Scapy_ All-In-One Networking Tool

Embed Size (px)

Citation preview

  • 7/27/2019 Scapy_ All-In-One Networking Tool

    1/11

    8/21/13 Scapy: All-in-One Networking Tool

    resources.infosecinstitute.com/scapy-all-in-one-networking-tool/

    InfoSec Institute

    InfoSec Resources

    Intense School

    HackingHacking

    Scapy: All-in-One Networking Tool 33

    Sudhanshu ChauhanSudhanshu Chauhan October 02, 2012October 02, 2012

    A network is an essential part of any cyber infrastructure. There are various tools available for the networking

    part of pentesting and other security assessment tasks like Nmap, tcpdump, arpspoof, etc., but one tool which

    stands out of all is Scapy.

    Scapy is a powerful interactive packet manipulation tool written in Python, and the best part is that it can also be

    utilized as a library in Python programs, which provides the pentester the ability to create his/her own tool

    based on the requirement. In this article we will discuss how we can use Scapy as an interactive tool as well as a

    library in our programs (Python). It allows us to sniff, create, send and slice packets for analysis.

    Most of the tools are built with something specific in mind, like Nmap for network scanning or Wireshark for

    sniffing, but Scapy allows us to build something new utilizing its functionalities and hence opens up a whole

    new world of networking applications. Unlike other tools which provide an interpreted output of the query,

    Scapy will present a raw output of any query that we make and let us decide what we need out of it and how to

    interpret it. This specific advantage ofthe tool is very helpful during the advanced analysis of the network. Using

    Scapy we can create and send custom packets over the network and analyze the raw output rece ived with a

    minimal amount of lines of code, and it supports a wide range of protocols for the purpose.

    Before going into the details of Scapy, here are few terminologies that need to be discussed:

    Scanning: The act of probing a host machine to identify any specific detail about it. Eg. Port scanning.

    Sniffing: The act of intercepting and logging the packets which flow across the network.

    Fuzzing: A software testing technique in which random data is passed as input to a computer application

    to check its stability.

    Scapy provides various commands from basic to advanced level for probing a network. Lets start with some

    basic commands for interactive usage:

    >>> ls(): D isplays all the protocols supported by Scapy, as shown in figure 1.

    >> > lsc(): D isplays the list of comm ands supported by Scapy, as shown in figure 2.

    >>> conf: D isplays configurations options.

    >>> help (): D isplay help on a specific command. Usage example: help(sniff)

    >>> show( ): Display the details about a specific packet. Usage example :

    Newpacket.show()

    Using the above mentioned command would be helpful to further explore the tool.

    SearchSearchHOMEHOME CATEGORIESCATEGORIES IT CERTIFICATIONSIT CERTIFICATIONS CONTRIBUTORSCONTRIBUTORS CONTACT USCONTACT US STUDENT PAPERSSTUDENT PAPERS

    http://resources.infosecinstitute.com/scapy-all-in-one-networking-tool/#commentshttp://infosec.wpengine.com/http://resources.infosecinstitute.com/category/certifications-training/http://resources.infosecinstitute.com/contributors/http://resources.infosecinstitute.com/contact-us/http://infosec.wpengine.com/cgi-bin/fp.cgihttp://resources.infosecinstitute.com/http://infosec.wpengine.com/cgi-bin/fp.cgihttp://resources.infosecinstitute.com/contact-us/http://resources.infosecinstitute.com/contributors/http://resources.infosecinstitute.com/category/certifications-training/http://infosec.wpengine.com/http://resources.infosecinstitute.com/author/sudhanshu/http://resources.infosecinstitute.com/scapy-all-in-one-networking-tool/#commentshttp://resources.infosecinstitute.com/category/hacking-2/http://resources.infosecinstitute.com/http://www.intenseschool.com/http://resources.infosecinstitute.com/http://www.infosecinstitute.com/
  • 7/27/2019 Scapy_ All-In-One Networking Tool

    2/11

    8/21/13 Scapy: All-in-One Networking Tool

    resources.infosecinstitute.com/scapy-all-in-one-networking-tool/ 2

    Figure 1. Output of commands ls() and conf

    Figure 2. Output of command lsc()

    Scapy allows us to create custom packets based on the huge set of protocols that it supports. Let us see how we

    can create simple packets:

    >>> Newpacket=IP(dst=google.com)

    >>> Newpacket.ttl=10

    >>> Newpacket.show()

    We can also create sets of packets based on our requirements. Here is an example of simple IP packets for

    different port addresses.

