W9124922Q0006.pdf

SEE ADDENDUM

(No Collect Calls)

W9124922Q0006 02-May-2022

b. TELEPHONE NUMBER

706-791-9208

8. OFFER DUE DATE/LOCAL TIME

10:00 AM 17 May 2022

5. SOLICITATION NUMBER 6. SOLICITATION ISSUE DATE

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

STANDARD FORM 1449 (REV. 2/2012)

Prescribed by GSA – FAR (48 CFR) 53.212

(TYPE OR PRINT)

(SIGNATURE OF CONTRACTING OFFICER)

ADDENDA ARE

26. TOTAL AWARD AMOUNT (For Gov t. Use Only )

23.

CODE 10. THIS ACQUISITION IS

SUCH ADDRESS IN OFFER

17b. CHECK IF REMITTANCE IS DIFFERENT AND PUT

BELOW IS CHECKED

TELEPHONE NO.

W912499. ISSUED BY

18b. SUBMIT INVOICES TO ADDRESS SHOWN IN BLOCK 18a. UNLESS BLOCK

7. FOR SOLICITATION

INFORMATION CALL:

a. NAME

SHERRILYN U. RICE

2. CONTRACT NO. 3. AWARD/EFFECTIVE DATE 4. ORDER NUMBER

(TYPE OR PRINT)

30b. NAME AND TITLE OF SIGNER 30c. DATE SIGNED 31b. NAME OF CONTRACTING OFFICER

30a. SIGNATURE OF OFFEROR/CONTRACTOR 31a.UNITED STATES OF AMERICA

0 27a. SOLICITATION INCORPORATES BY REFERENCE FAR 52.212-1. 52.212-4. FAR 52.212-3. 52.212-5 ARE ATTACHED.

25. ACCOUNTING AND APPROPRIATION DATA

1. REQUISITION NUMBER

20.

ADDITIONAL SHEETS SUBJECT TO THE TERMS AND CONDITIONS SPECIFIED.

OFFEROR TO COMPLETE BLOCKS 12, 17, 23, 24, AND 30

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

ARE NOT ATTACHED

27b. CONTRACT/PURCHASE ORDER INCORPORATES BY REFERENCE FAR 52.212-4. FAR 52.212-5 IS ATTACHED. ADDENDA ARE ARE NOT ATTACHED

(BLOCK 5), INCLUDING ANY ADDITIONS OR CHANGES WHICH ARE

SET FORTH HEREIN, IS ACCEPTED AS TO ITEMS:

. YOUR OFFER ON SOLICITATION

28. CONTRACTOR IS REQUIRED TO SIGN THIS DOCUMENT AND RETURN

% FOR:SET ASIDE:UNRESTRICTED ORX

SMALL BUSINESS

17a.CONTRACTOR/ CODE FACILITY

OFFEROR CODE

MICC - FORT GORDON

271 HERITAGE PARK LANE

BLDG. 35200

FT GORDON GA 30905

18a. PAYMENT WILL BE MADE BY CODE

RATED ORDER UNDER

DPAS (15 CFR 700)

13a. THIS CONTRACT IS A

13b. RATING

CODE15. DELIVER TO CODE 16. ADMINISTERED BY

SEE SCHEDULE

12. DISCOUNT TERMS11. DELIVERY FOR FOB DESTINA-

TION UNLESS BLOCK IS

MARKED

SEE SCHEDULE

14. METHOD OF SOLICITATION

RFQ IFB RFPX

706-791-8651FAX:

TEL: 706-791-1800 SERVICE-DISABLED

VETERAN-OWNED

SMALL BUSINESS

8(A)

HUBZONE SMALL

BUSINESS

SIZE STANDARD:

1,000

NAICS:

519130

X

OFFER DATED

29. AWARD OF CONTRACT: REF.

DELIVER ALL ITEMS SET FORTH OR OTHERWISE IDENTIFIED ABOVE AND ON ANY

COPIES TO ISSUING OFFICE. CONTRACTOR AGREES TO FURNISH AND

EMAIL:

TEL:

31c. DATE SIGNED

SEE SCHEDULE

SCHEDULE OF SUPPLIES/ SERVICESITEM NO. QUANTITY UNIT UNIT PRICE AMOUNT

24.22.21.19.

