Joseph McCray

Courses by Joseph McCray

Posts by Joseph McCray

All new Advanced Threat Hunting with Splunk

When it comes to log analysis Splunk is one the most popular enterprise grade solutions in the field today. It can pull logs from nearly any device in the network, and it can integrate with most of the popular security products on the market. In the InfoSec field today Splunk is a common tool for what called Cyber Threat Hunting/Hunt Teaming/Malware Hunting/Defensive Cyber Operations (DCO)/Cyber Threat Analysis and many other names.

As popular as Splunk is – surprisingly few people are comfortable performing security event analysis with it. We decided to develop a Hands-on Splunk course designed specifically for InfoSec Professionals that want to do HANDS-ON DEEP TECHNICAL SECURITY ANALYSIS with Splunk.

The course price is $200, but the first 5 signups get it for $100 – so signup now!

Class Syllabus

Module 1: Deploying Splunk, configuring logging and forwarding

  • Installing Splunk
  • Configuring logging in Windows and Linux
  • Setting up log forwarding
  • Understanding how Windows Event logging works

The course price is $200, but the first 5 signups get it for $100 – so signup now!

Module 2: Attacking Servers and Workstations

  • Learning attacker tools/tactics/procedures (TTPs)
  • Generating real world security events to analyze
  • Attacking Workstations
  • Attacking Application Servers
  • Learning what types of security events generate log events
  • Writing basic queries for common attacks
  • Analyzing PCAP files with Splunk

Module 3: Hunting with Splunk

  • Data-Centric vs End-Point Hunting
  • Understanding IOCs/IOAs
  • Indicators of Compromise (IOCs)
  • Indicators of Attack (IOAs)
  • Integrating data from popular security products
  • Writing complex queries
  • Detecting Zero-Day attacks

The course price is $200, but the first 5 signups get it for $100 – so signup now!

Who is this class for?

IT System Administrators, IT Security Professionals, SOC Analysts, First Responders, Incident Handlers, Intrusion Analysts, Malware Analysts

Class pre-requisites

Students should be familiar with using Windows and Linux operating environments and be able to troubleshoot general connectivity and setup issues.

Students should be familiar with VMware Workstation and be able to create and configure virtual machines.

Students are recommended to have a high-level understanding of key programming concepts, such as variables, loops and functions; however, no programming experience is necessary.

Students will be provided with detailed courseware, detailed lab manuals, and copy/paste notes so that even if student is not very strong technically they will be able to complete the lab exercises and take notes effectively.

Class Schedule & Delivery Method

This class is a completely self-paced course that will go live on Monday the 13th of August at midnight. You can access the course by clicking on the “My Courses” link in the top right corner of

Students will receive

  • 24 hours of CPEs
  • Several virtual machines
  • Courseware slides
  • Lab manual

Videos are in the actual course module lessons in the InfoSec Addicts website.


Students can request help via the support chat system in the site or via the email based trouble ticketing system (allow 24 hours for a response). Send all questions/concerns to [email protected]


The course price is $200, but the first 5 signups get it for $100 – so signup now!


Ultimate Hacklab – Self Paced (SP)

Ultimate hacklab – Self Paced (SP) – prep for hacking challenge lab exams like OSCP, LPT, eCPPT, and soon even the new CEH is going to be a hacking challenge lab as well.

If you really want to know what it takes to pass hack lab challenge-based exams like OSCP, LPT, eCPPT then ultimate hacklab is for you and it’s only $200.

The InfoSec Addicts Ultimate hacklab – Self Paced (SP) – is best way for you to practice the skills required for almost any hands-on lab based penetration testing/ethical hacking certification.

The Ultimate hacklab – Self Paced (SP) – gives you the opportunity to follow along with a structured and very detailed training program, and/or make your way through the labs and just ask for help whenever you get stuck. You can run almost any tool and try almost attack in the environment. The class is self-paced. You can sign-up ANYTIME, and start IMMEDIATELY.

