CyberSec First Responder (CFR-310)

Explore exploitation frameworks that speed up testing through modular, point‑and‑click automation, using tools like core impact, canvas, beef, and metasploit to validate vulnerabilities and obtain shells.

Explore how client side attacks exploit vulnerable apps and browsers, highlighting cross site scripting, reflected and DOM based flaws, with hands-on DVWA and Burp Suite practice.

Learn how server-side attacks target web and database servers, including stored cross site scripting, SQL injection, and command injection, with practical demos on a guest book app.

Assess mobile threats in a bring-your-own-device world by securing unpatched, insecure devices, enforcing encryption, and defending against malicious apps, smishing, and data exposure.

Explore common web attacks including cross-site request forgery, sql injection, directory traversal, local and remote file inclusion, and command injection, with hands-on demonstrations of session exploitation and reverse shells.

Demonstrate wireless attack concepts, cracking WEP and WPA/WPA2 with aircrack-ng and Fern, and explain client and infrastructure attacks like deauthentication, man-in-the-middle, evil twin.

Explore social engineering tactics like phishing, spear phishing, whaling, baiting, quid pro quo, shoulder surfing, and tailgating, and learn how attackers exploit human weaknesses to breach security.

Explore man-in-the-middle attacks, including ARP poisoning, ICMP redirects, DHCP spoofing, DNS and NBNS poisoning, WPAD, Responder demos, and session hijacking via cross-site scripting, with mitigation insights.

Explore malware concepts from trojan horses and malvertisment to viruses, worms, ransomware, and rootkits. Gain defensive insights and forensics practices for cyber incident response.

Analyze out-of-band attacks, from supply-chain and side-channel intrusions to watering hole infections, with examples like the Department of Labor and Forbes breaches.

Explore denial of service concepts from ddos to resource exhaustion with real-world examples. Learn how low orbit ion cannon and hping3 generate traffic and cause outages.

Explore command and control concepts, including botnets, C2 servers, stealth channels like IRC, DNS, and ICMP, plus hands-on demos of icmpsh and Pupy to illustrate how attackers manage compromised hosts.

Explore data exfiltration from command and control to covertly steal sensitive data, using covert channels, encryption, and stealthy cloud storage like Dropbox or Google Drive.

Explore pivoting and lateral movement from a compromised host by using SSH tunnels, VPNs, and proxy chains, plus routing tables to access internal networks.

Explore common lateral movement techniques in Windows networks, including pass the hash, golden tickets, PS exec, WMIC, and RDP, to demonstrate attacker pivoting across hosts.

Learn how persistence maintains access through rootkits, backdoors, rogue accounts, and logic bombs, including hardware backdoors like land turtle and software backdoors such as vsftpd.

Explore anti-forensics techniques that obstruct investigations, including memory-resident malware, buffer-overflow tricks against forensic tools, virtual machine and sandbox detection, alternate data streams, and file shredding.

Cover your tracks by clearing or selectively deleting or modifying log files such as /var/log, Apache logs, and auth logs, using tools like shred to hinder incident response and forensics.

Stay current on the threat landscape with threat research and incident prep, using security intel and trend data to prepare proactively against container threats.

Analyze network data sources for incident response by inspecting configuration files, log files, wireless logs, and device state data, then sniff traffic with Wireshark to detect indicators of compromise.

Learn to collect and analyze host logs to establish baselines and spot anomalies, using authentication, SSH, HTTP access, system and application logs, and forwarding to a syslog server.

Detect anomalies through real-time data analysis by collecting and validating logs, using agent-based or agentless methods, and establishing actionable alerts and threat hunting.

Identify indicators of compromise by examining hosts for anomalies—registry changes, unknown ports (dns port 53), suspicious startup items, new or admin accounts, off-hours activity, and unusual network traffic.

Master log analysis with siem and linux windows tools, learning grip, cut, diff, find, and event viewer to extract actionable security insights.

Implement containment through whitelisting, blacklisting, firewalls, and port blocking to stop breach spread. Segment networks, filter web content, and deploy IDS/IPS and DLP to isolate and mitigate threats.

Explore asset discovery methods, from agent-based and agent-list approaches to tracker-style inventory, and use tools such as Nmap/Zenmap, Quarless, and OpenVAS to identify network assets for security assessments.

Explore Windows incident response tools for registry analysis, network monitoring, file system checks, memory forensics, and malware analysis to triage and investigate incidents.

Explore linux-based incident response tools for network analysis and memory forensics, including nmap, netstat, wireshark, tcpdump, arp, lsof, md5sum, sha1sum, sha256sum, strings, volatility, recall, and session commands.

Explore the incident response process, including preparation, identification, containment and eradication, recovery, and post-incident activities, with emphasis on communication, root cause analysis, and lessons learned, and documentation.

Plan and prep for incident response by maintaining up-to-date contact lists and toolkits, training teams, conducting tabletop exercises, and documenting playbooks, escalation paths, and internal and external communication.

Explore compliance and standards for cybersec first responders, covering ISO 27001, PCIDSS, HIPAA, GLBA, GDPR, SOX, NIST 800-series, and RFC 2196 site security handbook.

Explore how frameworks provide systematized approaches to implementing best practices, and examine examples like COBIT, NIST, RMF, ITIL, TOG, and OWASP CAPEC for risk and security.

Gather digital and physical evidence, preserve it forensically with imaging and hashing, maintain chain of custody, and ensure admissibility in court.

Identify common vulnerable areas across users, operating systems, apps, network devices, and IoT, and learn how weak configurations, unpatched software, and insecure protocols expose systems and guide vulnerability assessments.

Identify critical assets and data, set scope and frequency of vulnerability assessments, and guide testing. Use automated scanners and credentialed or uncredentialed scans, then generate reports for remediation and documentation.