This project demonstrates an end-to-end Security Operations Center (SOC) investigation workflow using Kali Linux, Metasploitable2, Nmap, Wireshark, and VirtualBox.
The objective was to simulate a real-world SOC analyst environment by performing network verification, service discovery, traffic analysis, evidence collection, and security assessment within a controlled laboratory environment.
- Phase 1 - Network Verification
- Phase 2 - Reconnaissance
- Phase 3 - Traffic Analysis
- Phase 4 - Evidence Collection
- Findings Report
- Final Investigation Report
Successfully completed an end-to-end SOC investigation workflow including:
- Network Verification
- Service Enumeration
- Traffic Analysis
- Evidence Collection
- Security Assessment
- Incident Documentation
This project demonstrates practical SOC analyst skills using industry-standard cybersecurity tools and methodologies.
| Component | IP Address | Purpose |
|---|---|---|
| Kali Linux | 192.168.56.104 | Analyst Machine |
| Metasploitable2 | 192.168.56.103 | Vulnerable Target |
| VirtualBox Host-Only Network | 192.168.56.0/24 | Isolated Lab Network |
- Network Verification
- Network Reconnaissance
- Nmap Enumeration
- Service Discovery
- Wireshark Traffic Analysis
- Packet Capture Analysis
- Evidence Collection
- Security Assessment
- Incident Documentation
- Vulnerability Identification
- Linux Administration
- Cybersecurity Reporting
- Kali Linux
- VirtualBox
- Metasploitable2
- Nmap
- Wireshark
Verify connectivity between the analyst machine and the target machine.
ping 192.168.56.103- Successful ICMP communication
- 0% packet loss
- Connectivity confirmed
Identify active services running on the target system.
sudo nmap -sV 192.168.56.103| Port | Service |
|---|---|
| 21 | FTP |
| 22 | SSH |
| 23 | Telnet |
| 25 | SMTP |
| 53 | DNS |
| 80 | HTTP |
| 139 | NetBIOS |
| 445 | SMB |
| 3306 | MySQL |
| 5432 | PostgreSQL |
| 5900 | VNC |
| 6667 | IRC |
Capture and analyze network traffic generated during reconnaissance activities.
Wireshark
- ICMP Echo Requests and Replies
- TCP Connection Attempts
- SMB Communication
- NetBIOS Traffic
- Service Discovery Traffic
Preserve collected evidence for analysis and reporting.
- Packet Capture File
- Nmap Scan Results
- Investigation Screenshots
- Findings Report
pcaps/network_capture.pcapng
| System | IP Address |
|---|---|
| Analyst Machine | 192.168.56.104 |
| Target Machine | 192.168.56.103 |
- Successful communication established between analyst and target systems.
- ICMP traffic observed and validated.
- No packet loss detected.
Multiple services were exposed on the target system.
| Service | Risk Level |
|---|---|
| FTP | Medium |
| SSH | Low |
| Telnet | High |
| SMTP | Medium |
| DNS | Low |
| HTTP | Medium |
| NetBIOS | High |
| SMB | High |
| MySQL | Medium |
| PostgreSQL | Medium |
| VNC | Medium |
| IRC | Medium |
The target system exposes multiple services that increase the attack surface and could be exploited by attackers.
- Unencrypted Telnet communication
- SMB exposure
- NetBIOS information disclosure
- Multiple publicly accessible services
- Unauthorized access
- Credential compromise
- Information disclosure
- Lateral movement opportunities
- Disable unnecessary services.
- Replace Telnet with SSH.
- Restrict SMB access.
- Implement firewall controls.
- Continuously monitor network traffic.
- Conduct regular vulnerability assessments.
- Verified connectivity between analyst and target systems.
- Identified multiple exposed network services.
- Captured and analyzed live network traffic.
- Preserved evidence through screenshots and packet captures.
- Conducted security assessment of discovered services.
- Produced professional investigation documentation and reporting.
SOC-Investigation-Lab/
│
├── docs/
│ ├── Phase1-Network-Verification.md
│ ├── Phase2-Reconnaissance.md
│ ├── Phase3-Traffic-Analysis.md
│ ├── Phase4-Evidence-Collection.md
│ └── Findings.md
│
├── pcaps/
│ └── network_capture.pcapng
│
├── reports/
│ └── final_findings.md
│
├── screenshots/
│ ├── SOC architecture diagram.jpeg
│ ├── ping_test.jpeg
│ ├── nmap_scan.png
│ └── wireshark_capture.jpeg
│
└── README.md
- Nessus Vulnerability Scanning
- OpenVAS Integration
- Snort IDS Monitoring
- Suricata Alert Analysis
- SIEM Integration
- Incident Response Playbooks
Om Sone
Cybersecurity Student | SOC Analyst Enthusiast | Network Security Learner
This project was conducted in an isolated laboratory environment using intentionally vulnerable systems for educational and research purposes only.