DIGITAL FORENSICS AND INCIDENT RESPONSE (DFIR)

"These programs were never about terrorism: they're about economic spying, social control and diplomatic manipulation. They're about power." (Edward Snowden)

BASIC STRATEGY

Crime Triangle

Basic Investigative Metodology

• 5W: Who, What, When, Where and Why
• PDCA Cycle: Plan, Do, Check and Act
• Root Cause Analysis (RCA):
— Identify and describe the problem clearly
— Establish a timeline from the normal situation
until the problem occurs
— Distinguish between the root cause and other
causal factors (e.g., using event correlation)
— Establish a causal graph between the root
cause and the problem

FORENSIC SUITES

FLOSS
Free/Libre and Open Source Software

PROPRIETARY
Cyber-surveillance Industry

• Kali Linux
https://www.kali.org
• Drive Badger
https://drivebadger.com (GitHub)
• SIFT Workstation
https://www.sans.org/tools/sift-workstation
• Parrot Security
https://www.parrotsec.org
• CAINE
https://www.caine-live.net
• CSI Linux
https://csilinux.com
• Avilla Forensics
https://github.com/AvillaDaniel/AvillaForensics
• IPED
https://github.com/sepinf-inc/IPED
• Debian Forensics Package
https://packages.debian.org/unstable/forensics-all
• Mobile Verification Toolkit (MVT)
https://docs.mvt.re/en/latest
• Tsurugi Linux
https://tsurugi-linux.org/
• REMnux
https://remnux.org
• Bitscout
https://github.com/vitaly-kamluk/bitscout
• Eric Zimmerman's tools (Freeware)
https://ericzimmerman.github.io/#!index.md
• Paladin® (Freeware)
https://sumuri.com/software/paladin/
• Forensic Toolkit (FTK)® - Lite (Freeware)
https://www.exterro.com/forensic-toolkit
• Magnet Forensic® - Mobile Extractor (Freeware)
https://www.magnetforensics.com
• Windows® Forensic Environment WinFE (Freeware)
https://www.winfe.net
• NirSoft® (Freeware)
https://www.nirsoft.net
• MiTeC® (Freeware)
https://www.mitec.cz
• Medusa Box® (Easy J-TAG)
https://medusabox.com
╰┈➤Models Features
╰┈➤Aliexpress
• Octoplus Box® (Easy J-TAG)
https://octoplusbox.com
╰┈➤Models Features
╰┈➤Aliexpress

• Cellebrite®
https://cellebrite.com
• NSO Group®
https://www.nsogroup.com
• Cognyte®
https://www.cognyte.com
• Team Cymru®
https://www.team-cymru.com
• BriefCam®
https://www.briefcam.com/
• Forensic Toolkit (FTK)®
https://www.exterro.com/forensic-toolkit
• Magnet Forensic®
https://www.magnetforensics.com
• Harpia Tech®
https://harpia.tech
• Visual Cortex®
https://visualcortex.com
• Oxygen Forensic®
https://oxygen-forensic.wedatasolution.com
• MSAB®
https://www.msab.com
• GMDSOFT®
https://www.gmdsoft.com
• Verint Systems®
https://www.verint.com
• Cyber Arm®
https://cyber-arm.com/services
• Cobalt Strike®
https://www.cobaltstrike.com
• Lumi Networks®
https://www.lumi.network
• Clear View AI®
https://www.clearview.ai
• Lockheed Martin®
https://www.lockheedmartin.com/
• MOBILedit®
https://www.mobiledit.com
• Crowd Strike®
https://www.crowdstrike.com
• Binalyze®
https://www.binalyze.com
• LexisNexis®
https://risk.lexisnexis.com
• NetQuest®
https://netquestcorp.com
• Gamma®
https://www.gamma.co.uk
• Memento Labs®
https://mem3nt0.com
• CYSource®
https://www.cysrc.com
• Maltego®
https://www.maltego.com
• Thorn's Safer®
https://www.thorn.org

FORENSIC TOOLS

• Evidence ProjectForensics Tools Catalogue - https://www.dftoolscatalogue.eu

• NIST - Forensics Tools Catalogue - https://toolcatalog.nist.gov

• S&T partners and NIST - Computer Forensic Tool Testing (CFTT) - https://www.dhs.gov/science-and-technology/nist-cftt-reports

_{Interesting information
• Beyond the Veil of Surveillance: Private Sector Offensive Actors (PSOAs)
• Burn, drown, or smash your phone: Forensics can extract data anyway
• How law enforcement gets around your smartphone’s encryption
• Cellphone data used to solve murder case from 2 years ago, police say
• The Stingray: How Law Enforcement Can Track Your Every Move
• Police are tracking you and your license plates
• SCOTUS: Police Need Search Warrant to Ping cell Phones
• EFF to Michigan Court: Governments Shouldn’t Be Allowed to Use a Drone to Spy on You Without a Warrant
• Motion to Suppress Aerial Surveillance Evidence in U.S. vs Muhammed Momtaz Alazhari
• Researchers Find Way to Steal Encrypted Data - NYT (2008)
• “Reverse Location Search Warrant”: A New Personal Data Hoovering Exercise Brought to You by Google (2019)
• As UN Human Rights Chief Urges Stricter Rules, Snowden Calls for End to Spyware Trade (2021)
• Forensics Journal Comparative analysis of mobile forensic proprietary tools: an application in forensic investigation (2022)
• Methodology for Forensics Data Reconstruction on Mobile Devices with Android
Operating System Applying In-System Programming and Combination Firmware (2020)}

INTERCEPTION PLATFORMS

Comparison between Drive Badger (Open source platform) with other lawful interception platforms. Visit: Official online sheet complete and updated or PDF in our repo.

