T-IK-half-A — Insights + Kartis, ½ day: find the weak link

Lab guide · Isla Mercantile Group · 195m net (09:00–12:30)

Schedule

Before you start

Log in

Your slip has your own credentials. Nobody shares a login; working in pairs on one login (one drives, one checks) is fine.

In Center, switch the UI to EN on first login. Your Center organisation team-NN has one customer: Isla Mercantile Group (team-NN). traineeNN and kNN are both members of team-NN and work on that same customer.

Shared environment

• One Insights for the whole group. Tags are shared: every team sees the others' tags appear.
• Custom views are shared: every view you save is in everyone's list. Prefix the name with your team or login (webshop — chain); do not change or delete a view you did not create.
• There is no personal reset. Do not delete data, uploads or tags you did not create.
• Tag rule: tag only hosts of your own app, one person per host, never remove tags you did not set. Full convention: Tag convention.
• Center and the Kartis pages keep state per team customer: register upload, posture runs, finding status and labels are shared by traineeNN and kNN of the same team, and invisible to other teams.
• Traffic replays (probe chapters) are started by the trainer. You need no shell on the server.
• AI: the Insights Chat is available in the Insights blocks. The Kartis pages have no AI.

Isla at a glance

Client: Isla Mercantile Group, retail and payments, Curaçao. Internal names <host>.<app>.isla.test in 10.20.0.0/16; public names <vhost>.isla.edu.eoncore.net.

Hosts outside isla.test and isla.edu.eoncore.net are background noise. Search isla.test to hide them.

Client documents (handed out per block): client brief, ckm-intake.xlsx, register.xlsx, register-flawed.xlsx.

Exercises

I-M0 — Welcome & client brief

09:00 · 15 min

I-M1 — Crypto 101

09:15 · 20 min

I-M2 — How Insights sees (live)

09:35 · 25 min

I-M3 — Dashboard tour

10:00 · 40 min

I-TAG — Tag teams: build the chain

10:55 · 45 min

K-1 — Outside-in with Kartis

11:40 · 30 min

Queries, live checks and templates

Queries

Run these through the Insights Chat. The Chat only accepts SELECT/WITH and rejects any query containing words such as INSERT, UPDATE, DELETE, ALTER, CREATE, REPLACE, SET anywhere in the text.

A.1 Chain view (I-TAG.2, I-M11)

Replace app:webshop with your app.

SELECT
    hostname,
    toString(any(ipv4))                                  AS ip,
    arrayDistinct(groupArrayArray(tags))                 AS all_tags,
    arrayFirst(t -> startsWith(t, 'tier:'),  all_tags)   AS tier,
    arrayFirst(t -> startsWith(t, 'owner:'), all_tags)   AS owner,
    anyLast(security_level)                              AS level,
    multiIf(level = 'insecure', 1, level = 'weak', 2,
            level = 'secure', 3, level = 'recommended', 4, 5) AS ladder_rank
FROM hosts
GROUP BY hostname
HAVING has(all_tags, 'app:webshop')
ORDER BY ladder_rank, tier

Live checks

Against the Isla public sites. Always pass -servername: web-b routes by SNI, and a client without SNI lands on pay. OpenSSL 3 needs @SECLEVEL=0 in the cipher string for 3DES and TLS 1.0; drop :@SECLEVEL=0 on LibreSSL (openssl version tells you which one you have). Some Linux distributions block TLS 1.0 in the system crypto policy even with @SECLEVEL=0; B.1b shows whether yours does. If it does, use testssl.sh or pair with someone whose client can.

B.1 3DES on pay (I-M2.3, K-1.6, C6.1)

openssl s_client -connect pay.isla.edu.eoncore.net:443 -servername pay.isla.edu.eoncore.net \
  -tls1_2 -cipher 'DES-CBC3-SHA:@SECLEVEL=0' </dev/null

B.1b Control: can your client speak TLS 1.0? (C6.2, K-1.5, I-M11)

openssl s_client -connect pay.isla.edu.eoncore.net:443 -servername pay.isla.edu.eoncore.net \
  -tls1 -cipher 'DEFAULT:@SECLEVEL=0' </dev/null

Handshake succeeds: your client can test TLS 1.0. no protocols available or a failure before any server answer: your client refuses TLS 1.0, and B.2 proves nothing.

B.2 TLS versions on intranet (K-1.5, C6.2, I-M11)

openssl s_client -connect intranet.isla.edu.eoncore.net:443 -servername intranet.isla.edu.eoncore.net -tls1 -cipher 'DEFAULT:@SECLEVEL=0' </dev/null
openssl s_client -connect intranet.isla.edu.eoncore.net:443 -servername intranet.isla.edu.eoncore.net -tls1_2 </dev/null