Siddhesh

Nutrition Guide | Fitness Freak
Your Health should be your first priority. Stay Fit , Workout hard💪🏻🔥

[Siddhesh @sidsec_]

Grateful for the chance to volunteer at @BrumBsides . Amazing experience, great people, and lots of learning. Proud to be part of it!
#volunteering #CyberSecurity
#meetups

[BSides Birmingham (UK) @BrumBsides]

Just 3 sleeps to go! 🎉
Scan the QR code in the image to check out the full agenda & floor plan.
Talks, workshops, good vibes — the BSides team can’t wait to welcome you! 💥

#BSidesBirmingham #BSides

[BSides Birmingham (UK) @BrumBsides]

🚨 BSides Birmingham: Malware Village
Led by @MalwareVillage & team, Malware Village offers hands-on malware analysis, reverse engineering, & threat defense sessions!
A must-visit for all skill levels — even kids! 👾
Learn, connect, and help build a safer digital world.
#BSides

[Siddhesh @sidsec_]

@LambdaMamba @MalwareVillage @BSidesExeter @BrumBsides @BSidesDublin Glad to see you'll be attending @BrumBsides event. It would be a pleasure to meet in person if possible 😊

[Ben Sadeghipour @NahamSec]

Final giveaway of the year🎁:
4️⃣Hand-On Web Exploitation (Course Only https://t.co/Vk3Q9lzV6l)
3️⃣Shodan Codes
2️⃣Caido licenses
1️⃣Hands-On Web Exploitation (Certificate+Course Bundle)

To enter drop a 🫶🏼and RT

[Siddhesh @sidsec_]

@NahamSec 🫶🏽

[Vijay Patel @vijaygajera]

DIGITAL ARREST SCAM🚨

FIRST TIME LIVE RECORDING.

1. Please read, watch, and share this thread as much as possible so we can save more people from this fraud.

[Bug Bounty Village @BugBountyDEFCON]

Excited to announce a new giveaway, thanks to @PentesterLab.
We will pick 10 winners to win 6 month (x5) and 1 month (x5) subscriptions.

To enter:
1️⃣ Follow us @BugBountyDefcon and @PentesterLab
2️⃣ Like this post ❤️
3️⃣ RT this post 🔁

You've time until next Friday (10/18), GO!

[IWCON - The Infosec Writeups' Security Conference @IWcon_]

iwcon 4.0 ??? 🤔

[Siddhesh @sidsec_]

@IWcon_ Excited 🤩

[InfoSec Community @InfoSecComm]

🔥 125th edition of IWWeekly is LIVE 🔥

Read here: https://t.co/ztlVGbGKSC

[Siddhesh @sidsec_]

Discipline is all about doing things even when you don’t feel like doing them.

[InfoSec Community @InfoSecComm]

🔥 123th edition of IWWeekly is LIVE 🔥

Read here: https://t.co/1A9ILubupO

[Harshleen @0xharshleen]

🛡️ Digital Forensics Overview Guide

1. 💻Foundations

Digital Forensics Fundamentals:
-Forensic Principles: Understanding the chain of custody, evidence integrity, legal considerations, and the importance of documentation.
-Forensic Process: Learn about the digital forensics process: Identification, Preservation, Collection, Examination, Analysis, and Reporting.
-Regulations and Compliance: Familiarize with laws and regulations like GDPR, HIPAA, and standards such as ISO/IEC 27037, NIST guidelines.
Operating Systems:

Windows Forensics:
-Registry Analysis: Investigate the Windows Registry for user activity, auto-start locations, USB device history.
-Event Logs: Analyze Security, Application, and System logs for anomalies.
-File Systems: Study NTFS structure, Master File Table (MFT), and Alternate Data Streams (ADS).
-Artifacts: Investigate Prefetch files, Jump Lists, and LNK files.

Linux Forensics:
-Log Files: Analyze important logs such as auth.log, syslog, dmesg.
-File Systems: Deep dive into Ext4, understand inode structure, journaling, and data recovery.
-User Activity: Examine .bash_history, SSH keys, crontab entries, and system binaries for tampering.

Networking:
Network Traffic Analysis:
-Packet Analysis: Use tools like Wireshark, Tcpdump to capture and analyze network traffic.
-Intrusion Detection: Leverage Snort, Zeek (Bro) to detect suspicious network activity.
-Logs and Flows: Analyze NetFlow data, firewall logs, and proxy logs for indicators of compromise (IOCs).

