B3 Common Tools

Question 1

tcpdump

Answer 1

Built into most linux distro. Lightweight, can be scripted packet capture. Can be scripted.

Question 2

Wireshark

Answer 2

most popular, graphical. can struggle with large data and command line tshark may be needed

Question 3

networkminer

Answer 3

graphical, multi platform. focus on network hosts ratehr than traffic.

Question 4

Microsoft message analyser

Answer 4

used to troubleshoot network problems, 
can capute, view and analyse network data
deciphers network protocols
can import log and trace files
can do charts and timelines

Question 5

FTK Imager Lite

Answer 5

free
can image disks
can image memory
can image pagefile

Question 6

Volatility

Answer 6

free
supports 32 and 64 bit systems
acquires and analyses live system memory
uses python

Question 7

Memoryze

Answer 7

Mandiant’s
Memoryze is free memory forensics software that helps incident responders ‘find evil’ in live
memory. Memoryze can acquire and/or analyze memory images, and on live systems, can include the
paging file in its analysis.
It can image the full range of system memory; or a process’ entire address space, including any loaded
DLLs, EXEs, heaps and stacks.
It can also enumerate all running processes and identify all drivers loaded in memory, even those hidden
by rootkits, along with many other functions.

Question 8

systeminfo

Answer 8

windows command. first to use.

• operating system
• hardware
• network

Question 9

net user

Answer 9

list all local user accounts on the system

Question 10

net group

Answer 10

list groups on a server

Question 11

ipconfig /all

Answer 11

network connections

Question 12

netstat -aon

Answer 12

list active connections
flags
a displays all connections and listening ports
o displays the owning process id
n displays addresses and port numbers in numeroical form

f would displays FQDN so would query DNS. On an attacked system can you trust that the TA does not own the DNS server?

Question 13

tasklist

Answer 13

list the current processes

Question 14

autoruns

Answer 14

part of sysinternals from microsoft
show programs, services and drivers that start up during system boot
can hid standard windows processes to conecntrate on 3rd party

Question 15

OpenedFilesView

Answer 15

displays list of files currently open on a system. shows filename, filepath, process name, file size, MAC times

Question 16

windows registry

Answer 16

acquire using FTK

examine using registry browser by lockandcode.com

Question 17

windows password locations

Answer 17

SAM and SYSTEM files from within registry. Then use Ophcrack

Question 18

sleuth kit

Answer 18

can parse images of windows, linux nad mac systems. free. can have autopsy over the top for graphical view. log2timeline as well.