Posted By Nick | April 7th, 2011
When dealing with PC’s that are suspected to have a virus there are a myriad of tools to perform “forensic” tasks. However none of them met ALL of my needs. Most got some of the data, were constrained to a particular format, or required user intervention. Not helpful if you want to instruct tier 1 … Continue reading
Tags: cirt, Incident Response, nirsfot, sysinternals
Filed In: IT Infrastructure Security
Posted By Nick | November 2nd, 2010
It has been quite a few weeks since my last blog post. I have been very busy with the PWB course from offensive security, as well as the daily grind to put food on the table. But, that’s no excuse! Hard core *nix enthusiasts will no doubt say “duh” to the knowledge I’m attempting to … Continue reading
Tags: account creation, Backtrack, guid, Information Security, Linux, non interactive, OCSP, pen test, penetration testing, pw, PWB, Root, root user, second root user, Security, uid, useradd
Filed In: IT Infrastructure Security, Security Testing
Posted By Nick | August 12th, 2010
Malware analysis is not a skill that every IT security professional has. It comes with a heavy amount of programming experience, an understanding of assembly, computer memory, debuggers and decompilers. Malware analysis can take a lot of time and skill, and is usually not done by organizations’ security staff. The staff leaves it to AV … Continue reading
Tags: analysis, joebox.org, malware
Filed In: IT Infrastructure Security, Security Testing
Posted By Nick | August 10th, 2010
I recently had an opportunity to do some research into a large volume of Snort IDS rules that had begun to fire (to the tune of millions of alerts a day) for an organization. At first glance these alerts appeared to be false positives, but they smelled like a lazy application DDoS attempt from some … Continue reading
Tags: False Positive, Snort
Filed In: IT Infrastructure Security, Security Testing
Posted By Nick | July 27th, 2010
This is quick commo check and update to my progress with the PWBv3 course. I’ve spent the better part of this week knee deep in shellcode, assembly and debuggers… and let me tell you my brain needs a break! Don’t let the latter sentence scare you away from this course; the tutorials and examples are … Continue reading
Tags: assembly, Backtrack, buffer overflow, OSCP, penetration test, pwbv3
Filed In: IT Infrastructure Security
Posted By Nick | July 20th, 2010
In my never ending quest for IT security excellence I’ve decided to enroll in the Offensive Security Penetration Testing With Backtrack version 3 (PWB3) course, offered by Offensive-Security. The course, formerly known as OSCP 101, has turned out to be quite a different animal than other security courses\certification tracks I have taken in the past. … Continue reading
Tags: Backtrack, certification, offensive-security, offsec, OSCP, pen test, penetration test, PWB3, security training
Filed In: IT Infrastructure Security