2. 🔍 Data Acquisition

Evidence Collection:
Disk Imaging:
-Tools: Use FTK Imager, dd, EnCase for bit-by-bit disk imaging.
-Hashing: Ensure data integrity with hashing algorithms (MD5, SHA-256) before and after acquisition.
-Live vs. Dead Acquisition: Learn when to perform live acquisitions and how to handle volatile data (RAM, running processes).

Memory Forensics:
-Tools: Analyze memory dumps using Volatility, Rekall.
-Memory Artifacts: Identify running processes, open network connections, injected DLLs, and rootkits.

Mobile Device Forensics:
-Data Acquisition: Use tools like Cellebrite, Oxygen Forensic Suite for iOS and Android data extraction.
-Artifacts: Examine call logs, SMS, app data, GPS data, and deleted files.

Cloud Forensics:
-Challenges: Understand the unique challenges posed by cloud environments, such as data jurisdiction, multi-tenancy.
-Cloud Evidence Acquisition: Learn to extract logs, VM snapshots, and cloud storage data from AWS, Azure, GCP.
-Logging and Monitoring: Utilize cloud-native tools (e.g., AWS CloudTrail, Azure Monitor) for gathering forensic evidence.

3. 🛠️ Analysis and Examination
File and Data Analysis:
-File Carving: Recover deleted files using tools like Scalpel, PhotoRec, and analyze file fragments.

-Metadata Analysis: Investigate file metadata for information such as timestamps, author details, and modification history.
-Steganography Detection: Identify hidden data within images, audio files, using tools like StegDetect, OpenStego.

Malware Forensics:
-Static Analysis: Examine the structure of executable files, disassemble code with tools like IDA Pro, Ghidra.
-Dynamic Analysis: Execute malware in sandbox environments (Cuckoo Sandbox) to observe behavior.
-Memory Analysis: Detect malicious processes, code injections, and artifacts of malware using Volatility.

Log Analysis:
-Syslog: Interpret system logs for suspicious activity, error messages, and abnormal patterns.
-Windows Event Logs: Correlate event logs to detect login attempts, privilege escalations, and application errors.
-Web Logs: Analyze web server logs for SQL injection attempts, cross-site scripting (XSS), and unauthorized access.

4. 🚨 Advanced Forensic Techniques

Reverse Engineering
-Binary Analysis: Disassemble and decompile binaries to understand their functionality and potential exploits.
-Obfuscation Techniques: Tackle obfuscated code, identify packing, encryption, and bypass anti-reverse engineering tricks.
-Firmware Analysis: Extract and analyze firmware from embedded devices, identify vulnerabilities.

Network Forensics:
-Deep Packet Inspection (DPI): Analyze network packets at a granular level to detect hidden payloads, covert channels.
-Traffic Reconstruction: Reconstruct sessions, files transferred over the network using tools like Xplico, NetWitness.
-IoT Forensics: Investigate IoT devices, extract logs, and analyze network traffic specific to IoT ecosystems.

Data Recovery:
-Deleted Data: Recover deleted files, partitions, and RAID arrays using tools like R-Studio, TestDisk.
-Encrypted Data: Work on decrypting data, analyzing TrueCrypt, BitLocker volumes.
-Database Forensics: Analyze database contents, recover deleted records, and identify SQL injection traces.

5. 🌐 Reporting and Legal Considerations

Forensic Report Writing:
-Structure: Create clear, concise reports that outline the investigation process, findings, and conclusions.
-Documentation: Maintain detailed records of all actions taken, tools used, and the results obtained.
-Presentation: Prepare to present findings to non-technical stakeholders, legal teams, and in court.
Expert Testimony:

-Legal Proceedings: Understand the role of a forensic expert in court, how to handle cross-examination.
-Ethics: Adhere to ethical guidelines, ensure impartiality, and maintain the integrity of the investigation.
-Courtroom Dynamics: Familiarize with courtroom procedures, how to communicate technical findings effectively.

Continuous Learning:
-Stay Updated: Engage with the forensic community, participate in conferences, webinars, and training.
-Certifications: Obtain certifications like CHFI (Certified Hacking Forensic Investigator), GCFA (GIAC Certified Forensic Analyst), EnCE (EnCase Certified Examiner).
-Research: Keep up with the latest forensic tools, techniques, and case studies.