    >>> basepkt=IP(dst= www.google.com)

    >>> pktport=TCP(dport=[80,443])

    >>> [p for p in basepkt/pktport]

    Now when we have created packets we need to send these packets over the network. We have two options for

    this purpose:

    send(), which is a layer 3 send. It decides the routing based on local table.

  • 7/27/2019 Scapy_ All-In-One Networking Tool

    3/11

    8/21/13 Scapy: All-in-One Networking Tool

    resources.infosecinstitute.com/scapy-all-in-one-networking-tool/ 3

    sendp(), which is a layer 2 send.

    To send our packet we are using send(), as shown in figure 3:

    >>> send(Newpacket)

    Figure 3. Packet creation and sending

    To see if the packet is really sent we can utilize any sniffer like Wireshark or tcpdump. Although Scapy also

    provides the functionality of sniffing, which we will see later in the article.

    We can create a ping echo request packet by simply adding the ICMP protocol after our previous packet.

    >>> Newpacket=IP(dst=google.com)/ICMP()

    The operator / is used as a composite operator between two layers.

    We can send this packet similar to our previous packet. To send the same packet again and again we can simply

    add the loop=1 argument with the send packet.

    >>> send(Newpacket, loop=1)

    As we have seen how to create simple packets and send them, now we should see how to send and also

    receive packets. This functionality is very useful when we need to send some packets and we expect a response

    for those packets, like an ARP request. Again there are two types based on the layers the packets are sent and

    received:

    Layer3:

    sr(): It returns the answered and unanswered packets

    sr1(): It returns only answered and sent packets

    Layew2:

    srp():It returns the answered and unanswered packets

    srp1(): It returns only answered and sent packets

    Lets see an example of the sr function.

    >>> output=sr(IP(dst=google.com)/ICMP())

    output

    We see that the output contains two different results, Results and Unanswered. The first part contains the

    packets received as response and the second part contains the packets which were not answered. So we can

    divide it into two parts:

  • 7/27/2019 Scapy_ All-In-One Networking Tool

    4/11

    8/21/13 Scapy: All-in-One Networking Tool

    resources.infosecinstitute.com/scapy-all-in-one-networking-tool/ 4

    >>> result, unanswered=output

    >>> result

    The output of the result shows that we got one ICMP packet as a reply, so we can see the raw packet we got in

    response by using the following command, as shown in figure 4.

    >>> result[0]

    Figure 4. Sending and receiving packets

    If we look closely we can see that this is an echo reply packet for our echo request. Now if we want to see the

    current routing table of our machine, we can use the command:

    >>> conf.route

    Scapy allows us to include user specified routes to this table, without affecting the original table, this can be

    done by using the add function.

    >>> conf.route.add(host=192.168.118.2, gw= 192.168.118.25)

    Now any packet intended for the host 192.168.118.2 would go through 192.168.118.25

    After we are done using this table we can get back to the original table simply by using the resync function, as

    displayed in figure 5.

    >>> conf.route.resync()

  • 7/27/2019 Scapy_ All-In-One Networking Tool

    5/11

    8/21/13 Scapy: All-in-One Networking Tool

    resources.infosecinstitute.com/scapy-all-in-one-networking-tool/ 5

    Figure 5. Configuring the routing table

    Now that we have seen how to create simple packets, send them and receive them, le ts move forward to

    packet sniffing, so that we can analyze what is happening over the network . Packet sniffing can be done by thesimple function sniff:

    >>> a=sniff(filter=icmp, iface=eth1, timeout=10, count=3)

    >>> a.summary()

    >>> a[1]

    As demonstrated in the example, the sniff function can sniff the packets and can also filter them based on the

    user requirements. Now to see the output in real time we can use the lambda function along with the show or

    summary function based on the amount of de tail we require.

    >>> a=sniff(filter=icmp, iface=eth1, count=3, timeout=10, prn=lambda x:x.summary())

    Now as we have seen how easily we can sniff packets using Scapy, we also need to learn how to save these

    packets for later analysis and also how to read those saved files.

