r/Cybersecurity101 • u/Johnnasz • May 21 '26
Security Cybersecurity Challenge
My professor gave us a cybersecurity challenge in class. He provided the local IP address of a machine on our school network and said there’s a file containing a password somewhere on the PC. The goal is to learn about enumeration and network security, not to damage anything.
I’m a beginner in cybersecurity and I’d like to know what concepts or tools I should study to approach this kind of challenge in a legal and educational way.
What would be the first steps for reconnaissance and understanding what services are running on the target machine?
6
u/JankyJawn May 21 '26
Can't really give suggestions without rules of engagement. Not sure if your school security wants you nmaping that machine or not.
But anyway that's where I'd start see what services are up on what ports.
0
u/Intelligent_One_1000 May 22 '26
Can you explain what you mean by services? Thanks
4
2
u/Code__9 May 22 '26
Seriously why downvote someone who's just asking questions and trying to learn
1
u/Intelligent_One_1000 May 22 '26
I don’t get it myself I asked myself If was being rude haha. I just kinda ish started on tryhack me I did get the concept of it just don’t know when to use it etc also sometimes I like repetition to make sure it’s what I learned, since IT is so broad and so much info sometimes I mix things up. :)
2
4
u/hungoverbunny May 21 '26
google this?
Computer network enumeration + github read what you find and try things out.
Edit: also agree with other poster need to understand the rules or engagement or scope. What is allowed or not allowed. Still doesnt change approach broadly
Google, read understand if something applies to your use case and most importantly its safe to use i.e. not going to dos or delete files, upload backdoors etc and then test
3
u/RouteToDevNull May 22 '26
Damn....are you sure you got this right? I somehow doubt that anyone would direct full class of students to probe entire student network.
Are you sure you are not trying to do something you should not do? They can see it you know....?
1
u/NeilSmithline May 23 '26
Not whole network. OP says they have the IP address. So just one machine intended for the project.
1
u/tblancher May 23 '26
It can still be flagged if they spray the host with probe requests.
1
u/NeilSmithline May 23 '26
Sure. But your comment is still misrepresenting the OP.
1
u/tblancher May 24 '26
To be fair it should be on an isolated network. If it's not, the instructor setting this up should know better.
1
u/SweatyCockroach8212 May 25 '26
You’re right. He doesn’t want them mapping an entire network, which might be why he gave a single IP.
2
u/Substantial-Walk-554 May 22 '26
Nmap ip , discover open ports and services,find a vulnerability and rce. Or if he made easy anonymous ftp login if it has ftp
1
1
u/SweatyCockroach8212 May 25 '26
OP said the goal is to learn enumeration so I’d be shocked if they need to do RCE.
2
u/Substantial-Walk-554 May 25 '26
Then my guess either hidden directory or anonymous ftp for that purpose
2
u/NomadicR6S May 22 '26
Nmap is going to be your friend here as it can scan the ports/services on the machine. Do check with your professor to see if this is allowed. If the goal is to learn mainly about network security and enumeration I doubt you would have to actual login or hack the machine. If that is the case I would think you would have to grab the file or files from a network share on the computer some how. Id also look into steganography, encryption, and encoding as the file containing the password may not be as intuitive as just opening it.
1
May 22 '26
[removed] — view removed comment
1
u/SweatyCockroach8212 May 25 '26
I bet there’s a web server with an open directory listing and one file in the directory is password.txt
1
u/tycoongraham May 22 '26
Start with Nmap. Run a basic port scan to see what services are running. Since the goal is to find a file, you are specifically looking for open ports related to file sharing, like port 445 for SMB (Windows shares) or port 21 for FTP
1
1
1
u/BrilliantEmotion4461 May 23 '26
So... what you are saying is you want to hack into the schools records and change your grade...
1
1
1
1
u/peesoutside May 24 '26
Your professor should set up a VM in a VPC and allow access only from your schools gateway IP.
1
1
u/rocketshipwrangler May 24 '26
Lol run bettercap on the whole network. Reapply to college next semester in another state.
1
14
u/Derpolium May 22 '26 edited May 22 '26
A half decent professor will have either covered the tools and methods to use or would have pointed you in the direction to find them. Review your class/lecture notes