Sites

https://futureboy.us/stegano/decinput.html

https://apackets.com/upload

https://packettotal.com/

https://www.pdf-online.com/osa/extract.aspx

Malware analysis

https://www.google.com

https://www.virustotal.com/gui/

https://cuckoo.cert.ee/

https://app.any.run/

Challenges

Find computername, user& password:

https://drive.google.com/file/d/10y0sR_BZuXgJB4Rg3qc6Qx0-24Ej7HGe/view?usp=sharing

Corrupt file / Signature

• hexdump -c file.jpg

• Check if signature of the file matches with the universal signature given at https://filesignatures.net

• If signature is different, edit it using hexedit file.jpg (https://hexed.it/)

• xxd -r -p pngfile.hex output.png or https://tomeko.net/online_tools/hex_to_file.php?lang=en

• pngcheck -v file.png (Check other stuffs like misspelled IDAT, IHDR and so on.)

Image

From my past experience with CTFs, the most common Steganography techniques in a CTF challenge would be the following:

1. Embedding text within the raw bytes of the image. (strings)

2. Bit Steganography, which is hiding data in the bits of the pixel data in an image. (zsteg)

3. Embedding another file within the image (binwalk)

4. Hiding pixels in a single color plane (stegsolve)

https://aperisolve.fr

https://manytools.org/hacker-tools/steganography-encode-text-into-image/

exiftool file

java -jar stegsolve.jar

zsteg -a file.png

steghide --extract -s (-sf) file.png

binwalk -e file.png

binwalk --dd=".*" file.jpg

foremost file.png

eog file.jpg

Windows machine

Logless forensics:

• history / get-content C:\Users\*\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadline\ConsoleHost_history.txt [Clear-History ]

• dir 'C:\Windows\Prefetch' | sort LastWriteTime -desc

• .\PECmd.exe -f 'C:\Windows\prefetch\MIMIKATZ.EXE-599C44B5.pf' -mp [ .\PECmd .exe -d 'C:\Windows\Prefetch' --csv . ]

• .\AppCompatCacheParser.exe -t --csv . --csvf shimcache.csv / import-csv .\shimcache.csv | sort lastmodified -Descending | fl path,last*

• velociraptor.exe gui #spin this up as admin [SELECT Usn,Timestamp,Filename,Fullpath,FileAttributes,Reason,SourceInfo FROM source()ORDER BY Timestamp desc ]