Skip to content

Commit 9f2ff60

Browse files
SolitudePySolitudePy
committed
offline jekyll use
1 parent e80e2be commit 9f2ff60

6 files changed

Lines changed: 261 additions & 127 deletions

File tree

‎Dockerfile‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
FROM jekyll/jekyll:latest
2+
3+
# Copy Gemfile and Gemfile.lock to install dependencies
4+
COPY ./Gemfile /srv/jekyll/Gemfile
5+
COPY ./Gemfile.lock /srv/jekyll/Gemfile.lock
6+
7+
# Install dependencies
8+
WORKDIR /srv/jekyll
9+
RUN bundle install
10+
11+
# Set the default command
12+
CMD ["bundle", "exec", "jekyll", "serve", "--host", "0.0.0.0"]

‎Gemfile‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
source 'https://rubygems.org'
2+
3+
gem 'jekyll', '~> 4.2.2' # Match the version in the logs
4+
gem 'webrick' # Add webrick for the server
5+
gem 'jekyll-paginate' # From _config.yml in the repository
6+
gem 'jekyll-sitemap' # From _config.yml in the repository
7+
gem 'minima' # Theme used in the repository
8+
9+
group :jekyll_plugins do
10+
# Add any additional plugins specified in _config.yml
11+
end

‎Gemfile.lock‎

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
GEM
2+
remote: https://rubygems.org/
3+
specs:
4+
addressable (2.8.7)
5+
public_suffix (>= 2.0.2, < 7.0)
6+
colorator (1.1.0)
7+
concurrent-ruby (1.3.5)
8+
em-websocket (0.5.3)
9+
eventmachine (>= 0.12.9)
10+
http_parser.rb (~> 0)
11+
eventmachine (1.2.7)
12+
ffi (1.17.2-x86_64-linux-musl)
13+
forwardable-extended (2.6.0)
14+
http_parser.rb (0.8.0)
15+
i18n (1.14.7)
16+
concurrent-ruby (~> 1.0)
17+
jekyll (4.2.2)
18+
addressable (~> 2.4)
19+
colorator (~> 1.0)
20+
em-websocket (~> 0.5)
21+
i18n (~> 1.0)
22+
jekyll-sass-converter (~> 2.0)
23+
jekyll-watch (~> 2.0)
24+
kramdown (~> 2.3)
25+
kramdown-parser-gfm (~> 1.0)
26+
liquid (~> 4.0)
27+
mercenary (~> 0.4.0)
28+
pathutil (~> 0.9)
29+
rouge (~> 3.0)
30+
safe_yaml (~> 1.0)
31+
terminal-table (~> 2.0)
32+
jekyll-feed (0.17.0)
33+
jekyll (>= 3.7, < 5.0)
34+
jekyll-paginate (1.1.0)
35+
jekyll-sass-converter (2.2.0)
36+
sassc (> 2.0.1, < 3.0)
37+
jekyll-seo-tag (2.8.0)
38+
jekyll (>= 3.8, < 5.0)
39+
jekyll-sitemap (1.4.0)
40+
jekyll (>= 3.7, < 5.0)
41+
jekyll-watch (2.2.1)
42+
listen (~> 3.0)
43+
kramdown (2.5.1)
44+
rexml (>= 3.3.9)
45+
kramdown-parser-gfm (1.1.0)
46+
kramdown (~> 2.0)
47+
liquid (4.0.4)
48+
listen (3.9.0)
49+
rb-fsevent (~> 0.10, >= 0.10.3)
50+
rb-inotify (~> 0.9, >= 0.9.10)
51+
mercenary (0.4.0)
52+
minima (2.5.2)
53+
jekyll (>= 3.5, < 5.0)
54+
jekyll-feed (~> 0.9)
55+
jekyll-seo-tag (~> 2.1)
56+
pathutil (0.16.2)
57+
forwardable-extended (~> 2.6)
58+
public_suffix (6.0.2)
59+
rb-fsevent (0.11.2)
60+
rb-inotify (0.11.1)
61+
ffi (~> 1.0)
62+
rexml (3.4.1)
63+
rouge (3.30.0)
64+
safe_yaml (1.0.5)
65+
sassc (2.4.0)
66+
ffi (~> 1.9)
67+
terminal-table (2.0.0)
68+
unicode-display_width (~> 1.1, >= 1.1.1)
69+
unicode-display_width (1.8.0)
70+
webrick (1.9.1)
71+
72+
PLATFORMS
73+
x86_64-linux-musl
74+
75+
DEPENDENCIES
76+
jekyll (~> 4.2.2)
77+
jekyll-paginate
78+
jekyll-sitemap
79+
minima
80+
webrick
81+
82+
BUNDLED WITH
83+
2.3.25

