Forensic Blogs

An aggregator for digital forensics blogs

by

Overview of Content Published in July

Here is an overview of content I published in July:

Blog posts: simple_listener.py Quickpost: Standby Power Consumption Of My USB Chargers Update: base64dump.py Version 0.0.23 Update: sortcanon Version 0.0.2 Update: oledump.py Version 0.0.69 Update: re-search.py Version 0.0.21 Quickpost: Standby Power Consumption Of My USB Chargers (120V vs 230V) Quickpost: iPad Pro Charging – Power Consumption YouTube videos: Maldoc: non-ASCII VBA Identifiers Videoblog posts: Maldoc: non-ASCII VBA Identifiers SANS ISC Diary entries: YARA 4.2.2 Released 7-Zip & MoW 7-Zip & MoW: “For Office files” 7-Zip Editing & MoW Python: Files In Use By Another Process Adding Your Own Keywords To My PDF Tools Maldoc: non-ASCII VBA Identifiers Video: Maldoc: non-ASCII VBA Identifiers Wireshark 3.6.7 Released

by

simple_listener.py

This is the release of simple_listener.py, a Python program that can accept TCP and UDP connections and react according to its configuration. It has evolved from my beta program tcp-honeypot.py, that I will no longer maintain.

Everything you could do with tcp-honeypot, can be done with simple_listener.

I use simple_listener now whenever I need a server that listens for incoming TCP and/or UDP connections. For example, I have a configuration that can accept connections from Cobalt Strike beacons using leaked private keys.

simple_listener has a full man page, explaining all configuration items and options.

simple_listener_v0_1_2.zip (http)
MD5: 8F79FCB51EE2C1EB20B0F30F022EAE47
SHA256: F0EED539775AF36FFEB9B91529AF852C833D6A2764A9B9C65998AEA577F08175

by

Overview of Content Published in June

Here is an overview of content I published in June:

Blog posts: Update: oledump.py Version 0.0.68 Update: python-per-line.py Version 0.0.8 New Tool: dns-query-async.py Discovering A Forensic Artifact Update: base64dump.py Version 0.0.22 New Tool: sortcanon.py Another Exercise In Encoding Reversing Examples Of Encoding Reversing Quickpost: Cracking PDF Owner Passwords Update: cut-bytes.py Version 0.0.15 Update: format-bytes.py Version 0.0.14 YouTube videos: Decoding Obfuscated BASE64 Statistically Another Exercise In Encoding Reversing Videoblog posts: Maldoc .DOCX MSDT Inside Sandbox RTF & ms-msdt & Preview Pane Decoding Obfuscated BASE64 Statistically SANS ISC Diary entries: Analysis Of An “ms-msdt” RTF Maldoc “ms-msdt” RTF Maldoc Analysis: oledump Plugins Quickie: Follina, RTF & Explorer Preview Pane Decoding Obfuscated BASE64 Statistically Wireshark 3.6.6 Released Video: Decoding Obfuscated BASE64 Statistically More Decoding Analysis My Paste Command