................................... 142
Week1

Stateless Inspection
Stateful Inspection
Firewall Filters- IDS and IPS Systems
The Difference between IDS and IPS Systems

Network Address Translation

An Introduction to Local Area Networks
Ethernet and LAN - Ethernet Operations
Ethernet and LAN - Network Devices
Introduction to Basic Network Routing
Layer 2 and Layer 3 Network Addressing
Address Resolution Protocol
Routers and Routing Tables, Part 1

Routers and Routing Tables, Part 2

Routers and Routing Tables, Part 3
Research Network Vendor Training
Check out a few of the online training resources available for the following network vendors.

Cisco

https://www.cisco.com/c/en/us/training-events/training-certifications/training-catalog/course-
selector.html

Juniper Networks

https://www.juniper.net/us/en/training/

Palo Alto Networks

https://www.paloaltonetworks.com/services/education

Week 2

IP Addressing - The Basics of Binary

IP Address Structure and Network Classes
IP Protocol and Traffic Routing
Introduction to the IPv6 Address Schema
Application and Transport Protocols UDP and TCP, Part 1
Application and Transport Protocols UDP and TCP, Part 2
DNS and DHCP
Syslog Message Logging Protocol
Flows and Network Analysis
Port Mirroring and Promiscuous Mode
Next Generation Firewalls - Overview
NGFW and the OSI Model
NGFW Packet Flow Example and NGFW Comparisons
Intrusion Detection and Intrusion Prevention Systems
High Availability and Clustering
 Week 3

Data Source Types Part 1

Data Source Types Part 2
Data Model Types
Structured Data
Securing the Crown Jewels
Leveraging Security Industry Best Practices

Structured Data and Relational Databases

Anatomy of a Vulnerability Assessment Test Report

Securing Data Sources by Type

Securing Databases Wrap Up

Data Monitoring
Data Alerts
Data Activity Reporting
Attributes to Include in Logging
Failed Access Monitoring
Failed Access Monitoring
Suspicious Access Events, Part 1
Data Breach Feeds
Data Breach Feeds
In today's environment there are multiple data breaches that occur every day. As an analyst you
will want to keep track of what is going on in the world every day.

Data Breaches reports on current breaches from Malware to Data exposures

DataBreaches.net

Read the very latest data breach news: https://www.databreaches.net/news/

Search among many thousands of data breach cases by breach type, industry, etc.:
https://www.databreaches.net/?s=case+studies

Learn about data breach notification laws: https://www.databreaches.net/state-breach-

notification-laws/

Bleeping Computer reports news on current breaches and threats

BleepingComputer.com

Think using a VPN will guaranty your security? This article from 2021 might have you thinking
again.

https://www.bleepingcomputer.com/news/security/hackers-leak-passwords-for-500-000-fortinet-
vpn-accounts/

IBM X-Force Exchange current, real-time world threat map

https://exchange.xforce.ibmcloud.com/activity/map

Click on any IP address at the top of the map and you will see details of the threat.

Week 4

Introduction to Injection Flaws

OS Command Injection Part 1
OS Command Injection Part 2
OS Command Injection Part 3
SQL Injection Part 1
SQL Injection Part 2
Other Types of Injection
Additional Resources
Additional Resources
This course is the beginning of your journey. In Cybersecurity there is no way to know everything
about Databases or Networking and their vulnerabilities. You need to know where to find
additional information and detailed steps to safeguard data. Here are some additional resources
that are important to be aware of and explore as you are developing your Cybersecurity skills.
OWASP Cheat Sheets
Injection Flaws https://owasp.org/www-community/Injection_Flaws

OS Command Injection https://owasp.org/www-community/attacks/Command_Injection

SQL Injection https://owasp.org/www-community/attacks/SQL_Injection

LDAP Injection
https://cheatsheetseries.owasp.org/cheatsheets/LDAP_Injection_Prevention_Cheat_Sheet.html

pentestmonkey
MSSQL injection cheat sheet: http://pentestmonkey.net/cheat-sheet/sql-injection/mssql-sql-
injection-cheat-sheet

Oracle injection cheat sheet: http://pentestmonkey.net/cheat-sheet/sql-injection/oracle-sql-

injection-cheat-sheet

DB2 injection cheat sheet: http://pentestmonkey.net/cheat-sheet/sql-injection/db2-sql-injection-

cheat-sheet

Postgres injection cheat sheet: http://pentestmonkey.net/cheat-sheet/sql-injection/postgres-sql-

injection-cheat-sheet

MySQL injection cheat sheet: http://pentestmonkey.net/cheat-sheet/sql-injection/mysql-sql-

injection-cheat-sheet The

Database Hacker's Handbook: Defending Database Servers

You can find this book at different retailers such as Amazon.com.

Software Vulnerabilities
A vulnerability is a potential weakness that someone can exploit in a system, network, or
application. When targeting applications, attackers commonly exploit the following vulnerabilities:

• Broken access control or authentication

• Unencrypted data
• Use of default passwords or configurations
• Unpatched flaws
• Unused pages

By exploiting these vulnerabilities, attackers can circumvent an application’s security to steal

protected information, damage systems, or disable services.

Common Attacks
The following list describes some of the most common attacks on applications:

• SQL injection involves placing malicious code into a Structured Query Language (SQL)
statement through a web page. The attacker typically uses a user input request, such as
a username, to enter an SQL statement that will run on your database.
• Cross-site scripting (XSS) is an injection in which the attacker uses a web application to
send a browser-side script to another user. Because the user’s browser recognizes the
script as coming from a trusted site, the script runs.
 • File inclusion targets poorly written web applications that allow users to upload files
without appropriate validation. The attacker tricks the web application into showing or
running files that should not be publicly visible or available.
• Buffer overflow occurs when the amount of data sent exceeds what the memory buffer
can handle. If the application is not properly secured, a knowledgeable attacker can use a
buffer overflow attack to crash the system. The attacker could even overwrite existing
executable code with their own to take control of the system.

Prevention Measures
To defend against common attacks, developers should build security into each step of the
software development life cycle (SDLC). They should consider and plan for potential security
threats early on and test, scan, audit, and review code throughout development. Plus, various
tools can automate security checks through nearly every stage of development, freeing
developers to focus on other tasks.

Developers should also limit the number of applications and pages the product has. Extra pages,
documentation, and features can increase the attack surface for attackers to target.

Security monitoring and logging practices help teams identify login, validation, and access control
errors before a potential attacker can do damage. Personnel can respond quickly to patch the
application if needed.

Another critical defense against common attacks is vulnerability scans. These scans identify
vulnerabilities in the application and from libraries (collections of reusable code) on which the
application depends. A standard type of vulnerability scan is a penetration test. A penetration test
(pentest) simulates real hacking techniques to find application or system vulnerabilities that
attackers can exploit. Organizations should perform pentesting regularly. Some useful pentesting
tools for identifying web applications include OWASP ZAP, Comodo, and Vega.