Threat Level: Infocon green
DShield
phpbb and sql errors asp sqlserver odbc sql errors

Today´s Diary

If you have more information or corrections regarding our diary, please share.


ISC StormCast for Thursday, May 23rd 2013 http://isc.sans.edu/podcastdetail.html?id=3326

MoVP II

Published: 2013-05-23,
Last Updated: 2013-05-23 14:00:31 UTC
by Adrien de Beaupre (Version: 1)

1 comment(s)

Volatility is a Python framework for performing memory forensics. If you haven't tried it yet I highly recommend it. The Volatility Month of Volatility Plugins II is on! As announced here: http://volatility-labs.blogspot.ca/2013/05/whats-happening-in-world-of-volatility.html Volatility 2.3 is entering beta and the second MoVP (Month of Volatility Plugins) has started and is actually in their second installment. Some very exciting new stuff:

1.1 - Mach-O Address Space
1.2 - VirtualBox ELF64 Core Dumps
1.3 - VMware Snapshot and Saved State Analysis
1.4 - New HPAK Address Space
1.5 - ARM Address Space (Volatility and Andriod / Mobile)
2.1 - RSA Private Keys and Certificates
2.2 - Unloaded Windows Kernel Modules

Cheers,
Adrien de Beaupré
Intru-shun.ca Inc.
My SANS Teaching Schedule

 

Keywords: memory forensics MoVP II plugins volatility
1 comment(s)
Top of page
Wireshark 1.10.0rc2 is now available http://www.wireshark.org/download.html

If you have more information or corrections regarding our diary, please share.

Diary Archive

DateAuthorTitle
2013-05-23 Adrien de Beaupre MoVP II (1 Comments)
2013-05-22 Adrien de Beaupre Privilege escalation, why should I care? (14 Comments)
2013-05-21 Adrien de Beaupre Moore, Oklahoma tornado charitable organization scams, malware, and phishing (0 Comments)
2013-05-20 Johannes Ullrich Ubuntu Package available to submit firewall logs to DShield (3 Comments)
2013-05-20 Guy Bruneau Safe - Tools, Tactics and Techniques (0 Comments)
2013-05-19 Kevin Shortt Port 51616 - Got Packets? (1 Comments)
2013-05-17 Daniel Wesemann e-netprotections.su ? (3 Comments)
2013-05-17 Johannes Ullrich SSL: Another reason not to ignore IPv6 (3 Comments)
2013-05-16 Joel Esler Cisco TelePresence Supervisor MSE 8050 Denial of Service Vulnerability (1 Comments)
2013-05-16 Daniel Wesemann Extracting signatures from Apple .apps (0 Comments)
Folder Icon Complete Archive
Search Diaries:

Diary Tagslink arrow

  61     waco fertilizer plant explosion     fantasia     malware     firewall     adobe     ie 8     cve20120158     spamhaus     microsoft     dshield     chargen     watering hole     hak5     51616     black tuesday     cyberterrorism     certificates     micorsoft     dos     security advisory     cnn     memory forensics     boston marathon bombing     gov     mt6d     protocol     boston marathon     updates     ssl     movp ii     java vulnerability     ipv4     thunderbird     email     got packets     boston marathon scams     outage     patch tuesday     apple     enterprise certificate authority     firefox     msft     ipv6     javascript     relays     volatility     frequency hopping     scam     ipv6 focus month     cyberbunker     apache     patch     bcp 38     preference     back tuesday     kernel     exploit     rfc6724     safe     notification     spam     configuration     web app sec     privilege escalation     vrt     charity     certificate     trojan     opendoc     cisco     port 51616     certutil     signature     usbexe     java security update     vulnerability     sourcefire     patches     bgp     anti virus     denial of service     ddos     remnux     ios     tornado     boston marathon explosions     sysinternals     linux     spoofing     fake charities     mozilla     phishing     advance notification     passwords     disaster     security intelligence     happy eyeballs     psexec     tools     java 7u21     webserver     packets     usbdoc     rfc6555     incident     xss     overview     malware analysis     0 day     plugins     blackhole     phish     cloudflare     postgresql     snort     internet status     perimeter     fake tech calls     typo squatting     malware containment     google     ubuntu     oklahoma     java     flash  
site/port/ip search:

Announcement!

IPv6 Support Added

Our iptables client now supports submitting IPv6 firewall logs.

DSHIELD Polllink arrow

What are your plans when XP is no longer supported?

Latest RR Paperslink arrow

Event Monitoring and Incident Response

Dead Linux Machines Do Tell Tales

Setting Up a Database Security Logging and Monitoring Program

Managing the Implementation of a BYOD Policy

Analysis of the building blocks and attack vectors associated with the Unified Extensible Firmware Interface (UEFI)

World Map

world map

Trends

trend graph

Security News Feeds

InternetStormCenter
SANS Newsbites
SANS @Risk

Diary Archives

MoVP II - by: Adrien de Beaupre (2013-05-23)

Privilege escalation, why should I care? - by: Adrien de Beaupre (2013-05-22)

Moore, Oklahoma tornado charitable organization scams, malware, and phishing - by: Adrien de Beaupre (2013-05-21)

View Diary Archives

Search Diaries:

SANS Institute

View our Privacy Policy

Contact Us

Phone: (757) SANS-ISC (726-7472) - Voice Mail Only
Web Contact: handlers@isc.sans.edu
Report Bugs: Sourceforge Project
Debug Info: Browser Debug Info

"The experiences gained in the SANS Technology Institute program have helped me advance in IBM, taking a more public facing role."
- Jerome Radcliffe, SANS Technology Institute Student

"SANS is a 'giving back to the community factory.' SANS encourages and fosters growing security awareness and growing the security community."
- Rob VandenBrink, Alumni of SANS Technology Institute