Packed File Forensics With PEextract Tool

Python is the only language which provides a better interface for the analysts who are working in forensics departments. It is a high level language. The analyst can write scripts in order to examine the different evidence. In the past many analysts have written open-source scripts which got rapidly used by the world in forensic investigation. For example, volatility tool for the memory forensics analysis, GRR, which is a rapid incident response framework, libppf, which is a helpful tool to access the personal files and folders. This paper will provide you the introduction to different areas of forensics in which python is used as a scripting language. Then I will develop an artefact in which I will create a python tool which will be used in forensics to analyse PE file format which is known as portable executable file attributes. Quickly generate using Python to further examine the evidence.

Suspicious File Analysis With PEFRAME

In this article I am going to conduct a walk through with a nice python tool named PeFrame. This tool should be an analyst’s first choice in order to analysis a piece of static malware. I am going to discuss each and every feature provided by this tool and I will also show you why it is important to find information through the malware.

Python Service Banner Grabbing Script

Hello Guys I have written some small banner grabbing script in python. It is very simple and basic. By using this script you can check the services any network or domain. You will be able to know which services as well as version of service they are using.

In our penetration testing we do some nmap or other port scanning. After we come to know that these much of ports are opened, we try to find the version of service they are using. We do that in order to find  if there is any direct exploit available or not. So in this case this little code will help you to find out the version of services.

Its just basic script which does FTP, HTTP banner grabbing.

Lets send packet without PING command - Introducing Scapy

Whats scapy?

Its packet manipulation mechanism. One can send and receive the packet of large no. of protocols. Its useful to send and receive reply in order to further analysis. Scapy provides many classical tasks such as :

• probing
• tracerouting
• scanning
• network discovery