From SOC Intern to Security Analyst: A Hands-On Guide to Web App Pentesting, Incident Response, and Email Threat Investigation + Video

By /

Listen to this Post

Featured Image

Introduction:

The transition from theoretical cybersecurity knowledge to practical, hands-on skills is one of the most critical—and often most challenging—steps for any aspiring security professional. A recent virtual internship at Cryptonic Area provided a comprehensive immersion into three core pillars of modern security operations: web application security assessment, Linux-based incident response, and email threat investigation. By tackling a DOM-based XSS vulnerability in OWASP Juice Shop, tracing an SSH brute-force attack through privilege escalation, and dissecting phishing emails using header analysis, the intern demonstrated the exact skill set required of a Tier 1 SOC Analyst or Junior Penetration Tester. This article deconstructs each of these projects, providing the technical commands, methodologies, and secret tips that transform a simulated lab exercise into real-world investigative prowess.

Learning Objectives & Secrets:

  • Objective 1: Master Web Application Security Assessments – Learn to identify, exploit, and document DOM-based Cross-Site Scripting (XSS) vulnerabilities using OWASP Juice Shop, including proper CVSS scoring and pentest reporting.
  • Objective 2: Execute Full-Cycle Incident Response – Investigate a simulated Linux server breach from initial SSH brute-force detection through privilege escalation, backdoor account identification, and remediation planning.
  • Objective 3: Conduct Professional Email Threat Investigations – Analyze email headers to detect phishing, business email compromise (BEC), vendor fraud, and malware-laced attachments using SPF, DKIM, DMARC checks, and OSINT techniques.

1. Web Application Security: DOM-Based XSS Deep Dive

Cross-Site Scripting (XSS) remains one of the most prevalent web application vulnerabilities, consistently appearing in the OWASP Top 10. DOM-based XSS is particularly insidious because the attack payload executes entirely on the client side, never touching the server logs and often bypassing traditional Web Application Firewalls (WAFs). In the OWASP Juice Shop environment, the search function’s Angular frontend takes user input and writes it directly to the DOM using unsafe bindings—a classic vulnerability pattern found in single-page applications that parse URL fragments client-side.

Step‑by‑Step Guide:

1. Launch Juice Shop Locally:

docker run --rm -p 3000:3000 bkimminich/juice-shop

Navigate to http://localhost:3000` and access the scoreboard at//score-board`.

  1. Identify the Vulnerable Field: On the Juice Shop home page, locate the search bar. This input field is the entry point for the DOM XSS attack.

3. Inject the XSS Payload:

Enter the following payload into the search bar and press Enter:


<

iframe src="javascript:alert('xss')">

The `javascript:` URI scheme in the `src` attribute is a classic DOM XSS vector that often bypasses naive content filters that only block `