    To save packets we can use the function wrpacp as shown below :

    >>> wrpcap(mypackets.pcap, a)

    Now if we need to read these packets we can simply use the function rdpcap, as shown in figure 6. As pcap

    format is supported by many sniffers like Wireshark, tcpdump etc., we can also analyze these files using them.

    >>> rdpkt=rdpcap(mypackets.pcap)

    >>> rdpkt.show()

    >>> rdpkt[1]

  • 7/27/2019 Scapy_ All-In-One Networking Tool

    6/11

    8/21/13 Scapy: All-in-One Networking Tool

    resources.infosecinstitute.com/scapy-all-in-one-networking-tool/ 6

    Figure 6. Sniffing, writing and reading packets

    As Scapy allows us to create custom packets, we can utilize this functionality to perform port scanning. Here is

    an example of how to perform some simple port scanning using the interactive interface. We will create aTCP/IP packet with the TCP flag set as S (SYN) for port 1-1024.

    >>> res,unans = sr( IP(dst=192.168.118.1)/TCP(flags=S, dport=(1,1024)))

    The output can be analyzed by using the command

    >>> res.summary()

    Apart from packet creation, Scapy can also perform simple networking functions such as ping, traceroute etc.

    Example of a simple traceroute of google .com is shown here:

    >>> traceroute(www.google.com)

    Scapy also contains commands for some network based attacks such as arpcachepoison, etherleak, srpflood etc.

    These commands can be very useful during a network security analysis. If we need to discover the hosts on the

    local Ethernet we can use the command arping.

    >>> arping(192.168.118.*)

    Want to learn more?? The InfoSec Institute Ethical Hacking course goes in-

    depth into the techniques used by malicious, black hat hackers with attention

    getting lectures and hands-o n lab exercises . While these hacking skills can be

    used for malicious purposes, this class teaches you how to use the same hacking

    techniques to perform a white-hat, ethical hack, on your organization. You leave

    with the ability to quantitatively assess and measure threats to information assets;

    and discover where your organization is most vulnerable to black hat hackers.

    Some features of this course include:

    Dual Certification - CEH and CPT

    5 days of Intensive Hands-On Labs

    Expert Instruction

    CTF exercises in the evening

    Most up-to-date proprietary courseware available

    VIEW ETHICAL HACKING

    http://www2.infosecinstitute.com/l/12882/2013-05-28/6g66whttp://www.iacertification.org/cpt_certified_penetration_tester.htmlhttp://www2.infosecinstitute.com/l/12882/2013-05-28/6g66w
  • 7/27/2019 Scapy_ All-In-One Networking Tool

    7/11

    8/21/13 Scapy: All-in-One Networking Tool

    resources.infosecinstitute.com/scapy-all-in-one-networking-tool/ 7

    Scapy also provides the functionality of fuzzing, utilizing the function fuzz, here is the example of a simple DNS

    fuzzer:

    >>> send(IP(dst=192.168.118.1)/UDP()/fuzz(DNS()) , inter=1,loop=1)

    We have seen how we can use Scapy as a tool and use its various functions interactively. Now lets see how to

    use Scapy in Python programs, through simple example codes. The example codes demonstrate how easily we

    can create programs in Python using the Scapy library and create powerful tools with minimum amount of

    coding.

    The code shown below is a simple Python program which sends ARP requests and waits for response and

    displays the response.

    #!/usr/bin/python

    #import sys module for command line argument

    import sys

    #import scapy as a library

    from scapy.all import *

    print Usage: scapy-arping eg: ./scapy-arping.py 192.168.1.0/24

    #create and send ARP request p ackets

    rec,unans=srp(Ether(dst=ff:ff:ff:ff:ff:ff)/ARP(pdst=sys.argv[1]),timeout=2)

    #print the result

    for send,recv in rec:

    print recv.sprintf(rMAC: +%Ether.src%+ IP: + %ARP.psrc%)

    The example output of this program is shown below:

    root@bt:~/Desktop# ./ scapy-arping.py 192.168.118.0/24

    WARNING: No route found for IPv6 destination :: (no default route?)

    Usage: scapy-arping eg: ./scapy-arping.py 192.168.1.0/24

    Begin e mission:

    **Finished to send 256 packets.

    *

    Received 3 packets, got 3 answers, remaining 253 packets

    MAC: 00:50:56:f5:48:7a IP: 192.168.118.2

    MAC: 00:50:56:c0:00:08 IP: 192.168.118.1

    MAC: 00:50:56:f8:5e:b3 IP: 192.168.118.254

    Another example code for a simple ARP monitor is shown below ( source:

    http://www.secdev.org/projects/scapy/doc/usage.html#recipes). The program simply monitors for any ARP

    request or reply and prints the associate MAC and IP address.

