Forensic

最新推荐文章于 2022-03-09 17:33:24 发布
最新推荐文章于 2022-03-09 17:33:24 发布
阅读量2.4k 收藏
点赞数
CC 4.0 BY-SA版权
分类专栏： CTF
版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。
本文链接：https://blog.youkuaiyun.com/wangyi_lin/article/details/11372049
这篇博客介绍了ASIS-CTF2013中的网络取证分析题目，包括rm -rf、spcap、pcap和memdump等环节，探讨了这些有趣的热身题目。

摘要生成于 C知道 ，由 DeepSeek-R1 满血版支持， 前往体验 >

这种类型的题，比较有趣，大概是热身一类的题吧。

rm -rf (ASIS-CTF2013)

这道题，给了一个镜像文件。里面文件貌似挺多的。
不过直接用WinHex打开搜一下ASIS_密码就出来了。



spcap (ASIS-CTF2013)

这个题目名字的意思大概就是，simple pcap
拿Wireshark打开这个包，Statistics->Conversations 里面看到
有两个IP通信比较频繁


Statistics->Protocol Hierarchy Statistics
里面看到有一个图片格式的数据传输了




File - > export -> object 吧图片导出来，就可以看到Flag了





pcap (ASIS-CTF2013)

这题应该是比较难一点的，pcap
照例上wireshark    Statistics->Protocol Hierarchy Statistics 里面看到一些乱七八糟的东西，
虽然没大看懂但是还是装作很懂的看了一下。
一般情况下容易藏数据的地方在  HTTP traffic  TCP Data  UDP Data 这
最低0.47元/天 解锁文章