WOMEN-OWNED SMALL BUSINESS (WOSB)

ELIGIBLE UNDER THE WOMEN-OWNED

SMALL BUSINESS PROGRAM

EDWOSB

32g. E-MAIL OF AUTHORIZED GOVERNMENT REPRESENTATIVE

SOLICITATION/CONTRACT/ORDER FOR COMMERCIAL ITEMS

(CONTINUED)

PAGE 2 OF11

ACCEPTED, AND CONFORMS TO THE CONTRACT, EXCEPT AS NOTED: ______________________________________________________

32a. QUANTITY IN COLUMN 21 HAS BEEN

RECEIVED INSPECTED

32b. SIGNATURE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32c. DATE 32d. PRINTED NAME AND TITLE OF AUTHORIZED GOVERNMENT

REPRESENTATIVE

32e. MAILING ADDRESS OF AUTHORIZED GOVERNMENT REPRESENTATIVE 32f . TELEPHONE NUMBER OF AUTHORIZED GOVERNMENT REPRESENTATIVE

37. CHECK NUMBER

FINALPARTIALCOMPLETE

36. PAYMENT35. AMOUNT VERIFIED

CORRECT FOR

34. VOUCHER NUMBER

FINAL

33. SHIP NUMBER

PARTIAL

38. S/R ACCOUNT NUMBER 39. S/R VOUCHER NUMBER 40. PAID BY

41a. I CERTIFY THIS ACCOUNT IS CORRECT AND PROPER FOR PAYMENT

41b. SIGNATURE AND TITLE OF CERTIFYING OFFICER 41c. DATE

42a. RECEIVED BY (Print)

42b. RECEIVED AT (Location)

42c. DATE REC'D (YY/MM/DD) 42d. TOTAL CONTAINERS

STANDARD FORM 1449 (REV. 2/2012) BACK

Prescribed by GSA – FAR (48 CFR) 53.212

AUTHORIZED FOR LOCAL REPRODUCTION

PREVIOUS EDITION IS NOT USABLE

SEE SCHEDULE

20.

SCHEDULE OF SUPPLIES/ SERVICES

21.

QUANTITY UNIT

22. 23.

UNIT PRICE

24.

AMOUNT

19.

ITEM NO.

W9124922Q0006

Section SF 1449 - CONTINUATION SHEET

ITEM NO SUPPLIES/SERVICES QUANTITY UNIT UNIT PRICE AMOUNT

0001 1 Each 170A WOAC ADV Hacking methodologies

FFP

Class 22-003 Advanced Hacking Methodologies (31 OCT 22 – 29 NOV 22)

CURRICULUM (SEE STATEMENT OF WORK AND TECHNICAL

SPECIFICATIONS)

FOB: Destination

PSC CD: 7610

NET AMT

0002 1 Each 170A WOAC ADV Hacking methodologies

FFP

Class 23-001 Advanced Hacking Methodologies (27 FEB 23 – 24 MAR 23)

CURRICULUM (SEE STATEMENT OF WORK AND TECHNICAL

SPECIFICATIONS)

0003 1 Each 170A WOAC ADV Hacking methodologies

FFP

Class 23-002 Advanced Hacking Methodologies (03 JUL 23 – 28 JUL 23)

CURRICULUM (SEE STATEMENT OF WORK AND TECHNICAL

SPECIFICATIONS)

INSPECTION AND ACCEPTANCE TERMS

Supplies/services will be inspected/accepted at:

CLIN INSPECT AT INSPECT BY ACCEPT AT ACCEPT BY

0001 Destination Government Destination Government 0002 Destination Government Destination Government 0003 Destination Government Destination Government