    #! /usr/bin/env python

    from scapy.all import *

    http://www.secdev.org/projects/scapy/doc/usage.html
  • 7/27/2019 Scapy_ All-In-One Networking Tool

    8/11

    8/21/13 Scapy: All-in-One Networking Tool

    resources.infosecinstitute.com/scapy-all-in-one-networking-tool/ 8

    def arp_monitor_callback(pkt):

    if ARP in pkt and pkt[ARP].op in (1,2): #who-has or is-at

    return pkt.sprintf(%ARP.hwsrc% %ARP.psrc%)

    sniff(prn=arp_monitor_callback, filter=arp, store=0)

    Example o utput for the program is shown below:

    root@bt:~/Desktop# ./ arpmonitor.py

    WARNING: No route found for IPv6 destination :: (no default route?)

    00:50:56:c0:00:08 192.168.118.1

    00:0c:29:d8:b6:4d 192.168.118.130

    00:0c:29:d8:b6:4d 192.168.118.130

    00:50:56:c0:00:08 192.168.118.1

    Lets see how we can create a simple D NS fuzzer using the fuzz function demonstrated in the description above.

    #!/usr/bin/env python

    #import module sys for command line argument

    import sys

    #import scapy as a library

    from scapy.all import *

    #fuzz dns

    while True:

    sr(IP(dst=sys.argv[1])/UDP()/fuzz(DNS()),inter=1,timeout=1)

    Sample output of the D NS fuzzer created using scapy.

    root@bt:~/Desktop# ./dnsfuzzer.py 192.168.118.1

    WARNING: No route found for IPv6 destination :: (no default route?)

    Begin e mission:

    .Finished to send 1 packets.

    Received 1 packets, got 0 answers, remaining 1 packets

    Begin e mission:

    Finished to send 1 packets.

    Received 0 packets, got 0 answers, remaining 1 packets

    Begin e mission:

    Finished to send 1 packets.

    Received 0 packets, got 0 answers, remaining 1 packets

    OTHER ARTICLES BY SUDHANSHU CHAUHANOTHER ARTICLES BY SUDHANSHU CHAUHAN

    Wireshark

    Netcat: TCP/IP Swiss Army Knife

    Windows Vulnerability Assessment

    Interview: Marius Corici, CEO of Hack a Server

    Intrusion Prevention System: First Line of Defense

    Metadata: The Hidden Treasure

    Passive Fingerprinting

    http://resources.infosecinstitute.com/passive-fingerprinting-os/http://resources.infosecinstitute.com/metadata-the-hidden-treasure/http://resources.infosecinstitute.com/intrusion-prevention-system/http://resources.infosecinstitute.com/interview-marius-corici/http://resources.infosecinstitute.com/windows-vulnerability-assessment/http://resources.infosecinstitute.com/netcat-tcpip-swiss-army-knife/http://resources.infosecinstitute.com/wireshark/
  • 7/27/2019 Scapy_ All-In-One Networking Tool

    9/11

    8/21/13 Scapy: All-in-One Networking Tool

    resources.infosecinstitute.com/scapy-all-in-one-networking-tool/ 9

    [ . . . ]

    The output of all the sample programs is shown in figure 7.

    Figure 7. Programs using Scapy

    There are many other third party libraries available for packet manipulation in Python, like Pycapy, pypcap, dpkt,

    etc., yet Scapy turns out be one of the simplest to use and integrate into Python code and hence is widely used.

    There are many other functionalities provided by Scapy, which individually might seem very simple, but once

    they all are weaved together, they have the capabilities which no other tool provides.

    Conclusion

    We saw that Scapy is very powerful ye t easy to use. Scapy is actually not a replacement for tools like Nmap,

    tcpdump or p0f. These tools are developed for specific needs and they all perform their functions very well .

    During a quick security assessment they come in handy and provide us the desired result, but sometimes we

    need the raw outputs, without any interpretation so that we can analyze and make decisions for ourselves. For

    example if we need to check if the system we are trying to parse is actually a honeypot or not, another example

    would be to test how a firewall/ IDP/ IPS behaves for different types of custom packets, then tools like Scapy

    are very useful.

