SANS Digital Forensics and Incident Response Blog: Category - Computer Forensics

Client-side Web Application Attacks

Over the past few years, attacks against web applications have become more prevalent and sophisticated. There are several methods of attacking web applications, SQL injection being one of the more well-known. In this article, we are going to discuss a different class of attacks and a few examples of how an incident responder or computer forensic investigator might spot them.

All web forms contain fields that are used to grab input from a user and post it to the server for processing. Form fields are commonly used to collect information, from transaction details on e commerce sites to authentication credentials for restricted content. While form fields are used to collect data legitimately from users, they can also be used maliciously.

An example of this is a client side attack commonly known as form field injection. In this type of attack, malware interacting in a web browser adds additional form fields to

...


Finer Points of Find

The *NIX "find" command is probably one of the system security tester's best friends on any *NIX system. This command allows the system security tester or digital forensic analyst to process a set of files and/or directories in a file subtree. In particular, the command has the capability to search based on the following parameters:

  • where to search (which pathname and the subtree)
  • what category of file to search for (use "-type" to select directories, data files, links)
  • how to process the files (use "-exec" to run a process against a selected file)
  • the name of the file(s) (the "-name" parameter)
  • perform logical operations on selections (the "-o" and "-a" parameters)

One of the key problems associated with the "find" command is that it can be difficult to use. Many experienced professionals with years of hands-on experience on *NIX systems still find this command to be tricky. Adding

... Continue reading Finer Points of Find


The Chain of Custody for 2010-03-21 - Weekly Tweets

  • The Chain of Custody for 2010-03-14 - Weekly Tweets http://bit.ly/b9IDMg #
  • Digital Forensics Magazine Promote Global Survey Into Forensics Tools- Digital Forensics Magazine is urging its rea... http://bit.ly/9TRgp5 #
  • Police launch new high-tech mobile phone unit in Kent, UK- Sim card specialists will aid the technological tussle w... http://bit.ly/bXvkxI #
  • Finding out about other users on a Linux system http://bit.ly/8Ya32c

Digital Forensics Case Leads: Tools and Lists, Bugs, and Web 2.0 for Packet Ninjas

A variety of items this week, including news of the first successful prosecution using memory forensics, several tool updates, a Web 2.0 site for packet ninjas, bugs (the tiny biological kind) for forensics, and even forensics for mortgage refinancing. I've included Twitter handles in the form (@TwitterHandle) where applicable.

Tools:

  • Tableau (@tableauforensic), maker of write-blocker and duplicating hardware and software, has initiated a video series to update viewers on info about their products and items of general interest. The first entry concerns their firmware update tool. The Tableau T35e write blocker is provided as part of the

Nokia n900 mobile forensic cheat sheet

Nokia N900
Shadowed by coverage of all things Nexus and iPad, Nokia's new n900 is the unsung hero of the smart phone world. That's just fine for folks like DT and HD and anyone else looking for a *phone* that runs nmap, aircrack, metasploit and wireshark. Future functionality includes backtrack itself packaged as neopwn v2!

Cutting to the chase then this is a quickie cheat sheet about forensic artifacts on the n900 and where to find

...