Tag Archives: hats off security

Keybase.io Forensics Investigation

Posted on February 23, 2020 by

What is Keybase.io? I was first introduced to Keybase a few years ago. It was explained to me as a place to validate your identity with regards to sharing public keys for email encryption. Showing that a Twitter account is … Continue reading →

Posted in Keybase, Linux Forensics, Windows Forensics | Tagged , , , , , , | Leave a comment

When is Index.dat not Evidence of Browsing

Posted on August 10, 2019 by

It is easy to fall into familiar habits as a human being, we see patterns in what we do and expect those patterns to persist. However when these patterns can be the difference between a person keeping or losing their … Continue reading →

Posted in Browser Forensics, Internet Explorer | Tagged , , , , , | Leave a comment

HTTP Methods

Posted on April 9, 2019 by

In this post we are going to look at different types of HTTP/1.1 methods. We will leave HTTP/2 methods for another day. This will be a summary of each method, it is possible to go into great detail with some … Continue reading →

Posted in Network Analytics | Tagged , , , | Leave a comment

Wireshark – More Basics

Posted on April 3, 2019 by

I have been approached recently about explaining some of the fundamentals of how Wireshark can be used. Let’s have a look at some traffic that I captured for a challenge I created recently. Here we can see an example of … Continue reading →

Posted in Network Analytics, Network Forensics, Wireshark | Tagged , , , | Leave a comment

Decrypting Traffic in Wireshark

Posted on October 30, 2018 by

If you have a HTTPS session captured and are looking at unlocking the secrets that lie within, you are probably looking at Wireshark with eternal optimism hoping that somehow the magical blue fin will answer all of problems…. Sadly that’s … Continue reading →

Posted in Cryptography, Encrypted Traffic, Network Analytics, Network Forensics | Tagged , , , , , , , | Leave a comment

Identifying Sites in Encrypted Traffic

Posted on October 29, 2018 by

There is some mis-information around; that encrypted traffic is useless, and you should go back to netflow and statistical analysis only. I disagree. I will be doing a few posts showing clear-text information leakage we can use to our advantage. … Continue reading →

Posted in Encrypted Traffic, Network Analytics, Network Forensics | Tagged , , , , , , , | Leave a comment

SMB2 Protocol Negotiation

Posted on January 21, 2018 by

This is one of the few times when looking at SMBv2 you will need to use SMBv1 commands. The initial negotiation request will always be sent out as SMBv1. It makes sense when you think about it, SMB does not … Continue reading →

Posted in Network Analytics, SMB | Tagged , , , | Leave a comment

SMB2 – File/Directory Metadata

Posted on January 14, 2018 by

Using SMB it is possible to retrieve data that is typically only expected when carrying out host based forensics.  The MACB (Modification, Access, Change and Birth) data is sent across regardless of if a file is accessed or not. With … Continue reading →

Posted in Network Analytics, Network Forensics, SMB | Tagged , , | 1 Comment

SMB Tree Connect/Response Details

Posted on January 11, 2018 by

If you want to play along at home, the sample PCAP I will be using for SMB2+ is here, the SMB v1 PCAP is not something I can give away sadly. Tree Connect Request/Response When the SMB protocol connects to … Continue reading →

Posted in Network Analytics, Network Forensics, SMB | Tagged , , , | Leave a comment

SMBv2+ SYNC Header Explained

Posted on January 11, 2018 by

SMB2 Header The SMB2 Header will either be ASYNC or SYNC, you need to look this up from the flags. SYNC is the most common header as this can be in the form of a request or a response, where … Continue reading →

Posted in Network Analytics, Network Forensics, SMB | Tagged , , , , | Leave a comment