T-IK-1 — Insights + Kartis, 1 day

Lab guide · Isla Mercantile Group · 380m net (09:00–16:30)

Schedule

Before you start

Log in

Your slip has your own credentials. Nobody shares a login; working in pairs on one login (one drives, one checks) is fine.

In Center, switch the UI to EN on first login. Your Center organisation team-NN has one customer: Isla Mercantile Group (team-NN). traineeNN and kNN are both members of team-NN and work on that same customer.

Shared environment

• One Insights for the whole group. Tags are shared: every team sees the others' tags appear.
• Custom views are shared: every view you save is in everyone's list. Prefix the name with your team or login (webshop — chain); do not change or delete a view you did not create.
• There is no personal reset. Do not delete data, uploads or tags you did not create.
• Tag rule: tag only hosts of your own app, one person per host, never remove tags you did not set. Full convention: Tag convention.
• Center and the Kartis pages keep state per team customer: register upload, posture runs, finding status and labels are shared by traineeNN and kNN of the same team, and invisible to other teams.
• Traffic replays (probe chapters) are started by the trainer. You need no shell on the server.
• AI: the Insights Chat is available in the Insights blocks. The Kartis pages have no AI.

Isla at a glance

Client: Isla Mercantile Group, retail and payments, Curaçao. Internal names <host>.<app>.isla.test in 10.20.0.0/16; public names <vhost>.isla.edu.eoncore.net.

Hosts outside isla.test and isla.edu.eoncore.net are background noise. Search isla.test to hide them.

Client documents (handed out per block): client brief, ckm-intake.xlsx, register.xlsx, register-flawed.xlsx.

Exercises

I-M0 — Welcome & client brief

09:00 · 15 min

I-M1 — Crypto 101

09:15 · 45 min

I-M2 — How Insights sees (live)

10:00 · 30 min

I-M3 — Dashboard tour

10:45 · 60 min

I-TAG — Tag teams: build the chain

11:45 · 45 min

K-1 — Outside-in with Kartis

13:15 · 45 min

I-M7 — Threat on the wire

14:00 · 35 min

The trainer plays the beacon chapter at the start of the block.

I-M8 — Quantum & CBOM

14:45 · 35 min

The hook to A1 (crypto agility) follows this block in some tracks.

A1 — Crypto agility

15:20 · 10 min

No exercise. Discussion question: NIST deprecates an algorithm Isla uses for card payments. Who at Isla knows how long replacing it takes, and where is that written down?

I-M11 — Capstone (inside + outside)

15:30 · 50 min

The trainer plays the capstone chapter (and beacon if not played earlier). Per team, for your own app:

Expected: one inside-only, one outside-only and one both finding per app, plus the weakest link.

Queries, live checks and templates

Queries

Run these through the Insights Chat. The Chat only accepts SELECT/WITH and rejects any query containing words such as INSERT, UPDATE, DELETE, ALTER, CREATE, REPLACE, SET anywhere in the text.

A.1 Chain view (I-TAG.2, I-M11)

Replace app:webshop with your app.

SELECT
    hostname,
    toString(any(ipv4))                                  AS ip,
    arrayDistinct(groupArrayArray(tags))                 AS all_tags,
    arrayFirst(t -> startsWith(t, 'tier:'),  all_tags)   AS tier,
    arrayFirst(t -> startsWith(t, 'owner:'), all_tags)   AS owner,
    anyLast(security_level)                              AS level,
    multiIf(level = 'insecure', 1, level = 'weak', 2,
            level = 'secure', 3, level = 'recommended', 4, 5) AS ladder_rank
FROM hosts
GROUP BY hostname
HAVING has(all_tags, 'app:webshop')
ORDER BY ladder_rank, tier

A.3 Beacon interval (I-M7.A)

SELECT src_ip, dst_ip, sni, ja3, count() AS beacons,
       arrayDifference(arraySort(groupArray(toUnixTimestamp(timestamp)))) AS intervals_s
FROM tls_hellos
WHERE sni = 'cdn-update-check.net'
GROUP BY src_ip, dst_ip, sni, ja3

Live checks

Against the Isla public sites. Always pass -servername: web-b routes by SNI, and a client without SNI lands on pay. OpenSSL 3 needs @SECLEVEL=0 in the cipher string for 3DES and TLS 1.0; drop :@SECLEVEL=0 on LibreSSL (openssl version tells you which one you have). Some Linux distributions block TLS 1.0 in the system crypto policy even with @SECLEVEL=0; B.1b shows whether yours does. If it does, use testssl.sh or pair with someone whose client can.

B.1 3DES on pay (I-M2.3, K-1.6, C6.1)

openssl s_client -connect pay.isla.edu.eoncore.net:443 -servername pay.isla.edu.eoncore.net \
  -tls1_2 -cipher 'DES-CBC3-SHA:@SECLEVEL=0' </dev/null

B.1b Control: can your client speak TLS 1.0? (C6.2, K-1.5, I-M11)

openssl s_client -connect pay.isla.edu.eoncore.net:443 -servername pay.isla.edu.eoncore.net \
  -tls1 -cipher 'DEFAULT:@SECLEVEL=0' </dev/null

Handshake succeeds: your client can test TLS 1.0. no protocols available or a failure before any server answer: your client refuses TLS 1.0, and B.2 proves nothing.

B.2 TLS versions on intranet (K-1.5, C6.2, I-M11)

openssl s_client -connect intranet.isla.edu.eoncore.net:443 -servername intranet.isla.edu.eoncore.net -tls1 -cipher 'DEFAULT:@SECLEVEL=0' </dev/null
openssl s_client -connect intranet.isla.edu.eoncore.net:443 -servername intranet.isla.edu.eoncore.net -tls1_2 </dev/null

B.3 Certificate expiry (I-M11, C6)

openssl s_client -connect intranet.isla.edu.eoncore.net:443 -servername intranet.isla.edu.eoncore.net </dev/null \
  | openssl x509 -noout -enddate

Record every check you use as evidence: date, command, result.

Templates

C.1 Capstone readout (I-M11)

Team <app> — 3 minutes
1. Inside only:   <host / value> — why it is not visible outside — owner — fix — deadline
2. Outside only:  <what / page>  — why Insights cannot see it  — owner — fix — deadline
3. Both:          <finding>      — inside shows … / outside shows … — agree? — fix — deadline
4. Weakest link of our app and the first action for Monday