10. Tools for the defenders (Blue Team) 🛡️¶

Steps ① to ⑤ in this guide are red (offensive) techniques. This chapter is the flip side — blue (defensive) techniques. The persistence and backdoors you learned about on the attack side become "things to hunt for" here. Precisely because you know the attack techniques, you understand "where to look."

🔑 Fixing vulnerabilities isn't enough: while inside, attackers plant a back door separate from the vulnerability. So even after you apply the patch, a back door that was already planted survives (→ see the chapter 8 explanation). Defenders must not only "close the hole" but also check whether a back door has already been planted — that's what the tools in this chapter are for.

Investigation tools for the defenders¶

flowchart TD
    Q["Any signs of intrusion on the server?"] --> A["rkhunter / chkrootkit<br>detect rootkits & backdoors"]
    Q --> B["Lynis<br>system audit (hunt for holes)"]
    Q --> C["YARA<br>match malware traces"]
    Q --> D["LinPEAS<br>enumerate privilege-escalation holes"]
    style Q fill:#2d333b,stroke:#3fb950,stroke-width:2px,color:#e6edf3
    style A fill:#2d333b,stroke:#58a6ff,stroke-width:2px,color:#e6edf3
    style B fill:#2d333b,stroke:#58a6ff,stroke-width:2px,color:#e6edf3
    style C fill:#2d333b,stroke:#58a6ff,stroke-width:2px,color:#e6edf3
    style D fill:#2d333b,stroke:#bc8cff,stroke-width:2px,color:#e6edf3

Tool	What it investigates	Which attack it maps to
rkhunter / chkrootkit	Traces of rootkits & backdoors	Persistence / backdoor installation
Lynis	Holes in system configuration (audit)	Entry points from misconfiguration
YARA	Pattern matching against known malware	Malware installation
LinPEAS	Enumerate privilege-escalation holes	Privilege escalation

💡 LinPEAS works for both offense and defense. It's a tool attackers use to find escalation holes, but defenders can also use it to pre-check "whether there are any holes on my own server."

How to use them on a Linux server¶

# System audit (read-only. Points out things like "this setting is too loose")
sudo apt install lynis && sudo lynis audit system

# Check for traces of rootkits & backdoors
sudo apt install rkhunter && sudo rkhunter --check

# Enumerate privilege-escalation holes (also useful as a defensive pre-check)
curl -L https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas.sh | sh

Defending macOS (checking your own Mac)¶

Macs have defensive mechanisms active by default. First, check the current state:

spctl --status         # Gatekeeper (blocks unsigned apps)
csrutil status         # SIP (System Integrity Protection)

To investigate further on your own, use KnockKnock (Objective-See's free GUI app; lists persistently installed / auto-starting items) or brew install lynis.

💡 The default Gatekeeper/SIP/XProtect block most common malware. However, they don't look at "loose configuration," so an audit tool like Lynis is effective there.

Understanding attacks is strengthening your defenses. This is the greatest value of learning pentesting.