When something looks wrong, a calm order of steps beats a rush. This set covers the six phases of incident response applied to a small incident on your own device, and why the last phase, the one most people skip, is the one that makes the next incident easier.
Each one is marked as you go, and the explanation arrives straight after, which is
the part worth reading.
4 questions, marked as you go.
Tasks
These need your own device. Run the command in Termux, then paste what it printed.
The marking looks at what the output means, so spacing, version numbers and
ordering do not matter. If you have not installed anything yet, the
lesson covers the setup.
Take an incident snapshot
This makes an evidence file, locks its permissions down, and writes a dated snapshot of the device state: the time, the listening ports, the file permissions and the file hash. Read it as the record you would keep at the start of an incident.
Run this in Termux
On your own device. Nothing on this page executes it. The command runs in
your terminal, and this box only reads what you paste back.
cd ~; mkdir -p ir; printf 'report\n' > ir/evidence.txt; chmod 600 ir/evidence.txt; { echo "== when =="; date -u +%Y-%m-%dT%H:%M:%SZ; echo "== listeners =="; ( ss -tuln 2>/dev/null || netstat -tuln 2>/dev/null || echo none ) | head -n 5; echo "== file =="; ls -l ir/evidence.txt; sha256sum ir/evidence.txt; } > ir/incident.txt; cat ir/incident.txt
The order matters. The snapshot is taken before anything is changed, so it is the record of how things looked when the problem started.
the evidence file keeps owner-only permissions
the evidence file hash is recorded
the snapshot has every section
the commands actually ran
What a good answer looks like
Three headed sections. Under when you get the time in UTC. Under listeners you get the ports, or none, which is the door check. Under file you get the long listing, which should show owner-only permissions, and then the sha256 digest of the evidence file. That digest is what you compare with your manifest to confirm a change. If the file line shows -rw-r--r--, the permissions are too loose for evidence you care about.
Marking your own work
Both halves of this are checked in your browser, with no server involved, so nothing
stops you from pasting output you did not run. The tasks are written so that the
easiest way to pass one is to actually do it and read the result, which is the whole
intention.