200万优质内容无限畅学
RITSEC CTF2021 Forensics1597题解记录
m0_49762339的博客
04-13 434
题目地址：http://git.ritsec.club:7000/1597.git/ 这是一道与git版本管理有关的题目 解题过程： 一、很明显第一步将远程仓库克隆到本地 git clone http://git.ritsec.club:7000/1597.git/ 其中一共有两个文件打开后发现flag.txt为空文件，README.md文件显示： # 1597 A git challenge series? Sounds fun. 没有用!!! 二、推测（看大佬WP）查看版本记录。 1.mkdir ki
[ctfshow 2021摆烂杯] FORENSICS部分 writeup
ShenZ的博客
01-03 3535
[ctfshow 2021摆烂杯] FORENSICS部分 writeup 套的签到题 第一段flag 第二段flag 第三段flag JiaJia-CP-1 JiaJia-CP-2 JiaJia-CP-3 JiaJia-PC-1 JiaJia-PC-2 JiaJia-PC-3
Windows取证分析（Windows Forensic Analysis）随书工具盘
05-06
Windows 取证分析——dvd工具包，提供大量利用Perl脚本编写的程序。
CTF 之 Forensics 取证
algae
04-18 7431
这篇文章列出了CTF中Forensics（取证）类型题的技巧和窍门，展示了CTF中常用工具的使用场景和使用方法。文件格式（File Formats）十六进制文件头和对应ASCII码通过查看文件头前四到五个字节的十六进制数来识别文件类型。参考Hex file and Regex Cheat Sheet 和Gary Kessler File Signature Ta...
linux取证教程,Linux中的取证(Forensics in Linux)
weixin_33595380的博客
05-07 806
Linux中的取证(Forensics in Linux)数字调查的主要问题是通过加密或任何其他格式保护重要证据或数据。 基本示例是存储密码。 因此，有必要了解Linux操作系统在数字取证实施中的使用，以保护这些有价值的数据。所有本地用户的信息大多存储在以下两个文件中 -/etc/passwdetc/shadow第一个是必需的，它存储所有密码。 第二个文件是可选的，它存储有关本地用户的信息，...
passware kit forensic v13.5
08-18
passware kit forensic v13.5
Passware Kit Forensic 2017.1.1
09-05
Passware Kit Forensic 是 Passware 公司所开发的系列密码恢复软件中功能最为强大也是最新的一个密码恢复工具合集。它将所有的密码恢复模块全部集成到一个主程序中。恢复文件文件密码时，无需再像以前的它的姊妹版...
Windows Forensic Analysis Including DVD Toolkit.pdf
08-21
forensic examiners have noticed is an overreliance by investigators on what forensic analysis tools are telling them,without really understanding where this information is coming from or how it is ...
baby_forensic.zip
09-10
本篇将重点探讨一个特定的案例——通过“baby_forensic.zip”压缩包文件，对Windows系统镜像进行内存取证分析。 “baby_forensic.zip”是一个用于CTF挑战的压缩包，内含的数据1.7z文件可能包含了关键证据。在这样的...
VMDK Forensic Artifact Extractor (VFAE):从 VMDK 中分类、搜索和提取文件的 C++ 应用程序。-开源
07-11
VFAE 是用 C++ 编写的基于 Windows 的工具，可从运行 Windows 操作系统的 VMDK 映像中提取文件。 该工具利用 VDDK（虚拟磁盘开发套件）API 进行繁重的工作，例如安装、打开和读取所选的 VMDK。 执行 vfae.exe 时，它...
android forensic
08-01
此书是对载有android系统的手机进行取证的参考书，讲到了很多android系统相关的知识，针对android系统进行取证时用到的一些工具等等。
Learning Android Forensics
11-02
Many forensic examiners rely on commercial, push-button tools to retrieve and analyze data, even though there is no tool that does either of these jobs perfectly. This book will introduce you to the Android platform and its architecture, and provides a high-level overview of what Android forensics entails. You will see how data is stored on Android devices and how to set up a digital forensic examination environment. Next, you will go through the various physical and logical techniques to extract data from devices to obtain forensic evidence. You will also learn how to reverse-engineer applications and forensically analyze the data with the help of various open source and commercial tools. By the end of this book, you will have a complete understanding of the Android forensic process.
Windows Forensic Analysis Toolkit 3rd Edition PDF
04-11
Now in its third edition, Harlan Carvey has updated Windows Forensic Analysis Toolkit to cover Windows 7 systems. The primary focus of this edition is on analyzing Windows 7 systems and on processes using free and open-source tools. The book covers live response, file analysis, malware detection, timeline, and much more. The author presents real-life experiences from the trenches, making the material realistic and showing the why behind the how. New to this edition, the companion and toolkit materials are now hosted online. This material consists of electronic printable checklists, cheat sheets, free custom tools, and walk-through demos. This edition complements Windows Forensic Analysis Toolkit, 2nd Ed. (ISBN: 9781597494229), which focuses primarily on XP. Complete coverage and examples on Windows 7 systems Contains Lessons from the Field, Case Studies, and War Stories Companion online material, including electronic printable checklists, cheat sheets, free custom tools, and walk-through demos
The Forensic Laboratory Handbook - Procedures and Practice
06-03
If the law has made you a witness, remain a man of science. You have no victim to avenge, no guilty or innocent person to convict or save— you must bear testimony within the limits of science.
Windows Forensic Analysis Toolkit
04-08
Windows Forensic Analysis Toolkit: Advanced Analysis Techniques for Windows 7 provides an overview of live and postmortem response collection and analysis methodologies for Windows 7. It considers the core investigative and analysis concepts that are critical to the work of professionals within the digital forensic analysis community, as well as the need for immediate response once an incident has been identified. Organized into eight chapters, the book discusses Volume Shadow Copies (VSCs) in the context of digital forensics and explains how analysts can access the wealth of information available in VSCs without interacting with the live system or purchasing expensive solutions. It also describes files and data structures that are new to Windows 7 (or Vista), Windows Registry Forensics, how the presence of malware within an image acquired from a Windows system can be detected, the idea of timeline analysis as applied to digital forensic analysis, and concepts and techniques that are often associated with dynamic malware analysis. Also included are several tools written in the Perl scripting language, accompanied by Windows executables. This book will prove useful to digital forensic analysts, incident responders, law enforcement officers, students, researchers, system administrators, hobbyists, or anyone with an interest in digital forensic analysis of Windows 7 systems. Timely 3e of a Syngress digital forensic bestseller Updated to cover Windows 7 systems, the newest Windows version New online companion website houses checklists, cheat sheets, free tools, and demos
[ctf Misc][RoarCTF2019]forensic +内存取证
ShenZ的博客
09-09 2552
这题蛮鬼的，就，没有捷径，捷径导出文件一定是坏的 附件：mem.raw [RoarCTF2019]forensic 1.volatility处理 λ volatility_2.6_win64_standalone.exe -f xxx7\Compressed\mem.raw imageinfo Volatility Foundation Volatility Framework 2.6 INFO : volatility.debug : Determining profile based o
Android Phone Forensic Analysis – Unleash Hidden Evidence
相信未来！
12-04 866
转载地址：http://www.dataforensics.org/android-phone-forensics-analysis/ ANDROID FILE SYSTEMS There is no singularly defined file system for Android. Android is developed on Linux kernel and Linux su
BUUCTF [RoarCTF2019]forensic
../../../../../../../
10-12 1519
打开 下载到mem.raw 把mem.raw放入kali volatility查看镜像 volatility -f mem.raw imageinfo 建议用profile, 后面用Win7SP1x86 查看内存进程： volatility -f men.raw pslist --profile Win7SP1x86 发现有几个进程 了解发现： TrueCrypt.exe是一款磁盘加密工具，所有虚拟磁盘上的文件都被自动加密，需要通过密码来进行访问。 notepad.exe windows自带记事本
CTF中简单杂项小结
Amire0x的小乐园
03-09 7977
MISC1 参考 CTF Wiki MISC 简介 主要分为几个板块：Recon,Forensic,Stego,Crypto（古典密码）… Recon：信息收集 主要介绍一些获取信息的渠道和一些利用百度、谷歌等搜索引擎的技巧 Encode（编码转换） 主要介绍在 CTF 比赛中一些常见的编码形式以及转换的技巧和常见方式 Forensic && Stego（数字取证 && 隐写分析） 隐写取证是 Misc 中最为重要的一块，包括文件分析、隐写、
forensic analysis
最新发布
01-24
2. **FTK (Forensic Toolkit)** AccessData 的 FTK 提供了一个全面的工作流程来管理案件中的电子证据。该平台不仅限于硬盘驱动器上的静态数据获取；还扩展到了网络流量捕获等领域，增强了实时监控的可能性。 3. **...
评论 1
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值