Learning by practicing
Learning is an ongoing activity ... practicing makes it fun
Thursday, December 10, 2015
tcpreplay - Taking a look at packet replaying.
›
While teaching the SANS 503 (Intrusion Detection In-Depth) Community class last week in Ottawa, a student asked if the packets are actuall...
Wednesday, December 9, 2015
Covert Channels - Part 2 - exfiltrating data through TCP Sequence Number field
›
A while back I did this blog post on transferring data via the IP ID field . Recently, I had to do some work on this topic again, so I thoug...
Tuesday, December 8, 2015
Some tshark examples a mix of basic and somewhat advance
›
Viewing all IP packets tshark -n -r filename.pcap -Y "ip" Viewing all TCP packets tshark -n -r filename.pcap -Y "tcp...
a few not so basic windump examples
›
Verify IP verion is 4 windump -nvv -r filename.pcap -X "ip[0] & 0xF0 = 0x40" Verify IP header has no options. That is the IP...
Windump basics by examples
›
Just a quick put together of some basic tcpdump commands. In this post I will be targeting a .pcap file. However, these commands can be us...
8 comments:
Sunday, November 1, 2015
Volatility Memory Forensics - Investigation a potential virus situation - Part 5
›
Part 1 | Part 2 | Part 3 | Part 4 Final Pass – ShimCache, ShellBags & Prefetch Before closing off, the decision was made to tak...
‹
›
Home
View web version
