YARA is an advanced string searching tool designed to assist malware researchers in identifying malware samples. Its extremely versatile, allowing analysts to scan a variety of file types both on disk or in memory, to quickly highlight pre-identified malicious indicators and classify the files. I've created a bash script to make it easier to scan … Continue reading [BSH] Quick Tip: YARA Scanning Files
[RE] Zombieland CTF – Reverse Engineering for Beginners
I've been working on my programming recently to help improve my reverse engineering skills and I've just finished writing my first reverse engineering capture the flag. I've tried to make the assembly as clear and simple as possible, whilst still remaining challenging, to allow inexperienced REs to be able to step through and really get … Continue reading [RE] Zombieland CTF – Reverse Engineering for Beginners
[BSH] PCAP Email Extractor
This is just a quick post to share a technique I use to extract emails from trigger PCAPs. This can be achieved using tools like Network Miner etc, but I prefer the command line approach as it scales better, its quicker and it can be built upon to add additional functionality as you go. The … Continue reading [BSH] PCAP Email Extractor
[RE] Linux Bomb Walkthrough – Part3 (Phases 4-6)
Welcome to part 3 of 3 of this RE walkthrough. If you've somehow jumped straight in here, go look up the first 2 parts to catch up. PHASE 4 I'll start this write-up with the debugger paused at the first instruction within the phase_4 function. At first glance, this looks like its a lot simpler than … Continue reading [RE] Linux Bomb Walkthrough – Part3 (Phases 4-6)
[RE] Linux Bomb Walkthrough – Part2 (Phases 1-3)
Welcome to part 2. This will go through the phases of the Linux Bomb binary provided by Open Security Training. Check out their training if you're a beginner looking to develop your assembly skills. You can also grab the binary from their. http://opensecuritytraining.info/IntroX86.html If you need a help setting up, check Part 1 of this … Continue reading [RE] Linux Bomb Walkthrough – Part2 (Phases 1-3)
[McB]Defence 