Sharkin' Using Wireshark to find evil in packet captures. Ben S. Knowles BBST, CISSP, GCIA, GCIH, GSEC, LPIC-1, et cetera
|
|
|
- Emmeline Francis
- 5 years ago
- Views:
Transcription
1 Sharkin' Using Wireshark to find evil in packet captures Ben S. Knowles BBST, CISSP, GCIA, GCIH, GSEC, LPIC-1, et cetera
2 Packet Captures Recordings of Internet activity Often used by analysts and researchers What can you quickly find out from a pcap? Buy the official Three Investigators Cluedo (auf Deutsch) at
3 pcaps: quick answers Basic packet analysis should find: IP addresses involved hosts who Protocols used how characterization Directionality who did to whom Application used (if any) how TTP Time and date when, but watch out for timezones! Adds up to Characterization of the traffic and a possible story it tells: Who?, Did What?, When?, To Whom? What is the significance (so what)? and What should someone do about it?
4 IDS: a source of packets for analysis Intrusion Detection Systems (IDS): Alert on traffic that matches signature rules (Snort, et al) Or log and notify based on policy (Bro IDS) Alerts are displayed in consoles: Bro IDS, Snort, Suricata, RealSecure, McAfee NSM DSWX CTP Portal, sguil, Snorby, SiteProtector, EPO Consoles display many event details And (usually) give you option to pull a pcap file
5 Wireshark: about Wireshark is the world's foremost network protocol analyzer. It lets you capture and interactively browse the traffic running on a computer network. It is the de facto (and often de jure) standard across many industries and educational institutions. Wireshark development thrives thanks to the contributions of networking experts across the globe. It is the continuation of a project that started in 1998 from: Looks a bit like this >
6 Packet analysis tips: safety and accuracy Get offline! Disable lookups in your tools tcpdump -nn Wireshark: uncheck in View / Name Resolution Keep your analysis tools updated! Analysis tools are a juicy target for attackers. File and protocol parsers are a constant source of vulnerabilities No captures on production networks or other peoples networks! Isolate your analysis environment for safety and cleaner results Check with your boss / client / spouse / lawyer before capturing traffic. Double-check those timezones again. Most computer systems record time in UTC no matter where they are.
7 Packets! Let's get some packets and take a look! PCAP files are at:
8 Snorby: a few events
9 Snorby: id check returned root : testmy-handout.pcap
10 testmy-handout.pcap: questions Let's find: IP addresses involved hosts who Protocols used how characterization Directionality who did to whom Application used (if any) how TTP Time and date when, but watch out for timezones! Adds up to Characterization of the traffic and a possible story it tells: Who?, Did What?, When?, To Whom? What is the significance (so what)? and What should someone do about it?
11 Wireshark tricks: Statistics Summary In Wireshark menu: Statistics / Summary Gives times and packet statistics Similar output to capinfos command
12 testmy-handout.pcap: answers Root user is super admin on UNIX systems This suggests an attacker has gotten remote root Game over? Found at anvari.org
13 Snorby: Wordpress login: ptmag-login.pcap
14 ptmag-login.pcap: questions Let's find: IP addresses involved hosts who Protocols used how characterization Directionality who did to whom Application used (if any) how TTP Time and date when, but watch out for timezones! Adds up to Characterization of the traffic and a possible story it tells: Who?, Did What?, When?, To Whom? What is the significance (so what)? and What should someone do about it?
15 Wireshark tricks: filters Powerful filters let us sift and sort through captures Color highlighting for syntax check Suggestions help you pick fields Use what you already know To find what you are looking for faster
16 Wireshark tricks: display filters We know from the alert and can filter on to sift out packets: Protocols: TCP/IP HTTP (2445) (2445) Hosts (1082) & ? Applications: PenTestMag site HTML form WordPress blog (73) (1) (1)
17 research: reproduce it and pcap it, search pcaps... ## check my tcpdump settings with a live capture ## sudo tcpdump -i en0 -v 'host ' ## verified, capture session to a file ## sudo tcpdump -i en0 -w ptmag.pcap 'host ' Offstage: login to suspect site again in browser, then ## read back the capture file and dump text to another file ## tcpdump -r ptmag.pcap -X 2>&1 > outfile.txt ## Look for suspicious strings in the output, grep -c counts ## grep Password -c outfile.txt ; grep Password outfile.txt grep adricnet -c outfile.txt ; grep adricnet outfile.txt
18 Much easier in Wireshark: Find Packet Edit / Find Packets By: String Packet: bytes
19 ptmag-login.pcap: answers Seems our subject web magazine isn't handling logins properly. SSL/TLS should be used for all logins and all login pages. Especially for public and commercial sites (this one is both). We should send them a nice note about this after the brownbag is over. Found on InfoSec Reactions, a very silly place.
