January 19, 2016, meetup wrap-up

Nice turnout for tonight's meeting! pic.twitter.com/lDsbFO4GsM

— Cola InfoSec (@cola_sec) January 19, 2016

We had a really good meeting to kick off 2016. We defined some goals for 2016 including, but not limited to:

• malware analysis and reverse engineering
• MOAR CTFs
• Wireless hacking

Then Josh gave a presentation on OSINT, using me as the target. Here are some of the resources he used:

These are some of the links to the facebook OSINT techniques from Michael Bazzell's website I mentioned in my talk last night.
This is a 75 minute demo where he teaches you the basics of OSINT on facebook
https://inteltechniques.com/intel/demo-FB.html

This is the custom facebook search link that includes the PIPL/API search that I've found usually yields some decent information on most targets:
https://inteltechniques.com/intel/OSINT/facebook.html

Finally, we got into the SANS Holiday Hack Challenge. We had some connection issues and didn't get very far, but we definitely had some fun.

I figured out how hard it is to get scapy on Windows 10.

Here's the recording of our meetup.

January 19, 2016 meetup agenda - Gnome in your Home and OSINT

Hello 2016!

We're kicking of the first meeting of the New Year with some OSINT and a hacking challenge.

The plan for this month's meetup, January 19th, 2016, is simple: somplete the SANS Holiday Hack Challenge. The competition might be over, but the fun is still available online. Bring your computers and get ready to have some fun as we work our way through the challenges.

Before that thought, Josh will be giving a short OSINT presentation on yours truly. That's right I told Josh to go find the most embarrassing or most controversial thing online for me.

All that and more for this month's meetup. The fun begins at 6:30 p.m. at IT-ology.

October 17, 2015, CTF wrapup

ColaSec held its first ever capture the flag event this past Saturday. A huge shoutout goes to Ralph Collum and Training Concepts for making the event possible. Ralph pretty much picked up the idea of a CTF event and ran with it for a touchdown. Also a shoutout to Jeff Lang for doing the Tuesday presentation on CTF basics.

We peaked at 10 people participating during the event and had six people stay for the entire four-hour event. It was a valuable experience that everyone seemed to enjoy. We plan to do more of the events in the future. Right now we're looking at doing them twice a year. Stay tuned for more details.

Here are some thoughts and links from Ralph:

"ColaSec participated in its first CTF this past Saturday.  It was a great opportunity to learn some new skills and tools as everyone could learn some new ways to compromise machines and technologies.  This was a great opportunity to engaged in learning as oppose to strict lecture and presentations.  There were a variety of challenges in the machines everything from web applications, password cracking, forensics and crypto.  The list of VM’s available for compromises are listed below in order of target’s assigned to everybody at the meetup.  These types of events are actually a critical element of the security professional’s development, helping to build and maintain skills essential to the protection of our institutions. These events offer a more practical way to learning about vulnerabilities and threats and help the individuals participating in them build their skillset and sharpen their tools in testing and assessing networks are services.  Most of the CTF exercises follow a common methodology of attacks, which include recon/footprinting, scanning, system hacking/exploitation, post exploitation/privilege escalation, and then finally gaining root level access to the environment.  Hopefully, the most important thing that came out of the CTF was that everybody got an opportunity to learn something new and possible find a new way to look at and understand the threats out there.  Finally, even though it might seem like some of the challenges were tough through practice, patience, and dedications these CTF’s can be invaluable to the improvement and development of skills in information security."

• VM Target #1: https://www.vulnhub.com/entry/de-ice-s1100,8/
• VM Target #2: https://www.vulnhub.com/entry/de-ice-s1120,10/
• VM Target #3: https://www.vulnhub.com/entry/de-ice-s1140,57/
• VM Target #4: https://www.vulnhub.com/entry/pentester-lab-electronic-codebook-ecb,67/
• VM Target #5: https://www.vulnhub.com/entry/tr0ll-1,100/
• VM Target #8: https://www.vulnhub.com/entry/pentester-lab-xss-and-mysql-file,66/

I've created an events gallery which features some pictures from the CTF event.

