Канал: Ali Hadi

Basic User Behavior Simulation

Basic User Behavior Simulation

Fileless Malware Simulation

Fileless Malware Simulation

Simulation of the ShrinkLocker Ransomware using BitLocker

Simulation of the ShrinkLocker Ransomware using BitLocker

Installing Velociraptor - Windows Client

Installing Velociraptor - Windows Client

Installing Velociraptor - Server Config Files

Installing Velociraptor - Server Config Files

Installing Velociraptor - Installing Server Package

Installing Velociraptor - Installing Server Package

Overview of Installing log2timeline and using Timesketch

Overview of Installing log2timeline and using Timesketch

Working with log2timeline and Timesketch

Working with log2timeline and Timesketch

Installing Sysmon and Elastic Agents (Security Onion)

Installing Sysmon and Elastic Agents (Security Onion)

Security Onion 2.4 Standalone Setup

Security Onion 2.4 Standalone Setup

Ransomware Simulation - Scenario #3

Ransomware Simulation - Scenario #3

Ransomware Simulation - Scenario #2

Ransomware Simulation - Scenario #2

Ransomware Simulation - Scenario #1

Ransomware Simulation - Scenario #1

New PowerShell Plugin - Adversary Simulation

New PowerShell Plugin - Adversary Simulation

Fixing a Corrupted MBR Drive - Case #1

Fixing a Corrupted MBR Drive - Case #1

Fixing a Corrupted GPT Drive - Case #3

Fixing a Corrupted GPT Drive - Case #3

Fixing a Corrupted GPT Drive - Case #2

Fixing a Corrupted GPT Drive - Case #2

Fixing a Corrupted GPT Drive - Case #1

Fixing a Corrupted GPT Drive - Case #1

Run Key Mystery - Did the Program Truly Run or Not?

Run Key Mystery - Did the Program Truly Run or Not?

Parsing Multiple Registry Hives using VSCToolset and RegRipper

Parsing Multiple Registry Hives using VSCToolset and RegRipper

Parsing Run Keys using RegRipper

Parsing Run Keys using RegRipper

Grouping Agents

Grouping Agents

C5W Agent Peer2Peer Capability

C5W Agent Peer2Peer Capability

Demo of the Code Injection Plugin

Demo of the Code Injection Plugin

Unloading the RansomCare Plugin at Runtime.

Unloading the RansomCare Plugin at Runtime.

Adding Custom HTTP Headers.

Adding Custom HTTP Headers.

Loading and Unloading RansomCare over DNS

Loading and Unloading RansomCare over DNS

LNK File Testing and New Findings (Discussion)

LNK File Testing and New Findings (Discussion)

Reading NTFS Dataruns

Reading NTFS Dataruns

MFT Slack Space Discussion (No longer There)!

MFT Slack Space Discussion (No longer There)!

Comparison between Loading a Dirty and Clean Windows.edb using WinSearchDBAnalyzer

Comparison between Loading a Dirty and Clean Windows.edb using WinSearchDBAnalyzer

Fixing Windows edb and using WinSearchDBAnalyzer

Fixing Windows edb and using WinSearchDBAnalyzer

Fixing and Loading a Corrupted GPT Drive

Fixing and Loading a Corrupted GPT Drive

Fixing and Loading a Corrupted MBR Drive

Fixing and Loading a Corrupted MBR Drive

41-Reviewing 010 Template for PE File Format & How RVA to FOA is Calculated

41-Reviewing 010 Template for PE File Format & How RVA to FOA is Calculated

40-Working with 010 Templates - PE File (Part #12)

40-Working with 010 Templates - PE File (Part #12)

39-Working with 010 Templates - PE File (Part #11)

39-Working with 010 Templates - PE File (Part #11)

38-Working with 010 Templates - PE File (Part #10)

38-Working with 010 Templates - PE File (Part #10)

37-Working with 010 Templates - PE File (Part #9)

37-Working with 010 Templates - PE File (Part #9)

36-Working with 010 Templates - PE File (Part #8)

36-Working with 010 Templates - PE File (Part #8)

35-Working with 010 Templates - PE File (Part #7)

35-Working with 010 Templates - PE File (Part #7)

34-Working with 010 Templates - PE File (Part #6)

34-Working with 010 Templates - PE File (Part #6)

33-Working with 010 Templates - PE File (Part #5)

33-Working with 010 Templates - PE File (Part #5)

32-Working with 010 Templates - PE File (Part #4)

32-Working with 010 Templates - PE File (Part #4)

31-Working with 010 Templates - PE File (Part #3)

31-Working with 010 Templates - PE File (Part #3)

30- Working with 010 Templates - PE File (Part #2)

30- Working with 010 Templates - PE File (Part #2)

29- Working with 010 Templates - PE File (Part #1)

29- Working with 010 Templates - PE File (Part #1)

Tracing Windows APIs using Tiny_Tracer

Tracing Windows APIs using Tiny_Tracer

Writing Yara Rules - Part #2

Writing Yara Rules - Part #2

IOCs and Yara - Part #1

IOCs and Yara - Part #1

More Yara Rules - Part #3

More Yara Rules - Part #3

28- Templates (Part 2) and File Signatures

28- Templates (Part 2) and File Signatures

27- Templates (Part 1)

27- Templates (Part 1)

26- Inspector (Interpreter Part 2)

26- Inspector (Interpreter Part 2)

25- Inspector (Interpreting Data)

25- Inspector (Interpreting Data)