The program outlines how to create your own lab environment or you can connect to the InfoSec Addicts lab environment with almost any platform (Windows, Mac OS X, Kali Linux, other Linux distros) to go through the lab exercises.

Class syllabus:

  • Module 1: Connecting via VPN to the lab network
    • Connecting to the VPN with Windows
    • Connecting to the VPN with Mac OS X
    • Connecting to the VPN with Linux
    • Connecting to the VPN with Kali
  • Module 2: Scanning
    • Nmap
    • Net-Discover
  • Module 3: Module X: Enumeration
    • nmap NSE
    • rpcinfo/showmount
    • nbtstat
    • enum4linux
  • Module 4: Brute-forcing
    • Hydra
    • Medussa
  • Module 5: Vulnerability Scanning
    • Nessus
    • OpenVas
  • Module 6: Attacking web servers/web apps
    • Manual XSS/SQL Injection/LFI/RFI
    • Nikto
    • Dirbuster
    • Burp Suite
    • w3af
    • Arachni
  • Module 7: Compiling/Modifying Exploit code
    • Compiling code in Windows
    • Compiling code in Linux
    • Finding offsets
    • Changing out shellcode
  • Module 8: Client-Side Exploitation
    • Metasploit
    • Social Engineering Toolkit
  • Module 9: Transferring files
    • FTP
    • TFTP
    • VBscript
    • Debug,exe
    • wget/linux/bitsadmin
    • PowerShell
  • Module 10: Privilege Escalation
    • Linux
      • SUID binaries
      • Shell escapes
    • Windows
      • Identifying vulnerable services/misconfigurations
      • beR00t.exe
  • Module 11: Data-mining a compromised host
  • Module 12: Hashcracking
  • Module 13: Pivoting
    • Netcat/Socat pivot
    • SSH Pivot
    • Metasploit pivot
  • Module 14: Lateral movement
    • psexec
    • smbexec
    • winexe
  • Module 15: Data Exfiltration
    • ICMP Tunneling
    • DNS Tunneling
  • Module 16: Reporting


Lab Network Access

Targets in the lab network will change on the 1st of every month. Students have the option to purchase 1 months access to the lab environment for $25.


Students will receive:

  • Up to 124 hours of CPEs (24 CPE for the actual training and the rest come from labs and challenges completed by the students)
  • Several virtual machines
  • Courseware access
  • Lab Manual
  • Lab access


Class Videos

Each course module has a corresponding video that demonstrates the task being performed. So you can see each individual lesson’s skill or task that is being described actually being performed.


Each student will have access to an InfoSec Addicts Group ( for the class. Additionally, this is where they can work with other students on lab exercises, homework, and challenges. An InfoSec Addicts class mentor will be assigned to the group to answer questions (allow one day for responses). Likewise, a Customer Relationship Manager will get assigned to the class to manage questions and support issues.


Class Schedule

The class is self-paced. You can sign-up ANYTIME, and start IMMEDIATELY.

Fill out this form below to sign up for the class.

$100.00Add to cart



Was sick, my mother passed away, but now I’m back on track

I want to thank all of you well wishers. The last few months have been crazy for me. I’ve been in and out of the hospital several times, my mother passed away a few days ago, my birthday was on the day I burried my mother (Mother’s Day).

My mother was very sick so honestly her passing was a painful but good thing as her suffering is finally over. My family got together and had a celebration of her life instead of a funeral.


So again to all of you thank you.

My medical issues are under control now, and we’ve dealt with my mother’s passing so I’m back to work next week.

I’ll be teaching Advanced Metasploit, and Python as night classes so I decided to bundle them for $100 (they are usually $100 each).