DELIVERY INFORMATION

CLIN DELIVERY DATE QUANTITY SHIP TO ADDRESS DODAAC /

CAGE

0001 POP 29-SEP-2022 TO

28-SEP-2023

N/A N/A

0002 POP 29-SEP-2022 TO

28-SEP-2023

0003 POP 29-SEP-2022 TO

28-SEP-2023

CLAUSES INCORPORATED BY REFERENCE

52.204-24 Representation Regarding Certain Telecommunications and

Video Surveillance Services or Equipment

DEC 2021

52.204-25 Prohibition on Contracting for Certain Telecommunications and Video Surveillance Services or Equipment

DEC 2021

52.204-26 Covered Telecommunications Equipment or Services-- Representation.

OCT 2020

52.212-1 Instructions to Offerors--Commercial Products and Commercial Services

DEC 2021

52.212-2 Evaluation - Commercial Items DEC 2021 52.212-3 Offeror Representations and Certifications--Commercial

Products and Commercial Services

DEC 2021

52.212-4 Contract Terms and Conditions--Commercial Products and Commercial Services

DEC 2021

252.204-7012 Safeguarding Covered Defense Information and Cyber Incident Reporting

DEC 2019

252.232-7003 Electronic Submission of Payment Requests and Receiving Reports

DEC 2018

STATEMENT OF WORK

USACyS, 170A WOAC Advanced Hacking Methodologies Training Requirement

1. General: The United States Army Cyber Center of Excellence (Cyber CoE) and Fort Gordon requires support to provide a four (4) week self-paced cyber technical training package for the Cyber School Warrant Officer Advanced Course (WOAC). The government anticipates at least three (3) iterations of the required four (4) week self-paced training. Each iteration will have a maximum number of twenty (20) students. This requirement shall provide the U.S. Army Cyber School with curriculum via online/virtual or other acceptable means of delivery on the below topic.

2. Curriculum:

Advanced Hacking Methodologies: Given a native OS and a training range, the student will employ hacking methodologies to successfully breach highly restricted / well defended networks.

Introduction to Hacking Methodologies that covers cryptography/VPN, network security monitoring applications like Wireshark, Binary Arithmetic Basics – Hex, Decimal, and Bitwise Operations

Networking Introduction that covers OSI layer protocols like TCP/UDP or DNS, IP addresses (IPv4 and IPv6), basic understanding of routing, link layer protocols, firewall types, IDS/IPSs, network security monitoring packet filtering with tools like Wireshark

Web Application Introduction – HTTP protocol basics, cookies, and sessions, tool overviews of web applications like Burp Suite.

Penetration Testing Lifecycle o Engagement o Information Gathering o Foot printing/Scanning o Vulnerability Assessment o Exploitation o Reporting

Programming basics with overviews of penetration testing command line scripting with languages such as C++, Python, Bash, PowerShell, and Windows Command line.

o PowerShell Cmdlets used like Get-ChildItem, Get-WMIObject, Get-Process, Get-Service, Invoke-Obfuscation, and Invoke-CradleCrafter o PowerShell frameworks like PowerShell Empire, PowerSploit, Posh- SecMod, Nishang, Psgetsystem

Information Gathering process – Open-Source Intelligence with tools like Whois, Shodan, DNSdumpster, DNSEnum, DNSrecon, The Harvester, DNSMap, Maltego, Netcraft, Google Hacking, or Crunchbase.

o Understand resources to get DNS, domain, IP blocks for organizations.

Foot printing/Scanning process – Mapping and scanning with tools like Hping, and

FPing with basic/advanced Nmap scans like TCP connect, SYN, UDP, Idle, Xmas, ACK, Null, and NSE scripts.

o Understand banner grabbing, active and passive OS fingerprinting.

o Performing firewall/IDS evasion techniques with source ports, fragmentation, or timing methods.

Enumeration process o Enumeration of NetBIOS, SMB, SNMP with tools like Dumpsec, Enum4Linux, RPCClient, Winfo, smbclient, mount, snmpwalk, snmpset, and Nmap scripts.

