Learning Objectives#

• Understanding the Echo Response answer submission format
• Base64 encoding/decoding techniques
• Web server log analysis
• Path traversal attack detection
• Security awareness fundamentals

Question 1: Tutorial Message#

Task: Decode the Base64-encoded content in tutorial.txt and extract the exercise answer.

Encoded Content:

1
TXVmZmluIHRoZSBjYXQgY2xpY2tlZCBvbiBhIGxpbmssCk5vdyBhbGwgaGlzIGZpbGVzIGJlZ2FuIHRvIHNocmluayEKSGUgc2hvdWxk4oCZdmUgY2hlY2tlZCB0aGUgc2VuZGVy4oCZcyBuYW1lLApCdXQgbm93IGhpcyBsYXB0b3AncyBub3QgdGhlIHNhbWUuCgpBIHBhc3N3b3JkIHN0cm9uZywgYSBmaXJld2FsbCB0aWdodCwKS2VlcHMgc25lYWt5IGhhY2tlcnMgb3V0IG9mIHNpZ2h0LgpTbyB0aGluayBiZWZvcmUgeW91IHN1cmYgYW5kIHBsYXnigJQKQ3liZXItc21hcnRzIHdpbGwgc2F2ZSB0aGUgZGF5IQoKVGhlIGFuc3dlciB0byB0aGlzIGV4ZXJjaXNlIGlzICJUcnlIYXJkZXIi

Decoded Message:

1
Muffin the cat clicked on a link,
2
Now all his files began to shrink!
3
He should've checked the sender's name,
4
But now his laptop's not the same.
5

6
A password strong, a firewall tight,
7
Keeps sneaky hackers out of sight.
8
So think before you surf and play
9
Cyber-smarts will save the day!
10

11
The answer to this exercise is "TryHarder"

Answer:

1
TryHarder

Question 2: Log Analysis - Path Traversal Attack#

Task: Analyze the access.log file and identify the path traversal attack. Provide the source IP address, malicious request path, and target file.

Answer:

Source IP Address:

1
192.168.1.101

Malicious Request:

1
GET /public/plugins/welcome/../../../../../../../../home/dave/.ssh/id_rsa HTTP/1.1

Target File:

1
/home/dave/.ssh/id_rsa

Attack Details:

• Timestamp: 01/Oct/2025:08:17:55 +0000
• HTTP Method: GET
• Status Code: 200 (Successful - Attack succeeded!)
• Response Size: 1,678 bytes
• User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)
• Directory Traversal Depth: 8 levels (../../../../../../../../)

Question 3: Additional Suspicious Activities#

Task: Identify other suspicious activities in the access logs.

Answer:

Authentication Failure:

• IP: 192.168.1.20
• Request: POST /api/auth
• Status: 401 Unauthorized
• Timestamp: 01/Oct/2025:08:04:32 +0000
• Note: Followed by successful authentication attempt 8 seconds later

Server Errors:

1. Upload Failure:

   • IP: 172.16.0.2
   • Request: POST /api/upload
   • Status: 500 Internal Server Error
   • User Agent: PostmanRuntime/7.32.0

2. Forbidden Access:

   • IP: 172.16.0.2
   • Request: GET /metrics
   • Status: 403 Forbidden
   • User Agent: curl/7.68.0

Missing Resource:

• IP: 192.168.1.99
• Request: GET /favicon.ico
• Status: 404 Not Found

Base64 Decoding Method#

PowerShell:

1
[System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String("TXVmZmluIH..."))

