CyberDefenders – HoneyPot PCAP Analysis

Onto a new site this week! CyberDefenders hosts challenges of the cyber defence theme and it’s a great place for analysts, defenders and DFIR folk to practice their skills and learn new ones as well. Diving right into it, we’ll download the pcap file and open it up in WireShark. Q1 – What is the

TryHackMe – Forensics Room

After downloading the victim.zip file and verifying it’s hash via powershell we are ready to get started! Question 2 – What is the OS of this Dump?For this question we can try to determine the profile of the memory dump using the imageinfo command from volatility. Looking at this output we can see this is

Volatility – TryHackMe

TryHackMe is a security upskilling platform with many different topics covered. This room was part of the ‘Incident Response and Digital Forensics’ track. Many of the rooms on the site are free to access including this one. Task 1 – Intro ‘Volatility is a free memory forensics tool developed and maintained by Volatility labs. Regarded

Adventures in Email Forensics

METASPIKE CTF Challenge – It’s About Time (0) Downloading the file gets us a EML file which is fortunately readable in many different programs. It’s essentially a text file and thus easily editable. I don’t have a lot of tools setup on my laptop right now due to a O/S reload so I opened the