Subscription

Explore Products

Best Sellers

New Releases

Books

Videos

Audiobooks

Learning Hub

Conferences

Free Learning

You're reading from Hands-On Network Forensics Investigate network attacks and find evidence using common network forensic tools

Product type Paperback

Published in Mar 2019

Publisher

ISBN-13 9781789344523

Length 358 pages

Edition 1st Edition

Languages

Tools

Wireshark

Concepts

Forensics

Author (1):

Nipun Jaswal

View More author details

Table of Contents (16) Chapters

Preface

1. Section 1: Obtaining the Evidence

2. Introducing Network Forensics FREE CHAPTER

3. Technical Concepts and Acquiring Evidence

4. Section 2: The Key Concepts

5. Deep Packet Inspection

6. Statistical Flow Analysis

7. Combatting Tunneling and Encryption

8. Section 3: Conducting Network Forensics

9. Investigating Good, Known, and Ugly Malware

10. Investigating C2 Servers

11. Investigating and Analyzing Logs

12. WLAN Forensics

13. Automated Evidence Aggregation and Analysis

14. Other Books You May Enjoy

Leave a review - let other readers know what you think

15. Assessments

A case study – defaced servers

Consider a scenario where we have been tasked to investigate a server that was compromised and defaced by the attackers. The administration team has all the practices, such as logging and full packet capturing, in place. However, it seems that someone also cleared out logs, as suggested by its Modified, Accessed, Created, Executed (MACE) properties. There are very few entries in the Apache logs, as shown in the following log set:

    192.168.153.1 - - [25/Mar/2019:14:43:47 -0400] "GET /site/ HTTP/1.1" 200 701 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0"
    192.168.153.1 - - [25/Mar/2019:14:43:47 -0400] "GET /icons/blank.gif HTTP/1.1" 200 431 "http://192.168.153.130/site/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:66.0) Gecko/20100101 Firefox...

The rest of the chapter is locked

A free Packt account unlocks extra newsletters, articles, discounted offers, and much more. Start advancing your knowledge today.

Unlock this book and the full library FREE for 7 days

Get unlimited access to 7000+ expert-authored eBooks and videos courses covering every tech area you can think of

Start free trial

Renews at R$50/month. Cancel anytime

Authors (1)

Nipun Jaswal

Nipun Jaswal is an international cybersecurity author and an award-winning IT security researcher with more than a decade of experience in penetration testing, Red Team assessments, vulnerability research, RF, and wireless hacking. He is presently the Director of Cybersecurity Practices at BDO India. Nipun has trained and worked with multiple law enforcement agencies on vulnerability research and exploit development. He has also authored numerous articles and exploits that can be found on popular security databases, such as PacketStorm and exploit-db. Please feel free to contact him at @nipunjaswal.

See other products by Nipun Jaswal