Sniffing with tools like Dsniff, Wireshark, TCPDump, WinDump.

Man-in-the-middle (MiTM) attacks with tools like Ettercap, Cain & Abel, Macof, arpspoof, Bettercap, and SSLStrip.

Vulnerability Assessment process – Using Vulnerability scanners like OpenVAS or

Nessus.

o Identifying weak passwords with tools like Ncrack, Medusa, EyeWitness, Mentalist, CeWL, John the Ripper, or Hydra Exploitation process with exploits like Eternal Blue, Shellshock, Heartbleed, remote and client-side exploitation.

Post-exploitation process with techniques for maintaining access with tools like

Mimikatz or Mimipenguin, privilege escalation, lateral movement, building backdoors, maintaining persistence, data exfiltration with tools like Iodine, and performing clean-up after penetration exploitation.

Web Application Attack process:

o Fingerprinting web applications using tools like Netcat, OpenSSL, Dirbuster, SQLmap, or Httprint.

o HTTP request examples like GET, POST, or HEAD o Cross-site-scripting (XSS) –

Understanding of XSS types like reflected, persistent, and DOM-based

XSS attacks with tools like BeEF.

o Server query language (SQL) injections – Understanding of in-band, error-based, and blind SQL injections.

Understanding statements like SELECT, UNION, or Boolean operators Understanding of advanced SQL exploitation with xp_cmdshell or database manipulation.

o Understanding of other web attacks like session hijacking, cross-site request forgery, directory traversal, and file inclusion vulnerabilities.

System Attacks o Introduction into terms like Viruses, Trojans, backdoors, rootkits, botnets, adware/spyware, keyloggers, ransomware, and worms.

o Password Attack introduction with tools like John the Ripper, Hashcat, OphCrack, or Hydra to perform dictionary or rainbow table attacks of LM/NT hashes and SAM files.

o Buffer Overflow attacks with introduction of heap and stack operations.

Network Attacks o Authentication attacks with tools like Hydra to perform brute force and dictionary attacks o Windows shares with NetBIOS protocols, Admin and misconfigured shares.

o Null sessions with tools like nbtstat, netview, nmblookup, enum4linux, winfo, and smbclient.

o ARP poisoning attacks with tools like dsniff, arpspoof, or Cain & Abel o Metasploit/Meterpreter modules used for configuring network attacks with exploits, payloads, and basic script configuration.

Windows and Linux Architecture introduction which covers Assembly language, registers, process memory, and stack operations like POP, PUSH, and NOPs.

o Understanding of security implementations like ASLR (Address Space

Layout Randomization), DEP (Data Execution Prevention), Stack Canaries, SafeSEH, and ROP chains.

o Assemblers, Debuggers, and Compilers like Microsoft Visual C ++ and debuggers like Immunity Debugger, IDA Pro, GDB, WinDBG, and OllyDBG.

Buffer Overflows o Understanding of vulnerable functions like strcpy/strncpy o Understanding of fuzzing and static code review for finding buffer overflows o Building buffer overflows with understanding offsets and using tools like pattern create, pattern offset, and mona to overwrite stack pointers.

Shellcode o Introduction to local and remote shellcode o Building basic and advanced shellcode with tools like msfvenom to avoid terminators, Nulls, and security implementations.

Cryptography and Password cracking o Discussion of Public Key Infrastructure, PGP, and misconfigurations in implementation of cryptography systems.

Malware o Malware techniques with process hiding, hooking, obfuscation, packing, polymorphism and metamorphism.

o Examination of malware types like key loggers, Trojans, viruses, or worms.

Social Engineering process with tools like Social Engineering Toolkit (SET) to perform Phishing, Spear Phishing, and Whale Phishing.

