She started with reconnaissance— without scanning. She used the TTL trick from earlier, sending single crafted ICMP packets with low TTLs to map the firewall’s hop count. She found the border firewall at hop 2. The HR server at hop 5. No alerts.
The next morning, Viktor stopped by her desk. "I saw your final exam run," he said, almost smiling. "The SOC didn't even blink. You walked right past the firewall, used a honeypot's own fake credentials to blindside it, and made Snort drop half your packets." She started with reconnaissance— without scanning
Maya’s skin prickled. Honeypots weren't just traps. They were misdirections. At 3:45 AM, the lecture ended. A final screen appeared: The HR server at hop 5
Maya blinked. "Wait—I didn't use fake credentials. I used DNS tunneling and TTL evasions." "I saw your final exam run," he said, almost smiling