akde/infosec

Information security is ultimately about managing risk

  • Debian Package Managment System

    Show info: dpkg --info $package Show all files of a deb: dpkg -L $package Show all installed packages: dpkg -l Search for a file or path: dpkg -S htpasswd Show why a pack­age was installed: apitude why apache2-utils About deb files A deb file is a ar archive with this structure: $ ar t example.debdebian-binarycontrol.tar.xz (or .gz or…

  • Threat Hunting on Linux

    Show sys­tem files which were changed after installation. dpkg --verify Check var­i­ous secu­ri­ty relat­ed issues: checksecurity Tools

  • Kali

    Some notes: Build an own Kali ISO image apt install curl git live-buildgit clone https://gitlab.com/kalilinux/build-scripts/live-build-config.gitcd live-build-config..../build.sh --verbose This will cre­ate a cus­tom ISO.

  • Grepable strings

    Oth­er

  • MemProcFC

    Mem­o­ry ana­lyza­tion soft­wrae to see phys­i­cal mem­o­ry as files in a vir­tu­al file system. GitHub — ufrisk/MemProcFS: MemProcFS

  • Analyzing memory (dumps)

    See also mem­o­ry dump article. Usu­al stuff: Spe­cial­ized software: Thinks to look out for:

  • Linux incidence response

    Note: See many, many com­mands from the Lin­ux privesc post. Analyze logs On sys­tems: Browse through the /var/log files. On new­er sys­tems with systemd: Note: If you have an image, you can also ana­lyze logs from a mount­ed image like journalctl --root /mnt/hdd23 -t ssh ... Analyze startup services On SysVinit: Browse through /etc/init.d/ On…

  • Detecting Malware

    Windows Detect­ing PE/DLL injection:

  • The Windows Portable Executeable (EXE)

    See also the Bina­ry analy­sis post Win­dows uses as for­mat for the exe­cute­able files the PE Portable Exe­cute­able for­mat. This is a bina­ry for­mat which can be used as a Eng­lish (light ‘xkcd’) — Imgur has a graph­i­cal overview.

  • Binary analysis of PE files

    See the Analy­sis data / foren­sic arti­cle for gen­er­al data analy­sis. Also, rel­e­vant articles: Static analysis Notes before­hand: Have a first look into the file: xxd file.exe | less Have a look into the file segments binwalk file.exe Have a look in the strings strings file.exefloss file.exe You can try to visu­al­ize the entropy to maybe…

  • Code deobfuscation

    Tools: Exe­cu­tion pos­si­bil­i­ties for a dynam­ic analy­sis, if deob­fus­ca­tion is not soooo good: Tipp: Over­write sen­si­ble meth­ods, if the lan­guage allows it. For exam­ple, in JavaScript: eval = print Now, each eval state­ment is not exe­cut­ed, but just printed :-).

  • Detecting Execution traces on Windows

    Goal: See on a sys­tem if some spe­cif­ic exe­cute­able was executed.

  • Persistence on Windows Systems

    See also Autostart (Per­sis­tence) | Hexacorn

  • Windows Forensic

    Registry Windows Event Logging File system analysis See the NTFS arti­cle about logging.

  • Sleuthkit

    Foren­sic tools

  • Dissec

    Dis­sect is a foren­sic tool for file sys­tem images,

  • Logging and data collection best practices

    Ques­tions, who should be answered easily: Tips for analyzing log files Search a log and count the hosts: cat log | jq -c '.host' | sort | uniq -c | sort -n To see more about the host “Apache” cat log | grep "Apache" | jq Search in gzipped logs: zgrep log.gzzcat log.gz | grep "Apache" Con­vert…

  • Network Flow Data analysis

    Use cas­es Tools Stan­dard unix tools like awk can also been used with a cat of a flow file. nfdump SiLK argus

  • TLS Server Response Fingerprint

    JA4S is a sys­tem to hash the con­fig­u­ra­tion of a TLS con­nec­tion. More: ja4/technical_details/README.md at main · FoxIO-LLC/­ja4 · GitHub Pos­si­ble use cases:

  • When an incident occurred

    Case: Ransomware

About

Personal collection of some infosec stuff. Primary purpose of this site is to collect and organize for myself.

Note: Some content is not publicly visible due to copyright issues. Therefore, some links could be broken.

Checklists

Categories

Checklists: Ports

python -c 'import pty;pty.spawn("/bin/bash")';

python3 -c 'import pty;pty.spawn("/bin/bash")';