Wireless Attacks – Understanding of wireless standards like WEP, WPA, WPA2, WPS, and WPA3 o Understanding of Wireless attacks like initialization vector flaws, birthday paradox, rogue access points, evil-twin attack, and war driving o Display knowledge in the operation of wireless tools like inSSIDer, Kismet, aircrack-ng, airodump-ng, oclHashCat, CloudCracker, Pyrit, and Eaphammer

Ruby Fundamentals o Introduction to the data types, arrays, ranges and hashes, variables, declarations and how is it used as an interpreter.

o Understanding of Ruby methods, blocks, aliases, classes, modules and handling exceptions o Understanding of exploitation methodology with Ruby Understanding of maintaining in-depth notes and screenshots for penetration reports.

2.1 Curriculum Presentation: Provide three (3) class iterations of four (4) weeks self-paced training in accordance with the Government Training Schedule:

Class 22-003 Advanced Hacking Methodologies (31 OCT 22 – 29 NOV 22)

Class 23-001

Advanced Hacking Methodologies (27 FEB 23 – 24 MAR 23)

Class 23-002

Advanced Hacking Methodologies (03 JUL 23 – 28 JUL 23)

All curriculum presentations dates are tentative and subject to change based on the Government Training Schedule.

Provide requisite licensing, user account, log in, etc. required to access all services, curriculum, and virtual environment provided by the contractor for approximately 60, 170A WOAC students per year.

TECHNICAL SPECIFICATIONS

TECHNICAL SPECIFICATIONS

Cyber School, 170A WOAC Advanced Hacking Methodologies

Advanced Hacking Methodologies: Given a native OS and a training range, the student will employ hacking methodologies to successfully breach highly restricted / well defended networks.

Introduction to Hacking Methodologies that covers cryptography/VPN, network security monitoring applications like Wireshark, Binary Arithmetic Basics – Hex, Decimal, and Bitwise Operations

Networking Introduction that covers OSI layer protocols like TCP/UDP or DNS, IP addresses (IPv4 and IPv6), basic understanding of routing, link layer protocols, firewall types, IDS/IPSs, network security monitoring packet filtering with tools like Wireshark

Web Application Introduction – HTTP protocol basics, cookies, and sessions, tool overviews of web applications like Burp Suite.

Penetration Testing Lifecycle o Engagement o Information Gathering o Foot printing/Scanning o Vulnerability Assessment o Exploitation o Reporting

Programming basics with overviews of penetration testing command line scripting with languages such as C++, Python, Bash, PowerShell, and Windows Command line o PowerShell Cmdlets used like Get-ChildItem, Get-WMIObject, Get-Process, Get-Service, Invoke-Obfuscation, and Invoke-CradleCrafter o PowerShell frameworks like PowerShell Empire, PowerSploit, Posh-SecMod, Nishang, Psgetsystem

Information Gathering process – Open-Source Intelligence with tools like Whois, Shodan, DNSdumpster, DNSEnum, DNSrecon, The Harvester, DNSMap, Maltego, Netcraft, Google Hacking, or Crunchbase o Understand resources to get DNS, domain, IP blocks for organizations.

Foot printing/Scanning process – Mapping and scanning with tools like Hping, and

FPing with basic/advanced Nmap scans like TCP connect, SYN, UDP, Idle, Xmas, ACK, Null, and NSE scripts.

o Understand banner grabbing, active and passive OS fingerprinting.

o Performing firewall/IDS evasion techniques with source ports, fragmentation, or timing methods.

Enumeration process o Enumeration of NetBIOS, SMB, SNMP with tools like Dumpsec, Enum4Linux, RPCClient, Winfo, smbclient, mount, snmpwalk, snmpset, and Nmap scripts

Sniffing with tools like Dsniff, Wireshark, TCPDump, WinDump Man-in-the-middle (MiTM) attacks with tools like Ettercap, Cain & Abel, Macof, arpspoof, Bettercap, and SSLStrip Vulnerability Assessment process – Using Vulnerability scanners like OpenVAS or

Nessus.

o Identifying weak passwords with tools like Ncrack, Medusa, EyeWitness, Mentalist, CeWL, John the Ripper, or Hydra Exploitation process with exploits like Eternal Blue, Shellshock, Heartbleed, remote and client-side exploitation.

