• Ques­tions, who should be answered easily: Tips for analyzing log files Search a log and count the hosts: cat log | jq -c '.host' | sort | uniq -c | sort -n To see more about the host “Apache” cat log | grep "Apache" | jq Search in gzipped logs: zgrep log.gzzcat log.gz | grep "Apache" Con­vert…

  • Use cas­es Tools Stan­dard unix tools like awk can also been used with a cat of a flow file. nfdump SiLK argus

  • JA4S is a sys­tem to hash the con­fig­u­ra­tion of a TLS con­nec­tion. More: ja4/technical_details/README.md at main · FoxIO-LLC/­ja4 · GitHub Pos­si­ble use cases:

  • Scapy fundamentals Com­mands for the inter­ac­tive scapy interpreter: conf.iface shows the cur­rent­ly used interface  conf.iface='tun0' sets the inter­face to use ls shows all protocols ls(TCP) shows all known head­ers for a giv­en protocol lsc shows build-in functions Details about a pack­et p: p shows gen­er­al information p.summary() shows also gen­er­al information p.show() shows each field and…

  • Bettercap

    A Etter­cap suc­ces­sor, writ­ten in Go. Basic commands: Pas­sive ARP probing:  net.recon on net.recon off Active prob­ing: net.probe on net.probe off Sniff­ing: set net.sniff.output /tmp/sniff.pcap // optional net.sniff on net.sniff off Spoof­ing: set arp.spoof.targets $target1, $target2, $target3 arp.spoof on arp.spoof off DNS Spoof­ing: set dns.spoof.domains target.domain // the domain which should be resolved as… set…

  • Volatility

    See also Mem­ProcFS The foren­sic mem­o­ry frame­work Volatil­i­ty (Ver­sion 3 since 2019) offers a wide range of meth­ods to analyse mem­o­ry. See the blog post Retriev­ing mem­o­ry for meth­ods and tech­niques to obtain memory. Start by get­ting gen­er­al infor­ma­tion about a mem­o­ry dump: volatility -f image.mem imageinfo Now use the fol­low­ing com­mands to get more information:…

  • YARA

    Yet anoth­er ridi­colous acrynom is a tool for detect infor­ma­tion in bina­ry and text files. YARA rules are writen in text files.  By call­ing yara with a rule file and a file to test, it either returns noth­ing if no rule was detect­ed or one or mul­ti­ple rules which match­es the pro­vid­ed file. Exam­ple: The foll­wing rule…

  • iptables / netfilter

    Note that ipt­a­bles and ip6tables should be used always together! Tables Ipt­a­bles man­ages a set of tables which act as ACL Access Con­trol Lists. Actions Actions are defined via the -j option. Examples Show all rules iptables -Lip6tables -L Ignore all pack­ets from a network: iptables -A INPUT -s 192.168.5.1/32 -j DROPip6tables -A INPUT -s fd75:943b:5f2e:0:a4:45a1:b753:4152 -j…

  • tcpdump Get incom­ing ICMP packets: sudo tcpdump -i any icmp and src host $target Nützliche Parameter Domains nicht auflösen, IPs anzeigen -n Dump der Dat­en anzeigen -X Paket in ASCII anzeigen -A Umgang mit Dateien Dump in Datei schreiben tcpdump -w file Dump aus Datei lesen tcpdump -r file Standard-Abfragen tcpdump -n src|dst 10.10.10.10 and port…

  • Wireshark

    See a pack­et in its context Kontextmenü, Follow auswählen Show only ICMP pack­ets from a host tcpdump host 10.11.1.128 and icmp -i tun0 Show oth­er sys­tems com­mu­ni­cat­ing out­side the own address ip.addr == 10.11.1.0/24 && !(ip.addr == 192.168.119.0/24) && ! dns && !browser && !ssdp && !nbns && !llmnr Record audio Wire­shark can trans­form cap­tured audio…

  • knockd

    With knockd a serv­er can be con­fig­ured to respond only after some ports were checked before. Its often used for SSH. Couter­mea­sure: Sniff traf­fic and wait for an user to login and recon­struct the knock­ing pat­tern out of the pcaps.

  • Ettercap

    Sniff­ing and live con­tent fil­ter­ing. Oper­a­tion modes: Uni­fied:  sniffs all pack­ets from one inter­face. Pack­ets for an attack host are end­ing here, but are direct­ly for­ward­ed after receiving Brid­get: For­wards traf­fic from one inter­face to anoth­er. Absolute­ly secret because there is real­ly no one “between the cable” Usage ettercap OPTIONS TARGET1 TARGET2 Tar­gets are defined as MAC/IPv4s/IPv6s/PORT…