    The best thing about Scapy is that we can also use it as a Python library, which allows us to create networking

    tools very quickly without going into the details of creating raw packets from scratch, which considerably

    reduces the size of the code. It simply allows us try anything we can imagine over a network. The inbuilt

    functions like fuzz, sniff, traceroute, arping, etc. wipe out the need of different tools for different functions and

    integrate it all into a single package.

    Incoming search terms:

    scapy

    no route found for ipv6 destination scapy

    scapy hacking

    scapy python example

    fuzzing with scapy

    scapy sniff( count callback

    scapy training

    Python all in one s60v2

    scapy sniff prn

    Www scapy com

    Virtualization Security: Hacking VMware with VASTO

    Wi-Fi Security: The Rise and Fall of WPS

    Cross-Site Scripting (XSS)

    LIKE US O N FACEBOOK == STAY UP TO DATELIKE US O N FACEBOOK == STAY UP TO DATE

    InfoSec Institute

    Like 5,816

    AWARD WINNIN G TRAININ G FROM INFOSE CAWARD WINNIN G TRAININ G FROM INFOSE C

    Be the first to hear ofnew free tutorials, training videos,

    product demos, and more. We'll deliver the best of our fr

    resources to you each month, sign up here:

    Email

    Yes, Send My Free Training & Tutorials

    Want to learn more?? The InfoSec Institute Ethical

    Hacking course goes in-depth into the techniques used by

    malicious, black hat hackers with attention getting lecture

    and hands-on lab exercises . While these hacking skill

    can be used for malicious purposes, this class teaches you

    how to use the same hacking techniques to perform a wh

    hat, ethical hack, on your organization. You leave with the

    ability to quantitatively assess and measure threats to

    information assets; and discover where your organization

    most vulnerable to black hat hackers. Some features of th

    course include:

    Dual Certification - CEH and CPT

    5 days of Intensive Hands-On Labs

    Expert Instruction

    CTF exercises in the evening

    Most up-to-date proprietary courseware available

    VIEW ETH ICAL HACKING

    InfoSec Institute - The most awarded security training

    company

    http://www.infosecinstitute.com/infosec_institute/awards.htmlhttp://www2.infosecinstitute.com/l/12882/2013-05-28/6g66whttp://www.iacertification.org/cpt_certified_penetration_tester.htmlhttp://www2.infosecinstitute.com/l/12882/2013-05-28/6g66whttp://www.facebook.com/infoseceduhttp://www.facebook.com/infoseceduhttp://resources.infosecinstitute.com/cross-site-scripting-xss/http://resources.infosecinstitute.com/wi-fi-security-wps/http://resources.infosecinstitute.com/virtualization-security/http://resources.infosecinstitute.com/scapy-all-in-one-networking-tool/http://resources.infosecinstitute.com/scapy-all-in-one-networking-tool/http://resources.infosecinstitute.com/scapy-all-in-one-networking-tool/http://resources.infosecinstitute.com/scapy-all-in-one-networking-tool/http://resources.infosecinstitute.com/scapy-all-in-one-networking-tool/http://resources.infosecinstitute.com/scapy-all-in-one-networking-tool/http://resources.infosecinstitute.com/scapy-all-in-one-networking-tool/http://resources.infosecinstitute.com/scapy-all-in-one-networking-tool/http://resources.infosecinstitute.com/scapy-all-in-one-networking-tool/http://resources.infosecinstitute.com/scapy-all-in-one-networking-tool/
  • 7/27/2019 Scapy_ All-In-One Networking Tool

    10/11

    8/21/13 Scapy: All-in-One Networking Tool

    resources.infosecinstitute.com/scapy-all-in-one-networking-tool/ 10

    ARCHIVEARCHIVE

    August 2013August 2013 (26)(26)

    July 2013July 2013 (44)(44)

    June 2013June 2013 (38)(38)

    RECENT POSTSRECENT POSTS

    InfoSec Institute is Hiring: SecurityInfoSec Institute is Hiring: Security

    ResearcherResearcher

    Dictionary Attack Using Burp SuiteDictionary Attack Using Burp Suite

    SANS Investigate Forensics Toolkit SANS Investigate Forensics Toolkit

    CATEGORIESCATEGORIES

    Application SecurityApplication Security (128)(128)

    Exploit DevelopmentExploit Development (48)(48)

    ForensicsForensics (58)(58)

    Name (required)

    Email (required)

    Website

    Comment

    Post CommentPost Comment

    f ea ture ha cking

    About the Author

    Sudhanshu Chauhan is a researcher at InfoSec Institute. He is a B.Tech (CSE) graduate from

    Amity University. His areas of interest include (but are not limited to) Web Application Security

    and Bypasssing Security Measures(IDS/IPS, AV etc.).