Exploit and Spyware Vendor

Zero-day Exploit	Associated Spyware Vendor
CVE-2023-28205 and CVE-2023-28206 (Apple iOS)	Variston (BridgeHead)
CVE-2023-2033 (Google Chrome)	Intellexa/Cytrox (Predator)
CVE-2023-2136 (Google Chrome)	Intellexa/Cytrox (Predator)
CVE-2023-32409 (Apple iOS)	Variston (BridgeHead)
CVE-2023-3079 (Google Chrome)	Intellexa/Cytrox (Predator)
CVE-2023-41061 and CVE-2023-41064 (Apple iOS)	NSO Group (Pegasus)
CVE-2023-41991, CVE-2023-41992, and CVE-2023-41993 (Apple iOS)	Intellexa/Cytrox (Predator)
CVE-2023-5217 (Google Chrome)	Candiru (DevilsTongue)
CVE-2023-4211 (Arm Mali GPU)	Cy4Gate (Epeius)
CVE-2023-33063 (Qualcomm Adreno GPU)	Variston (BridgeHead)
CVE-2023-33106 and CVE-2023-33107 (Qualcomm Adreno GPU)	Cy4Gate (Epeius)
CVE-2023-42916 and CVE-2023-42917 (Apple iOS)	PARS Defense
CVE-2023-7024 (Google Chrome)	NSO Group (Pegasus)

NATIONAL CYBER SECURITY AGENCIES

US — CISA CA — Cyber Americas — CSIRT	EU — ENISA UK — NCSC NL — NCSC DE — BSI FR — ANSSI ES — CCN-CERT IT — ACN HU — NKI CZ — NUKIB NO — NCSC	IS — INCD AU — Cyber NZ — CERT NZ — NCSC	KR — KISA JP — Cert JP — NISC SG — CSA

${\color{Blue}\textbf{1.PASSIVE FORENSICS}}$

👷🛠️UNDER CONSTRUCTION🚧🏗

1.01 Forensic standards

Visit our repo tree: 2.FORENSIC

Standards

NIST — National Institute of Standards and Technology

Visit: https://www.nist.gov/standards

ISO/IEC — International Electrotechnical Commission

Visit: https://www.iso27001security.com

Official - Information security, cybersecurity and privacy protection — https://www.iso.org/standard/27001

RFC

Best Current Practices (BCP)

Standards

Informational

Experimental / Historic

1.02 Forensic certs & training

1.03 Online forensic tools

• Message Header Analyzer — https://mha.azurewebsites.net
• Message Header Analyzer — https://github.com/microsoft/MHA
• PhishTank — https://phishtank.org
• Simple Email Reputation — https://emailrep.io
• Have I Been Pwned — https://haveibeenpwned.com
• DeHashed — https://www.dehashed.com
• Whois — https://www.iana.org/whois
• ViewDNS — https://viewdns.info
• WhoisMyDNS — https://whoismydns.com
• NSLookup — https://www.nslookup.io
• My-Addr — https://my-addr.com
• Malpedia — https://malpedia.caad.fkie.fraunhofer.de
• CVE Details — https://www.cvedetails.com
• Exploit Database — https://www.exploit-db.com
• FileInfo — https://fileinfo.co
• xCyclopedia — https://strontic.github.io/xcyclopedia
• The Windows Binary Index — https://winbindex.m417z.com
• Palo Alto Applipedia — https://applipedia.paloaltonetworks.com
• Windows Securitiy Logs — https://www.ultimatewindowssecurity.com/securitylog/encyclopedia
• Internet Archive - WayBackMachine - https://web.archive.org • Archive web content — https://archive.ph
• Internet Archive — https://archive.org
• HTTrack — https://www.httrack.com
• IPVOID — https://www.ipvoid.com
• AbuseIPDB — https://www.abuseipdb.com
• Grabify IP Logger — https://grabify.link/
• IP Logger — https://iplogger.org
• IP Tracker — https://iplogger.org/ip-tracker
• IP location — https://www.iplocation.net
• Location Tracker — https://iplogger.org/location-tracker
• URL Checker — https://iplogger.org/url_checker
• MAC Address Lookup — https://iplogger.org/mac-checker
• MAC Vendor — https://macvendors.com
• IP API
— ip-api — https://ip-api.com
— ipify — https://www.ipify.org
— ipapi — https://ipapi.co
— vpnapi — https://vpnapi.io
— ipapi — https://ipapi.com
• Virus Total — https://www.virustotal.com
• Hybrid Analysis — https://hybrid-analysis.com
• AlienVault OTX — https://otx.alienvault.com/ • IBM X-Force Exchange — https://exchange.xforce.ibmcloud.com
• Cisco Talos — https://talosintelligence.com/reputation_center
• Maltiverse — https://maltiverse.com/collection
• GreyNoise — https://www.greynoise.io
• SANS Internet Storm Center — https://isc.sans.edu
• Intelligence X — https://intelx.io
• MetaDefender Cloud — https://metadefender.opswat.com
• RiskIQ Community Edition — https://community.riskiq.com/home
• Pulsedive — https://pulsedive.com
• Valhalla YARA Rules — https://valhalla.nextron-systems.com
• Binvis — https://binvis.io
• JoeSandbox — https://www.joesandbox.com
• ANY.RUN — https://any.run
• urlscan.io — https://urlscan.io
• Verexif - https://www.verexif.com/en/
• Any Run — https://app.any.run
• The ZMap Project — https://zmap.io
• Name OSINT — https://namechk.com
• Reverse Shell Generator — https://www.revshells.com
• Rainbow Tables (Hashes) — https://hashes.com/en/decrypt/hash
• Breach Directory - https://breachdirectory.org
• MD5 Decrypt - https://md5decrypt.net/en/Sha1
• File Signatures ("Magic Numbers") — https://en.wikipedia.org/wiki/Magic_number_(programming)
• List of File Signatures — https://en.wikipedia.org/wiki/List_of_file_signatures
• CyberChef — https://gchq.github.io/CyberChef
• explainshell — https://explainshell.com
• Epoch Converter — https://www.epochconverter.com

