GPEN labs
Every hands-on lab that maps to the GIAC GPEN (GPEN) certification. This is the full lab package for that certification.
Certification: GIAC › GPEN GPEN clear · browse all certifications
11 labs
Intermediate
Authentication Attack Detection & Incident Response
Respond to a Authentication Weakness (brute force) compromise (CWE-307) in Acme Accounts. Reconstruct the timeline from the access and service logs, scope the impact, engineer a detection rule tuned past a benign look-alike, then contain, eradicate, verify and report.
Intermediate
Broken Access Control (IDOR) Detection & Incident Response
Respond to a Broken Access Control (IDOR) compromise (CWE-639) in Acme Billing. Reconstruct the timeline from the access and service logs, scope the impact, engineer a detection rule tuned past a benign look-alike, then contain, eradicate, verify and report.
Intermediate
Command Injection Detection & Incident Response
Respond to a Command Injection compromise (CWE-78) in Acme Ops Console. Reconstruct the timeline from the access and service logs, scope the impact, engineer a detection rule tuned past a benign look-alike, then contain, eradicate, verify and report.
Intermediate
Cross-Site Request Forgery Detection & Incident Response
Respond to a Cross-Site Request Forgery (CSRF) compromise (CWE-352) in Acme Bank. Reconstruct the timeline from the access and service logs, scope the impact, engineer a detection rule tuned past a benign look-alike, then contain, eradicate, verify and report.
Intermediate
Cross-Site Scripting Detection & Incident Response
Respond to a Cross-Site Scripting (XSS) compromise (CWE-79) in Acme Community. Reconstruct the timeline from the access and service logs, scope the impact, engineer a detection rule tuned past a benign look-alike, then contain, eradicate, verify and report.
Intermediate
File Inclusion Detection & Incident Response
Respond to a File Inclusion (LFI/RFI) compromise (CWE-98) in Acme CMS. Reconstruct the timeline from the access and service logs, scope the impact, engineer a detection rule tuned past a benign look-alike, then contain, eradicate, verify and report.
Intermediate
Server-Side Template Injection Detection & Incident Response
Respond to a Server-Side Template Injection (SSTI) compromise (CWE-1336) in Acme Mailer. Reconstruct the timeline from the access and service logs, scope the impact, engineer a detection rule tuned past a benign look-alike, then contain, eradicate, verify and report.
Intermediate
SQL Injection Detection & Incident Response
Respond to a SQL Injection compromise (CWE-89) in Acme Store. Reconstruct the timeline from the access and service logs, scope the impact, engineer a detection rule tuned past a benign look-alike, then contain, eradicate, verify and report.
Intermediate
SSRF Detection & Incident Response
Respond to a Server-Side Request Forgery compromise (CWE-918) where a web app's URL-fetch feature was aimed at the cloud metadata endpoint and leaked IAM credentials. Reconstruct the timeline from the access and fetch logs, scope the credential exposure, engineer a detection rule for fetches aimed at internal/link-local targets (tuned past a benign look-alike), then contain with an allowlist, rotate the exposed credentials, verify and report.
Intermediate
Unrestricted File Upload Detection & Incident Response
Respond to a Unrestricted File Upload compromise (CWE-434) in Acme Portal. Reconstruct the timeline from the access and service logs, scope the impact, engineer a detection rule tuned past a benign look-alike, then contain, eradicate, verify and report.
Intermediate
XML External Entity Detection & Incident Response
Respond to a XML External Entity (XXE) compromise (CWE-611) in Acme Invoicing. Reconstruct the timeline from the access and service logs, scope the impact, engineer a detection rule tuned past a benign look-alike, then contain, eradicate, verify and report.