Openfire

Openfire is a blue team lab that falls under the Network Forensics category and will cover the following subjects: Wireshark, Zui, Network Miner, Brim, Initial Access, Execution, Persistence, Discovery, Command and Control.

Learning Objectives

Reconstruct an Openfire server attack timeline by analyzing PCAP files with Wireshark to identify login attempts, plugin uploads, command execution, and the exploited CVE-2023-32315 vulnerability.

Categories: Network Forensics.

MITRE ATT&CK Tactics: Initial Access, Execution, Persistence, Discovery, Command and Control.

Tools: Wireshark, Network Miner, Brim, Zui.

Difficulty: easy.