Sunday, July 6, 2014

Stimulus and Response - TCP - Setting a single flag

›
In this first post, we will set 1 flag on each packet. FIN -> Windows 2012/CentOS 6.5 -> 80 (Listening) >>> sendp(Ether()/IP(...

Stimulus and Response - TCP

›
So there I was, after encountering some flow data with strange flags, I decided to do a post on stimulus and response. Little did I know, I ...
Sunday, June 15, 2014

Beginning Memory Forensics - Volatility

›
In the previous post, the memory image of a Windows 2003SP2 machine was dumped. Now that we have the memory image, let's use volatility ...
Saturday, June 14, 2014

Beginning Memory Forensics – Getting the contents of RAM - DumpIT

›
Why would we want to do memory Forensics? As I’ve said previously, in analyzing an intrusion or any signs that  there may have been an intru...
Thursday, June 12, 2014

snort rules - Pandemiya Trojan - Zeus-based Variant - Revision 2

›
After some discussion it was recognised that the string which was being searched for in the URI may be randomly generated. It was suggested ...
Wednesday, June 11, 2014

snort rules - Pandemiya Trojan - Zeus-based Variant

›
 Earlier today a colleague (thanks Zuhair) made me aware of a new Zeus-based variant which was discovered. He sent me the following three l...
Sunday, June 8, 2014

Beginning IPv6 - Analyzing FTP Traffic

›
In the previous post we look at analyzing Telnet. Let's now look at the FTP protocol. Since in the post on DNS I elaborated on the field...

Beginning IPv6 - Analyzing Telnet Traffic

›
In the previous post we look at analyzing HTTP. Let's now look at the Telnet protocol. Since in the post on DNS I elaborated on the fiel...

Beginning IPv6 - Analyzing HTTP traffic

›
In the previous post we looked at analyzing DNS. Let's now look at the HTTP protocol. Since in the post on DNS I elaborated on the filed...

Beginning IPv6 - Analyzing DNS

›
Now we move into the meat of the matter. All the previous posts were really preparing for this stage. It is obvious that, unless we understa...