Collaborate Disseminate
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Wednesday, October 30th 2019 https://isc.sans.edu/podcastdetail.html?id=6730, (Wed, Oct 30th)
The PCAP[1] file format is everywhere. Many applications generate PCAP files based on information collected on the network. Then, they can be used as evidence, as another data source for investigations and much more. There exist plenty of tools[2] to work with PCAP files. Common operations are to anonymize captured traffic and replay it against another tool for testing purposes (demos, lab, PoC).
Continue reading Generating PCAP Files from YAML, (Tue, Oct 29th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Tuesday, October 29th 2019 https://isc.sans.edu/podcastdetail.html?id=6728, (Tue, Oct 29th)
I&#;x26;#;39;ve written a couple of diary entries about scdbg, a Windows 32-bit shellcode emulator.
Continue reading Using scdbg to Find Shellcode, (Sun, Oct 27th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Monday, October 28th 2019 https://isc.sans.edu/podcastdetail.html?id=6726, (Mon, Oct 28th)
This week I found this traffic in my honeypot, my first impression, it didn&#;x26;#;39;t look that unusual since Base64 encoding is used quite a bit to encode traffic to a web server. Using CyberChef, I decoded the Base64 portion to see what it was all about only to find out it was further encoded in Base64. Decoding the second Base64 revealed two IP address in it.
Continue reading Unusual Activity with Double Base64 Encoding, (Sun, Oct 27th)
Wireshark version 3.0.6 was released.
Update Alert! Patches are out for VMware VCSA (information disclosure in backups and restore) https://www.vmware.com/security/advisories/VMSA-2019-0018.html
I while back I posted a “part 1” story on DNS and DHCP recon ( https://isc.sans.edu/diary/DNS+and+DHCP+Recon+using+Powershell/20995 ) and recent events have given me some more to share on the topic.
Continue reading More on DNS Archeology (with PowerShell), (Fri, Oct 25th)
(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License. Continue reading ISC Stormcast For Friday, October 25th 2019 https://isc.sans.edu/podcastdetail.html?id=6724, (Fri, Oct 25th)