20 pcaps from ATTACK research ;) Trying out some IE8 attacks on a WinXP VM on my Mac at home Packets captured to file: msf_ie0day_winxpsp3.pcap
21 msf_ie0day_winxpsp3.pcap
22 msf_ie0day_winxpsp3.pcap: questions Let's find: IP addresses involved hosts who Protocols used how characterization Directionality who did to whom Application used (if any) how TTP Time and date when, but watch out for timezones! Adds up to Characterization of the traffic and a possible story it tells: Who?, Did What?, When?, To Whom? What is the significance (so what)? and What should someone do about it?
23 Wireshark tricks: Conversations In Wireshark menu: Statistics / Conversations Shows all network flows at multiple layers: Ethernet IP TCP
24 Wireshark tricks: Follow Stream In Conversations panel: Select a line and Follow Stream
25 Wireshark tricks: Evil found! This is a Windows Executable. Attacker is delivering a payload to the victim host. This is pretty bad. In Wireshark you can Save As to pull the file contents out for analysis or RE. Congratulations, you found some evil with Wireshark!
26 Next Steps? Wireshark books: Practical Packet Analysis, 2nd Ed Wireshark Network analysis, forensics courses: SANS SEC503 and GCIA SANS new! FOR572 Now in Beta
27 References Slide deck, pcaps, and links available online:
Sharkin' Using Wireshark to find evil in packet captures. Ben S. BBST, CISSP, GCIA, GCIH, GNFA, GSEC, LPIC-1, et cetera
Sharkin' Using Wireshark to find evil in packet captures Ben S. Knowles, @adricnet BBST, CISSP, GCIA, GCIH, GNFA, GSEC, LPIC-1, et cetera Packet Captures Recordings of Internet(work) activity Often used
Lab 4: Network Packet Capture and Analysis using Wireshark
Lab 4: Network Packet Capture and Analysis using Wireshark 4.1 Details Aim: To provide a foundation in network packet capture and analysis. You may be faced with network traffic analysis, from traffic
CNIT 50: Network Security Monitoring. 6 Command Line Packet Analysis Tools
CNIT 50: Network Security Monitoring 6 Command Line Packet Analysis Tools Topics SO Tool Categories Running Tcpdump Using Dumpcap and Tshark Running Argus and the Ra Client SO Tool Categories Three Types
Network Traffic Exploration Application. Presented By Grant Vandenberghe. (613)
Network Traffic Exploration Application Presented By Grant Vandenberghe Grant.Vandenberghe@drdc-rddc.gc.ca (613) 991-6464 Defence Research and! Development Canada Recherche et développement! pour la défense
Computer Forensics: Investigating Network Intrusions and Cybercrime, 2nd Edition. Chapter 2 Investigating Network Traffic
Computer Forensics: Investigating Network Intrusions and Cybercrime, 2nd Edition Chapter 2 Investigating Network Traffic Objectives After completing this chapter, you should be able to: Understand network
CNIT 121: Computer Forensics. 9 Network Evidence
CNIT 121: Computer Forensics 9 Network Evidence The Case for Network Monitoring Types of Network Monitoring Types of Network Monitoring Event-based alerts Snort, Suricata, SourceFire, RSA NetWitness Require
The Future of Threat Prevention
The Future of Threat Prevention Bricata is the leading developer of Next Generation Intrusion Prevention Systems (NGIPS) technology, providing innovative, disruptive, high-speed, high-performance network
Network Security Monitoring (NSM) Using
Network Security Monitoring (NSM) Using James Kirn 9/20/17 Based on Material from Doug Burks Presentation 2014_017_001_90218 North West Chicagoland Linux User Group (NWCLUG) -10.2017 1 Problem All our
Network Intrusion Analysis (Hands on)
Network Intrusion Analysis (Hands on) TCP/IP protocol suite is the core of the Internet and it is vital to understand how it works together, its strengths and weaknesses and how it can be used to detect
Texas Tech University Spring 2017 Digital Forensics Network Analysis
Analyzing the Network Capture of WannaCry Ransomware Background: Network analysis can get very detailed. There are several different types of evidence. Full packet captures, logs and netflow information.
