Lab 04: Reconnaissance & Firewall Evasion Guide

Lab Scenario

Welcome to the Reconnaissance & Evasion phase of the Cyber Defense curriculum. In this lab, you assume the role of an external attacker situated in the WAN zone. Your organization has tightened security, blocking all direct access to the internal LAN.

Your Mission: Map the perimeter to find a weak point in the DMZ, then utilize SSH Tunneling to pivot through that host and access critical infrastructure (IAM Server) hidden deep within the LAN. Finally, switch to the Blue Team to detect these specific attacks.

🕒 Duration: 3-4 Hours

💻 Hypervisor: VirtualBox

🔧 Tool: Nmap, SSH, Snort

🔴 Red Team Objectives

Scan DMZ for open ports (Nmap)
Identify service versions (Banner Grabbing)
Establish SSH Tunnel (Port Forwarding)
Access LAN via Pivot (RDP)

🔵 Blue Team Objectives

Analyze Firewall Logs for noise
Configure Snort IDS on IAM Server
Write Custom Snort Rules
Detect Tunneling Activity

Network Topology

💻

Attacker (WAN)

Kali Linux

Bridge / Home IP

🔥

Open-Source Firewall

Rules Engine

Allows: 80, 22 -> DMZ

🌐

DMZ Zone

192.168.2.x

Target: Web Svr

Blocked

🏢

LAN Zone

192.168.1.10

Target: IAM Svr

Preparation: Firewall Rules

Before simulating the attack, we must configure the environment to match the scenario. The firewall must strictly segment the LAN from the WAN, while allowing limited public access to the DMZ.

Configuration Checklist

Allow Web (HTTP): Create Rule on WAN Interface.
Src: Any | Dest: DMZ Net | Port: 80

Allow SSH: Create Rule on WAN Interface.
Src: Any | Dest: DMZ Net | Port: 22

Block All Else: Ensure default deny rule is active.

Verify LAN Block: Ensure NO rules allow WAN -> LAN.

Verification Step

Attempt to ping 192.168.1.10 from Kali. It MUST fail. This confirms the firewall is protecting the internal network.

Expected Firewall Table (WAN Tab)

Action	Proto	Source	Dest	Port
✔ Pass	TCP	*	DMZ Net	80 (HTTP)
✔ Pass	TCP	*	DMZ Net	22 (SSH)
✖ Block	*	*	*	*

CyberDefense Lab: Recon & Evasion

Lab Scenario

🔴 Red Team Objectives

🔵 Blue Team Objectives

Network Topology

Preparation: Firewall Rules

Configuration Checklist

Verification Step

Expected Firewall Table (WAN Tab)

Phase A & B: Reconnaissance

1. Port Discovery

2. Service Fingerprinting

3. Banner Grabbing

🔍 Recon Analysis

Phase C: SSH Tunneling (The Pivot)

Execution Protocol

Phase D: Blue Team Defense

Traffic Analysis: Identifying the Attack

Snort IDS Rule Logic