آزمایشگاه امنیت

امنیت در کوبرنتیس

https://madhuakula.com/kubernetes-goat/docs/

@Engineer_Computer

آنتی فارنزیک در حافظه

از جناب علیرضا تقی خانی

https://medium.com/@alirezataghikhani1998/memory-analysis-against-anti-forensics-methods-22dd2c37f2a

@Engineer_Computer

سرتیفیکیت بیش از ۸۳ هزار دامین چرا باطل می‌شود؟

https://thehackernews.com/2024/07/digicert-to-revoke-83000-ssl.html

@Engineer_Computer

⭕️ قابل توجه کاربران ایرانی که از سرویس دهنده Aeza بدلیل ارزون بودن استفاده هایی مثل راه اندازی VPN میکنند .
گزارش فعالیت های هکرهای روسیه در اروپا نشون میده که در جهت گسترش منافع روسیه بحثهایی که شکل گرفته نشون میده از اسم شرکت Aeza به عنوان یکی از اهرم های اصلی تهیه زیرساخت های هکرهای روس نام برده شده است.
سرویس دهنده ای که بین کاربران ایرانی خیلی پرطرفدار است.
باید مراقب و آگاهی نسبت به ریسک های استفاده از سرورهای این سرویس دهنده رو داشته باشید.
https://correctiv.org/en/fact-checking-en/2024/07/22/inside-doppelganger-how-russia-uses-eu-companies-for-its-propaganda/

#Aeza #VPN #ru
@Engineer_Computer

از chatGPT بهینه استفاده کنیم

مثال : سوال

As a forensic expert , Explain system call

جواب :

A system call is an essential mechanism that allows user-level processes to request services from the operating system's kernel. These services can include tasks like accessing hardware, managing files, allocating memory, or creating and managing processes. Here’s a detailed breakdown of system calls from a forensic expert's perspective:

### Basic Concept

1. Definition: A system call is a controlled entry point that allows a program to request a service from the operating system's kernel.
2. Purpose: It provides an interface between user-space applications and the kernel, enabling them to perform operations that require higher privileges.

### Categories of System Calls

System calls can be broadly categorized based on their functionality:

1. Process Control: Creating and managing processes (e.g., fork(), exec(), wait(), exit()).
2. File Management: Handling files and directories (e.g., open(), read(), write(), close(), unlink()).
3. Device Management: Interacting with hardware devices (e.g., ioctl(), read(), write()).
4. Information Maintenance: Gathering and setting system information (e.g., getpid(), alarm(), sleep()).
5. Communication: Facilitating inter-process communication (e.g., pipe(), shmget(), msgsnd(), recv()).

### System Call Lifecycle

1. Invocation: A system call is typically invoked by a user-level process through a library function (e.g., the C standard library).
2. Transition to Kernel Mode: The CPU switches from user mode to kernel mode to execute the system call. This transition is often triggered by a software interrupt or trap.
3. Kernel Execution: The kernel executes the requested service using its internal resources and privileged instructions.
4. Return to User Mode: The results of the system call are returned to the user process, and the CPU switches back to user mode.

### Forensic Relevance

From a forensic perspective, understanding system calls is crucial for several reasons:

1. Activity Monitoring: System calls provide insights into what a process is doing. By monitoring system calls, forensic experts can track file access, process creation, and other critical activities.
2. Malware Analysis: Malicious software often relies on system calls to perform its actions. By analyzing the sequence of system calls, experts can understand the behavior of malware.
3. Incident Response: During an incident, system call logs can help reconstruct the events leading up to the security breach.
4. Digital Evidence: System call traces can serve as digital evidence in investigations, revealing unauthorized access or data manipulation.

### Tools and Techniques

1. Strace: A widely used tool in Unix-like systems to trace system calls made by a process.
2. Auditd: The Linux Auditing System, which can log system calls for security monitoring and compliance purposes.
3. Sysmon: A Windows system service that logs system calls and other system events for detailed monitoring.

### Example

Here’s a simple example of how a system call works:

#include <unistd.h>
#include <stdio.h>

int main() {
    char buffer[128];
    int bytesRead;

    // System call: read from standard input (file denoscriptor 0)
    bytesRead = read(0, buffer, 128);

    // System call: write to standard output (file denoscriptor 1)
    write(1, buffer, bytesRead);

    return 0;
}

In this C program:
- The read() system call reads data from the standard input.
- The write() system call writes data to the standard output.

By understanding and analyzing such system calls, forensic experts can gain insights into the actions performed by processes on a system.

@Engineer_Computer

تحلیل رفتاری گروه UNC4393

https://cloud.google.com/blog/topics/threat-intelligence/unc4393-goes-gently-into-silentnight?linkId=10528541

@Engineer_Computer

پیرو مقالات هانت

تغییر نام پراسس ها در لینوکس برای غیر مشکوک سازی

https://doubleagent.net/process-name-stomping/

@Engineer_Computer

راهنمای مرور امنیت کد از OWASP
@Engineer_Computer

💎 کتاب جعبه ابزار سخت افزاری برای هکرها
➖در این کتاب 133 گجت سخت افزاری معرفی شده است که در هک و نفوذ کاربرد دارند.
@Engineer_Computer

#استخدام
@Engineer_Computer

فارنزیک و داکر

قسمت ۴

https://youtu.be/jvSVwGzvMhM

@Engineer_Computer

برای رسیدن به محرمانگی هنگام استفاده از LLM ها
میتوانید از لینک زیر برای خود لوکال LLM بالا بیاورید
حوزه استفاده : مهندسی معکوس

Core Features

Offline Operation: Runs LLMs entirely on local CPU/GPU, ensuring data privacy and security.

Automatic Function Naming: Automatically suggests semantically meaningful function names from decompiler output.

Binary Ninja Integration: Seamlessly integrates as a plugin with Binary Ninja.

Modular Architecture: Designed for easy extension to support other reverse engineering tools like IDA and Ghidra.

Consumer Hardware Compatibility: Optimized to run on consumer-grade hardware, such as Apple silicon architectures.

Enhanced AI with Static Analysis: Improves AI-based analysis and suggestions by incorporating insights from static analysis, providing a richer context and more accurate results.

https://github.com/mrphrazer/reverser_ai

@Engineer_Computer

تهدیدات ریز پرنده ها

https://www.asisonline.org/security-management-magazine/articles/2023/05/uncrewed-aerial-systems/security-implications-drones/

@Engineer_Computer

چند دستور جالب از سوریکاتا

@Engineer_Computer