Lab Exercise Protocol Layers
Lab Exercise Protocol Layers Objective To learn how protocols and layering are represented in packets. They are key concepts for structuring networks that are covered in 1.3 and 1.4 of your text. Review
Introduction to OSI model and Network Analyzer :- Introduction to Wireshark
Sungkyunkwan University Introduction to OSI model and Network Analyzer :- Introduction to Wireshark Syed Muhammad Raza s.moh.raza@gmail.com Copyright 2000-2015 Networking Laboratory 1/56 An Overview of
Network Forensics (wireshark) Cybersecurity HS Summer Camp
Network Forensics (wireshark) Cybersecurity HS Summer Camp Packet Sniffer a packet sniffer captures ( sniffs ) messages being sent/received from/by your computer; it will also typically store and/or display
Gibson: 3D Visualization and Modeling of Real Time Security Events. Dan Klinedinst
Gibson: 3D Visualization and Modeling of Real Time Security Events Dan Klinedinst gibson3d.org @dklinedinst Who Am I? Security Researcher at Carnegie Mellon University Security of enterprise systems Primarily
Week Date Teaching Attended 9 Mar 2013 Lab 9: Network Forensics
Week Date Teaching Attended 9 Mar 2013 Lab 9: Network Forensics Aim: The aim of this lab is to further investigate network-based forensic investigations, including network evidence capture and analysis
Agility2018-TCPdump Documentation
Agility2018-TCPdump Documentation Release.01 David Larsen Aug 10, 2018 Switches 1 F5 tcpdump and Wireshark 3 1.1 tcpdump Switches............................................ 3 1.2 tcpdump Filters..............................................
Wireshark 101 Essential Skills for Network Analysis 2 nd Edition
Wireshark 101 Essential Skills for Network Analysis 2 nd Edition Always ensure you have proper authorization before you listen to and capture network traffic. Protocol Analysis Institute, Inc 59 Damonte
Wireshark 101 Course Set
Wireshark 101 Course Set Essential Skills for Network Analysis Nine separate online courses focusing on essential network analysis skills. These courses are based on the best-selling Wireshark 101: Essential
Base64 The Security Killer
Base64 The Security Killer Kevin Fiscus NWN Corporation Session ID: DAS-203 Session Classification: Intermediate A Short (Made Up) Security Story Helix Pharmaceuticals is concerned about security Industrial
Wireshark: Network Forensic Exercise by Fakrul Alam, Bangladesh CERT
Wireshark: Network Forensic Exercise by Fakrul Alam, Bangladesh CERT Network Startup Resource Center http://www.nsrc.org/ These materials are licensed under the Creative Commons Attribution-NonCommercial
Packet Capture & Wireshark. Fakrul Alam
Packet Capture & Wireshark Fakrul Alam fakrul@bdhub.com Why we need to capture packet & how it s related to security? tcpdump Definition tcpdump is a utility used to capture and analyze packets on network
Network Security Monitoring: An Open Community Approach
Network Security Monitoring: An Open Community Approach IUP- Information Assurance Day, 2011 Greg Porter 11/10/11 Agenda Introduction Current State NSM & Open Community Options Conclusion 2 Introduction
Application Note. Providing Secure Remote Access to Industrial Control Systems Using McAfee Firewall Enterprise (Sidewinder )
Application Note Providing Secure Remote Access to Industrial Control Systems Using McAfee Firewall Enterprise (Sidewinder ) This document describes how to configure McAfee Firewall Enterprise to provide
When does it work? Packet Sniffers. INFO Lecture 8. Content 24/03/2009
Packet Sniffers INFO 404 - Lecture 8 24/03/2009 nfoukia@infoscience.otago.ac.nz Definition Sniffer Capabilities How does it work? When does it work? Preventing Sniffing Detection of Sniffing References
Network Security Laboratory 23 rd May STATEFUL FIREWALL LAB
Network Security Laboratory 23 rd May 2016. STATEFUL FIREWALL LAB 1 CONTENTS INTRODUCTION I. What is Stateful Firewall II. Difference between Stateful and Stateless III. Example of Stateful firewall IV.
