MemLabs
Open-Source-Security-Guide
Our great sponsors
MemLabs | Open-Source-Security-Guide | |
---|---|---|
6 | 23 | |
1,520 | 850 | |
- | - | |
2.6 | 6.4 | |
about 3 years ago | 4 months ago | |
Shell | Go | |
MIT License | - |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
MemLabs
- Platform for training digital forensics
- MemLabs: Learn Memory Forensics through CTF-styled labs
-
Best site for memory forensic test
MemLabs https://github.com/stuxnet999/MemLabs
- New to Forensics, Drop some Forensics tools/training content
-
forensics volatility
Volatility Foundation Volatility Framework 2.6 Usage: Volatility - A memory forensics analysis platform. Options: -h, --help list all available options and their default values. Default values may be set in the configuration file (/etc/volatilityrc) --conf-file=/root/.volatilityrc User based configuration file -d, --debug Debug volatility --plugins=PLUGINS Additional plugin directories to use (colon separated) --info Print information about all registered objects --cache-directory=/root/.cache/volatility Directory where cache files are stored --cache Use caching --tz=TZ Sets the (Olson) timezone for displaying timestamps using pytz (if installed) or tzset -f FILENAME, --filename=FILENAME Filename to use when opening an image --profile=WinXPSP2x86 Name of the profile to load (use --info to see a list of supported profiles) -l LOCATION, --location=LOCATION A URN location from which to load an address space -w, --write Enable write support --dtb=DTB DTB Address --shift=SHIFT Mac KASLR shift address --output=text Output in this format (support is module specific, see the Module Output Options below) --output-file=OUTPUT_FILE Write output in this file -v, --verbose Verbose information --physical_shift=PHYSICAL_SHIFT Linux kernel physical shift address --virtual_shift=VIRTUAL_SHIFT Linux kernel virtual shift address -g KDBG, --kdbg=KDBG Specify a KDBG virtual address (Note: for 64-bit Windows 8 and above this is the address of KdCopyDataBlock) ... LABS SET UP This scenario will be using MemLabs cloned from https://github.com/stuxnet999/MemLabs. The labs contain the CTF memory images as referenced earlier.
-
I saw my definition of a worst case scenario today, all because the client didn't want to spend a little bit of money a couple years ago.
I think your best bet to start today is to start looking at self-education options (all over youtube, reddit, google) and start shopping for jobs that either have big training budgets or are at a service provider/vendor that offers IR and try to move laterally within it. You'd be surprised by what you get from just shooting your shot. You could consider some really basic certs like Sec + (avoid CEH like the plague unless you're gov't.) or Blue Team Level 1. I like to watch guys like 13cubed, or the surviving digital forensics podcasts and courses. Also just stay aware of infosec news from sources like brian krebs or cyberwire daily. Some other things to think about are ashemery.com/dfir.html and https://github.com/stuxnet999/MemLabs for some good exercises. Don't feel bad for using walkthroughs your first few times. SANS 3 minutes max is also great for quick topics in DFIR
Open-Source-Security-Guide
-
Degree vs Certifications
Cyber Security is one of the biggest needs in the industry right now as well. This Github has a lot of information for all the different areas.
-
Open Source Security Development
Useful Tools and Resources for those getting into IT Security development such as Security Standards, Frameworks, Threat Models, Encryption, and Benchmarks.
-
Open Source Security Guide
Useful Tools and Resources for Open Source Security development.
I found this useful Open Source Security Guide. I thought I'd share for anyone that's interested .
-
New to Forensics, Drop some Forensics tools/training content
Open sourse OS that comes preintalled with lots of tools we use includijg a software write blocker. Best for investigating an image of an infected device. https://tsurugi-linux.org/ IR plan https://github.com/guardsight/gsvsoc_cybersecurity-incident-response-plan Very detailed IR battle cards https://github.com/guardsight/gsvsoc_cirt-playbook-battle-cards IR focused guide that lists lots of helpful tools and resources, like things to use for reverse engineering. https://github.com/mikeroyal/Open-Source-Security-Guide
-
Useful Security Guide
Found a useful set of Tools, Programs, and Learning Resources for Security. It covers Security Standards, Frameworks, Benchmarks , and Networking.
- Found a useful Open Source Security Guide
- Found a useful Security Guide
What are some alternatives?
MemProcFS-Analyzer - MemProcFS-Analyzer - Automated Forensic Analysis of Windows Memory Dumps for DFIR
dependency-track - Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain.
mal_unpack - Dynamic unpacker based on PE-sieve
mutillidae - OWASP Mutillidae II is a free, open-source, deliberately vulnerable web application providing a target for web-security training. This is an easy-to-use web hacking environment designed for labs, security enthusiasts, classrooms, CTF, and vulnerability assessment tool targets.
Kuiper - Digital Forensics Investigation Platform
gsvsoc_cirt-playbook-battle-cards - Cyber Incident Response Team Playbook Battle Cards
CaptfEncoder - Captfencoder is opensource a rapid cross platform network security tool suite, providing network security related code conversion, classical cryptography, cryptography, asymmetric encryption, miscellaneous tools, and aggregating all kinds of online tools.
secureCodeBox - secureCodeBox (SCB) - continuous secure delivery out of the box
my-arsenal-of-aws-security-tools - List of open source tools for AWS security: defensive, offensive, auditing, DFIR, etc.
bulk_extractor - This is the development tree. Production downloads are at:
hayabusa - Hayabusa (隼) is a sigma-based threat hunting and fast forensics timeline generator for Windows event logs.
gotestwaf - An open-source project in Golang to asess different API Security tools and WAF for detection logic and bypasses