Python:

1
import base64
2
decoded = base64.b64decode("TXVmZmluIH...").decode('utf-8')
3
print(decoded)

Linux/Bash:

1
echo "TXVmZmluIH..." | base64 -d

Path Traversal Attack Analysis#

The attack exploits insufficient path validation in the web application:

1
/public/plugins/welcome/../../../../../../../../home/dave/.ssh/id_rsa

Attack Chain:

1. Start at the legitimate path: /public/plugins/welcome/
2. Traverse up 8 directory levels using ../
3. Navigate to the target: /home/dave/.ssh/id_rsa
4. Successfully retrieve SSH private key (1,678 bytes returned)

Vulnerability Type: CWE-22: Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’)

From the Poem#

1. Phishing Awareness: Always verify sender information before clicking links
2. Strong Authentication: Use strong passwords and multi-factor authentication
3. Firewall Protection: Implement network security controls
4. Security Mindfulness: Think before interacting with untrusted content

From Log Analysis#

1. Path Traversal Prevention:

   • Validate and sanitize all user input
   • Implement proper access controls
   • Use allow-lists for file access
   • Never trust client-supplied paths

2. Monitoring & Detection:

   • Implement real-time log monitoring
   • Set up alerts for suspicious patterns (e.g., ../ in URLs)
   • Track failed authentication attempts
   • Monitor error rates and anomalies

3. Incident Response:

   • The 200 status code indicates successful data exfiltration
   • SSH private key compromise = immediate credential rotation required
   • IP 192.168.1.101 should be blocked and investigated
   • All SSH keys for user ‘dave’ must be regenerated

Immediate Actions#

1. Revoke Compromised Credentials:

   • Regenerate all SSH keys for user ‘dave’
   • Rotate any passwords for affected accounts
   • Audit access logs for unauthorized access attempts

2. Block Malicious IP:

   • Add 192.168.1.101 to firewall blocklist
   • Investigate source and motivation of attack
   • Check for other attacks from same IP range

3. Patch Vulnerability:

   • Implement path traversal protection
   • Update web application framework
   • Add input validation and sanitization

Long-Term Improvements#

1. Security Controls:

   • Deploy Web Application Firewall (WAF)
   • Implement file access restrictions
   • Use principle of least privilege
   • Enable security headers (X-Content-Type-Options, etc.)

2. Monitoring:

   • Set up SIEM for centralized log analysis
   • Configure alerts for path traversal patterns
   • Monitor for unusual file access attempts
   • Track authentication failures

3. Training:

   • Security awareness training for all users
   • Phishing simulation exercises
   • Secure coding practices for developers
   • Incident response drills

Automated Analysis#

Run the provided Python script to automatically analyze all challenge components:

1
python analyze_tutorial.py

Script Features:

• Base64 decoding with answer extraction
• Access log parsing and analysis
• Path traversal attack detection
• Suspicious activity identification
• Security summary report generation

Sample Output:

1
==================================================================================
2
 ECHO RESPONSE - WEEK 0: TUTORIAL CHALLENGE ANALYSIS
3
 Difficulty: Easy
4
 Category: Incident Response, Log Analysis, Encoding
5
==================================================================================
6

7
TUTORIAL MESSAGE DECODED
8
==================================================================================
9
Muffin the cat clicked on a link...
10
[Full decoded poem]
11
==================================================================================
12

13
 Exercise Answer: TryHarder
14

15
==================================================================================
16
ACCESS LOG ANALYSIS
17
==================================================================================
18

19
 Total log entries analyzed: 21
20

21
 PATH TRAVERSAL ATTACKS DETECTED: 1
22
  Source IP: 192.168.1.101
23
  Target File: /home/dave/.ssh/id_rsa
24
  Status: 200 OK (Attack Successful)
25
  Size: 1678 bytes

Accepted Formats#

Single Answer:

1
TryHarder

IP Address (Multiple):

1
192.168.1.101

or

1
- 192.168.1.101
2
- 192.168.1.20
3
- 172.16.0.2

Text Format:

1
The answer is TryHarder

List Format with Details:

1
- Source IP: 192.168.1.101
2
- Target: /home/dave/.ssh/id_rsa
3
- Status: Successful (200)

Important Notes#

• All required components must be included
• Extra or incorrect information will be marked wrong
• Duplicate entries will be marked wrong
• Order and formatting style don’t matter (as long as complete)