Packet Analysis - Wireshark
Packet Analysis - Wireshark Network Security Workshop 3-5 October 2017 Port Moresby, Papua New Guinea Why do we need to capture packet & how is it relevant to security? tcpdump tcpdump is a utility used
Instituto Superior Técnico, Universidade de Lisboa Network and Computer Security. Lab guide: Traffic analysis and TCP/IP Vulnerabilities
Instituto Superior Técnico, Universidade de Lisboa Network and Computer Security Lab guide: Traffic analysis and TCP/IP Vulnerabilities Revised on 2016-10-18 Alpha version: This is an early version and
Introduction to OSI model and Network Analyzer :- Introduction to Wireshark
Sungkyunkwan University Introduction to OSI model and Network Analyzer :- Introduction to Wireshark Syed Muhammad Raza s.moh.raza@gmail.com Copyright 2000-2014 Networking Laboratory 1/56 An Overview Internet
Lab Assignment for Chapter 1
CHAPTER 1 Lab Assignment for Chapter 1 We have created lab assignments for eight chapters of the textbook (Chapters 1, 2, 3, 4, 5, 6, 8, and 10). We have no lab assignments for Chapter 7, 9 or 11. We cannot
Using the AETA Remote Access service
Using the AETA Remote Access service 1. Background AETA codecs can all be controlled via an IP interface, and for instance a computer can easily take control over a codec when it is connected on the same
Example: Packet Logging Workflow. Using Packet Captures. Enabling Packet Capture in Security Policy Rules
Example: Packet Logging Workflow Using Packet Captures This topic summarizes IDP packet logging basics. It includes the following sections: Using Packet Captures on page 1 Enabling Packet Capture in Security
Microsoft Labs Online
Microsoft Labs Online Self-Service Student Guide Welcome to Microsoft Labs Online powered by Xtreme Velocity. This document provides stepby-step instructions on how to: Create an account. Use your virtual
Packet Capture Wireshark Fakrul Alam
Packet Capture Wireshark Fakrul Alam Why we need to capture packet & how it s related to security? tcpdump Defini=on tcpdump is a u0lity used to capture and analyze packets on network interfaces. Details
NIDS: Snort. Group 8. Niccolò Bisagno, Francesco Fiorenza, Giulio Carlo Gialanella, Riccardo Isoli
NIDS: Snort Group 8 Niccolò Bisagno, Francesco Fiorenza, Giulio Carlo Gialanella, Riccardo Isoli 1 Summary NIDS Snort Syn Flood Attack Exploit Kit Detection: Bleeding Life Packet Level Evasion Snort as
Exercises: Basics of Networking II Experiential Learning Workshop
Exercises: Basics of Networking II Experiential Learning Workshop 1 General Guidelines 1. Make a team of two or three unless stated otherwise. 2. For each exercise, use wireshark capture to verify contents
COMPUTER NETWORKS. CPSC 441, Winter 2016 Prof. Mea Wang Department of Computer Science University of Calgary
COMPUTER NETWORKS CPSC 441, Winter 2016 Prof. Mea Wang Department of Computer Science University of Calgary Introduction: Wireshark and tshark Running tshark Running Wireshark Exercise: Analyze HTTP traffic
RSA INCIDENT RESPONSE SERVICES
RSA INCIDENT RESPONSE SERVICES Enabling early detection and rapid response EXECUTIVE SUMMARY Technical forensic analysis services RSA Incident Response services are for organizations that need rapid access
Defense Wins Championships. April 16, 2014 For Educational Purposes Only
Defense Wins Championships April 16, 2014 For Educational Purposes Only For Educational Purposes Only Defense Wins Championships The threat landscape is constantly changing and being able to detect malicious
Blue Team Handbook: Incident Response Edition
Blue Team Handbook: Incident Response Edition A condensed field guide for the Cyber Security Incident Responder. By: Don Murdoch, GSE, MBA, CISSP+14 Version 2.0 1. Blue Team Handbook - Introduction 3 2.
