blog.didierstevens.com
MS15-034 Detection: Some Observations | Didier Stevens
https://blog.didierstevens.com/2015/04/17/ms15-034-detection-some-observations
Friday 17 April 2015. MS15-034 Detection: Some Observations. 8212; Didier Stevens @ 9:15. Several detection rules (SNORT, F5, …) are being published these days to detect exploitation of vulnerability MS15-034. If you are making or modifying such detection rules, I want to share some observations with you. MS15-034 can be exploited with a GET request with a specially crafted Range header. Here is the example we’ll use: Range: bytes=2-18446744073709551615. Referring to RFC 2616. If you are using rules that...
blog.didierstevens.com
MS15-034: PoC Excel Video | Didier Stevens
https://blog.didierstevens.com/2015/04/23/ms15-034-poc-excel-video
Thursday 23 April 2015. MS15-034: PoC Excel Video. 8212; Didier Stevens @ 19:31. Since I like to hack with Excel, I made a PoC for MS15-034 in VBA/Excel. PS: If you want to see my videos as soon as they are published, subscribe to my video blog videos.DidierStevens.com. Here’s the video:. Leave a Comment ». Feed for comments on this post. Leave a Reply (comments are moderated) Cancel reply. Enter your comment here. Fill in your details below or click an icon to log in:. Email (Address never made public).
blog.didierstevens.com
Free Malicious PDF Analysis E-book | Didier Stevens
https://blog.didierstevens.com/2010/09/26/free-malicious-pdf-analysis-e-book
Sunday 26 September 2010. Free Malicious PDF Analysis E-book. 8212; Didier Stevens @ 8:41. The title says it all…. This is a document. I shared with my Brucon workshop attendees. I know, this is a PDF document, you’ve to appreciate the irony😉. 53 Comments ». Why not host a unzipped pdf with a docs.google.com/viewer? 8212; Sunday 26 September 2010 @ 9:05. WndSks I’m old school. Comment by Didier Stevens. 8212; Sunday 26 September 2010 @ 9:16. Comment by Didier Stevens. Any easter eggs in the PDF? Another...
blog.didierstevens.com
Quickpost: Metasploit User Agent Strings | Didier Stevens
https://blog.didierstevens.com/2015/03/16/quickpost-metasploit-user-agent-strings
Monday 16 March 2015. Quickpost: Metasploit User Agent Strings. 8212; Didier Stevens @ 0:00. I searched through the Metasploit source code for User Agent Strings (starting with Mozilla/). This is what I found:. 7 Comments ». Are lines 5 and 7 truncated? Comment by Drew Hunt. 8212; Monday 16 March 2015 @ 14:11. Here are my finds for comparison:. Mozilla/4.0 (compatible; BullsEye; Windows 95). Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0). Mozilla/5.0 (Macintosh; Intel Mac OS X 10 7 3) AppleWebKit...
blog.didierstevens.com
Network Appliance Forensic Toolkit | Didier Stevens
https://blog.didierstevens.com/programs/network-appliance-forensic-toolkit
Network Appliance Forensic Toolkit. The Network Appliance Forensic Toolkit will grow to a set of tools to help with forensics of network appliances. Published in ISSA Journal December 2012. Here is a demo video:. NAFT V0 0 9.zip. When using YARA, option decoders can be used to decode the content of the blocks. Decords are Python programs like decoder add1, decoder rol1 and decoder xor1. Naft-icd.py -y IOS canary.yara –decoders decoder xor1 heap r870-core. YARA rule: IOS canary. 8230;….E. Command processe...
blog.didierstevens.com
Detecting Network Traffic from Metasploit’s Meterpreter Reverse HTTP Module | Didier Stevens
https://blog.didierstevens.com/2015/05/11/detecting-network-traffic-from-metasploits-meterpreter-reverse-http-module
Monday 11 May 2015. Detecting Network Traffic from Metasploit’s Meterpreter Reverse HTTP Module. 8212; Didier Stevens @ 5:52. I teach a Wireshark class. I took a closer look at Metasploit’s Meterpreter network traffic when reverse http mode is used. The Meterpreter client will make regular HTTP requests to the Metasploit server to check if it has commands ready to be executed. This is how a request looks like:. I’ve tested the detection of Metasploit Meterpreter traffic with this User Agent String ...
blog.didierstevens.com
TCP Flags for Wireshark | Didier Stevens
https://blog.didierstevens.com/2014/04/28/tcp-flags-for-wireshark
Monday 28 April 2014. TCP Flags for Wireshark. Filed under: My Software. 8212; Didier Stevens @ 20:03. This is a topic I’m teaching in my “Packet Class: Wireshark” training in Amsterdam. You can configure Wireshark to display TCP flags like Snort does. One way to do this, is to create a post-dissector and then add a column with its output (like in the screenshot above). I developed a Wireshark Lua dissector generator. You provide it some definitions, like this:. Wireshark-lua-dissectors V0 0 3.zip. Chris...
blog.didierstevens.com
Wireshark | Didier Stevens
https://blog.didierstevens.com/category/wireshark
Monday 18 May 2015. Howto: Install Wireshark Dissectors. Filed under: My Software. 8212; Didier Stevens @ 0:00. I teach a Wireshark class. If you want to use my Wireshark dissectors like TCP Flag dissector. But don’t know how to install a Wireshark dissector, then watch this video howto:. Monday 2 February 2015. AirPcap Channel Hopping With Python. Filed under: Didier Stevens Labs. 8212; Didier Stevens @ 0:00. I’m teaching a Wireshark WiFi and Lua 2-day class. Apc-channel v0 2.zip. Tuesday 10 June 2014.
