A Practical Guide to Wireshark Forensics for DevOps by Gilchrist Alasdair

Author:Gilchrist, Alasdair
Language: eng
Format: epub
Published: 2015-05-04T16:00:00+00:00

C – Malicious.pcap

1. What was the complete URI of the original web request that led to the client

being compromised?

The first thing we have to do is get some clue where to start looking here for suspicious activity. We can do this using an IDS that can take a pcap file as an input and analyse the file just as if it was reading the packets from the wire. Or, we can use Wireshark to filter out and display any requested downloads. For example if we run the filter: (ip.src==10.20.0.165) && (http.request.method==GET) && (ip.dst==10.20.0.111) we should be able to see what files have been downloaded.

Download

Copyright Disclaimer:
This site does not store any files on its server. We only index and link to content provided by other sites. Please contact the content providers to delete copyright contents if any and email us, we'll remove relevant links or contents immediately.