测试与安全技能

Inspect suspicious PDFs without opening them in a document viewer. Use peepdf, pdfid, and pdf-parser to examine internal objects, extract embedded code and files, and report threat indicators such as URLs and hashes.

中文简介正在准备中。当前显示英语简介。

• Triaging suspicious PDF email attachments
• Investigating PDF exploit documents
• Extracting embedded JavaScript and files

Create disk images for investigations using dd or dcfldd on Linux. The workflow covers write protection, bit-for-bit copying, hash checks to verify integrity, and documentation of the acquisition process.

中文简介正在准备中。当前显示英语简介。

• Preserving a suspect drive before investigation
• Creating evidence copies of USB devices or memory cards
• Verifying that a disk image matches its source

Investigate Linux kernel rootkits, malware that hides inside the operating system's core. Analyze memory dumps with Volatility3, compare system views, and run live scans to identify hidden modules, altered calls, and suspicious inconsistencies.

中文简介正在准备中。当前显示英语简介。

• Investigate suspected Linux rootkit infections
• Find hidden kernel modules in memory dumps
• Compare module lists for signs of concealment

Analyze memory dumps with Volatility3 to find heap spraying, an attack that fills memory with attacker-controlled data. Examine suspicious allocations and repeated byte patterns, extract suspicious code, and report affected processes and memory regions in JSON.

中文简介正在准备中。当前显示英语简介。

• Investigating suspected heap spraying in a memory dump
• Extracting suspicious code from memory
• Organizing evidence for detection rule development

Review Active Directory permissions with ldap3, a Python library for directory queries. Identify excessive access granted to non-administrative accounts, explain potential privilege escalation paths, and produce a JSON report with affected objects and remediation recommendations.

中文简介正在准备中。当前显示英语简介。

• Auditing excessive Active Directory permissions
• Investigating privilege escalation paths from ordinary accounts
• Reporting affected objects and permission remediation recommendations

Analyze access logs from AWS API Gateway, Kong, and Nginx with pandas, a Python data analysis library. Examine resource access patterns, authentication failures, and suspicious requests to investigate API abuse and inform detection rules.

中文简介正在准备中。当前显示英语简介。

• Investigating sequential access to resource IDs
• Examining spikes in authentication failures
• Checking for rate limit bypass and injection attempts

Examine captured network traffic for hidden malware communications in DNS, ICMP, and HTTP. Analyze domain patterns, packet sizes, and traffic frequency to identify suspicious channels used for remote control or data theft.

中文简介正在准备中。当前显示英语简介。

• Investigating suspicious DNS, ICMP, or HTTP traffic
• Hunting for hidden malware control channels in packet captures
• Assessing possible data theft through unusual network traffic

Examine Linux authentication logs, shell history, SSH keys, scheduled tasks, and system settings to investigate a compromise. Help reconstruct activity, identify ways attackers maintain access, and document suspicious accounts, files, and configuration changes.

中文简介正在准备中。当前显示英语简介。

• Investigating a potentially compromised Linux server
• Finding mechanisms that maintain unauthorized access
• Tracing user activity through logs and command history

Investigate compromised Docker containers by preserving evidence and examining image layers, logs, file changes, and host settings. Summarize suspicious activity, security configuration issues, and vulnerability findings to support incident response.

中文简介正在准备中。当前显示英语简介。

• Investigating a compromised application container
• Examining a suspicious image from a registry
• Checking evidence of a container escape attempt

Prepare for CMMC Level 2, a cybersecurity certification for defense contractors. Define the systems handling controlled information, review security requirements, calculate the SPRS assessment score, and organize remediation plans and evidence into a readiness report.

中文简介正在准备中。当前显示英语简介。

• Define the assessment scope for systems handling controlled information
• Calculate an SPRS score and prioritize unmet security requirements
• Prepare security plans, remediation milestones, and assessment evidence

Assess Shadow Credentials account takeover during authorized Active Directory testing. Examine permissions that allow public key registration, validate authentication without a password reset, and document credential cleanup, detection opportunities, and access control changes needed for remediation.

中文简介正在准备中。当前显示英语简介。

• Assessing risky permissions identified in BloodHound
• Validating account takeover without resetting a password
• Generating directory change records during security exercises

Analyze Go malware binaries in Ghidra by extracting build metadata, function names, dependencies, and relevant strings. Use GoResolver to help recover obscured names and organize functions so analysts can focus their reverse engineering work.

中文简介正在准备中。当前显示英语简介。

• Investigating the structure of a Go malware sample
• Recovering function names from stripped or obfuscated binaries
• Identifying embedded Go modules and dependencies

Map threat groups’ documented attack techniques in MITRE ATT&CK Navigator. Creates visual layers and heatmaps, compares groups, and highlights techniques missing from existing detection coverage to support security reporting and decisions about detection priorities.