‎README.md‎

Lines changed: 8 additions & 127 deletions
Original file line numberDiff line numberDiff line change
@@ -1,130 +1,11 @@
1-
# Linux Forensics Study Guide
2-
```
3-
Welcome to the Linux Forensics study guide!
4-
This document will help you navigate through the necessary topics,
5-
materials, and exercises to build a solid foundation in Linux forensics.
6-
Follow the outlined steps, explore the materials provided,
7-
and feel free to ask questions as you go.
8-
Currently this guide does not explore Memory Forensics
9-
Remember to document your answers and reflections along the way, Let’s dive in!
10-
11-
Resources:
12-
Download these: LinuxForensicsLabVM/, Exercises/, PomeranzLinuxForensics.pdf, README.txt
13-
https://archive.org/download/HalLinuxForensics/media-v3.0.2/
1+
## 🌐 GitHub Pages
2+
Visit the live site: [https://solitudepy.github.io/LinuxForensicsLearn](https://solitudepy.github.io/LinuxForensicsLearn)
143

15-
Challenges:
16-
https://cyberdefenders.org/blueteam-ctf-challenges/?content=free&categories=endpoint-forensics&os=Linux
4+
## How to use offline
5+
```
6+
git clone git@github.com:SolitudePy/LinuxForensicsLearn.git
7+
cd LinuxForensicsLearn
8+
docker compose build
9+
docker compose up -d
1710
```
1811

19-
# Chapter 1. Linux Directories
20-
21-
<a href="Subjects/1. Linux Directories/index.html" target="_blank">Linux Directory Structure By https://dev.to/softwaresennin</a><br>
22-
<a href="Resources/PomeranzLinuxForensics.pdf#page=15" target="_blank">PomeranzLinuxForensics page 15-20 By Hal Pomeranz</a>
23-
24-
25-
## Tasks
26-
1. What is the difference between a hard link and a symbolic(soft) link?
27-
2. what is the relationship of /bin and /usr/bin, /sbin and /usr/sbin?
28-
3. what is usually saved in /etc? name 3 forensic artifacts in /etc.
29-
4. what is usually saved in /var/log?
30-
5. what is special about the /tmp directory, why as forensic analysts we would want to check it?
31-
32-
# Chapter 2. Linux Logs
33-
<a href="Subjects/2. Linux Logs/Logs.html" target="_blank">Linux Logs guide</a><br>
34-
<a href="Subjects/2. Linux Logs/Linux_Auditd_For_ThreatDetection_IzyKnows_Part1.pdf" target="_blank">Linux Audit Subsystem Part 1 By IzyKnows</a><br>
35-
<a href="Subjects/2. Linux Logs/Linux_Auditd_For_ThreatDetection_IzyKnows_Part2.pdf" target="_blank">Linux Audit Subsystem Part 2 By IzyKnows</a><br>
36-
<a href="Subjects/2. Linux Logs/Linux_Auditd_For_ThreatDetection_IzyKnows_Part3.pdf" target="_blank">Linux Audit Subsystem Part 3 By IzyKnows</a><br>
37-
<a href="Subjects/2. Linux Logs/LAUREL_README.html" target="_blank">LAUREL_README By https://github.com/threathunters-io/laurel</a><br>
38-
<a href="Subjects/2. Linux Logs/laurel-about.7.html" target="_blank">laurel-about.7.md By https://github.com/threathunters-io/laurel</a><br>
39-
<a href="Subjects/2. Linux Logs/laurel.8.html" target="_blank">laurel.8.md By https://github.com/threathunters-io/laurel</a><br>
40-
41-
42-
## Tasks
43-
1. Explain the difference between utmp, wtmp, btmp and lastlog files.
44-
2. What command can be used to format btmp you acquired from other system?
45-
3. What does the /var/log/cron file track, and why is it important?
46-
4. Explain the purpose of auditd and the types of events it logs.
47-
