[forensic] NTDS.DIT Forensics

sec

http://www.ntdsxtract.com/downloads/ntdsxtract/ntds_forensics.pdf

2013-07-11

[malware] The Citadel crimeware kit - under the microscope

sec

The Citadel crimeware kit – under the microscope | Naked Security

2013-07-11

[malware] Citadel Trojan Malware Analysis

sec

http://botnetlegalnotice.com/citadel/files/Patel_Decl_Ex20.pdf

2013-07-10

Revelo

sec

Deobfuscate Javascript Tools | Kahu Security Deobfuscating Javascript with Revelo | Kahu Security

2013-07-06

[malware] [unpack] Themida+WL1.1.0.0-2.1.0.0Dumper+IAT Repair+CodeEncryptRepair_v2.6.0

sec

http://reversengineering.wordpress.com/category/tools/unpackers/

2013-07-06

virustotal-search.py

sec

Update: virustotal-search.py | Didier Stevens

2013-07-04

Forensic Analysis of Microsoft Internet Explorer Cookie Files.pdf

sec

Forensic Analysis of Microsoft Internet Explorer Cookie Files.pdf - Google ドライブ

2013-07-04

Viewing ELF Binary Signatures.pdf

sec

Viewing ELF Binary Signatures.pdf - Google ドライブ

2013-06-30

Recon 2013 Slides スライド

sec

Index of /2013/slides/

2013-06-25

[CTF] Defcon 21 Quals Writeupとかをまとめる予定地

sec

Defcon 21 Quals Writeupとかをまとめる予定地 - piyolog

2013-06-25

exploit-exercises.com

sec

Exploit Exercises

2013-06-21

DEFCON CTF Quals の write up 書いてみた

sec

DEFCON CTF Quals の write up 書いてみた - wakatonoの戯れメモ

2013-06-20

多発するWeb改ざんに備えてinotifywaitによる改ざん検知を導入した

sec

多発するWeb改ざんに備えてinotifywaitによる改ざん検知を導入した | 徳丸浩の日記 logging $ inotifywait -r -m /home/ubuntu/test > xxxx.log $ more xxxx.log /home/ubuntu/test/ CREATE xxxx /home/ubuntu/test/ OPEN xxxx /home/ubuntu/test/ ATTRIB xx…

2013-06-19

Windows7でのRDP時のイベントログ証跡

sec

RDPサービス開始ログの名前: Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational イベント ID: 258 リスナー RDP-Tcp によりリッスンが開始されましたRDP受信イベント ID: 261 リスナー RDP-Tcp で接続を受信しましたログの名前: S…

2013-06-19

Windows7でのログオン時のイベントログ証跡（OfflineFilesログとの比較）

sec

イベントログ Securityログ OfflineFilesログ起動時イベントID:4624 イベントID:7（ログオン）ログオンタイプ:2 イベントID:8（ログオフ）スクリーンロックからのログオンイベントID:4624 無しログオンタイプ:7

2013-06-13

Indicators of Compromise in Memory Forensics

sec

http://www.sans.org/reading_room/whitepapers/forensics/indicators-compromise-memory-forensics_34162

2013-06-13

Using IOC (Indicators of Compromise) in Malware

sec

Forensics http://www.sans.org/reading_room/whitepapers/incident/ioc-indicators-compromise-malware-forensics_34200

2013-06-04

[CTF]

sec

Flaggers CTFtime.org / All about CTF (Capture The Flag)

2013-06-01

Attack wave on Ruby on Rails

sec

Attack wave on Ruby on Rails - The H Open: News and Features

2013-05-27

Tools for Examining XOR Obfuscation for Malware Analysis

sec

SANS Digital Forensics and Incident Response Blog | Tools for Examining XOR Obfuscation for Malware Analysis | SANS Institute

2013-05-05

[fakedns] 3 Free Tools to Fake DNS Responses for Malware Analysis

sec

3 Free Tools to Fake DNS Responses for Malware Analysis

2013-05-01

Basic Packers: Easy As Pie

sec

Basic Packers: Easy As Pie

2013-05-01

SecurityTube Linux Assembly Expert (SLAE)

sec

Assembly Language and Shellcoding on Linux « SecurityTube Training

2013-05-01

Reverse Engineering Linux ELF Binaries on the x86 Platform

sec

http://www.linuxsa.org.au/meetings/reveng-0.2.pdf

2013-04-30

Library of Malware Traffic Patterns

sec

Malwareのトラフィックパターンが逐次更新され、公開されている ※グーグルドックス DeepEnd Research: Library of Malware Traffic Patterns

2013-04-30

[social] Social-Engineer.Org : Security Through Education

sec

The Official Social Engineering Portal - Security Through Education

2013-04-29

[malware] Malware.lu

sec

Malware.lu is a repository of malware and technical analyses for security researchers. Malware.lu provides an expert team in malwares analyses and incident response for private and government entities. Malware.lu - Home