Post-exploitation process with techniques for maintaining access with tools like Mimikatz or Mimipenguin, privilege escalation, lateral movement, building backdoors, maintaining persistence, data exfiltration with tools like Iodine, and performing clean-up after penetration exploitation

Web Application Attack process:

o Fingerprinting web applications using tools like Netcat, OpenSSL, Dirbuster, SQLmap, or Httprint.

o HTTP request examples like GET, POST, or HEAD o Cross-site-scripting (XSS) –

Understanding of XSS types like reflected, persistent, and DOM-based XSS attacks with tools like BeEF.

o Server query language (SQL) injections – Understanding of in-band, error-based, and blind SQL injections.

Understanding statements like SELECT, UNION, or Boolean operators Understanding of advanced SQL exploitation with xp_cmdshell or database manipulation.

o Understanding of other web attacks like session hijacking, cross-site request forgery, directory traversal, and file inclusion vulnerabilities.

System Attacks o Introduction into terms like Viruses, Trojans, backdoors, rootkits, botnets, adware/spyware, keyloggers, ransomware, and worms.

o Password Attack introduction with tools like John the Ripper, Hashcat, OphCrack, or Hydra to perform dictionary or rainbow table attacks of LM/NT hashes and SAM files.

o Buffer Overflow attacks with introduction of heap and stack operations Network Attacks o Authentication attacks with tools like Hydra to perform brute force and dictionary attacks o Windows shares with NetBIOS protocols, Admin and misconfigured shares.

o Null sessions with tools like nbtstat, netview, nmblookup, enum4linux, winfo, and smbclient.

o ARP poisoning attacks with tools like dsniff, arpspoof, or Cain & Abel o Metasploit/Meterpreter modules used for configuring network attacks with exploits, payloads, and basic script configuration.

Windows and Linux Architecture introduction which covers Assembly language, registers, process memory, and stack operations like POP, PUSH, and NOPs.

o Understanding of security implementations like ASLR (Address Space Layout

Randomization), DEP (Data Execution Prevention), Stack Canaries, SafeSEH, and ROP chains.

o Assemblers, Debuggers, and Compilers like Microsoft Visual C ++ and debuggers like Immunity Debugger, IDA Pro, GDB, WinDBG, and OllyDBG

Buffer Overflows o Understanding of vulnerable functions like strcpy/strncpy o Understanding of fuzzing and static code review for finding buffer overflows o Building buffer overflows with understanding offsets and using tools like pattern create, pattern offset, and mona to overwrite stack pointers.

Shellcode o Introduction to local and remote shellcode o Building basic and advanced shellcode with tools like msfvenom to avoid terminators, Nulls, and security implementations.

Cryptography and Password cracking o Discussion of Public Key Infrastructure, PGP, and misconfigurations in implementation of cryptography systems.

Malware o Malware techniques with process hiding, hooking, obfuscation, packing, polymorphism and metamorphism.

o Examination of malware types like key loggers, Trojans, viruses, or worms.

Social Engineering process with tools like Social Engineering Toolkit (SET) to perform Phishing, Spear Phishing, and Whale Phishing.

Wireless Attacks – Understanding of wireless standards like WEP, WPA, WPA2, WPS, and WPA3 o Understanding of Wireless attacks like initialization vector flaws, birthday paradox, rogue access points, evil-twin attack, and war driving o Display knowledge in the operation of wireless tools like inSSIDer, Kismet, aircrack-ng, airodump-ng, oclHashCat, CloudCracker, Pyrit, and Eaphammer

Ruby Fundamentals o Introduction to the data types, arrays, ranges and hashes, variables, declarations and how is it used as an interpreter.

o Understanding of Ruby methods, blocks, aliases, classes, modules and handling exceptions o Understanding of exploitation methodology with Ruby

Understanding of maintaining in-depth notes and screenshots for penetration reports.