abiral-timalsina/cyber-defenders-lab-
My write-ups from CyberDefenders' Blue Team labs, solved using Wireshark. Covers TeamCity RCE (CVE-2024-27198), XSS session hijacking, and LLMNR/NBT-NS credential poisoning — each with step-by-step packet analysis, screenshots, and a full Wireshark filter/command reference. Personal SOC Analyst Tier 1 learning log.
My write-ups from CyberDefenders' Blue Team labs, solved using Wireshark. Each lab is a real network forensics investigation — starting from a PCAP file and ending with a full reconstruction of the attack.
📄 Full combined PDF report — includes every lab write-up, evidence screenshots, and a complete Wireshark filter/command reference.
| # | Lab | Category | Key Technique | Tool |
|---|
| 1 | JetBrains | Network Forensics | TeamCity RCE (CVE-2024-27198), webshell upload, container escape | Wireshark |
| 2 | RetailBreach | Network Forensics | Directory brute-forcing, Stored XSS, session hijacking, path traversal | Wireshark |
| 3 | PoisonedCredentials | Network Forensics | LLMNR/NBT-NS poisoning, credential theft | Wireshark |
This is a personal learning log while working through CyberDefenders' SOC Analyst Tier 1 track. All lab scenarios and data belong to CyberDefenders — this repo only documents my own investigation process and findings.
Tools used: Wireshark
Skills practiced: Network traffic analysis, HTTP request/response inspection, credential/session token extraction, timeline reconstruction, MITRE ATT&CK technique mapping, LLMNR/NBT-NS poisoning analysis.
⭐ If this is useful for your own blue-team learning, feel free to star the repo.