    Related Posts

    3 Comments

    dejanOctober 2, 2012 at 2:51 pm - Reply

    Hi, theres a mistake in the >>> arping(192.168.118.*) line: double quotes are missing.

    Besides that, this is a great article, keep it up.

    Sudhanshu ChauhanOctober 2, 2012 at 3:42 pm - Reply

    @dejan, thanks for pointing it out.

    Scapy elautoctrl November 22, 2012 at 11:02 am - Reply

    [...] all in one net work tool scapy [...]

    Leave A Response

    http://resources.infosecinstitute.com/sans-investigate-forensics-toolkit-forensics-martial-arts-part-2/http://resources.infosecinstitute.com/scapy-all-in-one-networking-tool/?replytocom=346040#respondhttp://www.elautoctrl.info/wordpress/archives/1648http://resources.infosecinstitute.com/scapy-all-in-one-networking-tool/?replytocom=292799#respondhttp://resources.infosecinstitute.com/scapy-all-in-one-networking-tool/?replytocom=292763#respondhttp://resources.infosecinstitute.com/tag/hacking/http://resources.infosecinstitute.com/tag/feature/http://resources.infosecinstitute.com/sans-investigate-forensics-toolkit-forensics-martial-arts-part-2/http://resources.infosecinstitute.com/dictionary-attack-using-burp-suite/http://resources.infosecinstitute.com/category/forensics-2/http://resources.infosecinstitute.com/category/exploit-development/http://resources.infosecinstitute.com/category/application-security-2/http://resources.infosecinstitute.com/sans-investigate-forensics-toolkit-forensics-martial-arts-part-2/http://resources.infosecinstitute.com/dictionary-attack-using-burp-suite/http://resources.infosecinstitute.com/infosec-institute-is-hiring-security-researcher/http://resources.infosecinstitute.com/2013/06/http://resources.infosecinstitute.com/2013/07/http://resources.infosecinstitute.com/2013/08/
  • 7/27/2019 Scapy_ All-In-One Networking Tool

    11/11

    8/21/13 Scapy: All-in-One Networking Tool

    May 2013May 2013 (42)(42)

    April 2013April 2013 (56)(56)

    March 2013March 2013 (68)(68)

    February 2013February 2013 (65)(65)

    January 2013January 2013 (65)(65)

    December 2012December 2012 (51)(51)

    November 2012November 2012 (45)(45)

    October 2012October 2012 (59)(59)

    September 2012September 2012 (56)(56)

    August 2012August 2012 (35)(35)

    July 2012July 2012 (21)(21)

    June 2012June 2012 (31)(31)

    May 2012May 2012 (11)(11)

    April 2012April 2012 (16)(16)

    March 2012March 2012 (12)(12)

    February 2012February 2012 (24)(24)

    January 2012January 2012 (22)(22)

    December 2011December 2011 (15)(15)

    November 2011November 2011 (12)(12)

    October 2011October 2011 (12)(12)

    September 2011September 2011 (1)(1)

    August 2011August 2011 (2)(2)

    July 2011July 2011 (7)(7)

    June 2011June 2011 (22)(22)

    May 2011May 2011 (30)(30)

    April 2011April 2011 (33)(33)

    March 2011March 2011 (24)(24)

    February 2011February 2011 (7)(7)

    January 2011January 2011 (2)(2)

    December 2010December 2010 (3)(3)

    November 2010November 2010 (7)(7)

    October 2010October 2010 (1)(1)September 2010September 2010 (1)(1)

    August 2010August 2010 (4)(4)

    July 2010July 2010 (2)(2)

    Forensics Martial Arts Part 2Forensics Martial Arts Part 2

    SANS Investigate Forensics ToolkitSANS Investigate Forensics ToolkitForensics Martial Arts Part 1Forensics Martial Arts Part 1