5. What is Laurel? why is it useful?
48-
6. What is the significance of persistent vs. volatile storage in the context of systemd journal logs?
49-
7. What is the role of rsyslog in managing log files? What is Syslog?
50-
8. If you suspect unauthorized access to your system, which logs would you check first?
51-
9. Describe a method for correlating events across different log files.
52-
10. Discuss how log tampering can affect incident response.
53-
What techniques can an attacker use to modify or delete log entries,
54-
and how would you detect such tampering? Give atleast 3 tamper techniques and 2 security techniques.
55-
56-
# Chapter 3. Linux FileSystems
57-
<a href="Subjects/3. Linux FileSystems/procfs.html" target="_blank">procfs</a><br>
58-
<a href="Subjects/3. Linux FileSystems/sysfs/sysfs.html" target="_blank">sysfs</a><br>
59-
<a href="Subjects/3. Linux FileSystems/What_Are_inodes_linux.pdf" target="_blank">inodes</a><br>
60-
<a href="Resources/PomeranzLinuxForensics.pdf#page=169" target="_blank">PomeranzLinuxForensics page 169-181 By Hal Pomeranz</a><br>
61-
<a href="Resources/PomeranzLinuxForensics.pdf#page=182" target="_blank">PomeranzLinuxForensics page 182 (Exercise 16) By Hal Pomeranz</a>
62-
63-
64-
## Tasks
65-
1. Explain how the /proc filesystem differs from other filesystems in Linux.
66-
Why is it considered a "pseudo-filesystem"?
67-
2. Describe the purpose of the /proc/sys directory. How does this directory enable kernel parameter tuning,
68-
and what are some potential security implications of modifying files within it?
69-
3. Explain the purpose of the /proc/sys/net/ipv4 directory.
70-
How could configurations within this directory impact network performance and security?
71-
Describe two settings that a system administrator might modify and the effects they would have.
72-
4. The /proc filesystem contains process-specific directories named by their PID (process ID).
73-
Describe how you could use the contents of these directories to investigate a process that is suspected to be malicious.
74-
What files would you examine, and what indicators would suggest suspicious behavior?
75-
5. How is data generated when you read files in /proc? Explain the kernel’s role in this process.
76-
6. What is /proc/kcore, and what purpose does it serve? Why should accessing this file be handled with caution?
77-
7. What is an inode, and what role does it play in the Linux filesystem?
78-
8. How can forensic investigators access and analyze XFS structures?
79-
9. What happens to data on XFS when files are deleted?
80-
10. What limitations exist for XFS in forensic investigations?
81-
11. What is the purpose of the /sys directory in Linux? How does it differ from /proc?
82-
83-
# Chapter 4. Linux Attacks Techniques
84-
<a href="Subjects/4. Linux Attacks Techniques/Art-of-Linux-Persistence.pdf" target="_blank">Linux Persistence By hadess</a><br>
85-
<a href="Subjects/4. Linux Attacks Techniques/linux-persistence-map.pdf" target="_blank">Linux Persistence Map</a>
86-
87-
88-
## Tasks
89-
1. What is a persistence mechanism, and why is it valuable to attackers?
90-
2. List and explain three common persistence mechanisms discussed in the article.
91-