For OSINT tools visit our repository: https://www.dftoolscatalogue.eu

NIST - https://toolcatalog.nist.gov

S&T partners and NIST - Computer Forensic Tool Testing (CFTT) - https://www.dhs.gov/science-and-technology/nist-cftt-reports

Some tools

Image and video upscaling programs

• ImageJ
• Upscalers - https://github.com/hollowaykeanho/Upscaler

Extraction Methods

Encryption:	Seize the encrypted files and decrypt them using a password or key and the appropriate decryption software. OR Seize the data while it is in an unencrypted state.
Virtualization:	Seize the virtual image file and open it with the correct password. OR Log into the virtual machine and seize the data while the virtual machine is turned on and in an unencrypted state.
Relational Database:	Seize all the files containing records. Obtain a copy of the database software and rebuild the database. OR Log into the database while it is live and employ the application used to create and manage the database as a search tool. Download the data using the method allowed by the application, either in the form of printouts or data files.

Encryption workarounds:

Find the key.
Guess the key.
Compel the key.
Exploit a flaw in the encryption software.
Access plaintext while the device is in use.
Locate another plaintext copy.

1.05 Cryptography

Encryption Workrounds

Visit our repo tree: 3.DOCUMENTS/Encryption

Encryption workarounds:

Find the key.
Guess the key.
Compel the key.
Exploit a flaw in the encryption software.
Access plaintext while the device is in use.
Locate another plaintext copy.

Bruteforce

Read the thread Brute Force Attacks

.

Cryptanalysis

Visit our repo tree: 3.DOCUMENTS/Cryptanalysis

Steganography

1.06 Memory analysis

1.07 Cryptocurrencies analysis

Cryptocurrencies analysis

https://github.com/OffcierCia/On-Chain-Investigations-Tools-List
https://github.com/aaarghhh/awesome_osint_criypto_web3_stuff
https://blocksherlock.com/home/blockchain-explorers
https://tronscan.org
https://etherscan.io
https://algoexplorer.io
https://explorer.solana.com
https://stellar.expert
https://snowtrace.io
https://flowscan.org
https://polygonscan.com

Some tools

https://github.com/demining/CryptoDeepTools
https://github.com/demining/bitcoindigger
https://github.com/demining/Dao-Exploit
https://github.com/immunefi-team/Web3-Security-Library/blob/main/Tools/README.md#blockchain-analysis

Private sector

https://chainalysis.com
https://elliptic.co
https://ciphertrace.com
https://coinmetrics.io
https://www.whitestream.io
https://ciphertrace.com
https://elementus.io
https://trmlabs.com
https://bitok.org/investigations

${\color{Red}\textbf{2.ACTIVE FORENSICS}}$

👷🛠️UNDER CONSTRUCTION🚧🏗

2.01 Police hacking

Visit our repo tree: 4.POLICE_HACKING

The Cyber Kill Chain

• MITRE ATT&CK — ICS Techniques
https://attack.mitre.org/techniques/ics

• MITRE ATT&CK — Mobile Techniques
https://attack.mitre.org/techniques/mobile/

• MITRE ATT&CK — Enterprise Techniques
https://attack.mitre.org/techniques/enterprise/

• Training

∙ Rootme — https://www.root-me.org
∙ Vulnhub — https://www.vulnhub.com
∙ Hacker101 — https://www.hacker101.com
∙ Crackmes — https://crackmes.one
∙ Attack Defense — https://attackdefense.com