    Android Forensics: Cracking the PatternAndroid Forensics: Cracking the PatternLock ProtectionLock Protection

    WEB SERVER SECURITYWEB SERVER SECURITY

    Handy Devices Revolution: Another Set ofHandy Devices Revolution: Another Set ofEmbedded Devices and Dev BoardsEmbedded Devices and Dev Boards

    Owned by Chrome ExtensionsOwned by Chrome Extensions

    Keyloggers: How They Work and MoreKeyloggers: How They Work and More

    Steganography: What your eyes dont seeSteganography: What your eyes dont see

    Hacker Proofing Apache & PHPHacker Proofing Apache & PHPConfigurationConfiguration

    Malicious Firefox Add-Ons: KeyloggerMalicious Firefox Add-Ons: Keylogger

    General SecurityGeneral Security (175)(175)

    HackingHacking (299)(299)

    InterviewsInterviews (33)(33)

    IT CertificationsIT Certifications (65)(65)

    CCNACCNA (2)(2)

    CEHCEH (5)(5)

    CISACISA (16)(16)

    CISMCISM (10)(10)

    CISSPCISSP (33)(33)

    MCITPMCITP (2)(2)

    Management, Compliance, & AuditingManagement, Compliance, & Auditing (48)(48)

    MetaMeta (1)(1)

    OtherOther (79)(79)

    Reverse EngineeringReverse Engineering (115)(115)

    SCADASCADA (5)(5)

    Virtualization SecurityVirtualization Security (6)(6)

    Wireless SecurityWireless Security (10)(10)

    POPULARPOPULAR COMMENTSCOMMENTS TAGSTAGS POPULAR SEARCH TERMSPOPULAR SEARCH TERMS

    iphoneiphone,, i phonei phone,, backtrack 5 r3 tutorialbacktrack 5 r3 tutorial,,resources infosecinstitute comresources infosecinstitute com,, diarmfdiarmf,,network security engineernetwork security engineer,, w3af tutorialw3af tutorial,,

    backtrack 5 r3 tutorial pdfbacktrack 5 r3 tutorial pdf,, Backtrack 5Backtrack 5,,iphone 1iphone 1,, iphone 10iphone 10,, maltegomaltego

    Back to ToBack to ToCopyright 2012 - InfoSec InstituteCopyright 2012 - InfoSec Institute

