Based On Believe

I built a honeypot, then attacked it myself - here's what I learned. For my latest security lab, I wanted to answer a simple question: if an attacker came knocking, would I actually see it? I set up a Cowrie SSH honeypot on an isolated virtual network, then switched hats and became the attacker; using a Kali Linux VM to run Nmap reconnaissance (service detection, OS fingerprinting, script scanning), attempt manual SSH logins, and launch an automated brute-force attack with Hydra. The entire exchange was captured live with Wireshark. The honeypot did exactly what it was designed to do: it quietly logged the attacker's IP, every username/password combination tried, commands typed once "inside," and even full terminal session recordings. One notable detail, the structured logs showed three separate login attempts succeeding within the same second, a clear signature of automated tooling that no human could replicate manually. As a useful contrast, the real OpenSSH service running alongside the honeypot correctly rejected the same root login attempt, a small reminder of what proper hardening looks like right next to an intentionally permissive decoy. This project was as much about documentation discipline as the technical build. I wrote up the full attack timeline, indicators of compromise, and defense recommendations in a formal incident report, and documented every step; including the mistakes I hit along the way, as a reusable, step-by-step guide so the entire lab can be rebuilt from scratch. Deliverables: honeypot verification, complete Nmap scan output, a full packet capture, a one-page incident report, and a fully documented GitHub repo. Honeypots are a low-risk way to study real attacker behavior and validate that detection actually works before it matters in production. Would love to hear how others are using them in their own labs. 🔗 Full project + build guide: github.com/chukwupg/cowrie-h… #CyberSecurity #InfoSec #BlueTeam #HomeLab #NetworkSecurity #Honeypot

Week 4, Task 10 of my Tech Biz Security CEH Internship: Vulnerability Scanning Basics. I ran an Nmap vuln script scan against my Metasploitable 2 lab and picked out three findings: a backdoored vsftpd 2.3.4 (CVE-2011-2523), an outdated ISC BIND 9.4.2 (CVE-2008-0122) and an Apache 2.2.8 server exposed to Slowloris (CVE-2007-6750). I researched the severity, impact and fix for each, and also completed the TryHackMe Vulnerabilities 101 room. One thing I learned: a scanner result is a potential finding, not proof. Nmap even labelled the Slowloris issue “LIKELY VULNERABLE”, so every result needs validating before you report it. Thank you to Tech Biz Security for the practical task. #CyberSecurity #EthicalHacking #Nmap #VulnerabilityScanning #TryHackMe #TechBiz

Day 85 - Build Log I combined hands-on security learning with team collaboration. TryHackMe: Vulnerability 101 Completed the Vulnerability 101 room, strengthening my understanding of security vulnerabilities, how they are identified, assessed, and prioritised, and why vulnerability management is an important part of an organisation's security programme. @Cyblackorg Internship - Sprint 4: GRC Attended my team's first meeting as we kicked off the second phase of the internship following the break. We discussed our approach to the Governance, Risk and Compliance (GRC) sprint, shared responsibilities, and agreed on how to tackle the assigned tasks as a team. Lesson: Identifying vulnerabilities is only part of the process. Organisations also need structured approaches to assess risks, prioritise remediation, and maintain effective security controls. A new sprint, shared responsibilities, and more opportunities to grow. On to the work ahead! #Cybersecurity #VulnerabilityManagement #GRC #RiskManagement #Compliance #TryHackMe #CyBlack #LearningInPublic

I just completed Vulnerabilities 101 room on TryHackMe! tryhackme.com/room/vulnerabi… #tryhackme via @tryhackme

Day 84 - Build Log Today marked another productive step in my cybersecurity journey. DG Interns Hub - Week 3 I completed the Incident Management 101 course on LetsDefend, wrapping up my Week 3 internship learning task. I also submitted my Week 3 internship deliverables. I've documented the practical work from this week on GitHub, and you can check it out here: github.com/chukwupg/dg-inter… @Cyblackorg Internship - Sprint 4: Governance, Risk and Compliance (GRC) We resumed today after a six-day break with our Sprint 4 task call. I'm looking forward to exploring the governance, risk, and compliance side of cybersecurity and understanding how organisations establish controls, manage risks, and maintain security standards. Lessons learned: Technical security skills are important, but understanding how security is governed, assessed, and maintained is equally essential. A new sprint, new challenges, and another opportunity to grow. Ready for the work ahead! We resumed today after a six-day break with our Sprint 4 task call. I'm looking forward to exploring the governance, risk, and compliance side of cybersecurity and understanding how organizations establish controls, manage risks, and maintain security standards.

Week 3 of my DG Interns Hub cybersecurity internship: endpoint logs and network detection. What I did: - Installed Sysmon (SwiftOnSecurity config) on Windows and traced PowerShell, user creation, network connections and file creation. - Set up auditd on Ubuntu and searched command execution with ausearch. - Built Snort 3 from source, wrote four rules, and caught ping, HTTP, SSH and an Nmap SYN scan from Kali in my isolated lab. - Mapped my scan rule to MITRE ATT&CK T1046 (Network Service Discovery). - Completed 4 TryHackMe rooms (Linux Logging for SOC, Intro to Logs, Intro to Log Analysis, Snort) and 3 LetsDefend lessons (How to Investigate a SIEM Alert, SIEM 101, Incident Management 101). What did not go to plan: - Sysmon did not log a .txt file. Its config only covers certain file types, and a .bat file logged. Telemetry is only as good as the config. - Snort was not in Ubuntu 26.04's package list, so I built Snort 3. It also rejected the threshold rule keyword, and detection filter fixed it. Notes, writeups, rules and findings: github.com/chukwupg/dg-inter… Thank you DG Interns Hub for the practical tasks. #CyberSecurity #SOC #Sysmon #Snort #MITREATTACK #DGInternsHub