Microsoft Labs Online
Microsoft Labs Online Microsoft Certified Trainer (MCT) Readiness Guide Welcome to Microsoft Labs Online (MLO) powered by Xtreme Velocity. This document provides step-by-step instructions on how to: Create
n Describe sniffing concepts, including active and passive sniffing n Describe sniffing countermeasures n Describe signature analysis within Snort
Outline n Describe sniffing concepts, including active and passive sniffing and protocols susceptible to sniffing n Describe ethical hacking techniques for Layer 2 traffic Chapter #4: n Describe sniffing
Means for Intrusion Detection. Intrusion Detection. INFO404 - Lecture 13. Content
Intrusion Detection INFO404 - Lecture 13 21.04.2009 nfoukia@infoscience.otago.ac.nz Content Definition Network vs. Host IDS Misuse vs. Behavior Based IDS Means for Intrusion Detection Definitions (1) Intrusion:
The Bro Network Security Monitor
The Bro Network Security Monitor Bro Integrations: Some Misc. Bro Related Stuff Jon Schipp, NCSA BroCon15 MIT, Cambridge, Massachusetts Agenda Outlining a few things I ve worked on ISLET - Software that
Configuring IDS TCP Reset Using VMS IDS MC
Configuring IDS TCP Reset Using VMS IDS MC Document ID: 47560 Contents Introduction Prerequisites Requirements Components Used Conventions Configure Network Diagram Configurations Initial Sensor Configuration
BSc Year 2 Data Communications Lab - Using Wireshark to View Network Traffic. Topology. Objectives. Background / Scenario
BSc Year 2 Data Communications Lab - Using Wireshark to View Network Traffic Topology Objectives Part 1: (Optional) Download and Install Wireshark Part 2: Capture and Analyze Local ICMP Data in Wireshark
Activating Intrusion Prevention Service
Activating Intrusion Prevention Service Intrusion Prevention Service Overview Configuring Intrusion Prevention Service Intrusion Prevention Service Overview Intrusion Prevention Service (IPS) delivers
Needle in a Haystack. Improving Intrusion Detection Performance in University settings by removing good traffic to better focus on bad traffic
Needle in a Haystack Improving Intrusion Detection Performance in University settings by removing good traffic to better focus on bad traffic The Person Talking Paul Tatarsky paul@tatarsky.com Network
Detecting Computer Intrusions: Are You Pwned? Steve Anson HITB 8 Oct 2009
Detecting Computer Intrusions: Are You Pwned? Steve Anson HITB 8 Oct 2009 Steve Anson Former computer agent for the U.S. Department of Defense and Federal Bureau of Investigation (FBI) Cybercrime Task
Wireshark Lab: TCP v7.0
Wireshark Lab: TCP v7.0 Supplement to Computer Networking: A Top-Down Approach, 7th ed., J.F. Kurose and K.W. Ross Tell me and I forget. Show me and I remember. Involve me and I understand. Chinese proverb
9. Wireshark I: Protocol Stack and Ethernet
Distributed Systems 205/2016 Lab Simon Razniewski/Florian Klement 9. Wireshark I: Protocol Stack and Ethernet Objective To learn how protocols and layering are represented in packets, and to explore the
Logging. Steven M. Bellovin December 6,
Logging Steven M. Bellovin December 6, 2009 1 Shadow Hawk Shadow Hawk Busted Again As many of you know, Shadow Hawk (a/k/a Shadow Hawk 1) had his home searched by agents of the FBI... When he was tagged
Objectives: (1) To learn to capture and analyze packets using wireshark. (2) To learn how protocols and layering are represented in packets.
