Quick Navigation#

• Open README Section
• Open Investigation Report

README#

Challenge Overview#

In this cybersecurity incident response challenge, I investigated a database breach at ProtoVault, a secure facility managed by the Everbound Order. A threat actor claimed to have obtained the organization’s database and issued ransom demands, threatening to expose sensitive data if their demands weren’t met.

As a digital investigator, my mission was to:

1. Analyze the application source code for security vulnerabilities
2. Identify the source of the database leak
3. Locate and verify the publicly exposed database
4. Extract specific evidence to confirm the breach

Challenge Questions & Answers#

1
postgresql://assetdba:8d631d2207ec1debaafd806822122250@pgsql_prod_db01.protoguard.local/pgamgt?sslmode=verify-full

1
backup_db.py

1
pbkdf2:sha256:600000$YQqIvcDipYLzzXPB$598fe450e5ac019cdd41b4b10c5c21515573ee63a8f4881f7d721fd74ee43d59

1
https://protoguard-asset-management.s3.us-east-2.amazonaws.com/db_backup.xyz

Investigation Methodology#

1
# List all commits
2
git log --oneline --all
3

4
# Examine suspicious commit
5
git show 1cc71b0 --stat
6

7
# Recover deleted file
8
git show 1cc71b0^:app/util/backup_db.py

1
import requests
2
import codecs
3

4
# Download the leaked database
5
url = "https://protoguard-asset-management.s3.us-east-2.amazonaws.com/db_backup.xyz"
6
response = requests.get(url)
7

8
# Decode ROT13
9
decoded_db = codecs.decode(response.text, 'rot_13')
10

11
# Search for Naomi Adler
12
# Found user record with password hash

Critical Vulnerabilities Discovered#

Tools & Techniques Used#

• Git Forensics: Version control history analysis
• Python: Automated download and decoding scripts
• ROT13 Decoding: Cipher analysis (codecs library)
• S3 Analysis: AWS cloud storage investigation
• Source Code Review: Security vulnerability assessment
• OSINT: Open source intelligence gathering

Solution Files#

This directory contains:

1. INVESTIGATION_REPORT.md - Comprehensive forensic analysis report

   • Detailed investigation methodology
   • Security vulnerabilities identified
   • Remediation recommendations
   • Impact assessment

2. analyze_leak.py - Python script to download and decode the leaked database

   1
   # Usage:
   2
   python analyze_leak.py
   

3. README.md - This file (challenge overview and summary)

Key Takeaways & Lessons Learned#

Skills Demonstrated#

• Digital Forensics: Git repository analysis and artifact recovery
• Incident Response: Systematic investigation methodology
• Cryptanalysis: Decoding and cipher identification
• Cloud Security: AWS S3 security analysis
• Python Scripting: Automation and data processing
• Security Assessment: Vulnerability identification and risk analysis
• OSINT: Public data source investigation

Challenge Statistics#

• Time to Solve: ~45 minutes
• Files Analyzed: 8+ source files
• Git Commits Reviewed: 21 commits
• Database Records: 2,400+ lines
• Vulnerabilities Found: 6 critical/high severity issues
• Tools Used: 5+ different tools and techniques

Challenge Completed#

Status: SOLVED
All Questions Answered: 4/4
Evidence Verified:
Report Generated:

Author#

Umair Aziz

References#

• OffSec Echo Response Event - Proving Grounds: The Gauntlet
• OWASP Top 10 - Security Misconfiguration
• AWS S3 Security Best Practices
• Git Security Best Practices
• NIST Incident Response Framework

“Every artifact holds meaning, and every response leaves its own echo behind.”