中文简介正在准备中。当前显示英语简介。

• Visualizing a threat group's attack techniques
• Comparing techniques shared by multiple threat groups
• Finding gaps in existing detection coverage

Use Wireshark and tshark to capture and inspect network packets, the small units of network communication. Investigate suspicious connections and protocol problems, extract transferred files, and export evidence and summaries for incident investigations.

中文简介正在准备中。当前显示英语简介。

• Investigating suspected intrusions or data leaks
• Diagnosing retransmissions and DNS failures
• Checking traffic against firewall and IDS rules

Analyze suspicious Linux ELF executables through file inspection, runtime tracing, and reverse engineering. Identify malware behavior, network destinations, and persistence mechanisms, then organize findings and indicators for investigations involving servers, containers, or cloud infrastructure.

中文简介正在准备中。当前显示英语简介。

• Triaging suspicious executables on Linux servers
• Investigating suspected cryptominers
• Analyzing malware found in containers

Investigate suspicious URLs with URLScan.io by reviewing screenshots, redirects, page content, and network requests. Extract domains, IP addresses, and file hashes as indicators of compromise, then compare findings with threat intelligence sources.

中文简介正在准备中。当前显示英语简介。

• Investigating suspicious links in emails
• Checking pages for brand impersonation and credential forms
• Tracing redirects and extracting domains, IPs, and hashes

Inspect suspicious Android APK files without running them. Analyze permissions, app components, suspicious code patterns, and network indicators, then produce a JSON risk report to support malware triage and detection rule development.

中文简介正在准备中。当前显示英语简介。

• Triage suspicious APK files without running them
• Inspect dangerous permission combinations and suspicious API calls
• Extract network indicators for malware detection rules

Investigate suspicious IP addresses, domains, URLs, file hashes, and email artifacts using multiple threat intelligence sources. Assess confidence that each indicator is malicious, check links to known campaigns, and document evidence for blocking, monitoring, or allowing it.

中文简介正在准备中。当前显示英语简介。

• Triaging indicators from phishing emails
• Investigating suspicious IP addresses and URLs in alerts
• Assessing bulk indicators before adding them to blocklists

Analyze DNS query logs for signs of hidden data transfers and attacker command channels. This skill uses unusual name lengths, randomness, and traffic volumes, then correlates findings with endpoint processes and estimates possible data loss.

中文简介正在准备中。当前显示英语简介。

• Investigating suspected data theft through DNS
• Finding algorithmically generated domains used by malware
• Reviewing hosts with unusually high DNS query volumes

Compare evidence from cyber operations to assess which attacker may be responsible. Weigh shared infrastructure, attack methods, malware similarities, timing, and language clues against competing explanations, then report attribution findings with justified confidence levels.

中文简介正在准备中。当前显示英语简介。

• Assessing possible attackers during an incident investigation
• Comparing infrastructure and attack methods across campaigns
• Evaluating conflicting evidence against multiple hypotheses

Analyze NTFS file records and change journals to investigate deleted files on Windows disks. Recover surviving metadata and content where possible, reconstruct file activity timelines, and compare timestamps for signs of deliberate manipulation.

中文简介正在准备中。当前显示英语简介。

• Recovering names and paths of deleted files
• Assessing whether deleted file content can be recovered
• Reconstructing file creation, modification, and deletion timelines

Assess exposure of Windows secrets protected by DPAPI, the operating system’s data protection service, during authorized security tests. Guide examination and decryption of saved credentials and browser data using available user sessions, credentials, or backup keys.

中文简介正在准备中。当前显示英语简介。

• Assessing saved credential exposure in authorized tests
• Examining collected DPAPI files offline
• Reviewing protected browser and RDP credentials

Map intrusion evidence to the seven stages of the Lockheed Martin Cyber Kill Chain, a model of attack progression. Show where defenses worked or missed activity, and recommend prioritized controls that could interrupt attacks earlier.

中文简介正在准备中。当前显示英语简介。

• Mapping attack progression after an incident
• Finding detection gaps at each attack stage
• Planning layered defenses to stop attacks earlier

Review Cuckoo or AnyRun behavior reports for signs that malware is avoiding an analysis environment. Identify timing checks, virtual machine detection, and user activity checks, then produce a JSON report with evidence, technique mappings, and an evasion sophistication score.

中文简介正在准备中。当前显示英语简介。

• Investigating malware that stays inactive in a sandbox
• Reviewing behavior reports for analysis evasion
• Developing detections for anti-analysis behavior