Archive | Forensics

PowerShellArsenal – PowerShell For Reverse Engineering

December 18, 2016 | 2,784 views 0

PowerShellArsenal is basically PowerShell for reverse engineering in a module format. The module can be used to disassemble managed and unmanaged code, perform .NET malware analysis, analyse/scrape memory, parse file formats and memory structures, obtain internal system information, etc. PowerShellArsenal is comprised of the following tools: Disassembly – Disassemble native and managed code. MalwareAnalysis – […]

Tags: malware analysis, powershell, powershell hacking tools, powershell reverse engineering, powershellarsenal, ps, reverse engineering on windows, reverse-engineering, windows forensics, windows reverse engineering

Posted in: Forensics, Programming | Add a Comment

Androguard – Reverse Engineering & Malware Analysis For Android

November 19, 2016 | 1,717 views

Androguard is a toolkit built in Python which provides reverse engineering and malware analysis for Android. It’s buyilt to examine * Dex/Odex (Dalvik virtual machine) (.dex) (disassemble, decompilation), * APK (Android application) (.apk), * Android’s binary xml (.xml) and * Android Resources (.arsc). Androguard is available for Linux/OSX/Windows (Python powered). Features Map and manipulate DEX/ODEX/APK/AXML/ARSC […]

Tags: androguard, android, android app security, android disassembly, android forensics, android malware, android malware analysis, android reverse engineering, reverse engineer android app

Posted in: Forensics, Malware | Add a Comment

Volatility Framework – Advanced Memory Forensics Framework

September 26, 2016 | 1,446 views

The Volatility Framework is an an advanced, completely open collection of tools for memory forensics, implemented in Python under the GNU General Public License, for the extraction of digital artifacts from volatile memory (RAM) samples. The extraction techniques are performed completely independent of the system being investigated but offer visibility into the runtime state of […]

Tags: analyse memory dump, digital-forensics, extract from memory dump, Forensics, memory dump forensics, memory forensics, memory forensics framework, Python, volatility, volatility framework

Posted in: Forensics, Security Software | Add a Comment

CuckooDroid – Automated Android Malware Analysis

August 9, 2016 | 2,310 views

CuckooDroid is an extension of Cuckoo Sandbox the Open Source software for automating analysis of suspicious files, for Android malware analysis. CuckooDroid brings to Cuckoo the capabilities of execution and analysis of android applications. CuckooDroid provides both static and dynamic APK inspection as well as evading certain VM-detection techniques, encryption key extraction, SSL inspection, API […]

Tags: android, android malware, android malware analysis, android security, cuckoo, cuckoo droid, cuckoo framework, cuckoo sandbox, cuckoo sandbox android, cuckoodroid

Posted in: Forensics, Malware | Add a Comment

Cuckoo Sandbox – Automated Malware Analysis System

June 18, 2016 | 4,408 views

Cuckoo Sandbox is Open Source software for automating analysis of suspicious files. To do so it makes use of custom components that monitor the behaviour of the malicious processes while running in an isolated environment. In other words, you can throw any suspicious file at it and in a matter of seconds Cuckoo will provide […]

Tags: analyse exploits, analyse malware, automated malware analysis, cuckoo, cuckoo sandbox, malware, malware analysis, malware sandbox, open source malware analysis

Posted in: Countermeasures, Forensics, Malware, Security Software | Add a Comment

Web Application Log Forensics After a Hack

June 9, 2016 | 3,753 views

Sites get hacked, it’s not pleasant but it happens. A critical part of it, especially in my experience, has been the web application log forensics applied directly after an attack. You can usually piece together what happened, especially if the attacker doesn’t rotate IP addresses during the attack. With a little poking around and after […]

Tags: acunetix, hacked, hacking, web app hack, web application forensics, web forensics, web hacked, Web Hacking, web-application-security, website forensics

Posted in: Advertorial, Forensics | Add a Comment

CapTipper – Explore Malicious HTTP Traffic

May 23, 2016 | 2,982 views

CapTipper is a Python tool to explore malicious HTTP traffic, it can also help analyse and revive captured sessions from PCAP files. It sets up a web server that acts exactly as the server in the PCAP file and contains internal tools with a powerful interactive console for analysis and inspection of the hosts, objects […]

Tags: analyze malicious http traffic, analyze malicious traffic, captipper, http pcap replay, malicious http traffic, pcap, pcap simulation, Python, replay http traffic, replay malicious http traffic, revive http pcap

Posted in: Forensics, Network Hacking | Add a Comment

Google Rapid Response (GRR ) – Remote Live Forensics For Incident Response

April 26, 2016 | 10,627 views

GRR Rapid Response is an incident response framework focused on remote live forensics. It based on client server architecture, so there’s an agent which is installed on target systems and a Python server infrastructure that can manage and communicate with the agents. There are agents for Windows, Linux and Mac OS X environments. Overview To […]

Tags: Forensics, linux forensics, live forensics, live forensics framework, Python, remote forensics, remote live forensics, ubuntu forensics

Posted in: Countermeasures, Forensics, Security Software | Add a Comment

FastIR Collector – Windows Incident Response Tool

January 9, 2016 | 6,022 views

FastIR Collector is Windows incident response tool that offers the possibility to extract classic artefacts such as memory dump, auto-started software, MFT, MBR, Scheduled tasks, Services and records the results in csv files. The tool can also perform smart acquisitions thanks to the filecatcher, certificate filtering or support of Yara rules. The first part of […]

Tags: fast windows forensics, fastir, fastir collector, rootkit-detection, windows artefact collector, windows forensics, windows incident reponse toolkit, windows incident response tool, windows malware analysis, windows rootkit detection

Posted in: Forensics, Security Software, Windows Hacking | Add a Comment

Rekall – Memory Forensic Framework

November 24, 2015 | 2,251 views

Rekall is a memory forensic framework that provides an end-to-end solution to incident responders and forensic analysts. From state of the art acquisition tools, to the most advanced open source memory analysis framework. It strives to be a complete end-to-end memory forensic framework, encapsulating acquisition, analysis, and reporting. In particular Rekall is the only memory […]

Tags: cross platform memory analysis, Forensics, linux forensics, memory analysis, memory forensic framework, memory forensics, osx forensics, Python, rekall, windows forensics