================================================================================
  RED TEAM ATTACK TIMELINE
  Engagement: MegaCorp Industries External Assessment
  Period: 2026-03-15 through 2026-03-28
  Status: IN PROGRESS
  Classification: CONFIDENTIAL - Red Team Eyes Only
================================================================================

  Instructions for Students:
  --------------------------
  This timeline template documents a full red team attack chain against
  MegaCorp Industries. The RECON phase is complete. INITIAL ACCESS has
  partial entries with hints for you to complete. PRIVILEGE ESCALATION,
  LATERAL MOVEMENT, and ACTIONS ON OBJECTIVES are blank -- fill them in
  based on the recon data, vulnerability scan results, and your analysis.

  Use ATT&CK technique IDs where indicated. Reference:
  https://attack.mitre.org/techniques/enterprise/

================================================================================


PHASE 1: RECONNAISSANCE (COMPLETE)
================================================================================

[2026-03-15 09:00] -- OSINT Collection Started
  Action:    Passive reconnaissance using public sources
  Operator:  Red Team Lead
  Technique: T1593 - Search Open Websites/Domains
  Details:   Queried WHOIS, crt.sh, Shodan, LinkedIn, GitHub
  Result:    Identified 10 subdomains, 9 employees, full tech stack
  Evidence:  See recon-data.txt

[2026-03-15 14:30] -- Subdomain Enumeration
  Action:    Active DNS enumeration and brute forcing
  Operator:  Red Team Lead
  Technique: T1590.002 - Gather Victim Network Information: DNS
  Details:   Used subfinder + custom wordlist against megacorp-industries.com
  Result:    Discovered dev, staging, jenkins, gitlab subdomains on AWS
             All in 18.220.134.x subnet -- flat dev/CI network segment
  Evidence:  recon-data.txt, Section 2

[2026-03-15 16:00] -- Technology Profiling
  Action:    Fingerprinting web services and identifying software versions
  Operator:  Red Team Analyst
  Technique: T1592.002 - Gather Victim Host Information: Software
  Details:   HTTP headers, Wappalyzer, public API docs analysis
  Result:    Django 4.2 backend, React frontend, Jenkins CI, GitLab CE,
             WordPress blog, OpenVPN, PostgreSQL, Redis
  Evidence:  recon-data.txt, Section 4

[2026-03-16 08:00] -- Vulnerability Scanning
  Action:    Active scanning of identified hosts
  Operator:  Red Team Analyst
  Technique: T1595.002 - Active Scanning: Vulnerability Scanning
  Details:   Nmap service scan + Nikto web scan on all discovered hosts
  Result:    Multiple critical findings including unauthenticated Jenkins,
             exposed debug modes, default credentials, outdated software
  Evidence:  See vulnerability-scan.txt

[2026-03-16 15:00] -- Attack Path Analysis
  Action:    Prioritized attack paths based on effort/impact/detection risk
  Operator:  Red Team Lead
  Technique: N/A (Planning)
  Details:   Identified 5 viable attack paths; Jenkins script console is
             lowest effort with highest impact
  Result:    Primary: Jenkins RCE; Secondary: Dev default creds;
             Tertiary: Staging credential harvesting
  Evidence:  vulnerability-scan.txt, Section C


PHASE 2: INITIAL ACCESS (PARTIALLY COMPLETE)
================================================================================

[2026-03-17 09:00] -- Jenkins Script Console Access
  Action:    Accessed unauthenticated Jenkins Groovy script console
  Operator:  Red Team Operator
  Technique: T1190 - Exploit Public-Facing Application
  Details:   Navigated to jenkins.megacorp-industries.com:8080/script
             Console accessible without any authentication
  Result:    Confirmed arbitrary Groovy script execution capability
  Evidence:  Screenshot jenkins-console-001.png

[2026-03-17 09:15] -- TODO: System Enumeration via Jenkins
  Action:    ??? (What commands would you run first?)
  Operator:  [YOUR NAME]
  Technique: T1059.004 - Command and Scripting Interpreter: Unix Shell
  Details:   TODO -- Describe what system information you would gather
             using the Groovy console. Think: whoami, hostname, network
             interfaces, environment variables, file system exploration.
  Result:    TODO -- What did you find?
  Evidence:  TODO

[2026-03-17 10:00] -- TODO: Establish Persistent Access
  Action:    ??? (How would you maintain access if Jenkins is restarted?)
  Operator:  [YOUR NAME]
  Technique: TODO -- Select appropriate ATT&CK technique ID
  Details:   TODO -- Describe your persistence mechanism. Consider:
             - SSH key injection
             - Cron job
             - Jenkins job that callbacks
             - Web shell in Jenkins workspace
  Result:    TODO
  Evidence:  TODO