Click here to register for this class bundle for only $100
Next-Level Metasploit 21st and 23rd of May 2018
– Mon, May 21, 2018 7:00 PM – 9:00 PM EDT
– Wed, May 23, 2018 7:00 PM – 9:00 PM EDT


This is an advanced Metasploit course that will focus on the fundamentals of Ruby (specifically for Metasploit), metasploit automation, and writing auxilliary modules and exploits for Metasploit.
Python for InfoSec Professionals 28th and 30th of May 2018
– Mon, May 28, 2018 7:00 PM – 9:00 PM EDT
– Wed, May 30, 2018 7:00 PM – 9:00 PM EDT


This is a Python for security professionals course. In this course I’ll be covering both log and pcap analysis with Python, as well as network/web app testing with Python.

This course is really designed for people that are NOT very comfortable with programming.


Class Videos

Each class will be recorded and made available to the students via email. So you can keep up with the class even if you have to miss time or even a whole day.


Each student will receive access to an InfoSec Addicts Group ( for the class. Groups are where students can ask questions outside of the regular class hours, work with other students on lab exercises, homework, and challenges.

A class mentor is assigned to the InfoSec Addicts Group to answer questions (allow one day for responses).

Similarly, a Customer Relationship Manager is assigned to the class to manage questions and support issues.


Class Schedules

Next-Level Metasploit 21st and 23rd of May 2018

– Mon, May 21, 2018 7:00 PM – 9:00 PM EDT
– Wed, May 23, 2018 7:00 PM – 9:00 PM EDT

Python for InfoSec Professionals 28th and 30th of May 2018

– Mon, May 28, 2018 7:00 PM – 9:00 PM EDT
– Wed, May 30, 2018 7:00 PM – 9:00 PM EDT


Click here to register for this class bundle for only $100



Unlimited classes:

If you know that you are interested in this class as well as other InfoSec classes then you should consider the unlimited classes package for $49.99 per month. You can find out more about it by clicking on the link below:


NOTE: Due to Joe McCray’s travel and work schedule (ex: short notice consulting/training engagements or changes to those engagements) classes may reschedule or cancel. In these situations a refund will NOT be granted as the class will re-run the following week, or additional days will be added to the class schedule to make up for this.

Low level of interaction honeypots




Honeypots could be categorized according to the level of interaction with the system into three main categories: low level of interaction, medium level of interaction, and high level of interaction. I will discuss the low level of interaction honeypots in this article.


When using these type of honeypots, it is not possible to receive a large amount of data from such a honeypot system compared to the other systems where more and more amounts of data could be collected from them. The advantages of this type of honeypots are given neatly in the following points:

  • They have very limited interaction with the system. This implies that there is no high risk that could arise from an attacker from dealing with this honeypot type of system. To illustrate, there is no operating system in place for an attacker can interact with.
  • The main usage of this type of honeypots is that any traffic coming into the network could be easily identified and captured by such honeypots. Also, new viruses and new worms are identifiable by such honeypots as well.
  • Getting this type of honeypot configured and installed into the network is a simple task. Understanding this type of honeypots and dealing with them from the organization’s perspective is equally easy.
  • The most used honeypot in this category of low-level interaction honeypots is what is referred to as Honeyd. This is considered as a really important honeypot when it comes to the low level of interaction honeypots. The latest and most stable version is 1.5c, which was released back in 2007. I will talk about Honeyd more in detail. This will include how to use them in practice and modern approaches to using them in another article to be published soon. So stay tuned! 😊

In a nutshell, through this type of honeypots, there are only one or more services that have to be simple and available for the attacker to interact with. All communication attempts with any particular services such as a web or SSH server are logged and investigated afterward. These types of honeypots are considered as simple daemons that help a network administrator get to monitor any attempts of attacks on the system in a passive manner. The host operating system, in this case, is for sure free of any vulnerabilities that could be possibly exploited by an attacker. Thus, this makes such kinds of honeypots safe and secure from the organization point of view. On the other hand, this type of honeypots cannot be used for the sake of simulating a complex environment where interaction is a must, such as a Simple Mail Transfer Protocol (SMTP) server.

Security risks of using the low level of interaction honeypots?