1- The 010 Editor, Let us start

1- The 010 Editor, Let us start

20-Using EggHunters on Windows 10

20-Using EggHunters on Windows 10

19-SEH Exploitation Case Study #2 and Howto Jump Backwards in Memory

19-SEH Exploitation Case Study #2 and Howto Jump Backwards in Memory

17-Finding Badchars Manually

17-Finding Badchars Manually

18-Finding Badchars using mona

18-Finding Badchars using mona

Creating a GPG Key and using Gpg4win to Send Secret Messages

Creating a GPG Key and using Gpg4win to Send Secret Messages

16-Stack Guards (aka Stack Cookies) and HowTo Bypass them using SEH

16-Stack Guards (aka Stack Cookies) and HowTo Bypass them using SEH

15-Intro to SEH Exploitation with VS Studio Compilation Examples

15-Intro to SEH Exploitation with VS Studio Compilation Examples

14-Client Side Exploitation using Evil Server, No JMP ESP, and NULL Bytes

14-Client Side Exploitation using Evil Server, No JMP ESP, and NULL Bytes

13-Exploiting Ultra Mini HTTPd Webserver

13-Exploiting Ultra Mini HTTPd Webserver

12-Exploitation Methods and Exploiting VUPlayer

12-Exploitation Methods and Exploiting VUPlayer

11-Exploiting Test2.exe and Calculating Offset to Return Address

11-Exploiting Test2.exe and Calculating Offset to Return Address

26-Removing Badchars from Any Payload (e.g. win-exec-calc-shellcode)

26-Removing Badchars from Any Payload (e.g. win-exec-calc-shellcode)

10-Removing Badchars from Any Payload (e.g. win-exec-calc-shellcode) - P2

10-Removing Badchars from Any Payload (e.g. win-exec-calc-shellcode) - P2

10-Removing Badchars from Any Payload (e.g. win-exec-calc-shellcode)

10-Removing Badchars from Any Payload (e.g. win-exec-calc-shellcode)

9-Exploiting Test.exe

9-Exploiting Test.exe

8-Corrupting Test.exe Memory

8-Corrupting Test.exe Memory

7-Debugging Test.exe

7-Debugging Test.exe

6-Intro to Software Exploitation (Memory Land Part #3)

6-Intro to Software Exploitation (Memory Land Part #3)

5-Intro to Software Exploitation (Memory Land Part #2)

5-Intro to Software Exploitation (Memory Land Part #2)

4-Intro to Software Exploitation (Memory Land Part #1)

4-Intro to Software Exploitation (Memory Land Part #1)

Investigating Windows Scheduled Tasks used by Ransomware

Investigating Windows Scheduled Tasks used by Ransomware

Download and Run LNK File

Download and Run LNK File

Learning about .NET Malware by Going Over the SUNBURST SolarWinds Backdoor

Learning about .NET Malware by Going Over the SUNBURST SolarWinds Backdoor

Howto Install and Configure Zeek to Ship Logs to Splunk

Howto Install and Configure Zeek to Ship Logs to Splunk

How Process Hacker Can Easily Detect a Malware Installing a Windows Service

How Process Hacker Can Easily Detect a Malware Installing a Windows Service

25-SEH Buffer Overflow Case Study #2

25-SEH Buffer Overflow Case Study #2

3-Bug hunting (intro)

3-Bug hunting (intro)

24-Modifying Backward Jump (Bonus)

24-Modifying Backward Jump (Bonus)

23-SEH Vulnserver Case Study - (Part 3)

23-SEH Vulnserver Case Study - (Part 3)

22-SEH Vulnserver Case Study - (Part 2)

22-SEH Vulnserver Case Study - (Part 2)

21-SEH Vulnserver Case Study - (Part 1)

21-SEH Vulnserver Case Study - (Part 1)

2-Intro to PE File Format

2-Intro to PE File Format

1-Introduction to the Offensive Software Exploitation Course

1-Introduction to the Offensive Software Exploitation Course

20-Memory Jumping Strategies

20-Memory Jumping Strategies

19-Exploit Mitigation Part-1 (Theory)

19-Exploit Mitigation Part-1 (Theory)

18-Finding and Eliminating Badchars

18-Finding and Eliminating Badchars

17-Client Side Buffer Overflow Case #2

17-Client Side Buffer Overflow Case #2

16-Client Side Buffer Overflow

16-Client Side Buffer Overflow

15-Client Side Attacks Theory

15-Client Side Attacks Theory

14-Exploiting Vulnserver (Case1)

14-Exploiting Vulnserver (Case1)

13-Fuzzing Vulnserver using SPIKE (Case1)

13-Fuzzing Vulnserver using SPIKE (Case1)

12-Fuzzing and Exploitation Determination

12-Fuzzing and Exploitation Determination

11-Monitoring Test.exe and Dumping its Memory using Procdump

11-Monitoring Test.exe and Dumping its Memory using Procdump

10-Exploiting Test.exe

10-Exploiting Test.exe

9-Corrupting the Stack and Controlling EIP

9-Corrupting the Stack and Controlling EIP

8-Debugging Test.exe

8-Debugging Test.exe

7-Debugging Intro Lab

7-Debugging Intro Lab

6-Debugging (theory)

6-Debugging (theory)

5-Intro to Software Exploitation

5-Intro to Software Exploitation

4-Intro to Software Exploitation

4-Intro to Software Exploitation

3-Intro to Software Exploitation

3-Intro to Software Exploitation

OS Importance 4 Cybersecurity and DFIR (AR)

OS Importance 4 Cybersecurity and DFIR (AR)

OS Importance 4 Cybersecurity and DFIR (EN)

OS Importance 4 Cybersecurity and DFIR (EN)

2-Bug hunting

2-Bug hunting

1-PE File Format Basics and others

1-PE File Format Basics and others