Team Project 1 Due: Beijing 00:01, Friday Nov 7 Language: English Turn-in (via email) a.pdf file. Objectives: (1) To learn to capture and analyze packets using wireshark. (2) To learn how protocols and
Computer Forensics: Investigating Network Intrusions and Cyber Crime, 2nd Edition. Chapter 3 Investigating Web Attacks
Computer Forensics: Investigating Network Intrusions and Cyber Crime, 2nd Edition Chapter 3 Investigating Web Attacks Objectives After completing this chapter, you should be able to: Recognize the indications
SANS FORENSIC CHALLENGES REPORT
SANS FORENSIC CHALLENGES REPORT Nama 이름 : Fitroh Qori Saputro : 피뜨로코리사뿌뜨로 NIM : 10152147 1. Wireshark Wireshark is the world's foremost network protocol analyzer. It lets you see what's happening on your
Enhancing Byte-Level Network Intrusion Detection Signatures with Context
Enhancing Byte-Level Network Intrusion Detection Signatures with Context Robin Sommer sommer@in.tum.de Technische Universität München Germany Vern Paxson vern@icir.org International Computer Science Institute
RSA NetWitness Suite Respond in Minutes, Not Months
RSA NetWitness Suite Respond in Minutes, Not Months Overview One can hardly pick up a newspaper or turn on the news without hearing about the latest security breaches. The Verizon 2015 Data Breach Investigations
McAfee Network Security Platform 8.3
Revision J McAfee Network Security Platform 8.3 (Integration Guide) COPYRIGHT Copyright 2018 McAfee, LLC TRADEMARK ATTRIBUTIONS McAfee and the McAfee logo, McAfee Active Protection, epolicy Orchestrator,
Overview Intrusion Detection Systems and Practices
Overview Intrusion Detection Systems and Practices Chapter 13 Lecturer: Pei-yih Ting Intrusion Detection Concepts Dealing with Intruders Detecting Intruders Principles of Intrusions and IDS The IDS Taxonomy
Deployment Guide: Routing Mode with No DMZ
Deployment Guide: Routing Mode with No DMZ March 15, 2007 Deployment and Task Overview Description Follow the tasks in this guide to deploy the appliance as a router-firewall device on your network with
Data Plane Protection. The googles they do nothing.
Data Plane Protection The googles they do nothing. Types of DoS Single Source. Multiple Sources. Reflection attacks, DoS and DDoS. Spoofed addressing. Can be, ICMP (smurf, POD), SYN, Application attacks.
Configuring IP Logging
CHAPTER 8 This chapter describes how to configure IP logging on the sensor. It contains the following sections: Understanding IP Logging, page 8-1 Configuring Automatic IP Logging, page 8-2 Configuring
Chapter 7. Network Intrusion Detection and Analysis. SeoulTech UCS Lab (Daming Wu)
SeoulTech UCS Lab Chapter 7 Network Intrusion Detection and Analysis 2015. 11. 3 (Daming Wu) Email: wdm1517@gmail.com Copyright c 2015 by USC Lab All Rights Reserved. Table of Contents 7.1 Why Investigate
AN TOÀN LỚP 4: TCP/IP ATTACKS NGUYEN HONG SON PTITHCM
1 AN TOÀN LỚP 4: TCP/IP ATTACKS NGUYEN HONG SON PTITHCM 2 Introduction (1/2) TCP provides a full duplex reliable stream connection between two end points A connection is uniquely defined by the quadruple
Nonconventional Network Security Measures for Intrusion Detection
International Journal of Advances in Scientific Research and Engineering (ijasre) E-ISSN : 2454-8006 DOI: http://dx.doi.org/10.7324/ijasre.2017.32509 Vol.3 (9) Oct - 2017 Nonconventional Network Security
Foreword by Todd Heberlein
ConteNTS in Detail About the Author Foreword by Todd Heberlein xvii xix Preface xxv Audience... xxvi Prerequisites... xxvii A Note on Software and Protocols... xxvii Scope.... xxviii Acknowledgments...
Lecture 12. Application Layer. Application Layer 1
Lecture 12 Application Layer Application Layer 1 Agenda The Application Layer (continue) Web and HTTP HTTP Cookies Web Caches Simple Introduction to Network Security Various actions by network attackers
Network Performance Analysis System. White Paper
Network Performance Analysis System White Paper Copyright Copyright 2018 Colasoft. All rights reserved. Information in this document is subject to change without notice. No part of this document may be
Advanced Network Troubleshooting Using Wireshark (Hands-on)
Advanced Network Troubleshooting Using Wireshark (Hands-on) Description This course is a continuation of the "Basic Network Troubleshooting Using Wireshark" course, and comes to provide the participants
The trace file is here: https://kevincurran.org/com320/labs/wireshark/trace-udp.pcap
Lab Exercise UDP Objective To look at the details of UDP (User Datagram Protocol). UDP is a transport protocol used throughout the Internet as an alternative to TCP when reliability is not required. It
Fighting Phishing I: Get phish or die tryin.