[Siddhesh @sidsec_]

BlueTeam Tools:
Tools and Techniques for Blue Team / Incident Response
https://t.co/WWQoFIdtQk

RedTeam Tools:
Tools and Techniques for Red Team / Penetration Testing
https://t.co/dCKhsyIKlE

[Harshleen @0xharshleen]

Blue Team Roadmap🔵🎯

├── Foundations
│ ├── Basic Networking
│ │ ├── TCP/IP
│ │ ├── DNS
│ │ ├── DHCP
│ │ ├── Subnetting
│ │ └── Network Topologies
│ ├── Operating Systems
│ │ ├── Windows
│ │ │ ├── Active Directory
│ │ │ ├── Group Policy
│ │ │ └── Windows Event Logs
│ │ └── Linux
│ │ ├── File Permissions
│ │ ├── Syslog
│ │ └── Scripting (Bash, Python)
│ └── Cybersecurity Fundamentals
│ ├── CIA Triad
│ ├── Risk Management
│ ├── Threat Models
│ └── Attack Vectors
├── Threat Intelligence
│ ├── OSINT
│ │ ├── Tools (Maltego, Recon-ng)
│ │ └── Data Sources (Shodan, Censys)
│ ├── Threat Hunting
│ │ ├── Hypothesis-Driven Hunting
│ │ ├── TTPs
│ │ └── Use Cases Development
│ └── IOCs
│ ├── IP Addresses
│ ├── Hash Values
│ ├── Domains
│ └── File Names
├── Security Operations
│ ├── Monitoring and Logging
│ │ ├── SIEM
│ │ │ ├── Tools (Splunk, ELK Stack, QRadar)
│ │ │ └── Log Parsing and Correlation
│ │ └── Log Analysis
│ │ ├── Log Sources (Windows Event Logs, Syslog)
│ │ └── Log Aggregation and Storage
│ ├── Incident Response
│ │ ├── IR Plan Development
│ │ ├── Incident Handling Procedures
│ │ └── Digital Forensics
│ │ ├── Memory Analysis
│ │ └── Disk Forensics
│ ├── EDR
│ │ ├── Tools (CrowdStrike, Carbon Black)
│ │ └── Endpoint Visibility and Control
│ └── NSM
│ ├── Tools (Zeek, Suricata)
│ └── Traffic Analysis
├── Vulnerability Management
│ ├── Vulnerability Assessment
│ │ ├── Scanning Tools (Nessus, OpenVAS)
│ │ └── Assessment Methodologies
│ ├── Patch Management
│ │ ├── Patch Deployment Strategies
│ │ └── Patch Testing and Validation
│ └── Configuration Management
│ ├── Secure Configuration Guides
│ └── Configuration Monitoring
├── Identity and Access Management
│ ├── Authentication Methods
│ │ ├── MFA
│ │ └── SSO
│ ├── Authorization
│ │ ├── RBAC
│ │ └── ABAC
│ └── Identity Governance
│ ├── User Lifecycle Management
│ └── Access Reviews and Recertification
├── Secure Architecture
│ ├── Network Segmentation
│ │ ├── VLANs
│ │ └── Microsegmentation
│ ├── Zero Trust Architecture
│ │ ├── Principles and Implementation
│ │ └── Identity-Centric Security
│ └── Encryption
│ ├── Data at Rest
│ │ ├── Disk Encryption
│ │ └── Database Encryption
│ └── Data in Transit
│ ├── TLS/SSL
│ └── VPNs
├── Awareness and Training
│ ├── Security Awareness Programs
│ │ ├── Regular Training Sessions
│ │ └── Security Newsletters
│ ├── Phishing Simulations
│ │ ├── Phishing Campaigns
│ │ └── Analysis of Results
│ └── User Training
│ ├── Role-Based Training
│ └── Just-in-Time Training
├── Compliance and Governance
│ ├── Regulatory Requirements
│ │ ├── GDPR
│ │ ├── HIPAA
│ │ └── PCI-DSS
│ └── Policy Development
│ ├── Security Policies
│ ├── Incident Response Policies
│ └── Data Protection Policies
├── Advanced Defense Techniques
│ ├── Deception Technologies
│ │ ├── Honeypots
│ │ └── Honeytokens

follow for more- @harshleenchawl2

[N$🌟 @__nav1n_]

I recently found a cool #RCE/path traversal bug on a target in Intigriti. It was rejected because of OoS :( But I am proud that I found this cool bug through a full manual testing of the endpoint. This video just simplifies the steps, but I took hours to figure out. #BugBounty

[Siddhesh @sidsec_]

Malware Development, Analysis and DFIR Series

Part 1 :-
https://t.co/E0jGHqzBpx

Part 2 :-
https://t.co/hiVNPedeCI

Part 3 :-
https://t.co/DCCkJzMXcs

Part 4 :-
https://t.co/r2Q75Xiy8n

Credits :- @Azr43lKn1ght

[Siddhesh @sidsec_]

@ich_rish99 DFIR