Network Security Labs... Suggestions?

I wasn't sure which Discussion Forum to post this in so I thought I'd try the general Network Security.

I'm a network and security instructor at a technical school in Pennsylvania. I'm trying to come up with some new hands on labs for my students to run through.

The stuff we currently have is a little dated and I'd like to update things myself since it may be a while before our textbooks and lab manuals are. I want my students to have as current of information as they can.

Does anyone have any (or know where I can find) good hands on labs for Footprinting, Network Reconnaissance, enumeration or just about anything else that'd be good for them to experience?

These labs are going to be used in an isolated network of anywhere from 10-20 machines (depending on the classroom). I can provide the students with limited Internet access through a firewall if need be, but I'd prefer to give them the tools needed to do the labs without venturing out of our network at all. Operating systems are flexible because the students are taught XP, Server 2k3 and Linux.

Any help that can be provided would be much appreciated.

Hrmm.. I used to have a whole syllabus set up and haven't been able to find it recently (plus everything is packed).

When I taught a course like this I had a "tank machine" (highly locked down *nix box) that the students would go through and attempt to break into. The course would break the process down and have them do labs with tools like nmap, nslookup/dig, etc. Generally, I'd leave the labs free flowing as this worked best but they had to find certain information for me (e.g., OS type and version, open ports, pick say 3 ports and identify why having those open are a security risk or not) and submit it the following week. They would work in teams of two, "attacking" both the locked down box as well as each other. They were required to build their box as a dual-boot so they could experience things/pre-formatted tools in both major platforms.

Additionally, I reminded them of rules that they had to adhere to. You may want to use one of the live security OSes (STD Knoppix, for example) as a starting point.

HTH. If I remember more, I'll post it.

Quote:

---

Originally Posted by MsMittens

Hrmm.. I used to have a whole syllabus set up and haven't been able to find it recently (plus everything is packed).

When I taught a course like this I had a "tank machine" (highly locked down *nix box) that the students would go through and attempt to break into. The course would break the process down and have them do labs with tools like nmap, nslookup/dig, etc. Generally, I'd leave the labs free flowing as this worked best but they had to find certain information for me (e.g., OS type and version, open ports, pick say 3 ports and identify why having those open are a security risk or not) and submit it the following week. They would work in teams of two, "attacking" both the locked down box as well as each other. They were required to build their box as a dual-boot so they could experience things/pre-formatted tools in both major platforms.

Additionally, I reminded them of rules that they had to adhere to. You may want to use one of the live security OSes (STD Knoppix, for example) as a starting point.

HTH. If I remember more, I'll post it.

---

What are your thoughts on Auditor and BackTrack as far as live security OS's? Do you prefer Knoppix STD to those?

I haven't used BackTrack and only played around with Auditor a little bit. It's really a preference thing. My choice was to have students build their own systems and then provide them with internet access or have a local mount CD/disk with the necessary files.

Quote:

---

Originally Posted by MsMittens

I haven't used BackTrack and only played around with Auditor a little bit. It's really a preference thing. My choice was to have students build their own systems and then provide them with internet access or have a local mount CD/disk with the necessary files.

---

Since these students will be relatively new to security I want to keep things as simple and basic for them as possible. I haven't used STD but I know Auditor is pretty "newbie" friendly. Would you consider STD to be relatively easy for someone with little experience already?

I know BackTrack is more for someone with a little more knowledge than these students are going to have to begin with. I'll introduce them to that later in the course. I don't want to overwhelm them too quickly. :-D

One of the finals for the course is a "server wars" project where the class is divided in half. Each side sets up a proxy server and a network with specific machines and services running on it. Then we let them have at each other to see who can do what.

Since that's part of the final I want to avoid them actually 'breaking into' anything this early in the course. I want more information gathering type labs for them.

Thanks for the advice. Any additional suggests would be greatly appreciated.

Knoppix is generally pretty user friendly. I haven't downloaded the latest Knoppix STD but I remember it being very straightforward.

Remind them that information collection is often done beyond the computer. I was amazed as to how many of my students used lunch time, breaks, etc. to get passwords and other info from other students. It was rather impressive.

Quote:

---

Originally Posted by MsMittens

Knoppix is generally pretty user friendly. I haven't downloaded the latest Knoppix STD but I remember it being very straightforward.

Remind them that information collection is often done beyond the computer. I was amazed as to how many of my students used lunch time, breaks, etc. to get passwords and other info from other students. It was rather impressive.

---

I'm not going to mention that part of the equation to them because they should already know it by the time they get to this section. I have a social engineering project they complete prior to actual technical stuff. :)

When I was a student going through this course a long time ago my group won our server wars through a combo of social engineering and technical know-how. We sent all but two of our group members to lunch with the other group. One of us played lookout while the other used physical access to the other teams servers to reboot a domain controller, reset their local admin password using some password reset tools and then use that local admin account to gain admin access to their active directory network. It worked perfectly. They came back from lunch and had no idea we had total control over their entire network.

It was a reminder to everyone that you can have all the logical security you want in place... if you don't guard the physical security of your equipment I can sit down at your server and have domain admin rights in under 15 minutes.