Quiz: Module 2 Assignment: The Junior Analyst Assessment Assignment Overview Congratulations on making it through the technical core of network security. In the real world, a junior Security Operations Center (SOC) analyst or penetration tester is judged not by what they say they know, but by the data they can extract and present. In this assignment, you will act as a junior analyst hired to investigate a target network. You will be required to capture live traffic, enumerate a target using industry-standard tools, and build an Open Source Intelligence (OSINT) profile. This assignment pulls directly from the hands-on tutorials in Lessons 2.1, 2.2, and 2.3. Objective Prove your ability to capture and filter network traffic using Wireshark. Demonstrate proficiency with Nmap scanning flags and output interpretation. Apply Passive Reconnaissance techniques (Google Dorking, Shodan) and articulate the difference between passive and active recon. Part 1: Network Forensics with Wireshark (30 Points) Prerequisite: Your Kali Linux and Metasploitable 2 VMs must be running on your VirtualBox Host-Only network. The Scenario: You suspect an unauthorized SSH connection was made to the Metasploitable 2 server. You need to capture the traffic and prove the connection occurred. Your Tasks: Open Wireshark on Kali Linux and start a capture on your eth0 interface. Open a terminal and SSH into your Metasploitable 2 machine (Username: msfadmin, Password: msfadmin). Once logged in, run the command ls -la, then type exit to log out. Stop the Wireshark capture. Deliverables for Part 1 (Provide Screenshots and Text): Screenshot 1: Apply the display filter tcp.port == 22. Take a screenshot showing the filtered list of SSH packets. Screenshot 2: Right-click one of the SSH packets, select “Follow TCP Stream”. Take a screenshot of the pop-up window showing the conversation. Question: Look at the middle pane (Packet Details) of the very first SSH packet in your filtered list. Expand the “Transmission Control Protocol” section. What are the exact Flags set to for this first packet? (e.g., SYN, ACK, PSH, etc.) Part 2: Target Enumeration with Nmap (35 Points) Prerequisite: Ensure you can ping Metasploitable 2 from Kali. The Scenario: Management has asked you for a complete inventory of all open doors and software versions running on the Metasploitable 2 server (IP: Use your specific Metasploitable IP address). Your Tasks: Execute the necessary Nmap commands against your Metasploitable 2 VM to answer the following questions. Do not guess; your answers must come directly from Nmap output. Deliverables for Part 2 (Provide Screenshots and Text): Screenshot 3: Run an Nmap SYN scan against all 65,535 ports. Take a screenshot of the final output showing the list of open ports. (Note: Ensure the command you used is visible in the terminal screenshot). Question 1: Based on your full port scan, exactly how many ports are listed as “open” on this machine? Question 2: Run a version detection scan. Look at the output for Port 21. What is the exact name and version of the FTP software running? Question 3: Look at the output for Port 445. What is the name of the service running on this port? Question 4: In 2-3 sentences, explain why you chose the specific Nmap flags you used for this task, and why you didn’t just use a default nmap [IP] command. Part 3: The OSINT Dossier (Passive Reconnaissance) (25 Points) Prerequisite: You only need a standard web browser for this section. The Scenario: Before you are allowed to actively scan a client’s network (like you did in Part 2), you must first build a profile using only Passive Reconnaissance. Your client is a large state university (e.g., any .edu website). Your Tasks: Use Google Dorking and Shodan to gather intelligence. Deliverables for Part 3 (Provide Text Responses): Question 1: Construct a Google Dork to find Microsoft Excel spreadsheet files (.xls) containing the word “budget” on university websites. Write down the exact search query you used. Question 2: Go to Shodan.io and search for: port:23 country:US (This searches for Telnet servers in the US). Briefly describe (2-3 sentences) why finding an open Telnet port on a modern network is a massive security failure. Question 3: Compare the Nmap scan you did in Part 2 to the Shodan search you just did. If a system administrator at a company looks at their firewall logs tomorrow, will they see your IP address from the Nmap scan? Will they see your IP address from the Shodan search? Explain why. Part 4: The Consultant’s Pitch (10 Points) As discussed in Lesson 2.3, one of the easiest ways to monetize beginner cybersecurity skills is by selling “Passive Recon Audits” (also known as External Footprinting or Attack Surface Management) to local businesses that have no idea what they have exposed to the internet. Your Task: Write a short, 4-5 sentence “Cold Email” pitch that you could send to the owner of a local accounting firm. Goal: Convince them to pay you $150 to perform a Passive Recon audit of their company. Requirement: You must mention at least one specific thing you will look for (e.g., exposed databases, leaked credentials, unpatched devices) using non-technical language that a business owner would understand and fear. Submission Checklist (Before you submit, ensure you have:) Screenshot 1: Wireshark filtered for Port 22. Screenshot 2: Wireshark Follow TCP Stream window. Text answer identifying the TCP Flags of the first packet. Screenshot 3: Nmap full port scan (-p-) showing the command and open ports. Text answer stating the total number of open ports. Text answer identifying the exact FTP software version on Port 21. Text answer identifying the service on Port 445. Text answer justifying your Nmap flag choices. Text answer providing the exact Google Dork query used. Text answer explaining the danger of open Telnet ports. Text answer comparing Nmap logging vs. Shodan logging. A 4-5 sentence cold email pitching a Passive Recon audit. Instructor Evaluation Rubric (How you will be graded) Technical Execution (40%): Are the Wireshark and Nmap screenshots clear, unedited, and demonstrating the correct commands/filters? Did the student successfully map their virtual lab network? Analytical Accuracy (35%): Are the answers regarding port counts, software versions, and TCP flags correct based on the standard Metasploitable 2 configuration? Did the student accurately explain the difference in traceability between active and passive recon? Methodology Understanding (15%): Does the student’s justification for Nmap flags show an understanding of stealth vs. noise, and comprehensive scanning vs. default scanning? Business Communication (10%): Is the cold email professional, persuasive, and does it accurately translate a technical passive recon concept into a business risk? (Note for LMS Admin: Set this up as a “File Upload” assignment where students compile their screenshots and text answers into a single PDF or Word Document, or use an “Online Text” assignment with a file upload addon for the images). - The Acinge Network
Skip to content