[2026-03-17 11:00] -- ALTERNATIVE PATH: Dev Environment Access
  Action:    Logged into Django admin with default credentials
  Operator:  Red Team Operator
  Technique: T1078.001 - Valid Accounts: Default Accounts
  Details:   Used admin:megacorp on dev.megacorp-industries.com:8000/admin/
  Result:    Full Django admin access on development environment
  Evidence:  Screenshot dev-admin-001.png

[2026-03-17 11:30] -- TODO: Dev Environment Data Harvesting
  Action:    ??? (What would you look for in the Django admin?)
  Operator:  [YOUR NAME]
  Technique: TODO -- Select appropriate ATT&CK technique ID
  Details:   TODO -- What data would you extract from the dev environment?
             Consider: user tables, API keys, database connection strings,
             source code paths, configuration files.
  Result:    TODO
  Evidence:  TODO


PHASE 3: PRIVILEGE ESCALATION
================================================================================

  INSTRUCTIONS: This phase is entirely blank. Based on the access obtained
  in Phase 2, describe how you would escalate privileges. Consider:

  - Jenkins runs as which user? Can you access /etc/shadow?
  - Are there sudo privileges or SUID binaries?
  - Can you harvest credentials from Jenkins credential store?
  - Staging debug toolbar exposed AWS credentials -- can you use them?
  - Redis on staging has no auth -- can you write SSH keys?

  Fill in timeline entries following the format above. Include:
  - Timestamp (continue from 2026-03-17)
  - Action description
  - Operator name
  - ATT&CK technique ID
  - Detailed description
  - Expected result
  - Evidence reference

[2026-03-17 13:00] -- TODO: [Title]
  Action:    TODO
  Operator:  [YOUR NAME]
  Technique: TODO
  Details:   TODO
  Result:    TODO
  Evidence:  TODO

[2026-03-17 __:__] -- TODO: [Title]
  Action:    TODO
  Operator:  [YOUR NAME]
  Technique: TODO
  Details:   TODO
  Result:    TODO
  Evidence:  TODO

(Add as many entries as needed)


PHASE 4: LATERAL MOVEMENT
================================================================================

  INSTRUCTIONS: Describe how you would move from the compromised system(s)
  to other systems in the environment. Consider:

  - All dev/CI hosts are in the same subnet (18.220.134.x)
  - Jenkins likely has SSH keys or credentials for deployment targets
  - GitLab may contain credentials in repository code or CI/CD variables
  - Staging database credentials were exposed via debug toolbar
  - Redis can potentially be used for SSH key injection

  Relevant ATT&CK tactics to consider:
  - T1021 - Remote Services (SSH, RDP, etc.)
  - T1550 - Use Alternate Authentication Material
  - T1563 - Remote Service Session Hijacking
  - T1534 - Internal Spearphishing

[2026-03-18 09:00] -- TODO: [Title]
  Action:    TODO
  Operator:  [YOUR NAME]
  Technique: TODO
  Details:   TODO
  Result:    TODO
  Evidence:  TODO

[2026-03-18 __:__] -- TODO: [Title]
  Action:    TODO
  Operator:  [YOUR NAME]
  Technique: TODO
  Details:   TODO
  Result:    TODO
  Evidence:  TODO

(Add as many entries as needed)


PHASE 5: ACTIONS ON OBJECTIVES
================================================================================

  INSTRUCTIONS: Define and execute actions that demonstrate impact to the
  client. Remember: in a real engagement, you would NOT actually exfiltrate
  real data or cause damage. You would demonstrate ACCESS to objectives.

  Common red team objectives:
  - Access to source code repositories
  - Access to production database (prove access, do not dump data)
  - Access to cloud infrastructure (AWS console or CLI)
  - Domain admin or equivalent privileges
  - Ability to deploy code to production
  - Access to customer/financial data (prove access only)

  Document what you would demonstrate to the client and how.

[2026-03-19 09:00] -- TODO: [Title - Objective Demonstration]
  Action:    TODO
  Operator:  [YOUR NAME]
  Technique: TODO
  Details:   TODO
  Result:    TODO
  Evidence:  TODO

(Add as many entries as needed)


PHASE 6: CLEANUP & REPORTING
================================================================================

  INSTRUCTIONS: Document the cleanup steps and reporting approach.

  Cleanup considerations:
  - Remove any persistence mechanisms installed
  - Delete uploaded files, web shells, or tools
  - Remove injected SSH keys or modified configurations
  - Clear command history where appropriate
  - Restore any modified files to original state

  Reporting approach:
  - Compile all evidence (screenshots, logs, command output)
  - Map every action to ATT&CK technique IDs
  - Write executive summary for non-technical leadership
  - Write detailed technical narrative for engineering team
  - Prepare remediation recommendations prioritized by risk

[2026-03-20 09:00] -- TODO: [Cleanup Steps]
  Action:    TODO
  Details:   TODO

[2026-03-20 14:00] -- TODO: [Report Preparation]
  Action:    TODO
  Details:   TODO


================================================================================
  END OF ATTACK TIMELINE
  Compile findings into final report using the template from theory.html
================================================================================
