Analysis with Wireshark
TShark VS. Wireshark (Terminal vs. GUI) TShark is a purpose-built terminal tool based on Wireshark. TShark shares many of the same features that are included in Wireshark and even shares…
Incident Report Template
Elements of an incident report Source: Hack The Box Incident Report Template
Code Obfuscation and Deobfuscation
Code Obfuscation is a technique used to make a script more difficult to read by humans but allows it to function the same from a technical point of view, though…
Wireshark 101 | Traffic Analysis and Investigation (PART 02)
Identifying Hosts When investigating a compromise or malware infection activity, a security analyst should know how to identify the hosts on the network apart from IP to MAC address match.…
Posted inThreat Hunting Threat Intelligence
Threat Intelligence
Threat Intelligence Foundation: Threat Intelligence is the analysis of data and information using tools and techniques to generate meaningful patterns on how to mitigate against potential risks associated with existing…
Wireshark 101 | Traffic Analysis and Investigation (PART 03)
Investigate Tunnelling Traffic: ICMP and DNS Traffic tunnelling is (also known as "port forwarding") transferring the data/resources in a secure method to network segments and zones. It can be used for "internet…
Wireshark 101 | Traffic Analysis and Investigation (PART 04)
Encrypted Protocol Analysis: Decrypting HTTPS When investigating web traffic, analysts often run across encrypted traffic. This is caused by using the Hypertext Transfer Protocol Secure (HTTPS) protocol for enhanced security…