Misc Operations and Incident Response Flashcards
Metasploit
Exploitation Framework
Cuckoo
Malware-testing sandbox
theHarvester
open source intelligence gathering tool
Nessus
Vulnerability scanner
netstat -a
Can show all active connections in windows, using the -a flag
hping
A packet generator and analyzer. A packet analyzer and packet building tool often used to craft specific packets as part of penetration tests and attacks.
Nessus
A popular vulnerability scanning tool - can also scan ports and identify open ports
curl
The curl command-line tool supports downloads and uploads from a wide variety of services
nmap
port scanner
route
a command-line tool to view and add network traffic routes
netstat
a command-line tool that shows network connections, interface statistics, and other useful information about a system’s network usage. does not incorporate automatic service identification
memdump
a command-line memory dump utility that can dump physical memory - Linux
exiftool
metadata-retrieval tool
sn1per
A pen test framework. Can conduct a port scan and recognize open ports
FTK Imager
a free tool that can image both systems and memory
dd
Used to image drives. useful for capturing disks, not really for memory dumps.
Autopsy
A forensic tool for drive analysis and forensic investigations. A forensic analysis tool and does not provide its own imaging tools
Strings
command-line tool that retrieves strings from binary data
Scanless
a tool described as a port scraper, which retrieves port information without running a port scan by using websites and services to run the scan for you
WinHex
Disk Editor
Logger
a Linux utility that will add information to the Linux syslog. It can accept file input, write to the system journal entry, send to remote syslog servers, and perform a variety of other functions
tcpreplay
The tcpreplay tool is specifically designed to allow PCAP capture files to be replayed to a network, allowing exactly this type of testing
tcpdump
Used to capture packets
The Volatility framework
a purpose-built tool for the acquisition of random access memory (RAM) from a live system
Netcat
a tool used to transfer data or to make connections to systems across a network
journalctl
used to query the systemd journal. On systemd-enabled Linux distributions, the journal contains kernel and boot messages as well as syslog messages and messages from services
