Ravindra BagaleCourses & study guides

49. Cheat Sheets

49.7 Red vs Blue, Project and Real Incidents

By Last updated:

Shevtat purple loop – cheat-sheet skills on OWN Raja-Rani lab. Ethics closer. Chala finish kara!

Cheat-sheet project = build weak Amazon Linux + MySQL exposure → gentle Nmap from Kali + Metasploit awareness on Metasploitable only → fix hygiene → re-verify. Real incidents = known facts only, say reported.

Red team (attacker) does Blue team (defender) detects / stops
Uses cheat sheets to justify illegal scans / exploits Scope + host-only; Metasploit only vs Metasploitable .20
Leaves password SSH + outdated packages + MySQL on 0.0.0.0 Keys-only; sudo yum update; bind 127.0.0.1; firewalld/SG; re-scan
Quotes breach numbers from memory Well-known public facts; “reported”; control lesson

Ravindra Bagale's Tip

In the project, the “HACK” step = awareness + gentle Nmap + optionally a Metasploitable module you already know from ch23 – not inventing 0-days on Raja-Rani’s fictional shop. FIX proof = interview gold. Portfolio caption: OWN lab. Remember this.

Lab

Complete the Project box below. Then speak once in clean English: “I used Linux/MySQL/Nmap cheat lines on my OWN Raja-Rani host-only lab, demonstrated exposure awareness against Metasploitable, then fixed and re-verified.” Delete recordings that contain real org names.

Project: Build it, hack it, fix it

Build: For fictional Raja-Rani Traders (Kolhapur) on YOUR host-only Amazon Linux VM 192.168.56.50, deliberately leave: (1) SSH password authentication on with a weak lab password, (2) at least one outdated package you can later update (sudo yum check-update should show work), (3) MySQL/MariaDB listening beyond localhost (mis-set bind) with a practice DB rajarani. Install stack with sudo yum install -y httpd mysql (or mariadb-server) as needed; sudo service httpd start / sudo service mysqld start (Ubuntu note: apt + sudo service apache2 start / mysql). Snapshot pre-cheatsheet-weak. Keep Metasploitable at 192.168.56.20 unchanged for the MSF awareness step. Hack (lab only): From Kali 192.168.56.10, gentle sudo nmap -sS -T2 -sV -p 22,80,3306 192.168.56.50 -oN ~/labs/rajarani-cheatsheet/nmap-before.txt – document open SSH/MySQL exposure. For Metasploit awareness only, against Metasploitable 192.168.56.20 (not inventing exploits on .50): msfconsole → search/use a known lab module from ch23 → set RHOSTS 192.168.56.20 → set LHOST 192.168.56.10 → check if available → optional one lab exploit for learning service-exposure themes → write “Blue would patch/disable…”. Never MSF against cafe, phones, or real suppliers. Fix on .50: deploy SSH keys; PasswordAuthentication no; PermitRootLogin no; sudo service sshd restart (second session open); sudo yum update -y; set MySQL bind-address=127.0.0.1; create least-privilege DB user; firewalld/SG allow 22/80/443 only from 192.168.56.10 (or your admin IP); sudo service mysqld restart / sudo service httpd restart after config tests. Re-verify: Nmap from Kali shows 3306 filtered/closed from outside; SSH password auth fails; packages updated; note file nmap-after.txt. Interview closer: “Cheat sheets helped me recall commands – I still only scanned and tested systems I own on host-only 192.168.56.x.”

Real incident: Capital One breach (2019)

Public reporting described a breach involving a misconfigured web application firewall / cloud metadata access path (SSRF-class themes as widely reported) that led to unauthorised access to data in cloud storage, with Capital One and U.S. authorities publishing details afterward. Weakness themes: edge misconfiguration + over-broad access to cloud resources – the same hygiene class as “open management ports / wrong bind / missing least privilege” on a Linux/MySQL edge. Cheat-sheet lesson: inventory listeners (ss / Nmap on OWN assets), restrict SG, no public DB, IAM/instance-role least privilege (ch30). Source: company disclosures, U.S. DOJ / court public materials, and major press (verify; say “reported” for record counts – no invented numbers here).

Real incident: WannaCry (2017)

Public reporting described a worldwide ransomware worm that abused a Windows SMB-related vulnerability (EternalBlue class, as widely reported), hitting organisations that had not applied available patches / compensating controls. Weakness themes: unpatched internet-reachable service exposure + wormable malware – mirrors “scan finds old service → exploit framework → missing patch” stories students see in lab (without ever releasing worms). Defence mindset: patch cadence (sudo yum update habit on Linux estates you manage), disable unused SMB-class exposure, segment, backups, and never run worm demos outside isolated labs. Source: major vendor/CERT advisories and investigative reporting (verify; say “reported”).

Thodkyaat sangaycha tar

  • Cheat sheets = quick revision + Blue notes – never an attack cookbook; OWN lab / host-only only.
  • Linux: files, chmod/chown, users/sudo, processes, ss/ip, sudo yum, sudo service, logs, ssh/scp, harden one-liners.
  • MySQL: connect, CRUD, SELECT family, ALTER, keys/constraints, SQL_SAFE_UPDATES, GRANT, mysqldump awareness, bind localhost; prepared statements → ch29.
  • Nmap: -sS/-sT/-sV/-sC/-O, -p, -T2, -oN/-oX; ethics = OWN IPs; Blue watches mass SYN.
  • Metasploit: msfconsole workflow awareness on Metasploitable only; check; fix with patch/least privilege/monitor; msfvenom ≠ real phones.
  • Combined card: situation → recall → Blue control.
  • Project Build-Hack-Fix for Raja-Rani Traders (Kolhapur) on 192.168.56.x + Metasploitable awareness.
  • Real incidents (Capital One (2019), WannaCry (2017)) = exposure + missing hygiene — known facts only.
  • Next: Marathi glossary, then About the Author (still ethics first).

Samjla ka? Cheat sheets complete – Linux, MySQL, Nmap, Metasploit, Blue columns clear, OWN lab only. Pudhe **Marathi glossary**, mag About the Author. Chala revise kara, mitrano!