GCIA labs
Every hands-on lab that maps to the GIAC GCIA (GCIA) certification. This is the full lab package for that certification.
Certification: GIAC › GCIA GCIA clear · browse all certifications
38 labs
Intermediate
Authentication Attack Detection & Incident Response
Respond to a Authentication Weakness (brute force) compromise (CWE-307) in Acme Accounts. Reconstruct the timeline from the access and service logs, scope the impact, engineer a detection rule tuned past a benign look-alike, then contain, eradicate, verify and report.
Intermediate
Broken Access Control (IDOR) Detection & Incident Response
Respond to a Broken Access Control (IDOR) compromise (CWE-639) in Acme Billing. Reconstruct the timeline from the access and service logs, scope the impact, engineer a detection rule tuned past a benign look-alike, then contain, eradicate, verify and report.
Intermediate
Command Injection Detection & Incident Response
Respond to a Command Injection compromise (CWE-78) in Acme Ops Console. Reconstruct the timeline from the access and service logs, scope the impact, engineer a detection rule tuned past a benign look-alike, then contain, eradicate, verify and report.
Intermediate
Cross-Site Request Forgery Detection & Incident Response
Respond to a Cross-Site Request Forgery (CSRF) compromise (CWE-352) in Acme Bank. Reconstruct the timeline from the access and service logs, scope the impact, engineer a detection rule tuned past a benign look-alike, then contain, eradicate, verify and report.
Intermediate
Cross-Site Scripting Detection & Incident Response
Respond to a Cross-Site Scripting (XSS) compromise (CWE-79) in Acme Community. Reconstruct the timeline from the access and service logs, scope the impact, engineer a detection rule tuned past a benign look-alike, then contain, eradicate, verify and report.
Intermediate
Detection Engineering & Incident Response: CVE-2023-27350
Respond to a PaperCut unauthenticated admin bypass to RCE compromise (CVE-2023-27350). Reconstruct the timeline from the access and service logs, see how an unauthenticated request reached the admin console and ran a device script as SYSTEM, find the rogue local account, engineer a detection rule for unauthenticated access to the SetupCompleted admin page, then contain, eradicate, upgrade, verify and report.
Intermediate
Detection Engineering & Incident Response: CVE-2023-34960
Respond to a Chamilo unauthenticated OS command injection compromise (CVE-2023-34960). Reconstruct the timeline from the access and service logs, see how a crafted file name in a SOAP call was passed to a shell, find the PHP web shell, engineer a detection rule for wsConvertPpt calls with shell metacharacters in file_name, then contain, eradicate, upgrade, verify and report.
Intermediate
Detection Engineering & Incident Response: CVE-2023-38646
Respond to a Metabase unauthenticated H2 JDBC RCE compromise (CVE-2023-38646). Reconstruct the timeline from the access and service logs, see how an H2 JDBC connection string executed code at connect time, pre-auth, find the scheduled-task persistence, engineer a detection rule for database-validation requests using the H2 engine with an INIT clause, then contain, eradicate, upgrade, verify and report.
Intermediate
Detection Engineering & Incident Response: CVE-2023-43208
Respond to a Mirth Connect unauthenticated deserialization RCE compromise (CVE-2023-43208). Reconstruct the timeline from the access and service logs, see how an unauthenticated XML body was deserialized into a gadget chain and ran code, find the rogue channel, engineer a detection rule for unauthenticated API bodies containing deserialization gadget markers, then contain, eradicate, upgrade, verify and report.
Intermediate
Detection Engineering & Incident Response: CVE-2024-2044
Respond to a pgAdmin 4 session-traversal pickle-RCE compromise (CVE-2024-2044). Reconstruct the timeline from the access and service logs, see how traversal in the session id loaded an attacker pickle and ran code, find the staged-pickle persistence, engineer a detection rule for traversal, then contain, eradicate, upgrade, verify and report.
Intermediate
Detection Engineering & Incident Response: CVE-2024-23897
Respond to a Jenkins CLI arbitrary-file-read breach (CVE-2024-23897). Reconstruct the timeline from the access and read logs, see how @<path> arguments inlined master.key and credentials.xml, scope the exposure, engineer a detection rule for the @-file pattern, then contain by disabling the CLI feature, eradicate (upgrade + rotate secrets), verify and report.
Intermediate
Detection Engineering & Incident Response: CVE-2024-27348
Respond to a HugeGraph unauthenticated Gremlin RCE compromise (CVE-2024-27348). Reconstruct the timeline from the access and service logs, see how a Gremlin query bypassed the sandbox via reflection and ran OS commands, find the rogue cron entry, engineer a detection rule for Gremlin scripts that use reflection to reach Runtime/ProcessBuilder, then contain, eradicate, upgrade, verify and report.