Fighting Phishing I: Get phish or die tryin. Micah Nelson and Max Hyppolite bit.ly/nercomp_sap918 Please, don t forget to submit your feedback for today s session at the above URL. If you use social media
Information Security Policy
Information Security Policy Information Security is a top priority for Ardoq, and we also rely on the security policies and follow the best practices set forth by AWS. Procedures will continuously be updated
Certified Snort Professional VS-1148
VS-1148 Certified Snort Professional Certification Code VS-1148 Vskills certification for Snort Professional assesses the candidate as per the company s need for network security and assessment. The certification
Using RDP with Azure Linux Virtual Machines
Using RDP with Azure Linux Virtual Machines 1. Create a Linux Virtual Machine with Azure portal Create SSH key pair 1. Install Ubuntu Bash shell by downloading and running bash.exe file as administrator.
FortiTester Handbook VERSION 2.4.1
FortiTester Handbook VERSION 2.4.1 FORTINET DOCUMENT LIBRARY http://docs.fortinet.com FORTINET VIDEO GUIDE http://video.fortinet.com FORTINET BLOG https://blog.fortinet.com CUSTOMER SERVICE & SUPPORT https://support.fortinet.com
Kismet. Dragorn July 10,
Kismet Dragorn dragorn@kismetwireless.net July 10, 2004 1 Kismet 802.11 sniffer Can sniff 11a, 11b, and 11g with the right hardware Completely passive Signature and Trend Layer2 IDS Runs on Linux, some
GCIA. GIAC Certified Intrusion Analyst.
GIAC GCIA GIAC Certified Intrusion Analyst TYPE: DEMO http://www.examskey.com/gcia.html Examskey GIAC GCIA exam demo product is here for you to test the quality of the product. This GIAC GCIA demo also
4. What is the sequence number of the SYNACK segment sent by spinlab.wpi.edu to the client computer in reply to the SYN? Also Seq=0 (relative
1. What is the IP address and TCP port number used by your client computer (source) to transfer the file to spinlab.wpi.edu? My computer is at 10.211.55.3. The source port is 49247. See screenshot below.
Honeynet Weekly Report Canadian Institute for Cybersecurity (CIC)
Report (11) Captured from 04-05-2018 to 18-05-2018 1-Introduction The first honeypot studies released by Clifford Stoll in 1990, and from April 2008 the Canadian Honeynet chapter was founded at the University
Training for the cyber professionals of tomorrow
Hands-On Labs Training for the cyber professionals of tomorrow CYBRScore is a demonstrated leader in professional cyber security training. Our unique training approach utilizes immersive hands-on lab environments
CS 410/510: Web Security X1: Labs Setup WFP1, WFP2, and Kali VMs on Google Cloud
CS 410/510: Web Security X1: Labs Setup WFP1, WFP2, and Kali VMs on Google Cloud Go to Google Cloud Console => Compute Engine => VM instances => Create Instance For the Boot Disk, click "Change", then
Lab Exercise UDP. Objective. Requirements. Step 1: Capture a Trace
Lab Exercise UDP Objective To look at the details of UDP (User Datagram Protocol). UDP is a transport protocol used throughout the Internet as an alternative to TCP when reliability is not required. It
LOCKHEED MARTIN CYBERQUEST COMPETITION
LOCKHEED MARTIN CYBERQUEST COMPETITION 2018 CHALLENGES & SKILLS OVERVIEW LOCKHEED MARTIN PROPRIETARY INFORMATION WHAT MAY YOU ENCOUNTER? Challenges may include: Web-based attacks Common vulnerabilities
Firewalls. IT443 Network Security Administration Slides courtesy of Bo Sheng
Firewalls IT443 Network Security Administration Slides courtesy of Bo Sheng 1 Internet Security Mechanisms Prevent: Firewall, IPsec, SSL Detect: Intrusion Detection Survive/ Response: Recovery, Forensics
Raj Jain. Washington University in St. Louis
Intrusion Detection Raj Jain Washington University in Saint Louis Saint Louis, MO 63130 Jain@cse.wustl.edu Audio/Video recordings of this lecture are available at: http://www.cse.wustl.edu/~jain/cse571-11/
RSA INCIDENT RESPONSE SERVICES
RSA INCIDENT RESPONSE SERVICES Enabling early detection and rapid response EXECUTIVE SUMMARY Technical forensic analysis services RSA Incident Response services are for organizations that need rapid access
Introduction to Wireshark
Introduction to Wireshark CS3C03/SE4C03 Jason Jaskolka Department of Computing and Software Faculty of Engineering McMaster University Hamilton, Ontario, Canada jaskolj@mcmaster.ca Winter 2013 Jason Jaskolka
McAfee Network Security Platform 9.2
McAfee Network Security Platform 9.2 (9.2.7.22-9.2.7.20 Manager-Virtual IPS Release Notes) Contents About this release New features Enhancements Resolved issues Installation instructions Known issues Product
