Start with one tool
Predict. Observe. Explain.
Read the lab instructions, name the question and predict the result before running anything. Work in short stages and keep your own notes separate from the supplied example.
The small local applications use fictional records and bind only to this computer's loopback address. Packet fixtures and sample Windows events are explicitly synthetic. The Windows collection exercise belongs in a disposable lab VM.
The Python utilities use the standard library. Wireshark, Burp Community, Snort 3 and Sysmon are separate tools with their own setup instructions. No real cloud account or external target is needed.
These pages publish the exercise materials and their checks. They do not claim that Jeremy has independently completed the tool workflows. A passing utility test is not a personal packet capture, a manual Burp session, a Snort alert or a Sysmon collection. Personal evidence can be added after the activity and explanation have been checked.
Lab 27 / Hands-on practice
Capture and explain your own traffic
Generate a few harmless local requests, collect a small capture and connect each action to packet evidence.
- Start with
- Client/server basics and the DNS and TCP foundation exercises. Wireshark with loopback capture support.
- Evidence
- Your own controlled loopback capture, request observations and capture settings. Supplied instructions are not a personal capture record.
- Your deliverable
- A small reviewed PCAP, annotated exchanges and an explanation of a failed connection.
- First session
- 35–50 minutes after tool setup. Shorter sessions are welcome.
Independent practice not yet assessed. A worked example, practice drills and verification guidance are included.
Lab 28 / Hands-on practice
Test and retest access control with Burp
Use a local two-user training application to compare an insecure object-access check with a repaired version.
- Start with
- HTTP requests, responses and access-control basics. Burp Suite Community and its browser.
- Evidence
- Manual before-and-after requests and responses from an original loopback-only toy application with fictional records.
- Your deliverable
- A scoped finding, a denied cross-user request after the fix, and proof that the intended user can still read their record.
- First session
- 45–75 minutes after tool setup. Shorter sessions are welcome.
Independent practice not yet assessed. A worked example, practice drills and verification guidance are included.
Lab 29 / Hands-on practice
Write, run and tune an offline detection rule
Detect one harmless marker in local packet files, then test a near-miss and explain the rule's limits.
- Start with
- Packet basics and a simple Snort rule. Snort 3 in a suitable local lab environment.
- Evidence
- Labelled synthetic PCAP fixtures, an inspectable rule and alerts collected by actually running Snort. A generated fixture is not a real capture.
- Your deliverable
- A positive and negative test table, alert evidence, and a short explanation of false positives and missed traffic.
- First session
- 40–60 minutes after tool setup. Shorter sessions are welcome.
Independent practice not yet assessed. A worked example, practice drills and verification guidance are included.
Lab 30 / Hands-on practice
Collect Windows events and reconstruct a process chain
Generate harmless activity in a disposable Windows VM, inspect Sysmon process events and explain parent-child relationships.
- Start with
- Windows processes and the endpoint foundation exercise. A disposable licensed Windows VM with Sysmon configured for the lab.
- Evidence
- Synthetic XML examples for parser practice, followed by a separately labelled collection from your own lab VM.
- Your deliverable
- An event timeline, process-GUID relationships and a clear account of missing or incomplete evidence.
- First session
- 25–40 minutes for synthetic examples; 30–60 for a prepared VM. Shorter sessions are welcome.
Independent practice not yet assessed. A worked example, practice drills and verification guidance are included.
Build recall through use
Keep the reasoning when the example changes.
- Follow the worked example and explain each observation.
- Repeat with a short checklist and the answer closed.
- Change one meaningful condition and predict the difference.
- Complete an unfamiliar variant independently, using command help when needed.
- Give a short handover: evidence, conclusion, uncertainty and next check.
- Return on another day and again about a week later.
Record help used and what remains uncertain. Accurate reasoning and a repeatable result matter more than memorising flags or working quickly.