#letsdefend I have gained new badge on @LetsDefendIO app.letsdefend.io/my-rewards…

Day 83 - Build Log Another day of combining defensive and offensive security studies, with three practical learning sessions completed. TryHackMe: Snort Explored Snort as a network intrusion detection and prevention tool, how it analyses network traffic, and how to create and use detection rules to investigate suspicious activity. LetsDefend: SIEM 101 Covered the fundamentals of Security Information and Event Management (SIEM), including how SIEM works, log collection, log storage, and alert creation. TryHackMe: Attacking ICS 1 Explored Industrial Control System (ICS) security, learning how to discover and interact with industrial control systems through the Modbus protocol, including systems associated with Modicon/Schneider Electric. Lesson: Effective security monitoring depends on collecting and analysing the right data, writing meaningful detection rules, and understanding the environments being protected. This includes industrial systems, where security has implications beyond traditional IT networks. Continuing to build across both offensive and defensive security. #Cybersecurity #Snort #SIEM #ICS #OTSecurity #NetworkSecurity #TryHackMe #LearningInPublic #BuildInPublic

Why is endpoint logging (Sysmon and auditd) more valuable than standard OS logs for a SOC analyst? This week, as part of my internship at DG Interns Hub, I set up Sysmon on Windows and auditd on Linux. Here are some concepts and lessons I would like to share: 1. Full command lines. Sysmon showed me net1.exe creating a user, with the exact command. Standard logs often give less detail. 2. Process context. Every event shows the process, its parent and its hash, so I can trace what started what. 3. Network tied to a process. Sysmon Event ID 3 showed PowerShell connecting from one IP to another, with ports. A network log alone cannot tell me which process did it. 4. Real identity behind sudo. In auditd, auid stayed my login user even when the command ran as root. 5. You control what is recorded. Rules and configs decide the detail. I learned this when a .txt file did not log in Sysmon but a .bat file did. No event does not always mean no activity. Endpoint logs tell you what actually happened on the machine, not just that something happened. #CyberSecurity #SOC #Sysmon #auditd #BlueTeam #DGInternsHub

I just completed Attacking ICS Plant #1 room on TryHackMe! tryhackme.com/room/attacking… #tryhackme via @tryhackme

#letsdefend I have gained new badge on @LetsDefendIO app.letsdefend.io/my-rewards…

I just earned the Network Hog on TryHackMe! tryhackme.com/BasedOnBelieve…

I just completed Snort room on TryHackMe! In this room, I covered Snort, its definition, operation, and how to create and use rules to investigate threats. tryhackme.com/room/snort?utm… #tryhackme via @tryhackme

Day 82 - Build Log I had a mix of Blue Team learning, offensive security practice, and internship progress. @MicrosoftLearn - Identity Security Completed Three modules: - Secure your Azure resources with Azure role-based access control (Azure RBAC) - Manage Microsoft Entra Identity Protection. - Allow users to reset their passwords with Microsoft Entra self-service password reset (SSPR). Explored identity risk protection, password management, and ways to strengthen account security. @tryhackme - Three Rooms Completed Worked through: - Intro to Logs - Intro to Log Analysis - Vulnversity The first two strengthened my understanding of security logs and how to analyse them, while Vulnversity provided hands-on practice with web application reconnaissance and exploitation techniques. Tech Biz Security Internship Completed and submitted my Week 3, Task 9 assignment, making further progress with the internship. Lesson: Effective cybersecurity requires understanding both sides of the equation: identifying weaknesses through offensive testing and using logs and identity controls to detect, investigate, and reduce security risks. Another day of building practical skills across different areas of cybersecurity. #Cybersecurity #MicrosoftEntra #LogAnalysis #SOC #PenetrationTesting #TryHackMe #LearningInPublic #BuildInPublic

Week 3, Task 9 of my Tech Biz Security Internship was Enumeration: digging deeper into services. In my isolated lab, I picked SMB from my Nmap scan results and ran enum4linux against the Metasploitable target. Without logging in, it returned the workgroup name, 35 user accounts, 5 shares and the password policy. I confirmed the findings with smbclient and Nmap scripts, then grabbed FTP, SSH and SMTP banners with netcat to check the software versions. Lessons: a service will tell you a lot if you ask it directly, and confirming results with a second tool makes them far more reliable. Enumeration is also active, so it belongs only on systems you own or are authorised to test. Thank you Tech Bix Security for the practical training. #CEH #EthicalHacking #Enumeration #SMB #Cybersecurity #TechBizAcademy

I just completed Intro to Log Analysis room on TryHackMe! Explored log analysis, best practices, and essential tools for effective detection and response. tryhackme.com/room/introtolo… #tryhackme via @tryhackme

I just earned the Logging Legend on TryHackMe! tryhackme.com/BasedOnBelieve…

I just completed Vulnversity room on TryHackMe! Practiced active recon, web app attacks and privilege escalation. tryhackme.com/room/vulnversi… #tryhackme via @tryhackme

I just completed Intro to Logs room on TryHackMe! Here's what I covered: Log types, formats, and standards Collection, management, and centralization Storage, retention, and deletion Log analysis process, tools, and techniques. tryhackme.com/room/introtolo… #tryhackme via @tryhackme