5. Write a capture filter for question 4.
Pre-Lab 2: Single Segment IP Networks 1. Review Linux man pages for arp at www.linuxmanpages.com (in both Sections 7 and 8), the ARP RFC (RFC 826) at www.ietf.org, and Section 3.4 of the IBM Red Book.
Behavior-Based IDS: StealthWatch Overview and Deployment Methodology
Behavior-Based IDS: Overview and Deployment Methodology Lancope 3155 Royal Drive, Building 100 Alpharetta, Georgia 30022 Phone: 770.225.6500 Fax: 770.225.6501 www.lancope.com techinfo@lancope.com Overview
IMbrella Version Overview. Deerfield.com 4241 Old 27 South Gaylord, MI
IMbrella Version Overview Deerfield.com 4241 Old 27 South Gaylord, MI 49735 800.599.8856 sales@deerfield.com http://www.deerfield.com IMbrella Software Version Overview...3 IMbrella Blocker...4 Using IMbrella
Introduction to Troubleshooting TCP/IP Networks with Wireshark
Introduction to Troubleshooting TCP/IP Networks with Wireshark Course WIRE-1B 5 Days Instructor-led, Hands-on Introduction In this hands-on, instructor-led, five-day course, you will receive in-depth training
TCP/IP Attack Lab. 1 Lab Overview. 2 Lab Environment. 2.1 Environment Setup. SEED Labs TCP/IP Attack Lab 1
SEED Labs TCP/IP Attack Lab 1 TCP/IP Attack Lab Copyright c 2006-2016 Wenliang Du, Syracuse University. The development of this document was partially funded by the National Science Foundation under Award
Configuring IP Logging
CHAPTER 12 This chapter describes how to configure IP logging on the sensor. It contains the following sections: Understanding IP Logging, page 12-1 Configuring Automatic IP Logging, page 12-2 Configuring
Cisco Nexus 7000 Series Architecture: Built-in Wireshark Capability for Network Visibility and Control
White Paper Cisco Nexus 7000 Series Architecture: Built-in Wireshark Capability for Network Visibility and Control What You Will Learn The Cisco Nexus 7000 Series Switches combine the highest levels of
Wireshark Lab: HTTP. 1. The Basic HTTP GET/response interaction
Wireshark Lab: HTTP Version: 2.0 (June 2007) 2007 J.F. Kurose, K.W. Ross. All Rights Reserved Computer Networking: A Topdown Approach, 4 th edition. Having gotten our feet wet with the Wireshark packet
Transport Level Security
2 Transport Level Security : Security and Cryptography Sirindhorn International Institute of Technology Thammasat University Prepared by Steven Gordon on 28 October 2013 css322y13s2l12, Steve/Courses/2013/s2/css322/lectures/transport.tex,
CyberP3i Hands-on Lab Series
CyberP3i Hands-on Lab Series Lab Series using NETLAB Designer: Dr. Lixin Wang, Associate Professor Hands-On Lab for Application Attacks The NDG Security+ Pod Topology Is Used 1. Introduction In this lab,
Genie Snoop lab. Laboration in data communication GenieLab Department of Information Technology, Uppsala University
Genie Snoop lab Laboration in data communication GenieLab Department of Information Technology, Uppsala University Overview This lab deals with network layers, services and HTTP transactions as well as
SOURCEFIRE 3D SYSTEM RELEASE NOTES
SOURCEFIRE 3D SYSTEM RELEASE NOTES Version 5.3.0.3 Original Publication: April 21, 2014 These release notes are valid for Version 5.3.0.3 of the Sourcefire 3D System. Even if you are familiar with the
The Reconnaissance Phase
The Reconnaissance Phase Detecting the Enemy Before the Attack Carrie Gates PhD Candidate, Dalhousie University Visiting Scientist, CERT, Carnegie Mellon University Outline! Indicate a gap in our defences!