thinQtankLABS

Unrestricted File Upload Detection & Incident Response

Respond to a Unrestricted File Upload compromise (CWE-434) in Acme Portal. Reconstruct the timeline from the access and service logs, scope the impact, engineer a detection rule tuned past a benign look-alike, then contain, eradicate, verify and report.

Intermediate 21 guided steps 6 tasks About 75 minutes Runs in your browser

Skills you will practice

  • Log analysis
  • detection and IR; Incident-handling lifecycle; Unrestricted File Upload detection and IOCs; Security Operations domain

Certifications this lab maps to

This lab builds hands-on skills that appear on these certification exams. thinQtank Learning runs instructor-led training camps for each — click one to see upcoming classes.

CompTIA CySA+ CS0-003 Log analysis, detection and IR Training at thinQtank Learning EC-Council Certified Ethical Hacker CEH Web attack techniques and IOCs Training at thinQtank Learning EC-Council Certified Incident Handler E|CIH Incident-handling lifecycle Training at thinQtank Learning ISC2 CISSP CISSP Security Operations domain Training at thinQtank Learning
Part of these certification lab packages: CySA+ CS0-003 PenTest+ PT0-003 CISSP Certified Ethical Hacker (CEH) CEH Certified Incident Handler (E|CIH) E|CIH GCIH GCIH GPEN GPEN GCIA GCIA

The scenario

A Acme Portal host (CWE-434 open in the avatar/document upload feature) logged uploads with executable extensions and spoofed content types, followed by requests to the uploaded files. You are the responder.

What you will do

  1. Open and classify the incident4 steps

    Open the incident · Read the alert · Read the ticket · Classify it

  2. Reconstruct the timeline3 steps

    Pull the attacker's requests · Correlate the service log · What is the impact?

  3. Scope the exposure3 steps

    Inspect the triage capture · What persistence/impact? · Record IOCs

  4. Engineer a detection rule4 steps

    Study the sample · Write a rule · Test and tune · Why this pattern?

  5. Contain, eradicate, verify5 steps

    Contain · Eradicate the foothold · Verify the host · Confirm detection holds · …

  6. Report2 steps

    Write the report · Why eradicate, not just fix?

How this lab works

A real Linux-style console. Commands run against real files, so hashes, hex dumps and comparisons give real results.

A file browser where you can place evidence into the lab, either the file provided or one of your own.

Reset a single step, a whole task or the entire lab. The environment is rebuilt so you can try again cleanly.

Progress saves after every step. Close the tab and come back later; your files and answers are waiting.