• Some Cases

∙ Omerta Digital (FBI Honey Pot?)
https://www.omertadigital.com/
∙ Case: ANON (also stylized as AN0M or ΛNØM)
https://en.wikipedia.org/wiki/ANOM
https://www.vice.com/en/article/n7b4gg/anom-phone-arcaneos-fbi-backdoor
∙ Case: EncroChat
https://en.wikipedia.org/wiki/EncroChat
https://eucrim.eu/news/germany-federal-court-of-justice-confirms-use-of-evidence-in-encrochat-cases
https://xperylab.medium.com/the-dark-phones-encrochat-criminals-are-building-their-own-communication-system-474f3aeef759
∙ Case: Pegasus Spyware (NSO Group)
https://theintercept.com/2021/07/27/pegasus-nso-spyware-security
∙ Case: Verint
https://wikileaks.org/spyfiles/docs/VERINT_2012_AvneTurn_en.html
https://www.reddit.com/r/InfoSecNews/comments/sxxzju/leaktheanalyst_group_leak_critical_data_from/
∙ Case: Phantom Secure
https://en.wikipedia.org/wiki/Phantom_Secure
https://www.vice.com/en/article/v7m4pj/the-network-vincent-ramos-phantom-secure
∙ Case: Sky Global
https://en.wikipedia.org/wiki/Shutdown_of_Sky_Global
∙ Case: Bundestrojaner
https://en.wikipedia.org/wiki/Bundestrojaner
∙ Case: Magic Lantern
https://en.wikipedia.org/wiki/Magic_Lantern_(software)
https://github.com/bibanon/bibanon/blob/0b84bb23794c91c238a5601403898b61b5d193fc/Encyclopedia/History/Events/Pifts.md?plain=1#L125
∙ Case: Cryptophon
https://en.wikipedia.org/wiki/Tron_(hacker)#Cryptophon
∙ Planting Tiny Spy Chips in Hardware Can Cost as Little as $200
https://www.wired.com/story/plant-spy-chips-hardware-supermicro-cheap-proof-of-concept
∙ Installation of beacon implants
https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa-upgrade-factory-show-cisco-router-getting-implant
∙ The tricky issue of spyware with a badge: meet ‘policeware’
https://arstechnica.com/information-technology/2007/07/will-security-firms-avoid-detecting-government-spyware
∙ Analisi della normativa e della giurisprudenza sul captatore informatico e la spiegazione del Caso Exodus
https://www.dirittoconsenso.it/2021/11/11/captatore-informatico-trojan-di-stato
∙ LightEater Demo: Stealing GPG keys/emails in Tails via remote firmware infection
https://www.youtube.com/watch?v=sNYsfUNegEA
∙ KeyGrabber Forensic Keylogger
https://www.youtube.com/watch?v=6JJo8qCYE8M

2.02 Law Enforcement Agency (LEA)

• Rule of Law Benchmarks

*First of all, consult court cases to see how laws are (mis)applied.

• International Law

∙ UN — Library of Resources — https://www.unodc.org/e4j/en/resdb/index.html
∙ UN — https://www.unodc.org/elearning/en/courses/course-catalogue.html ∙ Budapest Convention — Cybercrime — https://www.coe.int/en/web/cybercrime/the-budapest-convention
∙ Octopus Project — https://coe.int/en/web/cybercrime/octopus-project
∙ Five Eyes — https://en.wikipedia.org/wiki/Five_Eyes

• Council of Europe — Cybercrime

∙ Cybercrime — https://www.coe.int/cybercrime
∙ GLACY+ — https://coe.int/en/web/cybercrime/glacyplus
∙ iPROCEEDS-2 — https://coe.int/en/web/cybercrime/iproceeds-2
∙ Octopus Project — https://coe.int/en/web/cybercrime/octopus-project
∙ CyberSouth — https://coe.int/en/web/cybercrime/cybersouth
∙ CyberEast — https://coe.int/en/web/cybercrime/cybereast

• Publications

Council of Europe – Cybercrime Digest and Cybercrime@CoE Update: a bi-weekly selection of news relevant to the current areas of interest to the Cybercrime Programme Office of CoE (C-PROC) and a quarterly review of the work carried out by the Cybercrime Convention Committee (T-CY).
Council of Europe – Cybercrime Newsletter: subscribe to receive the latest updates on the topic.
CERT-EU: access quarterly Threat Landscape Reports and monthly Cyber Security Briefs from the Computer Emergency Response Team for the EU institutions, bodies and agencies.
CEPOL – Publications: find the latest documents on trainings for law enforcement officials including the European Law Enforcement Research Bulletin.
ENISA Newsroom: follow the most recent news on cybersecurity.
ENISA Publications: sort the latest publications on cybersecurity by topic (and download copies).
EUROJUST Newsletter: news from the European Union Agency for Criminal Justice Cooperation.
European Commission’s DG HOME Newsletter: spotlight on Schengen and borders, internal security and relevant European funds.
Europol – Email alerts: ranging from news to upcoming publications and vacancies, choose what alerts to receive.
Organisation for Security and Co-operation in Europe (OSCE) Newsletter: hand-picked updates and in-depth information bundles on OSCE activities, with possibility to choose countries of interest.
SIRIUS project publications: co-implemented by Europol and Eurojust, in close partnership with the European Judicial Network, the SIRIUS project is a central reference point in the EU for knowledge sharing on cross-border access to electronic evidence and allows to download, among other publications, the yearly EU Digital Evidence Situation Report.

