Echo Trail – OffSec Proving Grounds Practice Machine | Cyber Security Penetration Testing Lab

1. Which file was attached to the phishing email that started the compromise?

ngo_update.png

2. What was the entire URL associated with the phishing page?

http://login.mcrosoft.com/login.html

3. What is likely the PHP attacker file name responsible for intercepting the credentials?

login.php

4. What is the valid Azure's password obtained through phishing?

Jopa373424

5. What hostname did the attacker present in EHLO?

attacker01

6. What failure specific message is provided in Azure when MFA is not succeeding?

Authentication failed during strong authentication request.

7. At what specific timestamp the attacker succeeded in logging in with the victim account? Format the answer as HH:MM:SS

08:15:49

8. Which Azure CLI subcommand initiated the server connection from Cloud Shell?

az ssh arc --subscription 65f29041-a905-45dd-aebd-6fbf877ed89e \

9. From which table were records extracted?

donorrecords

10. Which process image shows execution of the mysqldump.exe utility?

C:\Program Files\MariaDB 12.0\bin\mysqldump.exe