Lesson 2.1: A zero-day on an edge device
VPN gateways and firewalls sit on the internet, hold credentials, and rarely run security tools, which is why attackers have targeted them again and again: Citrix NetScaler ('Citrix Bleed', 2023), Ivanti Connect Secure (2024), Palo Alto PAN-OS GlobalProtect (2024) and others. When a vendor announces an exploited flaw, patching is only half the job; you must also find out whether you were hit before the fix. In the lab, a fictional vendor's advisory matches Northwind's firewall. From its support bundle you confirm the version, find the exploitation, the planted web shell and what it was used to read, and the persistence the attacker left.
18 min
You will learn to
- Explain why edge devices are prime targets
- Match an advisory to a device version
- Find exploitation attempts in access logs
- Use an integrity check to find planted files
- Scope what the attacker took and left
Key terms
- Edge device
- Internet-facing network equipment: VPN gateways, firewalls, load balancers.
- Zero-day
- A vulnerability exploited before a fix is available.
- Web shell
- A script planted on a web server that runs the attacker's commands.
- Integrity checker
- A vendor tool that compares the device's files with a signed manifest.
- Support bundle
- An archive of a device's logs, configuration and state, used for diagnosis and forensics.
← Certificate inventory and shrinking lifetimes · All lessons · Jobs in cybersecurity and your learning path →