NETS1032

Network Device Forensics

This lab is intended to give you practice looking for configuration changes on a router which may indicate compromise.

Examining pfsense router configuration backups

  1. Download the following pfsense configuration backup files to your local disk.
    1. backup 1
    2. backup 2
    3. backup 3
    4. backup 4
    5. backup 5
  2. For each of the downloaded config backup files, review the configuration in the backup to determine if there are unusual settings which may indicate compromise. Some of the kinds of things you should be checking for could include the following:
    1. Look for obviously invalid or unusable IP addresses
    2. Look for suspicious services configured
    3. Look for accounts which are suspicious
    4. Look for administrative access which does not appear normal
    5. Look for credentials which are suspicious

Grading

Submit a single PDF file with your comments about what might be compromised for each of the 5 backup files. Include supporting configuration information and data from the backup xml files to support your comments.