• Investigatory Powers — Criminal Law

Americas

∙ US — Federal Rules — Criminal Procedure — Overview — Link
∙ US — Federal Rules — Criminal Procedure — Rule 41 — Search and Seizure — Link

On a Network in a Single District	On a Network in Multiple Districts	On a Network with Data Stored Internationally	Unknown Where the Data is Stored (Cloud)
Search under Rule 41; consider noting in affidavit the possibility of other locations	Multiple search warrants for each district with data or §2703 Warrant served on service provider	Use legal process required in country hosting the data, or consider accessing data remotely with a search warrant under Rule 41	Search under Rule 41 for subject computers, and concurrently search under §2703 served on service provider

Union European

∙ UE — Criminal procedural laws across the European Union – A comparative analysis — Link
∙ UK — Crime, justice and law — Law and practice — Link
∙ UK — Public General Acts — Investigatory Powers Act 2016 — Link
∙ GE — German Criminal Code (Strafgesetzbuch — StGB) — Link
∙ GE — German Code of Criminal Procedure (Strafprozeßordnung — StPO) — Link

Court Cases

∙ US Federal Cases — https://pacer.uscourts.gov/find-case
∙ EUR-Lex https://eur-lex.europa.eu/homepage.html
∙ EU Common Portal of Case Law — https://network-presidents.eu/cpcl
∙ casetext (Thomson Reuters) - https://casetext.com
∙ UNODC — Case Law Database — https://sherloc.unodc.org/cld/v3/sherloc/cldb/index.html?lng=en
∙ UNODC — Cyber Organized Crime — https://www.unodc.org/e4j/en/cybercrime/module-13/additional-teaching-tools.html
∙ Council of Europe - COE Cybercrime - https://www.coe.int/en/web/cybercrime
∙ Council of Europe - Octopus Cybercrime Community - Materials - https://www.coe.int/en/web/octopus/training
∙ US Dod - Computer Crime and Intellectual Property Section (CCIPS) - https://www.justice.gov/criminal/criminal-ccips
∙ US FBI - Internet Crime Complaint Center (IC3) - https://www.ic3.gov
∙ Computer Crime Research Center - https://www.crime-research.org

The Five, Nine, & Fourteen Eyes surveillance alliance includes the following countries:


Countries	Five Eyes	Nine Eyes	Fourteen Eyes	Other
United Kingdom	✔️	✔️	✔️
United States	✔️	✔️	✔️
Australia	✔️	✔️	✔️
Canada	✔️	✔️	✔️
New Zealand	✔️	✔️	✔️
Denmark		✔️	✔️
Netherlands		✔️	✔️
France		✔️	✔️
Norway			✔️
Germany			✔️
Belgium			✔️
Spain			✔️
Sweden			✔️
Italy			✔️
Israel				✔️
Japan				✔️
Singapore				✔️
South Korea				✔️

"Apart from these methods of cooperation, there are a number of equally secretive bilateral and multilateral agreements in other regions of the globe – such as the Club of Berne (an intelligence-sharing arrangement among the EU intelligence services) and the Shanghai Cooperation Organizations (an affiliation among the People’s Republic of China (‘China’), India, Kazakhstan, Kyrgyzstan, Pakistan, the Russian Federation (‘Russia’), Tajikistan and Uzbekistan) – together with intelligence exchange arrangements within a group of states comprising Russia, Iraq, Iran and Syria to facilitate the fight against the Islamic State."

(Ref.: WATT, Eliza. State Sponsored Cyber Surveillance: The Right to Privacy of Communications and International Law. Edward Elgar Publishing, 2021.)

2.03 Liability for Contents

2.04 Tor Fingerprint

Tor Fingerprint

∙ TOR Fingerprinting — https://blog.torproject.org/browser-fingerprinting-introduction-and-challenges-ahead
∙ Attacks on Tor — https://github.com/Attacks-on-Tor/Attacks-on-Tor
∙ EFF Test — https://coveryourtracks.eff.org/learn

Hacker Cases

2.05 Forensics Footprints

Forensics Footprints

• https://github.com/PaulNorman01/Forensia

2.06 Supply Chain Attack

Supply Chain Attack

• https://reproducible-builds.org
• https://github.com/SAP/risk-explorer-for-software-supply-chains
• https://github.com/ossillate-inc/packj

2.07 APT & Cybercriminal Campagin Collections

APT & Cybercriminal Campagin Collections

• https://github.com/CyberMonitor/APT_CyberCriminal_Campagin_Collections

2.08 Man In The Middle (MitM)

Man In The Middle (MitM)

• https://github.com/frostbits-security/MITM-cheatsheet
• https://github.com/andreafortuna/MITMInjector
• https://github.com/KoreLogicSecurity/wmkick
• https://github.com/jakev/mitm-helper-wifi
• https://github.com/jakev/mitm-helper-vpn

2.09 Network Analysis (SIGINT)

Network Analysis

• Snort — https://github.com/snort3
• Wireshark — https://www.wireshark.org
• NMAP — https://nmap.org

Live System Based

Security Onion Network Security Toolkit

2.10 Metadata

Metadata

∙ ExifTool — https://github.com/exiftool/exiftool
∙ PhotoDNA — https://anishathalye.com/inverting-photodna
∙ Geo-tags — https://tool.geoimgr.com

2.11 Reverse Engineering

Reverse Engineering

https://github.com/alphaSeclab/awesome-reverse-engineering

Ghidra

https://ghidra-sre.org

2.12 Social Engineeringg (HUMINT)

Social Engineering

${\color{Yellow}\textbf{PHONE SNIFFING}}$

• DEFCON Safe Mode - Cooper Quintin - Detecting Fake 4G Base Stations in Real-Time https://www.youtube.com/watch?v=siCk4pGGcqA
• SRLabs - Warn you about threats like fake base stations (IMSI Catchers)
https://github.com/srlabs/snoopsnitch
• Android IMSI-Catcher Detector (suspended)
https://github.com/CellularPrivacy/Android-IMSI-Catcher-Detector
• Telecom Exploits - Signalling System 7 (SS7)
https://github.com/SigPloiter/SigPloit
• Telecom Exploits - HLR Lookups
https://github.com/SigPloiter/HLR-Lookups


