Defensive › Module 10 › Lesson 2
Evidence Pack
Index redacted lab artifacts — OS logs, central test, policy, backup restore proof.
Visual · t16_evidence_pack
Evidence pack = table of contents for YOUR lab work. Original Cyberlium.
Opening
Investigators trust indexed evidence — not a folder called stuff_final2.
Build evidence pack index listing each capstone artifact: path, date, one-line description, redaction note. Include OS log lab, central forward confirmation, policy lab file, backup restore log, hardening checklist references from earlier modules. All from $LAB — no employer tickets, no classmate logs, no production screenshots without authorization. chmod 600 index.
1. Index fields
Artifact name, module lesson, file path, UTC date, description, redactions applied.
Cross-link checklist item to artifact row.
Command guide
Try these commands — Index fields
═══ LINUX / KALI (Penetration Testing & Service Audit) ═══
Port scan and service banner grabbing against authorized target
Command — copy this
nmap -sV -sC -Pn -T4 -p 21,22,80,443,445,3389 ${LAB_HOST:-127.0.0.1}Enumerate web directories and hidden endpoints
Command — copy this
gobuster dir -u http://${LAB_HOST:-127.0.0.1} -w /usr/share/wordlists/dirb/common.txt -q -t 20 2>/dev/null || head -5 /etc/hostsMetasploit framework module inspection (Safe lab syntax)
Command — copy this
msfconsole -q -x "use auxiliary/scanner/portscan/tcp; set RHOSTS 127.0.0.1; set PORTS 80,443; run; exit" 2>/dev/null || echo "Run in Kali msfconsole"
═══ WINDOWS (Audit Target) ═══ Enumerate open listening ports with process mappings
Command — copy this
netstat -ano | findstr /i "LISTENING"
Primary tools to practice this lesson: journalctl, python3, ss. Reference sites: Evidence pack (https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html); NIST SP 800-92 (https://csrc.nist.gov/publications/detail/sp/800-92/final). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Redaction rules
Remove real names, IPs outside lab range, serial numbers if sharing mentor.
Keep enough to prove you did the work on YOUR hosts.
3. Integrity habit
Optional: hash index file after final edit for personal record.
No uploading pack to public repos.
4. What you ship: evidence pack index
Index table with ≥5 artifacts from $LAB modules.
5. What you record before the next lesson
Evidence index path.
6. Wrong vs right: stranger hosts vs YOUR lab hosts
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Include employer incident ticket in student pack without permission.
Right
Index redacted artifacts. Next: walkthrough.
Mission: evidence index
1) List OS log + central + policy + backup artifacts. 2) Add path and date each. 3) Note redactions applied.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Minimum artifacts for capstone?”
Knowledge Check
APPLY: Evidence pack is:
Multiple choice
Knowledge Check
APPLY: True or False: Production screenshots without scope belong in pack.
True or False
Knowledge Check
APPLY: Index should note:
Multiple choice