Intermediate
Detection Engineering & Incident Response: CVE-2024-3400
Respond to a PAN-OS GlobalProtect command-injection compromise (CVE-2024-3400). Reconstruct the timeline from the access and service logs, see how shell metacharacters in the SESSID value ran commands as root, find the web-implant persistence, engineer a detection rule for the malicious SESSID pattern, then contain, eradicate, upgrade, verify and report - assuming breach.
Intermediate
Detection Engineering & Incident Response: CVE-2024-36401
Respond to a GeoServer unauthenticated OGC expression RCE compromise (CVE-2024-36401). Reconstruct the timeline from the access and service logs, see how a request property name was evaluated as an expression and ran code, find the JSP web implant, engineer a detection rule for OGC requests whose property reference is an expression (exec()/Runtime), then contain, eradicate, upgrade, verify and report.
Intermediate
Detection Engineering & Incident Response: CVE-2025-24813
Respond to a Apache Tomcat partial-PUT path-equivalence compromise (CVE-2025-24813). Reconstruct the timeline from the access and work-dir logs, see how the `..;/` trick wrote a session file that FileStore deserialized into RCE, find the staged-session persistence, engineer a detection rule for the malicious PUT pattern, then contain, eradicate, upgrade, verify and report.
Intermediate
Detection Engineering & Incident Response: CVE-2025-29927
Respond to a Next.js middleware-auth-bypass compromise (CVE-2025-29927). Reconstruct the timeline from the access and session logs, see how the x-middleware-subrequest header made middleware skip and exposed /admin, find the backdoor-admin persistence, engineer a detection rule for the bypass header, then contain at the edge, eradicate, upgrade, verify and report.
Intermediate
Detection Engineering & Incident Response: CVE-2025-31131
Respond to a YesWiki path-traversal data breach (CVE-2025-31131). Reconstruct the timeline from the access and file-read logs, see how squelette traversal read /etc/passwd and the config (DB credentials), scope the exposure, engineer a detection rule for traversal, then contain at the WAF, eradicate (upgrade + rotate the exposed secrets), verify and report.
Intermediate
Detection Engineering & Incident Response: CVE-2025-32463
Respond to a sudo --chroot local-privilege-escalation compromise (CVE-2025-32463). Reconstruct the timeline from the sudo auth and activity logs, see how --chroot loaded an attacker nsswitch.conf as root, find the SUID-root backdoor persistence, engineer a detection rule for the chroot option, then contain, eradicate, upgrade, verify and report.
Intermediate
Detection Engineering & Incident Response: CVE-2025-3248
Respond to a Langflow unauthenticated code-injection compromise (CVE-2025-3248). Reconstruct the timeline from the access and service logs, see how /api/v1/validate/code executed posted code with no auth, find the rogue-cron persistence, engineer a detection rule for the code endpoint, then contain, eradicate, upgrade, verify and report - including rotating keys.
Intermediate
Detection Engineering & Incident Response: CVE-2025-49113
Respond to a Roundcube Webmail object-injection compromise (CVE-2025-49113). Reconstruct the timeline from the access and PHP logs, see how a serialized _from value was unserialized into a gadget and ran code, find the web-shell persistence, engineer a detection rule for the serialization markers, then contain, eradicate, upgrade, verify and report.
Intermediate
Detection Engineering & Incident Response: CVE-2025-55182
Respond to a React Server Components deserialization-RCE compromise (CVE-2025-55182). Reconstruct the timeline from the access and execution logs, see how a server-action payload resolved an arbitrary reference and ran as the node process, find the dropped-script persistence, engineer a detection rule for the malicious payload marker, then contain, eradicate, upgrade, verify and report.
Intermediate
Detection Engineering & Incident Response: CVE-2025-68613
Respond to an n8n workflow-expression RCE compromise (CVE-2025-68613). Reconstruct the timeline from the n8n audit and execution logs, see how an expression calling require()/child_process escaped the sandbox and ran as the n8n process, find the attacker's rogue scheduled-workflow persistence, engineer a detection rule for dangerous expressions, then contain by restricting editing, eradicate, upgrade, verify and report - including rotating stored credentials.
Intermediate
Detection Engineering & Incident Response: CVE-2026-10520
Respond to a Ivanti Sentry OS-command-injection compromise (CVE-2026-10520). Reconstruct the timeline from the access and service logs, see how shell metacharacters in a host parameter ran commands as root, find the rogue root-cron persistence, engineer a detection rule for the injection pattern, then contain by restricting the interface, eradicate, upgrade, verify and report.
Intermediate
Detection Engineering & Incident Response: CVE-2026-1357
Respond to a WPvivid file-upload compromise (CVE-2026-1357). Reconstruct the timeline from the web access log and the plugin upload log, see how filename traversal placed PHP in a web-accessible directory, find the attacker's rogue must-use-plugin persistence, engineer a detection rule for the malicious upload pattern, then contain, eradicate, update, verify and report.
