Tag Info

New answers tagged

0

I don't see any of the transmission modes for Ethernet or for IEEE 802.11 listed in the multimon-ng README file, so I'm not sure how you'd analyze a network capture, done at OSI layer 2, with multimon-ng. I.e., I'm not sure that you could convert an arbitrary pcap file to something multimon-ng can analyze. If there's some protocol in the pcap file that ...


0

Open Wireshark and go to: Menu -> File -> Export Packet Dissections -> As Plain Text File Select the packet range you want to see in your txt file: If you are interested in the command line solution then you can check tshark documentation.


1

If you want just the ASCII hex dump of all data and nothing else, then you can simply pipe the output of tshark through sed like so: tshark -x -r mydata.pcap | sed -n 's/^[0-9a-f]*\s\(\(\s[0-9a-f][0-9a-f]\)\{1,16\}\).*$/\1/p'


0

If your goal is anonymity then yes. But bear in mind that TOR, using a layered encryption scheme through a number of network, is considerably slower than single layer encryption using a direct connection. Transferring large files slows down the network for all users using the same circuit. Note that each user that connects to your hidden service uses a ...


0

With computer data in general there is only two ways of being able to detect tampering: A: Check if your file / data differs from the original and untempered version. You obviously need to have the original file / data for this. B: Check if your file's / data's hash is the same as the original one's. You need to have the original's hash for this. While ...


0

I assume what you mean by "live forensics" would be what the infosec community usually refers as memory forensics, eg. taking your machine while it is active and unlocked and proceeding to dump all data from it. The solution to your problem would be twofold: First you need to have good physical security, so that attackers can't access your unlocked ...


3

If we assume that a hash is calculated based on the drive contents, and that we trusted the drive contents to be authentic at the time of hashing, then what you're worried about is some manner of hash collision (where two different pieces of data produce the same hash). Currently, SHA-1 attacks are only theoretical, but there's a potential they could become ...


1

Forgot about this…so here is how I done it. First off I used google academic to find papers on last pass, password managers and memory forensics. It was the last one I found to be more helpful Amari, K. (2009) Techniques and Tools for Recovering and Analysing Data from Volatile Memory. After gaining an understanding memory extracting and analysis I ...


1

I try not to do this but this is very much a yes and no answer. Tools like FTK Remote Agent run as a service on the system. An investigator can connect to those tools and perform tasks (such as pulling a remote image of that particular system.) If you were to walk into the data center of AWS and could get console level access and installed than ran your ...



Top 50 recent answers are included