Feb 3

Why learning a Forensic Artifact matters?

5-steps to learning an artifact and how I used it to learn a thing or two about NTFS. As security analysts, I am sure some of us have had this question — what’s the best way to improve my host forensics skills? …

Forensics

8 min read

Why learning a Forensic Artifact matters?

Jan 29

Scanning Kernel Memory for a Known Encryption Key

Overview Let’s say you are given an encryption key and asked this question — “This key can be found somewhere in the Kernel memory. You will be given a memory dump and all the tools you need. Your job is to find where and how this key is stored in the…

Windows Internals

3 min read

Scanning Kernel Memory for a Known Encryption Key

Jan 18

Adversary-in-the-middle using Network Sniffing

A do-it-yourself guide to IP forwarding. What is this article about? This article is a step-by-step guide to try out an Adversary-in-the-middle (AITM) attack by sniffing network traffic. We will be trying this out using two Ubuntu hosts called Victim and Sniffer. The goal is to configure these two hosts such that the Sniffer is…

Iptables

9 min read

Adversary-in-the-middle using Network Sniffing

Nov 18, 2021

Getting started with jq

Examples and Patterns — What is jq? jq is a JSON processing tool written in C. It is a lightweight binary (~30kB) and can be run standalone i.e. you don’t need to install any additional dependencies. jq is available on Linux, OSX, and Windows and is a popular choice for command-line JSON processing. Why another article on jq? I agree there are…

7 min read

Apr 15, 2021

Understanding Anonymous Pipes — Part 1 — The Handles

Interprocess communication is fascinating in its own right. It is a mechanism that allows different processes, each running in its own dedicated address space, to talk to each other. The Windows operating system supports a variety of IPC mechanisms. …

Anonymous Pipes

5 min read

Jan 27, 2021

Symmetric Key Usage in EFS

This article provides information about symmetric key algorithms supported by EFS. This information is required to successfully decrypt a file once the FEK is obtained. EFS supports the use of AES-256 and 3DES symmetric key algorithms for encrypting the DATA attribute (Openspecs-office, 2018). In Windows 10, EFS defaults to using…

Symmetric Encryption

2 min read

Jan 27, 2021

Monitoring USN journal for changes

This article explains how the USN Journal can be used to monitor file system changes by taking the example of encrypting a plaintext file. Step 1 — Create a plain-text file: echo “Encrypt This!” > C:\Users\test\Documents\file.txt Step 2 — Query the USN Journal and note down the “Next Usn” value. …

Ntfs

1 min read

Monitoring USN journal for changes

This article explains how the USN Journal can be used to monitor file system changes by taking the example of encrypting a plaintext file.

Step 1 — Create a plain-text file:

echo “Encrypt This!” > C:\Users\test\Documents\file.txt

Step 2 — Query the USN Journal and note down the “Next Usn” value.

…

Jan 27, 2021

Finding Encryption Keys in Memory

Walkthrough of a few approaches using AES-256 Why this article? The computer memory (RAM) can be thought of as a storehouse of secrets. These secrets can range from your instant messenger chats, sites visited in incognito mode, or the encryption keys used by programs to protect your data. …

Ntfs

9 min read

Why learning a Forensic Artifact matters?

Scanning Kernel Memory for a Known Encryption Key

Adversary-in-the-middle using Network Sniffing

Getting started with jq

Understanding Anonymous Pipes — Part 1 — The Handles

Symmetric Key Usage in EFS

Monitoring USN journal for changes

Monitoring USN journal for changes

Finding Encryption Keys in Memory

diyinfosec