The Tech Academy's Live Project portion of the cybersecurity bootcamp. Offensive and defensive security work (OWASP Juice Shop, Burp Suite, Wireshark) with incident report writeups.
This repository tracks work on The Tech Academy's Live Project: applying offensive and defensive security techniques in a simulated professional environment. Work is organized into stories (offensive, defensive, and setup), each with its own incident report documenting what was investigated, how, what was found, and what the fix or takeaway is.
This repository is updated as stories are completed, not assembled at the end.
- Environment: Kali Linux, KVM/virt-manager
- Offensive: OWASP Juice Shop, Burp Suite, FoxyProxy
- Defensive: Wireshark, VirusTotal
- Research: ExploitDB, GTFOBins, Rapid7, CVE Details, CIS Security
setup/- Offensive Setup stories (Kali VM, Juice Shop, Burp Suite)offensive/- web application security stories against OWASP Juice Shopdefensive/- network forensics and malware investigation stories
- Install Kali Linux VM - Kali build on KVM/virt-manager and a clean-baseline snapshot
- Create Juice Shop App - OWASP Juice Shop deployed and run via Docker
- Intro - Burp Suite - intercepting proxy configured, traffic capture and request modification
- Admin Log In - SQL injection auth bypass
- User Log In - Targeted SQLi after user enumeration
- Reset Admin Password - Burp Intruder brute force
- Admin Access - Mass assignment on user registration
- Admin Page - Client-side route discovery + IDOR on baskets + admin panel abuse
- CAPTCHA Exploit - Reusable CAPTCHA + no rate limiting, Burp Intruder flood
- Access Secured Documents - Exposed /ftp/ directory, confidential file access
- Download Secured Documents - Poison null byte extension-filter bypass
- HTTP Requests - Request tampering: basket IDOR + zero-star feedback via improper input validation
- Wireshark Intro - Okay-Boomer pcap analysis: host/OS fingerprinting, PE file carving, Trickbot confirmed via VirusTotal
- Malware Traffic - Exploit kit chain reconstruction: Flash exploit + hidden iframe, executable disguised as text/html, ransomware confirmed via VirusTotal
- Malware Analysis - Multi-family infection: Word doc embedded in HTML, Hancitor check-in, Ficker Stealer download, Cobalt Strike beaconing
- PowerShell Script Analysis - Static analysis of a PowerShell keylogger: user32.dll API imports, hardcoded SMTP exfiltration, log deleted after send
- Linux Server Logs - Bash history reconstruction:
.phtmlwebshell slips a.php-only upload filter, then a SUID-Python privilege escalation attempt - Erik's Coffee Packet Analysis - PCAP triage of a two-host network: Kerberos host/user identification, Qakbot delivered via a zip-wrapped VBScript downloader, confirmed via VirusTotal
- Find the Culprit - Post-infection C2 analysis: Zeus config hidden inside a valid JPEG, fixed-interval check-ins over HTTP, encrypted upload following bank-related host activity
- Ransomware Attack - Live infection triage on a provided Windows 10 image: fake Firefox binary in AppData,
.funfile encryption, Jigsaw identified via PE metadata and hash lookup, files recovered and malware removed