-
Jun 30, 2017
Using OSINT sources for penetration testing In early stages of a penetration test is a best practice the gathering of the most detailed information about the target, also using public data and search engines. Below there is my short list… read more »
-
Jun 29, 2017
Six Python tools useful for identify and analyse malware Python is a very used scripting language in the field of computer forensics and malware analysis. Today, we look at some of the tools developed in this scripting language that are useful… read more »
-
Jun 28, 2017
Just create a file in c:\windows! Currently we have a lot of information about Petya (ot Notpetya): you can take a look at this post, that i use to collect all information gathered from websites and social networks. And from… read more »
-
Jun 28, 2017
Using vboxmanage and some tools from SleuthKit A key step in a forensic analysis is the creation of a timeline of the filesystem operations.The operation can be performed using (for example) the fls tool from Sleuthkit, that exports the timeline… read more »
-
Jun 27, 2017
What we know so far? UPDATE: We have a local vaccine New ransomware start spreading in Ukraine and shutdown a lot of critical infrastructures (hospitals, airport, banks and power plants). Some report coming also from Italy, Germany and Spain. Early comments on… read more »
-
Jun 27, 2017
Using a direct access to /sys/class/backlight My Debian laptop is configured with a very minimal setup, using i3 as window manager and without any graphical tool for system management. To manage the screen brightness i choosed not using a specific… read more »
-
Jun 25, 2017
In order to start a memory analysis with Volatility, the identification of the type of memory image is a mandatory step. Here some usefull commands. imageinfo For a high level summary of the memory sample you’re analyzing, use the imageinfo… read more »
-
Jun 23, 2017
In order to analyze it with Volatility Usually i use a VirtualBox sandbox in order to ‘detonate’ some malware and analyze the behavior of them. In this phase, the analysis of sandbox’s ram with Volatility is a mandatory step.But, how… read more »
-
Jun 22, 2017
The research paper by P1 Security was presented last week in a security conference in France A team of researchers from security firm P1 Security has detailed a list of flaws in the VoLTE protocol that allows an attacker to spoof… read more »
-
Jun 21, 2017
A research by Japan Computer Emergency Response Team With “lateral movement’ we identify the techniques that enable an adversary to access and control remote systems on a network: an attacker can use lateral movement for many purposes, including remote execution… read more »
-
Jun 20, 2017
Great speech by Keren Elazari from TED.com Keren Elazari is an internationally recognized researcher, author and speaker on all matters cyber security and hacker culture. Since 2000, Keren has worked with leading security firms, public organizations, Big 4 and Fortune 500… read more »
-
Jun 19, 2017
Simple, with 5 commands! Finally, Debian 9 “Stretch” was released in the “stable” branch! A lot of upgrades, especially in kernel, glibc and other base packages. Some info from the official wiki (also see the official stretch release notes.): New… read more »
-
Jun 16, 2017
Automated acquisition of data from thousands of hosts with Powershell! Kansa is a powershell framework designed by Dave Hull to support massive data collections. It permits to easily scaling to thousands of systems via powershell remoting, but is not confined… read more »
-
Jun 15, 2017
Useful in forensics analysis and incident response During the analysis phase, after (for example) a system compromization, is very important to know the standard Windows processes, in order to have a ‘baseline’ useful to make a ‘diff’ with the compromised system.… read more »
-
Jun 14, 2017
A custom user.js configuration file designed to make your Firefox more secure A user.js file is an alternative method of modifying Firefox’s preferences: it can make certain preference settings more or less “permanent” in a specific profile, and is also a… read more »
-
Jun 12, 2017
A python script that search and download exploit from Vulners Database getsploit is a command line search and download tool for Vulners Database. It was inspired by searchsploit, the tool used for search and download from https://www.exploit-db.com. It allows you to… read more »
-
Jun 9, 2017
A really interesting series of articles on SANS Digital Forensics Blog On 2010, Hal Pomeranz has started on SANS Digital Forensics blog a series of technical articles about EXT4 filesystem. What is EXT4? EXT4 is a journaling file system for Linux,… read more »
-
Jun 8, 2017
After all, the BSOD is also a useful feature! The researchers of security firm Kryptos Logic has performed an extensive analysis of well known WannaCry ransomware. One of the findings is really interesting (and funny!): WannaCry can infect machines that still… read more »
-
Jun 7, 2017
Pretty simple, with a node.js application Have I Been Pwned? is a website created by security expert Troy Hunt, that allows internet users to check if their personal data has been compromised by data breaches. The site collects and analyzes… read more »
-
Jun 6, 2017
It’s important to have the right tools to analyze suspect documents! Currently, the main malware infection vehicle remains the classic malicious document attached to an email. So it is very important to have the right tools to analyze suspect documents.… read more »