Auditing a server with Kali, from the defender’s side
Finding, validating, closing and reporting the weaknesses of your own lab server.
Level 201 · 17 lessons · 15 practice labs
Lessons
Preparing for the audit
- Scope and rules of the audit: You will understand why the scope, permission and rules of a security audit must be written down before any work begins.
- The pre-audit baseline: versions, configuration and a backup
- Mapping the visible surface of your own lab server: You will map how your own lab server looks from the outside and list which doors are open.
- Service inventory and version records: You will keep a record of every service and version on the server, so you can spot old or unneeded software.
- Short task: record the service inventory of the lab server
Triaging the findings
- Interpreting and prioritising scan results: You will read scan output and rank the findings by risk, so you can decide what to fix first.
- Validating findings: false alarm or real: You will learn to check safely, on your own lab system, whether a scan finding is a real weakness or a false alarm.
- Documenting a false positive and feeding it back into the scanner settings
- Short task: sort ten scan findings into real issues and false alarms
Closing and verifying
- Weak service configurations and their fixes: You will recognise common weak settings in services and see how each one is fixed with the right configuration.
- Hardening exposed shares and remote access: You will restrict needlessly open file shares and remote access so that only the people who need them can reach them.
- Credential hygiene: weak and default passwords: You will understand why weak and default passwords are a big risk, and find and replace them on your own systems.
- Running the same check again after the fix
- How the same event looks on the defence side: You will see, from the defender's side, what traces your audit steps leave in server logs and on the network.
- Short task: harden a weak service and prove it is fixed
Reporting
- Parts of an audit report: summary, finding, evidence, recommendation
- Capstone: an audit and remediation report: In the capstone you will audit the lab server of a fictional company and collect findings, fixes and re-check results in a report.
Practice labs
- Record the server's baseline before the audit: Write the lab server's OS version, installed packages and key configurations into a dated baseline file.
- Take a pre-audit backup and test that you can roll back: Back up the critical config files, deliberately break one, restore it from backup and confirm the service recovers.
- Map how your own server looks from outside: Scan the lab server from another machine on the network, compare with the services seen locally and record the difference table.
- Prioritise scan findings by severity and exposure: Rank the findings in the lab scan report by severity and external exposure and pick the first three fixes.
- Sort ten scan findings into real issues and false alarms: Verify each finding by hand on the server, mark the real ones and write the reason for each false alarm.
- Document a false alarm and feed it back into the scanner settings: Create an exception record for the confirmed false alarm, rerun the scanner and prove no real findings were lost.
- Harden a weakly configured service and prove it: Turn off the lab web server's version banner and unneeded modules and attach before and after output as evidence.
- Tighten an open share and remote access: Restrict the world-writable share, disable root password login over SSH and verify both changes by retesting.
- Clean out default passwords and report on credential hygiene: Find default and weak passwords on the lab server's services, change them and tabulate which account meets which policy rule.
- Rerun the same check after the fix: Fix the issue found in the earlier audit, check again with the same command and add the result to the finding record.
- Show how your audit steps look in the defence logs: Find your scans and login attempts in the server logs and prepare a table matching each step to its log line.
- Harden a weak service and prove the fix three ways: Harden the weak lab service and prove the fix with a config diff, a scan result and a log entry.
- Sort scattered notes into audit report sections: Distribute the given notes into summary, finding, evidence and recommendation sections and say which section is missing.
- Write an evidenced audit entry for one finding: Validate a misconfiguration on the lab server and add it to the report with finding, evidence, recommendation and verification lines.
- Write the lab server's audit and remediation report: Audit the Narçiçeği Eczaneleri lab server, fix two findings, close them with a retest and gather the results in a short report.
About this course
Finding, validating, closing and reporting the weaknesses of your own lab server.
What you will learn
- Preparing for the audit
- Triaging the findings
- Closing and verifying
- Reporting
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.