NAME	MEANING
IMEI	International Mobile Equipment Identity
IMSI	International Mobile Subscriber Identity
MCC	Mobile Country Code
MNC	Mobile Network Code
MSIN	Mobile Subscription Identification Number
ICCID	Integrated Circuit Card Identifier
MSID	Mobile Station ID

GSM	Global System for Mobile Communications
SIM Card	Subscriber Identity Module Card
SMS	Short Message/Messaging Service
SDR	Software-Defined Radio

Useful Websites

— OpenCellID — Link
— Cell Tower Locator (Cell2GPS) — Link
— Cell Phone Trackers — Link
— International Numbering Plans — Link
— GSM World Coverage Map and GSM Country List — Link
— Imei Info — https://www.imei.info
— GSMArena Phones Ref.- https://www.gsmarena.com
— Phonescoop Phones Ref.- https://www.phonescoop.com
— Cell Towers — https://opencellid.org

Information & Explanations

— IMSI-catcher — Link
— GSM frequency bands — Link
— List of software-defined radios — Link

Useful Apps

— Mobile Software
— AIMSICD — Link
— SnoopSnitch — Link
— Desktop Software
— GsmEvil 2 — Link
— IMSI-catcher — Link

Equipment

GSM 900 / GSM 1800 MHz are used in most parts of the world: Europe, Asia, Australia, Middle East, Africa.
GSM 850 / GSM 1900 MHz are used in the United States, Canada, Mexico and most countries of S. America.

— SDR
— RTL-SDR (65MHz-2.3GHz) — Link
— Antenna
— Antenna — Link

Equipment

— Catching IMSI Catchers — Link

GSM Sniffing Install/Setup Guide

Install

$ sudo apt install python3-numpy python3-scipy python3-scapy gr-gsm
$ git clone https://github.com/Oros42/IMSI-catcher && cd IMSI-catcher
$ sudo grgsm_livemon && python3 simple_IMSI-catcher.py --sniff

GSM Install Error? Try this!

$ sudo apt-get install -y \
cmake \
autoconf \
libtool \
pkg-config \
build-essential \
docutils \
libcppunit-dev \
swig \
doxygen \
liblog4cpp5-dev \
gnuradio-dev \
gr-osmosdr \
libosmocore-dev \
liborc-0.4-dev \
swig

$ gnuradio-config-info -v

Tips

$ sudo grgsm_scanner -l  # List your SDR connected.
$ sudo grgsm_scanner     # Scan for cell towers near you.
$ sudo grgsm_livemon     # Live radio scanning.

${\color{Green}\textbf{BRUTE FORCE ATTACKS}}$

Brute Force Attacks

The speed at which your password is cracked depends on the entropy of your password and the power of the computer.

Computer programs used for brute force attacks can check anywhere from 10,000 to 1 billion passwords per second. A Pentium 100 can try 10.000 passwords a second. A supercomputer can try 1.000.000.000 per second.

Complex sheet:

Simplified sheet:

Types of brute force attacks

Simple Brute Force Attack

The attacker relies on trying out commonly used, weak passwords such as 123456, qwerty, admin, changeme, qazwsxedc etc.

Dictionary attack

Software that can make thousands of guesses every second using dictionary databases, hence the name of the attack.

Hybrid Brute Force Attack

A hybrid attack is utilized once the attacker already knows the username of its prey.

Reverse Brute Force Attack

A reverse brute force attack requires the attacker to know the password beforehand and then attempt to guess the username.

Credential stuffing

Hackers can get entire databases of stolen login credentials and then try to apply them to the account they’re trying to access. This kind of attack can be especially devastating if the attacked user reuses passwords across multiple accounts.

Rainbow Table Attack

A rainbow table attack is a method of password cracking that employs rainbow tables to break the password hashes in a database. Websites or apps don’t store passwords in plain text; instead, they encrypt passwords with hashes. Once the password is used for logging in, it is immediately converted to a hash. The next time the user logs in using their passwords, the server checks whether the password matches the previously created hash. If the two hashes match, the user is then authenticated. The tables used to store password hashes are known as rainbow tables.

Multi Factor Authenticator (MFA) or Two-factor Authenticator (2FA)

Set up MFA whenever possible, It's an extra layer of security that requires additional steps to verify the user's identity.

Encryption workarounds:

Find the key.
Guess the key.
Compel the key.
Exploit a flaw in the encryption software.
Access plaintext while the device is in use.
Locate another plaintext copy.

