Mirrors/hacktricks
2
0
Fork 0
mirror of https://github.com/carlospolop/hacktricks synced 2024-11-22 12:43:23 +00:00
Code Issues Projects Releases Packages Wiki Activity
hacktricks/generic-methodologies-and-resources/basic-forensic-methodology
History
Translator e2cf4aff4b Translated ['README.md', 'binary-exploitation/arbitrary-write-2-exec/aw2
2024-05-05 22:31:04 +00:00
..
memory-dump-analysis Translated ['README.md', 'binary-exploitation/arbitrary-write-2-exec/aw2 2024-05-05 22:31:04 +00:00
partitions-file-systems-carving Translated ['README.md', 'binary-exploitation/arbitrary-write-2-exec/aw2 2024-05-05 22:31:04 +00:00
pcap-inspection Translated ['README.md', 'binary-exploitation/arbitrary-write-2-exec/aw2 2024-05-05 22:31:04 +00:00
specific-software-file-type-tricks Translated ['README.md', 'binary-exploitation/arbitrary-write-2-exec/aw2 2024-05-05 22:31:04 +00:00
windows-forensics Translated ['README.md', 'binary-exploitation/arbitrary-write-2-exec/aw2 2024-05-05 22:31:04 +00:00
anti-forensic-techniques.md Translated ['README.md', 'binary-exploitation/arbitrary-write-2-exec/aw2 2024-05-05 22:31:04 +00:00
docker-forensics.md Translated ['README.md', 'binary-exploitation/arbitrary-write-2-exec/REA 2024-04-07 05:33:57 +00:00
file-integrity-monitoring.md Translated ['README.md', 'binary-exploitation/arbitrary-write-2-exec/REA 2024-04-07 05:33:57 +00:00
image-acquisition-and-mount.md Translated ['binary-exploitation/rop-return-oriented-programing/ret2lib/ 2024-05-02 15:08:10 +00:00
linux-forensics.md Translated ['README.md', 'binary-exploitation/arbitrary-write-2-exec/aw2 2024-05-05 22:31:04 +00:00
malware-analysis.md Translated ['README.md', 'binary-exploitation/arbitrary-write-2-exec/REA 2024-04-07 05:33:57 +00:00
README.md Translated ['README.md', 'binary-exploitation/arbitrary-write-2-exec/REA 2024-04-07 05:33:57 +00:00

README.md

Basiese Forensiese Metodologie

Leer AWS-hacking van nul tot held met htARTE (HackTricks AWS Red Team Expert)!

Skep en Koppel 'n Beeld

{% content-ref url="../../generic-methodologies-and-resources/basic-forensic-methodology/image-acquisition-and-mount.md" %} image-acquisition-and-mount.md {% endcontent-ref %}

Malware-analise

Dit is nie noodwendig die eerste stap om uit te voer sodra jy die beeld het nie. Maar jy kan hierdie malware-analise tegnieke onafhanklik gebruik as jy 'n lêer, 'n lêersisteembeeld, geheuebeeld, pcap... het, dus dit is goed om hierdie aksies in gedagte te hou:

{% content-ref url="malware-analysis.md" %} malware-analysis.md {% endcontent-ref %}

Inspeksie van 'n Beeld

as jy 'n forensiese beeld van 'n toestel gekry het, kan jy begin met die analise van die partisies, lêersisteme wat gebruik word en die herwinning van potensieel interessante lêers (selfs uitgewisde een). Leer hoe in:

{% content-ref url="partitions-file-systems-carving/" %} partitions-file-systems-carving {% endcontent-ref %}

Afhanklik van die gebruikte bedryfstelsels en selfs platform moet verskillende interessante artefakte gesoek word:

{% content-ref url="windows-forensics/" %} windows-forensics {% endcontent-ref %}

{% content-ref url="linux-forensics.md" %} linux-forensics.md {% endcontent-ref %}

{% content-ref url="docker-forensics.md" %} docker-forensics.md {% endcontent-ref %}

Diep inspeksie van spesifieke lêertipes en sagteware

As jy 'n baie verdagte lêer het, dan afhangend van die lêertipe en sagteware wat dit geskep het, kan verskeie truuks nuttig wees.
Lees die volgende bladsy om 'n paar interessante truuks te leer:

{% content-ref url="specific-software-file-type-tricks/" %} specific-software-file-type-tricks {% endcontent-ref %}

Ek wil 'n spesiale vermelding maak van die bladsy:

{% content-ref url="specific-software-file-type-tricks/browser-artifacts.md" %} browser-artifacts.md {% endcontent-ref %}

Geheue-Dump Inspeksie

{% content-ref url="memory-dump-analysis/" %} memory-dump-analysis {% endcontent-ref %}

Pcap Inspeksie

{% content-ref url="pcap-inspection/" %} pcap-inspection {% endcontent-ref %}

Teen-Forensiese Tegnieke

Hou moontlike gebruik van teen-forensiese tegnieke in gedagte:

{% content-ref url="anti-forensic-techniques.md" %} anti-forensic-techniques.md {% endcontent-ref %}

Bedreigingspeuring

{% content-ref url="file-integrity-monitoring.md" %} file-integrity-monitoring.md {% endcontent-ref %}

Leer AWS-hacking van nul tot held met htARTE (HackTricks AWS Red Team Expert)!