When dealing with low interactive honeypots like Honeyd, there are some security risks. These risks mainly lie in the fact that it is really simple to get to know that a Honeyd is a trap. A Honeyd is easy to detect even when we do not configure our honeypot with our settings. The reason for that is a honeyd drops all the connections until it becomes impossible for it to deal with them anymore. Even when SYN package is not that good, the connections get terminated.

This information could assist any attacker in finding out that the targeted system is not a real one but a honeypot trap system. When an attacker checks the connections of the system, he will be capable of discovering that he fell into a trap, not a real system. Things are very clear in this case. Dropped connections are easily detected by the monitoring tools which an attacker uses, and these dropped connections imply the fakeness of such honeypot systems.

Low interaction honeypots get services emulated by an operating system, yet they are not real services. This very basic information becomes of valuable use for an attacker who wants to draw his conclusions about the fakeness of a website. Complicated services cannot get handled using such low interaction honeypots as well. Hence, breaking the system with the use of this technique becomes powerful. What an attacker needs to do is to merely look for information throughout the network. This is because, in the case of low interaction honeypots, the network stack is the one which we deal with.

Another major problem of low level of interaction honeypots is the fact that they depend on the resources of the system that they are deployed on. Removing such resources, as a result, leads to a great notable feature which is latency. This could be checked through a ping test where the response will occur much later than how it was before getting the resources of the system removed. The system will hardly reply with an answer to our ping. This could indicate that the attacker is dealing with a Honeyd or Nepenthes. We can even use these approaches to detect the type of honeypot which we just deployed.

Leaving the deployed low interaction honeypot open for several days in a row is also a great way to come up with some important conclusions. The requests that are received by our honeypot should be greatly taken care of such that any responses by our system should be believable and make sense to the attacker. The attacker should be fooled by the responses to the extreme that they believe that it is an actual running system. Nevertheless, when it comes to low interaction honeypots, SSH server is up and running while there are no generated replies or answers when talking to port 22. This trivially indicates that the system is not a real one because its responses are not appropriate, making the system not secure in the first place.




What are the levels of interactions in honeypots?

Honeypots could be categorized according to their aims such as prevention, detection, and of course response. In addition to that, we can categorize them according to their level of interaction with the real systems. This level of interaction determines the intensity of the interaction between an attacker and the systems of an organization’s network. To elaborate more on this point, if a honeypot has a high level of interaction, then this implies that the attacker can interact much more critically with the system, opposed to low levels of interaction where the attacker will not interact with the real systems in a critical manner. If we need to collect much more amounts of data, then a high level of interaction is recommended. On the contrary, this aspect comes with its risks which make the high levels of interactions really dangerous parts of the network. This is, of course, an undesirable feature which we need to abolish. In general, we have three categories for the levels of interaction: low interaction, medium interaction, and high interaction.

The most common type of classification is based on the level of interaction which is provided to the malicious user by the honeypot. The more interactive an environment is presented, the closer the honeypot becomes to the actual targets of an attack. This translates to potentially gathering more accurate information. The downside is that the more realistic honeypots present greater challenges to configure and setup.


An organization should decide on which level of interaction works best for its purposes and goals out of the configured honeypots inside its network. I will explain the three levels of interactions in detail throughout the following three points; I will advise when each level of interaction is useful and when it should be avoided.

  1. Low level of interaction:

An example is Honeyd. I talked about this in another article titled “low level of interaction honeypots.”

  1. Medium level of interaction honeypots:

This is a more advanced type of honeypot where more information could be available if used. Despite the fact these type of honeypots still don’t contain an operating system which could simply get exploited, there is a bigger chance that attacks could get through the system using this sort of honeypots. The problem arises from the fact that there exist many more security holes through which an attacker could simply get into the system and exploit it. Obtaining much more information and more attacks from the hackers that are complicated is possible in this case. The following honeypot names could be used to exemplify the medium level of interaction honeypots that are infamously in use nowadays: Mwcollect, honeytrap, and Nepenthes. I will also talk about some of these honeypots in another article and implement them in practice.