Sites of Interest

https://www.cve.org
https://www.cvedetails.com
https://www.openwall.com
https://www.lkrg.org
https://www.attack.mitre.org
https://www.exterro.com
https://www.forensicfocus.com
https://www.forensicscijournal.com
https://www.hackthebox.com
https://www.hackerone
https://www.hackread.com
https://www.htcia.org
https://www.osforensics.com
https://www.magnetforensics.com
FTK Lite
SSAC Publications
Botnets as a Vehicle for Online Crime — CERT
Security Audit
SANS Institute
Internet Storm Center — SANS Institute
COAST Hotlist: Computer Security, Law and Privacy — CERIAS, Purdue University

General Publications

• CVE Alerting Platform
https://github.com/opencve/opencve
• The Hacker News — Newsletter
https://thehackernews.com/#email-outer
• Forensic Focus — Newsletter
https://www.forensicfocus.com
• SANS Institute — Newsletter
https://www.sans.org>
• Google Scholar — Alerts
osgeolive-doc-readthedocs-io-en-stable https://scholar.google.com/scholar_alerts?view_op=list_alerts&hl=en-US
• Secure List
https://securelist.com • Debian Security Announce
https://lists.debian.org/debian-security-announce • Wired News
https://www.wired.com
• ZDnet
https://www.zdnet.com
• Cert Coordination Center
https://www.cert.org
• DoD Instructions Cybersecurity
https://www.esd.whs.mil/dd/
• Computer World
https://computerworld.com
• InfoWorld
https://www.infoworld.com
• InformationWeek
https://www.informationweek.com
• Sophos
https://sophos.com
• TechWorld
https://www.techworld.com
• Infosec Institute
https://resources.infosecinstitute.com
• Government Executive Magazine
https://govexec.com
• E Security Planet
https://www.esecurityplanet.com
• Help Net Security
https://www.helpnetsecurity.com
• Information Security Magazine
https://searchsecurity.techtarget.com
• Network World Fusion
https://www.nwfusion.com
• Federal Computer Week Security News
https://fcw.com/Home.aspx
• Government Computer News IT Security
https://gcn.com/Home.aspx
• IA Technology Analysis Center
https://iac.dtic.mil/csiac
• Overseas Security Advisory Council
https://www.osac.gov
• SANS Internet Storm Center
https://isc.sans.edu
• Search Security
https://searchsecurity.techtarget.com
• News Factor
https://www.newsfactor.com
• Security Focus
https://www.securityfocus.com/news
• New Scientist
https://www.newscientist.com/section/news
• Silicon Valley
https://www.siliconvalley.com
• USA Today
https://www.usatoday.com/tech
• Reuters
https://www.reuters.com/news/technology
• TechWeb
https://www.techweb.com

Forensic Publications

• Make a Google Scholar search from an interesting subject that you want to follow up on.

• Search paramters example:

police hacking intext:ilegal intext:abusive intext:law

• You could set keywords alerts: https://scholar.google.com/scholar_alerts?view_op=list_alerts

• Science Direct — Forensic Science International: Digital Investigation
https://www.sciencedirect.com/journal/forensic-science-international-digital-investigation
• Science Direct — Computer Law & Security Review
https://www.sciencedirect.com/journal/computer-law-and-security-review
• Forensic Science — Application of science to criminal and civil laws
https://www.forensicscijournal.com
• University of London - SAS Open Journals - Digital Evidence and Electronic Signature Law Review
https://journals.sas.ac.uk/deeslr/
• IEEE Intelligence and Security Informatics (IEEE-ISI)
https://ieee-isi.org
• USENIX Conferences
https://www.usenix.org/conferences
• International Journal of Intelligence and CounterIntelligence
https://www.tandfonline.com/journals/ujic20
• Information Security Journal: A Global Perspective
https://www.tandfonline.com/journals/uiss20
• Policing and Society — An International Journal of Research and Policy
https://www.tandfonline.com/journals/gpas20
• Police Practice and Research — An International Journal
https://www.tandfonline.com/journals/gppr20
• Journal of Applied Security Research
https://www.tandfonline.com/journals/wasr20
• Information Systems Security
https://www.tandfonline.com/journals/uiss19
• Journal of Computer Information Systems
https://www.tandfonline.com/journals/ucis20
• Australian Journal of Forensic Sciences
https://www.tandfonline.com/journals/tajf20
• Advancing Technology, Research and Collaboration
https://www.acm.org/conferences
• The APWG Symposium on Electronic Crime Research (APWG eCrime)
https://ecrimeresearch.org
• Communications in Computer and Information Science — Springer
https://www.springer.com/series/7899

Intelligence, Conflict, and Warfare Publications

• Taylor & Francis - Intelligence and National Security - Open access articles
https://www.tandfonline.com/action/showOpenAccess?journalCode=fint20
• The Journal of Intelligence, Conflict, and Warfare
https://journals.lib.sfu.ca/index.php/jicw/issue/archive
• CIA.gov - Center for the study of intelligence
https://www.cia.gov/resources/csi/studies-in-intelligence
• DCAF - Geneva Centre for Security Sector Governance
https://www.dcaf.ch/resources?type=publications
• E-International Relations - Open access scholarly books
https://www.e-ir.info/publications
• Springer Open
https://www.springeropen.com
• RIEAS
https://rieas.gr

