mirror of https://github.com/carlospolop/hacktricks synced 2024-11-26 06:30:37 +00:00

autoad 71795de168 Ad hacktricks sponsoring

2022-05-01 00:19:30 +00:00

7.5 KiB

Raw Blame History

Support HackTricks and get benefits!

Do you work in a cybersecurity company? Do you want to see your company advertised in HackTricks? or do you want to have access the latest version of the PEASS or download HackTricks in PDF? Check the SUBSCRIPTION PLANS!

Discover The PEASS Family, our collection of exclusive NFTs

Get the official PEASS & HackTricks swag

Join the 💬 Discord group or the telegram group or follow me on Twitter 🐦@carlospolopm.

Share your hacking tricks submitting PRs to the hacktricks github repo.

Support HackTricks and get benefits!

Discover The PEASS Family, our collection of exclusive NFTs

Get the official PEASS & HackTricks swag

Join the 💬 Discord group or the telegram group or follow me on Twitter 🐦@carlospolopm.

Share your hacking tricks submitting PRs to the hacktricks github repo.

File/Data Carving Tools

Carving tools

Autopsy

The most common tool used in forensics to extract files from images is Autopsy. Download it, install it and make it ingest the file to find "hidden" files. Note that Autopsy is built to support disk images and other kind of images, but not simple files.

Binwalk

Binwalk is a tool for searching binary files like images and audio files for embedded files and data.
It can be installed with apt however the source can be found on github.
Useful commands:

sudo apt install binwalk #Insllation
binwalk file #Displays the embedded data in the given file
binwalk -e file #Displays and extracts some files from the given file
binwalk --dd ".*" file #Displays and extracts all files from the given file

Foremost

Another common tool to find hidden files is foremost. You can find the configuration file of foremost in /etc/foremost.conf. If you just want to search for some specific files uncomment them. If you don't uncomment anything foremost will search for it's default configured file types.

sudo apt-get install foremost
foremost -v -i file.img -o output
#Discovered files will appear inside the folder "output"

Scalpel

Scalpel is another tool that can be use to find and extract files embedded in a file. In this case you will need to uncomment from the configuration file _/etc/scalpel/scalpel.conf_ the file types you want it to extract.

sudo apt-get install scalpel
scalpel file.img -o output

Bulk Extractor

This tool comes inside kali but you can find it here: https://github.com/simsong/bulk_extractor

This tool can scan an image and will extract pcaps inside it, network information(URLs, domains, IPs, MACs, mails) and more files. You only have to do:

bulk_extractor memory.img -o out_folder

Navigate through all the information that the tool has gathered passwords?, analyse the packets read[ **Pcaps analysis**](../pcap-inspection/), search for weird domains domains related to **malware** or **non-existent**.