To summarize what was mentioned regarding medium interaction honeypots, they are used to get some collections of software-emulated such that an attacker could become more convinced that it is, in fact, the actual system while he just accessed a honeypot system. In this case, the host operating system is still shielded. Nevertheless, getting a collection of software-emulated through the honeypot as we desire is not, in fact, a simple task at all. The reason for that lies in the fact that the response of such emulated collection of software should be almost identical to the response of the same actual programs. Still, we, of course, do not need to raise any real security issues here for these programs; otherwise, there is a real danger. Finally, the possibility of comprising the system exists here in fact with a higher percentage. This is basically because the vulnerable points that are kept for the attackers are considerable, and he can exploit a hole in the actual system to perform his malicious activity.

  1. High level of interaction honeypots:


This type of honeypots is considered the most advanced type of honeypots in general. First of all, these types of honeypots contain an operating system. What does this imply? We can simply infer that an attacker can possibly undertake anything on such an advanced honeypot system. However, an organization, in this case, is capable of getting more and more data about the attack type, source, and nature indeed.

This type of honeypots allows the user to have no restrictions to perform whatever tasks and actions that are desired by him. From this point comes the real danger of using such honeypots inside an organization. They are also very time-consuming honeypots to configure and implement. Moreover, it is much more difficult to be able to maintain such type of honeypots for a long time.  The most common name in this category of honeypots is Honeywell. This is a very important high level of interaction honeypot. I will also come back to it in another article and see how it could be configured in practice.

So, as I just mentioned, in this type of honeypots, actual instances of programs are used, not merely the emulations of them. An administrator has to choose this type of honeypots if he needs to grant an attacker root access to the machine and analyze how he will react then, and what actions he wished to do. The risk of implementing this type of honeypots is high. It is, in fact, the riskiest type of honeypot, yet it grants an administrator the greatest potential to get data collected about the attack and the attacker as well. Supervision of such honeypots is a must since such types of honeypots could become a zombie or a jumping point to perform more attacks on the systems inside the network.




Introduction to Honeypot Security

What is a honeypot?

Why is it important to talk about honeypots?

As the internet becomes more viral among us, we use it for every single task in our daily lives. The security issues related to the usage of the internet becomes much more critical and worth mentioning. We use the internet for different purposes, like sending or receiving emails, purchasing different desired goods online, getting our bills paid through online channels, and playing online games.

However, how much do we know about security and the different potential attacks surrounding us and threatening our “online lives?” In this regard, a victim’s computer may become utilized by an attacker to get through a network and place malicious pieces of code in there as he desires. In the meanwhile, a computer may become exploited to act as a zombie to get other victim systems infected by the code.

Technology always goes on developing and becoming more used in different fields. As a result of this issue, new attacks become used by “bad guys” to do some bad stuff. What we should do in response is to be fond of the security aspects and get to learn how to defend ourselves or our computers against any possible attacks that may have great damage to the system. Honeypots are considered an effective tool of security that has been growingly used in the last decade to defend big networks against any possible attacks that could cause harm to an entire organization.

A honeypot is a well-designed system that aims to get any attacker attracted to it. Accordingly, the behavior of the attacker could be easily monitored when he gets into the honeypot. Any processes initiated by the attacker or any malicious behavior become easily recognized the second after he gets through the trap of honeypot. Thanks to these modifications, accurate information about various types of attacks can be recorded. So, as I just mentioned, a honeypot is simply a trap system or machine, which is intentionally created to look exactly like the actual system such that an attacker gets into the trap and falls into the honeypot.

Why do we essentially do this for? Basically, we need to watch the attacker, analyze his behavior, and understand what he does on our beloved system. We need essentially to know his behavior to protect our actual system against him. This could greatly help us to get to develop more secure systems. This also adds to the network administrators’ knowledge through knowing more about the new ways to get information from a victim machine using forensics tool. Moreover, any new technology attacks become easily well-known of through honeypots such that they become useful for preventing future threats.