    Antivirus Evasion: TheAntivirus Evasion: TheMaking of a Full ,Making of a Full ,

    Undetectab le US BUndetectab le US B

    Dropper / SpreaderDropper / Spreader

    September 20, 2012September 20, 2012 4545

    Ideal Skil l Set For theIdeal Skil l Set For the

    Penetration TestingPenetration Testing

    August 27, 2010August 27, 2010 4444

    SLAAC Attack 0daySLAAC Attack 0day

    Windows NetworkWindows Network

    Inte rcept ionInte rcept ion

    Conf igurat ionConf igurat ion

    Vu ln er ab il it yVu ln er ab il it y

    April 04, 2011April 04, 2011 3939

    SQL In ject ion thro ughSQL In ject ion thro ugh

    HTTP HeadersHTTP Headers

    March 30, 2012March 30, 2012 3131

    http://resources.infosecinstitute.com/sql-injection-http-headers/#commentshttp://resources.infosecinstitute.com/sql-injection-http-headers/http://resources.infosecinstitute.com/slaac-attack/#commentshttp://resources.infosecinstitute.com/slaac-attack/http://resources.infosecinstitute.com/ideal-skill-set-for-the-penetration-testing/#commentshttp://resources.infosecinstitute.com/ideal-skill-set-for-the-penetration-testing/http://resources.infosecinstitute.com/antivirus-evasions-the-making-of-a-full-undetectable-usb-dropper-spreader/#commentshttp://resources.infosecinstitute.com/antivirus-evasions-the-making-of-a-full-undetectable-usb-dropper-spreader/http://resources.infosecinstitute.com/scapy-all-in-one-networking-tool/#http://resources.infosecinstitute.com/information-gathering-maltego/http://resources.infosecinstitute.com/clickjacking-facebook/http://resources.infosecinstitute.com/iphone-security-10-tips-and-settings/http://resources.infosecinstitute.com/penetration-testing-in-cms/http://resources.infosecinstitute.com/backtrack-5-part-1/http://resources.infosecinstitute.com/w3af-tutorial/http://resources.infosecinstitute.com/network-security-engineer/http://resources.infosecinstitute.com/goodbye-diacap-hello-diarmf/http://resources.infosecinstitute.com/german-trojan/http://resources.infosecinstitute.com/backtrack-5-part-1/http://resources.infosecinstitute.com/iphone-security-10-tips-and-settings/http://resources.infosecinstitute.com/book-practical-malware-analysis/http://resources.infosecinstitute.com/scapy-all-in-one-networking-tool/#tab3http://resources.infosecinstitute.com/scapy-all-in-one-networking-tool/#tab2http://resources.infosecinstitute.com/scapy-all-in-one-networking-tool/#tab1http://resources.infosecinstitute.com/category/wireless-security/http://resources.infosecinstitute.com/category/virtualization-security/http://resources.infosecinstitute.com/category/scada-2/http://resources.infosecinstitute.com/category/reverse-engineering-2/http://resources.infosecinstitute.com/category/other/http://resources.infosecinstitute.com/category/meta/http://resources.infosecinstitute.com/category/compliance-auditing/http://resources.infosecinstitute.com/category/certifications-training/mcitp/http://resources.infosecinstitute.com/category/certifications-training/cissp/http://resources.infosecinstitute.com/category/certifications-training/cism/http://resources.infosecinstitute.com/category/certifications-training/cisa/http://resources.infosecinstitute.com/category/certifications-training/ceh/http://resources.infosecinstitute.com/category/certifications-training/ccna-certification/http://resources.infosecinstitute.com/category/certifications-training/http://resources.infosecinstitute.com/category/interviews/http://resources.infosecinstitute.com/category/hacking-2/http://resources.infosecinstitute.com/category/general-security-2/http://resources.infosecinstitute.com/keylogger/http://resources.infosecinstitute.com/hacker-proofing-apache-php-configuration/http://resources.infosecinstitute.com/steganography-what-your-eyes-dont-see/http://resources.infosecinstitute.com/keyloggers-how-they-work-and-more/http://resources.infosecinstitute.com/owned-by-chrome-extensions/http://resources.infosecinstitute.com/handy-devices-revolution-another-set-of-embedded-devices-and-dev-boards/http://resources.infosecinstitute.com/web-server-security-2/http://resources.infosecinstitute.com/android-forensics-cracking-the-pattern-lock-protection/http://resources.infosecinstitute.com/sans-investigate-forensics-toolkit-forensics-martial-arts-part-1/http://resources.infosecinstitute.com/sans-investigate-forensics-toolkit-forensics-martial-arts-part-2/http://resources.infosecinstitute.com/2010/07/http://resources.infosecinstitute.com/2010/08/http://resources.infosecinstitute.com/2010/09/http://resources.infosecinstitute.com/2010/10/http://resources.infosecinstitute.com/2010/11/http://resources.infosecinstitute.com/2010/12/http://resources.infosecinstitute.com/2011/01/http://resources.infosecinstitute.com/2011/02/http://resources.infosecinstitute.com/2011/03/http://resources.infosecinstitute.com/2011/04/http://resources.infosecinstitute.com/2011/05/http://resources.infosecinstitute.com/2011/06/http://resources.infosecinstitute.com/2011/07/http://resources.infosecinstitute.com/2011/08/http://resources.infosecinstitute.com/2011/09/http://resources.infosecinstitute.com/2011/10/http://resources.infosecinstitute.com/2011/11/http://resources.infosecinstitute.com/2011/12/http://resources.infosecinstitute.com/2012/01/http://resources.infosecinstitute.com/2012/02/http://resources.infosecinstitute.com/2012/03/http://resources.infosecinstitute.com/2012/04/http://resources.infosecinstitute.com/2012/05/http://resources.infosecinstitute.com/2012/06/http://resources.infosecinstitute.com/2012/07/http://resources.infosecinstitute.com/2012/08/http://resources.infosecinstitute.com/2012/09/http://resources.infosecinstitute.com/2012/10/http://resources.infosecinstitute.com/2012/11/http://resources.infosecinstitute.com/2012/12/http://resources.infosecinstitute.com/2013/01/http://resources.infosecinstitute.com/2013/02/http://resources.infosecinstitute.com/2013/03/http://resources.infosecinstitute.com/2013/04/http://resources.infosecinstitute.com/2013/05/