Network Forensic Tools & Techniques Workshop
•
3 likes•1,388 views
Network Forensic Tools & Techniques Workshop (Introduction,Basic Protocol Analysis,Forensic Analysis Network/Web/Malware,Basic Packet Analysis Challenges)
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Network Forensic Tools & Techniques Workshop
Similar to Network Forensic Tools & Techniques Workshop (20)
More from Priyanka Aash
More from Priyanka Aash (20)
Recently uploaded
Recently uploaded (20)
Network Forensic Tools & Techniques Workshop
- 2. $WHOAMI • Senior Security Engineer • Developer turned Security Researcher - Web app security and network pen-testing, exploit development and network forensic • OSCP, GCIH, RHCE, CEH, ECSA, Cyber Crime Investigator • Speaker at OWASP, NULLCON, C0C0N, CLUBHACK, ISACA conferences • Winner of NULLCON 2010 “Battle Underground” hacking competition
- 3. • SANS Mentor for Sec 504: Hacker Techniques, Exploits & Incident handling course, SANS Institute, USA. • Core Member of NULL community – www.null.co.in . Facilitates NULL Bangalore Chapter • Member of - NASSCOM-DSCI, HONEYNET, CLUBHACK, OWASP etc. $WHOAMI
- 6. TOO BIG TO COVER • Difficult to cover every aspect of Network Forensic • So many aspects, features and possibilities • Highly addictive
- 7. TOO LONG TO COVER
- 8. • A million things can go wrong with a computer network - from a simple spyware infection to a complex router configuration error. • Packet level is the most basic level where nothing is hidden. • Understand the network, who is on a network, whom your computer is talking to, What is the network usage, any suspicious communication (DOS , botnet, Intrusion attempt etc.) • Find unsecured and bloated applications – FTP sends clear text authentication data • One phase of computer forensic - could reveal data otherwise hidden somewhere in a 150 GB HDD. WHY PACKET ANALYSIS?
- 10. 3 PHASES
- 11. TOOLS •Wireshark! Duh! •Tcpdump •Networkminer etc. Sniffer •Xplico etc. Analyzer
- 14. PRE-REQUISITE • An inquisitive mind and sometimes weirder is better
- 15. THERE ALWAYS BE A PROBLEM TO SOLVE
- 16. • Being a bit organized helps in long run
- 17. NOW WHAT? Think it like you are solving a mystery • Where do we start? • What questions to ask? • What tools do we need? • Once you have the traces - what then?
- 18. Capture •Where, How, What, How long Transfer •Hash, split, distribute Analyze •IP, Protocol, Time, Delay, Duration, pattern, graphs, charts, blah… HOW DO WE DO IT?
- 19. CAPTURE • Capture Methods • Wired • Mirror/Monitor/SPAN • Taps • Hubs • ARP poisoning??? • Promiscuous mode • WinPCAP/LibPCAP • Wireless • Rfmon/monitor mode • AirPCap
- 20. WHICH INTERFACE TO CAPTURE
- 21. ALWAYS START WITH THE NETWORK DETAILS
- 22. MORE QUESTIONS BETTER ANALYSIS • Are the servers in the same locations or different • Same subnet, different subnet • Any suspicion - IP Address, Application • When did it start • How and when did it get identified • Why you were there – lack of resource, time, expertise
- 23. WHAT NOT TO DO • Do not scroll up and down and try manually reading packets one by one. • Do not capture any and every traffic just for the sake of capturing. • Do not ASSUME. You can have thoughts, suspicions.
- 24. THEN WHAT DO WE DO?
- 25. ASK HIM
- 26. OR HIM
- 27. STILL NEED REASONS! • Capture Filters • Display Filters • Auto-complete • Red – error, Green – good • Recent usage history
- 28. FILTERS • Create Filter from Packet/field • Multiple filter conditioning using “and”, “or”, “not” etc. • Protocol Filtering
- 29. FOLLOW THE STREAMS • TCP • UDP • APP layer • FTP • HTTP • TELNET
- 31. RECONSTRUCT THE CRIME SCENE • Understand the flow • Reconstruct the files • Identify the attacker and victim
- 32. STATISTICS – PROTOCOL HIERARCHY
- 33. STATISTICS – END POINTS
- 35. STATISTICS – COLORING RULES
- 37. REFERENCE • Wireshark University by Laura Chappell and Gerald Combs • Sharkfest talks - Betty DuBois on Network Mysteries • Securitytube.net by Vivek Ramchandran • Picture courtesy Google. Not my property.