Law Publications

• Necessary and Proportionate - https://www.necessaryandproportionate.org
• Privacy International - https://www.privacyinternational.org
• EFF - https://www.eff.org
• EPIC - https://epic.org/issues/surveillance-oversight
• Citizenlab - https://citizenlab.ca
• Bugged Planet - http://buggedplanet.info • BBW - https://bigbrotherwatch.org.uk
• Bad Internet Bills - https://www.badinternetbills.com
• Software Freedom Law Center - https://softwarefreedom.org
• UN Internet Governance Forum - https://www.intgovforum.org
• The IT Law Wiki - https://itlaw.fandom.com
• Computer Crime Research Center - https://www.crime-research.org
• Internet Crime Complaint Center (IC3) - https://www.ic3.gov/Home/AnnualReports
• ETSI - https://www.etsi.org/committees
• The Bureau of Investigative Journalism - https://www.thebureauinvestigates.com
https://www.fbi.gov
https://www.justice.gov/news
https://www.justice.gov/criminal/cybercrime
https://www.coe.int/en/web/cybercrime
https://www.sherloc.unodc.org
https://www.enisa.europa.eu
https://csrc.nist.gov
https://openyls.law.yale.edu
https://scholarship.law.duke.edu
https://law.utexas.edu/transnational/foreign-law-translations
https://www.computerweekly.com
https://www.vice.com/en/section/tech
https://copsincyberspace.wordpress.com

YouTube Conferences

Others

• Computer Incident Response Center for Civil Society - https://www.civicert.org
https://eforensicsmag.com
https://0x00sec.org
https://csrc.nist.gov/projects
https://www.cisa.gov/news-events/cybersecurity-advisories
https://www.nsa.gov/Press-Room/Press-Releases-Statements
https://www.nsa.gov/ia/mitigation_guidance/security_configuration_guides/index.shtml
https://malware.lu
https://securelist.com
https://oval.mitre.org
https://www.w3.org/Security/Faq/www-security-faq.html
https://www.nowsecure.com
https://www.htcia.org
https://www.reddit.com/r/InfoSecNews
https://www.reddit.com/r/digitalforensics
https://www.reddit.com/r/computerforensics
https://www.reddit.com/r/antiforensics
https://www.reddit.com/r/Smartphoneforensics
https://github.com/yeahhub/Hacking-Security-Ebooks
https://github.com/InfoSecIITR/reading-material

REFERENCES

https://dfrws.org/presentation
https://issworldtraining.com
https://sciencedirect.com/journal/forensic-science-international-digital-investigation
https://sciencedirect.com/journal/computer-law-and-security-review
https://github.com/MISP/misp-training
https://github.com/ail-project/ail-training
https://isc2.org/Certifications/CISSP
https://github.com/connectans/awesome-CISSP-CCSP
https://github.com/jefferywmoore/CISSP-Study-Resources
https://github.com/Syslifters/OffSec-Reporting
https://attack.mitre.org
https://forensicfocus.com
https://ecrimeresearch.org
https://drivebadger.com
https://cellebritelearningcenter.com
https://public.cyber.mil

Back to Top ⬆

Made with ♥

Name		Name	Last commit message	Last commit date
.data		.data
1.TOP_SECRET		1.TOP_SECRET
2.FORENSIC		2.FORENSIC
3.DOCUMENTS		3.DOCUMENTS
4.POLICE_HACKING		4.POLICE_HACKING
5.LAW		5.LAW
6.BUSSINES_MODEL		6.BUSSINES_MODEL
7.OTHERS		7.OTHERS
README.md		README.md

Latest commit

History

Folders and files

Repository files navigation

DIGITAL FORENSICS AND INCIDENT RESPONSE (DFIR)

"These programs were never about terrorism: they're about economic spying, social control and diplomatic manipulation. They're about power." (Edward Snowden)

BASIC STRATEGY

FORENSIC SUITES

FORENSIC TOOLS

• Evidence ProjectForensics Tools Catalogue - https://www.dftoolscatalogue.eu

• NIST - Forensics Tools Catalogue - https://toolcatalog.nist.gov

INTERCEPTION PLATFORMS

Exploit and Spyware Vendor

NATIONAL CYBER SECURITY AGENCIES

Visit: https://www.nist.gov/standards

Visit: https://www.iso27001security.com

Official - Information security, cybersecurity and privacy protection — https://www.iso.org/standard/27001

NIST - https://toolcatalog.nist.gov

S&T partners and NIST - Computer Forensic Tool Testing (CFTT) - https://www.dhs.gov/science-and-technology/nist-cftt-reports

Some tools

Extraction Methods

Encryption Workrounds

Bruteforce

Cryptanalysis

Steganography

Volatile memory analysis

JTag, Chip-off and ISP forensics

Researching support for phones in JTAG software

Cryptocurrencies analysis

Some tools

Private sector

The Cyber Kill Chain

• Training

• Some Cases

• Rule of Law Benchmarks

• International Law

• Council of Europe — Cybercrime

• Publications

• Investigatory Powers — Criminal Law

Americas

Union European

Court Cases

The Five, Nine, & Fourteen Eyes surveillance alliance includes the following countries:

Tor Fingerprint

Hacker Cases

Forensics Footprints

Supply Chain Attack

APT & Cybercriminal Campagin Collections

Man In The Middle (MitM)

Network Analysis

Metadata

Reverse Engineering

Ghidra

Social Engineering

Useful Websites

Information & Explanations

Useful Apps

Equipment

Equipment

GSM Sniffing Install/Setup Guide

Install

GSM Install Error? Try this!

Tips

Brute Force Attacks

Types of brute force attacks

Simple Brute Force Attack

Dictionary attack

Hybrid Brute Force Attack

Reverse Brute Force Attack

Credential stuffing

Rainbow Table Attack

Multi Factor Authenticator (MFA) or Two-factor Authenticator (2FA)

REFERENCES

About

Resources

Stars

Watchers

Forks

Releases

Packages