| panopticon:~ gchao$ sudo tcpdump | |
| Password: | |
| tcpdump: data link type PKTAP | |
| tcpdump: verbose output suppressed, use -v or -vv for full protocol decode | |
| listening on pktap, link-type PKTAP (Packet Tap), capture size 65535 bytes | |
| 22:58:01.535356 IP 209.212.144.79.jetcmeserver > 10.0.1.21.53064: Flags [.], seq 971326800:971328248, ack 758627056, win 501, options [nop,nop,TS val 898360544 ecr 244484858], length 1448 | |
| 22:58:01.536414 IP 209.212.144.79.jetcmeserver > 10.0.1.21.53064: Flags [P.], seq 1448:2494, ack 1, win 501, options [nop,nop,TS val 898360544 ecr 244484858], length 1046 | |
| 22:58:01.536442 IP 10.0.1.21.53064 > 209.212.144.79.jetcmeserver: Flags [.], ack 2494, win 8126, options [nop,nop,TS val 244484944 ecr 898360544], length 0 | |
| 22:58:01.541432 IP 209.212.144.79.jetcmeserver > 10.0.1.21.53064: Flags [P.], seq 2494:3931, ack 1, win 501, options [nop,nop,TS val 898360545 ecr 244484883], length 1437 | |
| 22:58:01.541465 IP 10.0.1.21.53064 > 209.212.144.79.jetcmeserver: Flags [.], ack 3931, win 8036, options [nop,nop,T |
| username = raw_input("Enter SSH username:") | |
| yubikey_string = getpass.getpass('Enter YubiKey OTP:') | |
| client = paramiko.client.SSHClient() | |
| # Any means of getting the PKey will do. This code assumes you've only got one key loaded in your active ssh-agent. | |
| # See also: | |
| # - http://docs.paramiko.org/en/1.17/api/keys.html#paramiko.pkey.PKey | |
| # - http://docs.paramiko.org/en/1.17/api/client.html#paramiko.client.SSHClient.connect | |
| my_pkey = paramiko.agent.Agent().get_keys()[0] |
#DFIR These are my notes from BlackHat 2016 Digital Forensics & Incident Response Training
##Windows Drive Forensics NTFS: host default <---- Course focus ReFS: eventually the host default (not yet) <---- basically nothing FAT: external drives <--- a little focus ExFat: high-cap external drives <--- basically nothing
Our tools will mostly deal with NTFS and FAT.
I hereby claim:
To claim this, I am signing this object:
| #!/usr/bin/env python2.7 | |
| """ | |
| Test runner for dv_router.py and learning_switch.py. | |
| Add your own tests by creating new files in tests/ and updating main | |
| below. | |
| """ | |
| from __future__ import print_function |
| import argparse | |
| import os | |
| import re | |
| import sys | |
| import traceback | |
| from tests import * | |
| import tests | |
| import client |
| import os | |
| import sys | |
| import client | |
| import test_utils | |
| import wan | |
| from simple_tests import simple_send_test | |
| def cache_is_not_flow_specific(middlebox_module, testing_part_1): |