3. Choose one persistence mechanism and detail steps defenders can take to detect and mitigate it on Linux systems.
92-
4. Discuss the potential impact of overlooking persistence mechanisms during a Linux incident response. What risks might this pose?
93-
5. Explain how LD_PRELOAD and ld.so.preload can be used as persistence mechanisms in Linux. What are the security implications of these techniques?
94-
95-
96-
# Chapter 5. Linux Artifacts & Live Response
97-
<a href="Subjects/5. Linux Artifacts & Live Response/Artifacts.html" target="_blank">Linux Artifacts guide</a><br>
98-
<a href="Resources/PomeranzLinuxForensics.pdf#page=5" target="_blank">PomeranzLinuxForensics page 5-13(including Exercise) By Hal Pomeranz</a><br>
99-
<a href="Resources/PomeranzLinuxForensics.pdf#page=25" target="_blank">PomeranzLinuxForensics Honeypot Lab Part 1 By Hal Pomeranz</a><br>
100-
<a href="Resources/PomeranzLinuxForensics.pdf#page=35" target="_blank">PomeranzLinuxForensics Honeypot Lab Part 2 By Hal Pomeranz</a><br>
101-
<a href="Resources/PomeranzLinuxForensics.pdf#page=49" target="_blank">PomeranzLinuxForensics Honeypot Lab Part 3 By Hal Pomeranz</a>
102-
103-
104-
## Tasks
105-
1. Choose 5 artifacts and explain their forensic usage with real-world examples.
106-
2. An investigator notices that both ss and netstat commands are used in Linux network analysis. What could be the advantages of using each command in forensic investigations? Describe the usefulness of comparing the outputs of both commands in identifying suspicious activity.
107-
3. Explain the purpose of `lsof` in forensic investigations and describe a situation where lsof might be crucial in a Linux forensic analysis.
108-
4. User login information is critical for tracking user activity. Choose three artifacts from the list that log user activity and explain how each could help determine whether unauthorized access has occurred.
109-
5. Read about OSQuery, why is it useful for live response & monitoring in linux?
110-
6. Try your way around UAX(Unix-like Artifact Collector) and explore the artifacts.
111-
7. Run Plaso on UAC output.
112-
113-
# Chapter 6. Linux Bonus
114-
<a href="Resources/ulk3.pdf" target="_blank">Understanding the Linux Kernel</a><br>
115-
<a href="Subjects/6. Linux Bonus/How does ltrace work_ _ Packagecloud Blog.html" target="_blank">How does ltrace work By Joe Damato</a><br>
116-
<a href="Subjects/6. Linux Bonus/Linux Boot Process – What Happens when Booting RHEL.html" target="_blank">Linux Boot Process By Kedar Makode</a><br>
117-
<a href="Subjects/6. Linux Bonus/Linux Attack Techniques_ Dynamic Linker Hijacking with LD Preload.html" target="_blank">Dynamic Linker Hijacking By jbowen@cadosecurity.com</a><br>
118-
119-
120-
**Read about the following**
121-
* Linux bootloader
122-
* Ptrace
123-
* Linux Syscalls
124-
* Linux Signals
125-
* setuid,setgid, sticky bit file permissions
126-
127-
128-
# Answers
129-
Review your answers in:
130-
<a href="Answers.html" target="_blank">Answers</a>

‎docker-compose.yml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
services:
2+
jekyll-forensics:
3+
build:
4+
context: .
5+
dockerfile: Dockerfile
6+
container_name: jekyll_forensics
7+
ports:
8+
- "4000:4000"
9+
volumes:
10+
- .:/srv/jekyll
11+
restart: always

0 commit comments

Comments
 (0)