A hands-on lab environment for simulating common network and system attacks over a local network and analysing the resulting logs using Splunk. Each module covers a specific attack technique, walks through how it is executed, and demonstrates how to detect and investigate it using Splunk's search and alerting capabilities.
This repository documents a series of offensive security scenarios performed in a controlled lab setup. The primary goal is to understand how attacks manifest in log data and how Splunk can be used as a SIEM to detect, correlate, and investigate suspicious activity.
The lab uses a combination of Kali Linux as the attacker machine and Ubuntu as the target, with Splunk Enterprise configured to ingest logs via the Universal Forwarder.
Before running any of the attack modules, set up Splunk and configure log forwarding from the target machine.
Splunk Setup - Server and Universal Forwarder
This covers installing Splunk Enterprise on the monitoring machine, installing the Universal Forwarder on the target, and configuring inputs to forward system and audit logs.
| Module | Description |
|---|---|
| ARP Spoofing | Poisoning the ARP cache to perform man-in-the-middle attacks on the local network and detecting the anomalous ARP traffic in Splunk |
| Nmap SYN Port Scan | Running stealth SYN scans against the target to enumerate open ports and identifying the scan pattern through connection logs |
| Module | Description |
|---|---|
| Vsftpd Backdoor Exploit | Exploiting the backdoor present in vsftpd 2.3.4 to gain a root shell using metasploitable 2 since the latest versions have been patched for this exploit |
| FTP Brute Force Attack | Performing credential brute force against an FTP service and detecting repeated failed authentication attempts |
| SSH Brute Force Attack | Brute forcing SSH login credentials and correlating failed login events in Splunk to identify the attack pattern |
| Netcat Reverse Shell Attack | Establishing a reverse shell connection using Netcat after gaining access and detecting the outbound connection and shell spawning in logs |
| Module | Description |
|---|---|
| Cron Job Persistence Attack | Planting a malicious cron job on the target system to maintain persistence and detecting the cron execution and associated audit events in Splunk |
| Module | Description |
|---|---|
| Data Exfiltration via SCP | Using SCP to transfer sensitive files from the compromised target to the attacker machine and identifying the exfiltration through EXECVE and SYSCALL audit log entries |
| Module | Description |
|---|---|
| File Tampering Integrity Attack | Modifying system files on the target and detecting the changes through file integrity monitoring events in Splunk |
| Component | Role |
|---|---|
| Kali Linux | Attacker machine |
| Ubuntu | Target machine |
| Metasploitable 2 | Target Machine (Vsftpd 2.3.4 Exploit) |
| Splunk Enterprise | SIEM / log analysis |
| Splunk Universal Forwarder | Log collection agent on target |
Log sources monitored include /var/log/auth.log, /var/log/audit/audit.log, /var/log/syslog, and FTP/SSH service logs.
- A local network or virtual network connecting the attacker and target machines
- Splunk Enterprise installed and accessible on the monitoring machine (Windows was used in this setup)
- Universal Forwarder configured on the target and forwarding logs to Splunk