Category: Cybersec technology

Passive (DNS? Social Media accounts),Active Vulnerabilities identificationadvanced hackers use tools that produce less traffic Exploitation -exploit: piece of software which takes advantage of vulnerabilities– Web archives: https://archive.org/WhoisSearch enginesShodanMetadata of documentsIP and port scanning traceroute : 3 different packets send to the next IP. that idicates reachability traceroute: request timed out in the middle of path: this host is unreacahble but other...

https://docs.google.com/presentation/d/1yK6ANhM4af-5CQXBKpNJWVmv0Sccr-yTKjdLStzY3EY/edit iptablesTo check what is happening on the ubuntu server: journalctl –xe ports:  netstat -lntup,ss -lntup # Modern Linux Dropping is being used in production instead of rejecting packets. The attacker can’t be sure about existence of the address (service) so it will slow him down. netstat -lntup  # listening servicesdhclient -v eth0 # DHCP requesttcpdumparp -n https://elab.cs.ttu.ee/my_labs : ilovefirewalls...

How much does Google about us?340 request to Google servers from android phone per 24 hrshttps://adssettings.google.com/authenticatedhttps://myactivity.google.com/https://takeout.google.com/settings/takeout?pli=187% of income comes from advertisement Packages and malware.docxPart items (workbook.xml, sheetn.xml, other files )Content type items (description of)extraction of the document container: .doc has a “filesystem” inside a container.doc profiling tools OfficeMalScanner  DFView (oldschool microsoft OLE structure viewer) .. .pdf The original look of...

Base64 is most used when sending email with attachment. WikiPossible solution of the lab: Use pyhthon az4n6.blogspot.com google have it’s session about logs  DNS queriesNXDOMAIN response – nonexisting domain GeoIP is dynamic information. Mightchange

From virustotal would be shared to every company. Cuckoo sandbox does not. nodistribute wouldnt share it as well. Samples: http://www.tud.ttu.ee/im/Toomas.Lepik/Oldthings/ICT8250/ VM detonation. (modern.ie) https://developer.microsoft.com/en-us/microsoft-edge/IOC index of compromise TERMINAL file = filetypesha256, hash to virustotal hybrid-analysis.com19th oct deadline Lab “prices” presentation notes:bulletproof hosting www.2×4.ru/index.phpinfecting machine around 2 USD on wallstreetmarketcareful about logs of ISP, use clear deviceuse only basic language and different timezone = create...

When checking a file for fishing, fis make checksum and uplouad chceksum to virustotal.com. Where we can find malware:URLUSBin the Mailin a folder (FTP, Torrent)“Burrowed into the system” No need to understand a whole oce.if one tool fails, try anotherDont get stuck on a hard issue, move along The goals of malware analyses Static/dynamic analysesWe use multiple techniques to analyse...

browser checker for invisible trackers: https://panopticlick.eff.org How to anonymize yourself?  virtualization provides different fingerprint and takes different resolutions (if we will not sitch if off ex in TOR) DONT do this lab from my own computer. DONT do it from your network!! What can do annonsurf? I2P https://cs.wikipedia.org/wiki/I2P some addons to use: noscript,  Dont reccomand to contact.  if u break the law...