Lion Cipher Lab
Keep a tamper-evident engagement log during a penetration test
- Penetration Testing / Red Team
- Intermediate
- ~45 min
- Free · no account required
Why it matters
During a penetration test the client's own security team often sees your activity as it happens. When their monitoring fires at 2 a.m., the first question is 'was that the testers?'. If you cannot answer quickly and precisely, they either waste hours investigating you, or, worse, assume a real attack is you and stand down. An activity log also backs every finding in the final report (what was done, when, and what it showed), and it protects the tester if something breaks during the test, because it shows exactly what was and was not done. NIST SP 800-115 makes data handling part of the…
What you'll learn
- why every engagement needs an activity log
- what to record: time (UTC), operator, target, action, evidence
- hashing evidence files with SHA-256
- hash-chaining log entries so edits and deletions show
- verifying a log and reading where the chain breaks
- the truncation gap and anchoring the head hash outside the log
- answering 'was that you?' during an engagement
Steps in this lab
- What the log is for, and what each entry must hold
- Chain the entries so edits show
- Log a morning of (example) activity
- Verify it, and answer 'was that you?'
- Tamper with it three ways and measure what is caught
- Run it as a working habit