What you will learn
- Reading an `auth.log` to tell a brute-force failure wall from the one successful login.
- Reconstructing an initial web foothold (LFI + webshell) from an nginx access log.
- Following an attacker's shell history into the persistence they installed.
- Reading a systemd unit + its script to understand how loot was staged for pickup.
- Reversing a real-world obfuscation chain: base64 over an XOR with a recovered key.
What is inside
- Task 1 · Silent Witness1 question
Sign in to read the tasks, start the machine and answer the questions.