While I was analyzing a standard phishing e-mail my attention was drawn to the fact that the phishing page loaded remote Coldfusion scripts. The phishing mail itself is pretty default. It claims to come from e-mail support telling you that your mailbox is full.
The included cfform component allows to build a form with CFML custom control tags providing more functionality than standard HTML form input elements.
The phishing site was located … Read more.
In my previous post I talked about using the nmap NSE scripts or Hydra to search for systems with default passwords. My approach involved two steps: first learn via Burp how the authentication works (getting to know the form elements etc.) and then use this information as input for the brute force scripts.
A colleague pointed out that you can also use Burp suite for this last step.
Similar as with the previous approach, first … Read more.
I wrote a follow-up on using Burp for both the analysis and attack phase : Hunt for devices with default passwords (with Burp).
Using a strong and unique password for authentication is a key element in security. Unfortunately there are still a lot of devices installed with a default password. This post describes how you can find the web interface of these devices.
Before we start, it’s to important to list the three different web … Read more.
I published an article on How to Use Passive DNS to Inform Your Incident Response on the Security Intelligence blog.
This article gives you an insight on the different logging options for DNS traffic and how the historical records in passive DNS can help you during incident response. I included references to generating passive DNS data based on your traffic and which options you have for consuming it from a client perspective.
I published an article on Don’t Dwell On It: How to Detect a Breach on Your Network More Efficiently on the Security Intelligence blog.
This article describes which typical event types you should look for to detect an intrusion. The article lists 5 key steps to react when you suspect an incident is ongoing.
I published an article on What Metrics Do You Need to Measure the Success of Your SOC? on the Security Intelligence blog.
This article describes how you can evaluate the SOC performance and growth more accurately by building out consistent measurements to review it’s essential functions.
The article covers people, roles, technology, policies and processes and also includes some tips for further tuning reporting and metrics to measure the success of your SOC.
I published an article on How to Leverage Log Services to Analyze C&C Traffic on the Security Intelligence blog.
This article describes what can cause C2 traffic, the different types of C2 traffic and what log sources that you can use to detect the C2 traffic caused by malware.
I published an article on How to Defend With the Courses of Action Matrix and Indicator Lifecycle Management on the Security Intelligence blog.
This article describes the courses of action matrix to help you understand how to verify and validate indicators. The CoA matrix assists you in choosing the most useful action (“response”) to take with a an indicator.
I run a lab with a couple of Windows VMs on different laptops via VMware Workstation (for Linux). Some of these machines are “vulnerable” Windows systems (check out Microsoft Evaluation Center). I pretty much always use the same password for the administrator account to make management easy. This is bad practice for a real-life environment, but the purpose of these machines is to get compromised anyway.
However, sometimes it might seem like a good idea … Read more.
I published an article on How Pivoting Can Help Your Incident Response Process on the Security Intelligence blog.
This article describes what pivoting is about (mostly from a point of view of a defender, or during incident response), how to evaluate and track the links that you found, what domains are most useful to use for pivoting and what data points you can use for pivoting.