Our next meetup will be November 17, 2015. I've confirmed that the security catalyst, Michael Santarcangelo, will be joining us.

October 13, 2015, meetup wrapup - The CTF is coming.

We had a wonderful meetup with a couple of new faces.

Before we get to the recap, reminder that this Saturday October 17, 2015, we will be doing our first group CTF at Training Concepts. The address:

250 Berryhill Rd # 502, Columbia, SC 29210

Details are on our "Upcoming Events" page.

Onto the meetup. Josh gave a recap of DerbyCon and then Jeff went over some basics for participating in a CTF. His slides are available here: https://drive.google.com/open?id=16QyVo3UUOTMQyiZqAzBuLp2a_mDP9inkMWNj3JKMXwU

We did a Google Hangout again of the entire meetup if you're interested in watching the presentation.

We look forward to seeing everyone at the CTF Saturday.

October 13 and 17, 2015, meetup agenda

This month we will be putting on our first CTF event for ColaSec. We will meet October 13, 2015, at 6:30 p.m. at IT-ology for a CTF primer. The primer will be facilitated by Jeff and we'll walk through some basics and ensure Kali and other tools get installed on CTF machines.
Prior to all that Josh will give a presentation on his experiences at DerbyCon.

Schedule and requirements:

October 13 meetup - CTF Primer - IT-ology 6:30 p.m. - 9:00 p.m.

If you have problems loading Kali we can address them at the meeting. Here is a list of other programs that may be useful for the CTF:

• nmap
• netdiscover
• nikto or wikto
• wireshark
• some form of ssh client
• password cracker(online and offline)
• netcat
• dirbuster
• some proxy
• cookie editor
• steganalysis tool(stegdetect or stegspy)
• hex editor
• picture viewer(infanview)
• debugger(ollydb)
• malware analysis(IDA, PEiD, PEView, PEScanner.py)
• sqlmap

We will figure out teams at the Tuesday meetup as well.

October 17 CTF - Training Concepts - 1 p.m. to 5 p.m.

Ralph is putting together the CTF using VulnHub. He plans to have 3-4 local VMs with 1-2 additional online CTFs.

We will be at Training Concepts for the actual CTF on Saturday. 

250 Berryhill Rd # 502, Columbia, SC 29210

Bring your Kali-loaded laptops or just bring yourself. There will be computers available for people who don't have a laptop to use for the CTF.

September 15, 2015, meetup wrap-up - frameworks for securing things

We had an excellent meeting this month. About 14 people showed up and participated. We had a lot to talk about with BSides Augusta happening Saturday, the CTF planning for next month, and the usual infosec news. After that, Ralph Collum gave us an excellent talk on security frameworks and how to choose the best one. We finished with some videos from J4vv4d.

Next months meetup will be slightly different. We're planning to do two days. We'll meet our usual Tuesday, October 13, 2015, but we're also going to meet the following Saturday, October 17, 2015, for some capture the flag (CTF) fun. Details to come soon.

September 15, 2015, meetup agenda - Security Frameworks

It's looking like the September meetup is going to be jam-packed month for the ColaSec user group. We will wrap-up BSides Augusta, talk about the October CTF, and have a presentation on security frameworks.

BSides Augusta is this Saturday, September 12, 2015, in Augusta Georgia. It is one of the best well run BSides events out there and I highly recommend the event. Did I mention I'll be speaking at the event? The event is sold out, but has a waiting list. They've recently released some tickets, so who knows.

We're planning a CTF event for October. We will have a Tuesday primer meetup followed up by a CTF competition on the following Saturday. If you would like to participate fill out this Google survey and let us know what weekend in October works best for you: http://goo.gl/forms/ULuA1Jt3im

Finally, we're planning on having a presentation on security frameworks for this months meetup. If you have to decide on a framework for your organization, which one is the best one for your organization?