There are some ways in which researchers and developers can work to protect the software that they write. Some are proactive, like code reviews and regression testing, while others are reactive, like the pwn2own contest where new vulnerabilities are used to exploit browsers. Some tools can take on aspects of both; one class of these tools are honeypots. The term honeypot was first presented by Lance Spitzner in 1999 in a paper titled To Build a Honeypot.


One useful practice to help network administrators get to know about the efficiency of their created honeypot is summarized in this paragraph. It is always advisable that a network administrator builds the honeypot on a machine in which he already knows all the security flaws and weaknesses. Then, the administrator should attempt to break the system and exploit it. In the same time, he should depend on his security forensics tools to investigate the system and identify the tracks which the proposed hacker left behind. In addition to testing for the efficiency of a honeypot, an administrator has to be greatly aware of the proper place to put the honeypot inside the network. Also, he should get to discover what pitfalls the honeypots have on the system or the network.

Honeypots are unique because they allow a security researcher to see and record what actions a malicious user takes on a compromised computer without necessarily interfering or revealing to the attacker that they are being monitored. Because of this invisibility, valuable intelligence can be gathered about the actual strategies of an attacker. A honeypot can be configured to be either proactive or reactive to attacks depending on the needs of the person who set it up.

How can we define honeypots?

A honeypot is essentially a computer system. In this computer system, there exists some files and directories like any other usual computer system. A honeypot aims to attract an attacker to fall into its trap and investigate his actions and follow his behavior. In fact, a honeypot is not an actual system yet it is an intentionally fake system. The difference between a honeypot and other security systems lies in the fact that a variety of security problems could be tackled at once using diverse approaches by depending on honeypots.

On the contrary, other usual security systems are used to tackling one certain problem through a proposed solution. An instance of this point could be seen in the scenario when a compromised system is investigated after having a log of malicious activity. At the same time, new threats could be recognized through implementing a honeypot in a network and hence attempt to tackle these problems and overcome them effectively.

To an outside attacker, honeypots are indistinguishable from the actual production servers. Thus, they will not behave any differently when attacking them. However, the network security team can monitor the honeypots for recorded attacks and later analyze them. The honeypots can also help to absorb attacks directed against the real server.




FREE Exploit Development webinar

Exploit developmentIn this FREE webinar Joe McCray will cover the fundamentals of exploit development and modifying public exploit code on penetration tests. This webinar is designed for people with little to no exploit development or programming experience.

This webinar will be held on the 22nd of February at 1pm EST

Click the link below to sign up for this webinar:


Free Advanced Network Penetration Testing webinar

network penetration testingIn this FREE webinar Joe McCray will cover the fundamentals of the network penetration testing, and how to perform basic penetration testing tasks. This webinar is designed for people with little to no network penetration testing experience.

This webinar will be held on the 1st of February at 1pm EST

Click the link below to sign up for this webinar:

network penetration testing

Free Python For InfoSec Professionals webinar


In this FREE webinar Joe McCray will cover the fundamentals of programming, and how an InfoSec Professional can use Python to perform common IT Security tasks. This webinar is designed for people with little to no programming experience.

This webinar will be held on the 25th of January at 1pm EST

Click the link below to sign up for this webinar:

Free Introduction to Metasploit webinar


In this FREE webinar Joe McCray will cover the basics of Metasploit, and how to perform common penetration testing tasks with it. This webinar is designed for people with little to no penetration testing experience.

This webinar will be held on the 18th of January at 1pm EST

Click the link below to sign up for this webinar:


FREE Intro to Network Penetration Testing webinar

network penetration testing

In this FREE webinar Joe McCray will cover the fundamentals of the network penetration testing, and how to perform basic penetration testing tasks. This webinar is designed for people with little to no network penetration testing experience.

The webinar will run on the 12th of January at 1pm EST

Click the link below to sign up for this webinar:


network penetration testing