• Threat Hunting on Linux

    Show sys­tem files which were changed after installation. dpkg --verify Check var­i­ous secu­ri­ty relat­ed issues: checksecurity Tools

  • MemProcFC

    Mem­o­ry ana­lyza­tion soft­wrae to see phys­i­cal mem­o­ry as files in a vir­tu­al file system. GitHub — ufrisk/MemProcFS: MemProcFS

  • Sleuthkit

    Foren­sic tools

  • Dissec

    Dis­sect is a foren­sic tool for file sys­tem images,

  • Get hidden content from password fields Sce­nario: Use JavaScript for extrac­tion. Copy and pase the fol­low­ing into the web browser’s console: Extract keystrokes live from a Browser Sce­nario: Do: Extract Cookies Sce­nario: Inject/Do: Extract local / session storage Like above: Stealing site passwords Sce­nario: Then, inject JS which adds an invis­i­ble user/username/name text field and…

  • Volatility

    See also Mem­ProcFS The foren­sic mem­o­ry frame­work Volatil­i­ty (Ver­sion 3 since 2019) offers a wide range of meth­ods to analyse mem­o­ry. See the blog post Retriev­ing mem­o­ry for meth­ods and tech­niques to obtain memory. Start by get­ting gen­er­al infor­ma­tion about a mem­o­ry dump: volatility -f image.mem imageinfo Now use the fol­low­ing com­mands to get more information:…

  • radare2

    Address­es with­in the mem­o­ry are ref­er­enced with @ General Start­ing with direct­ly analysing all ref­er­enced code. r2 -A $file ... e emu.str = true Start­ing with enabled debug­ger (only when I want to exe­cute the program) r2 -AA -e dbg.follow.child=true -e dbg.forks=true -d $file ... e emu.str = true Fork para­me­ter: If the process forks, the debug­ger halts Type…

  • General tools Imaging tools dd, of course. Note that it makes sense to set the prop­er block size (some­times 4k, but most hard dri­ves are using 512), so that, when an error occued, the exact sec­tor is shown which can after­wards be skipped. dd if=/dev/sda of=/external/file.md5 bs=512 ewfacquire sudo ewfac­quire /dev/sda Advan­tages: aff4 advanced forensic…

  • Memory dump

    After­wards: See Ana­lyz­ing memory Linux Prozess memory dump Find out which mem­o­ry seg­ments are used by an appli­ca­tion via its PID: cat /proc/<pid>/maps Dump the used mem­o­ry from an appli­ca­tion: (cred­it) #!/bin/bash grep rw-p /proc/$1/maps \ | sed -n 's/^\([0-9a-f]*\)-\([0-9a-f]*\) .*$/\1 \2/p' \ | while read start stop; do \ gdb --batch --pid $1 -ex \…

  • redline

    Like OSX­col­lec­tor, but for Win­dows. Col­lects infor­ma­tion on a host for lat­er analyzation. https://www.fireeye.com/services/freeware/redline.html

  • osxcollector

    osx­col­lec­tor http://yelp.github.io/osxcollector/ Stand alone python script. Exe­cute it on a Mac which should be analysed. It cre­ates an archive with “every­thing” inter­esst­ing which the vic­tim can hand over an expert. See red­line for Windows