adricnet

aspe:keyoxide.org:S2KEQXGGHOXERMULVJAVMZ66FY

adricnet

Why might you care about filesystems

in 02025 CE ?

"in a investigation, details matter" -Dr. Emma Watson, OBE, Bill and Ted's Bogus Journey

• Endpoints: more than you may think
• Serverless, chatbots, APIs: maybe filesystems less important
  • although ../ won't stop and that's a filesystem path polite cough

Limits and shapes user and miscreant activity:

adricnet

root@kali:~/Desktop/live-build-config# cat kali-config/variant-light-voltron/package-lists/kali.list.chroot 
# You always want those
#kali-linux-core
kali-desktop-live

# Kali applications
#<package>
# You can customize the set of Kali metapackages (groups of tools) to install

adricnet

Thanks, Adrian and team at http://www.irongeek.com/

DerbyCon 2019

https://www.irongeek.com/i.php?page=videos/derbycon9/mainlist

• Keynote: Ed Skoudis
• Attribution and Deception for Threat Intelligence: John Strand
• BloodHound From Red to Blue: Mathieu Saulnier

adricnet

Some obstacles overcome to get a Cuckoo 2 sandbox going on the class laptop: Win10x64 Pro. This is just my notes and rambling and intent is to write up a working build in case someone else in 610 or the community wants it.

Book

Upstream installation instructions, might give harmless cert error: http://docs.cuckoosandbox.org/en/latest/installation/guest/agent/

Python

adricnet

The live demo attempt method (FileInsight):

1. Use web developer tools or Burp to capture source of index page. (Ctrl-A, Ctrl-C)

2. Paste that HTML into a new buffer in FileInsight.

3. Trim away everything but the suspicious bitstream.

4. Select the bitstream (Ctrl-A) and use the Decode tools in the left pane to convert Hex to ASCII (no key).

adricnet

Theme: Learn to Attack

Why?

• Purple is a lovely colour
• Lose less at CTFs
• Get another security certification

Why (srsly)

adricnet

==Major

1. GSE (done)
2. SOC Summit workshops
3. MGT517 SecOps Design and Operation
4. Security Onion Con / B-Sides Augusta
5. Investigation Theory (AND)
6. FOR572 self-study (4A)
7. DataCamp: Python Data Science ( 7 of 20 )

adricnet

In which we derive some lessons from the now decommisioned lab resources recently experimented with

Resources

• an Amazon Workspace with Windows and Office, rented for a month
• a Droplet with Docker, running an infosec app of interest, for a couple months
• Chromebook as client to all

Test tasks

adricnet

Get De-XRAY from Hexacorn:

• http://www.hexacorn.com/blog/category/software-releases/dexray/
• http://hexacorn.com/d/DeXRAY.pl

Ubuntu 16.04 (Xenial)

## at least these or just CPAN