Intermediate
Detection Engineering & Incident Response: CVE-2026-2329
Respond to an unauthenticated-RCE compromise of a Grandstream IP phone (CVE-2026-2329). Reconstruct the timeline from web and device logs, find the attacker's rogue provisioning persistence, engineer and tune a detection rule for the overflow pattern, then contain, eradicate (firmware + config), verify and report.
Intermediate
Detection Engineering & Incident Response: CVE-2026-29058
Respond to a live compromise of a WWBN AVideo host (CVE-2026-29058). Reconstruct the attack timeline from correlated logs, determine impact and find the attacker's persistence, engineer and tune a behavioral detection rule to zero false negatives and false positives, then contain, eradicate, verify and report.
Intermediate
Detection Engineering & Incident Response: CVE-2026-31431
Respond to a local privilege-escalation compromise on a shared Linux host (CVE-2026-31431). Reconstruct the timeline from auth and audit logs, find the attacker's sudoers persistence, engineer and tune a behavioral detection rule, then contain, eradicate, patch, verify and report.
Intermediate
Detection Engineering & Incident Response: CVE-2026-42167
Respond to a ProFTPD SQL-injection compromise (CVE-2026-42167). Reconstruct the timeline from the FTP auth log and SQL backend log, see how COPY TO PROGRAM turned injection into RCE, find the attacker's cron persistence, engineer a detection rule for malicious usernames, then contain, eradicate, upgrade, verify and report.
Intermediate
Detection Engineering & Incident Response: CVE-2026-42945
Respond to an NGINX worker-crash incident (CVE-2026-42945). Reconstruct the timeline from access and error logs, assess DoS versus RCE using the host ASLR setting, find the vulnerable rewrite config, engineer a detection rule, then contain with a config change, eradicate with an upgrade, verify and report.
Intermediate
Detection Engineering & Incident Response: CVE-2026-43284 & CVE-2026-43500
Respond to a local privilege-escalation compromise on a host exposed to two related kernel bugs (CVE-2026-43284 and CVE-2026-43500). Reconstruct the timeline, find the attacker's persistence, engineer one detection rule covering both vulnerable subsystems, then contain, eradicate, patch both with one update, verify and report.
Intermediate
Detection Engineering & Incident Response: CVE-2026-48282
Respond to a Adobe ColdFusion path-traversal-to-RCE compromise (CVE-2026-48282). Reconstruct the timeline from the access and server logs, see how traversal in a template parameter included an attacker .cfm and ran code, find the CFM web-shell persistence, engineer a detection rule for traversal, then contain, eradicate, update, verify and report.
Intermediate
Detection Engineering & Incident Response: CVE-2026-72898
Respond to a Metabase SQL-injection compromise (CVE-2026-72898). Reconstruct the timeline from the access and database logs, see how /reset_password injection yielded admin, find the backdoor-superuser persistence, engineer a detection rule for the injection pattern, then contain at the WAF, eradicate, upgrade, verify and report - including rotating connected-DB credentials.
Intermediate
File Inclusion Detection & Incident Response
Respond to a File Inclusion (LFI/RFI) compromise (CWE-98) in Acme CMS. Reconstruct the timeline from the access and service logs, scope the impact, engineer a detection rule tuned past a benign look-alike, then contain, eradicate, verify and report.
Intermediate
Server-Side Template Injection Detection & Incident Response
Respond to a Server-Side Template Injection (SSTI) compromise (CWE-1336) in Acme Mailer. Reconstruct the timeline from the access and service logs, scope the impact, engineer a detection rule tuned past a benign look-alike, then contain, eradicate, verify and report.
Intermediate
SQL Injection Detection & Incident Response
Respond to a SQL Injection compromise (CWE-89) in Acme Store. Reconstruct the timeline from the access and service logs, scope the impact, engineer a detection rule tuned past a benign look-alike, then contain, eradicate, verify and report.
Intermediate
SSRF Detection & Incident Response
Respond to a Server-Side Request Forgery compromise (CWE-918) where a web app's URL-fetch feature was aimed at the cloud metadata endpoint and leaked IAM credentials. Reconstruct the timeline from the access and fetch logs, scope the credential exposure, engineer a detection rule for fetches aimed at internal/link-local targets (tuned past a benign look-alike), then contain with an allowlist, rotate the exposed credentials, verify and report.
Intermediate
Unrestricted File Upload Detection & Incident Response
Respond to a Unrestricted File Upload compromise (CWE-434) in Acme Portal. Reconstruct the timeline from the access and service logs, scope the impact, engineer a detection rule tuned past a benign look-alike, then contain, eradicate, verify and report.
Intermediate
XML External Entity Detection & Incident Response
Respond to a XML External Entity (XXE) compromise (CWE-611) in Acme Invoicing. Reconstruct the timeline from the access and service logs, scope the impact, engineer a detection rule tuned past a benign look-alike, then contain, eradicate, verify and report.