Forensic Investigations of Web Exploitations
summary
Shows that a single pcap file can contain enough to prove compromise: HTTP directory‑traversal (double‑encoded, Nimda‑style) leads to a web‑server running a TFTP transfer, a downloaded executable and a netcat/tunnel on port 777, privilege escalation and a copied SAM file. Uses Wireshark plus tools like TCP‑extract, Xplico and ChaosReader to reconstruct streams, carve binaries and recover exfiltrated data; cites that ~60% of incidents seen relate to PCI DSS e‑commerce breaches.
AI-written summary · about
chapters (10)
- 0:00Start
- 0:37New cyber jobs
- 1:48Case from cyber field
- 14:20Web attacks
- 15:12HTTP GET-RFC 2616
- 36:37HTTP GET Decoded
- 37:31BeEF exploitation of the victim
- 40:56How to Record
- 41:34Xplicco
- 42:00Tips for Businesses
related talks
32mExplore Adventures in the Underland: Forensic Techniques against Hackers
53mForensics Skillset: Techniques for Extraction and Analysis of the Evidence
01h 00mA Security Tester's Toolbox
43mSocial Forensication: A Multidisciplinary Approach to Successful Social Engineering
40mBackdoor Investigation and Incident Response: From Zero to Profit
39mHow to think like a hacker
01h 06mHow hacking works
01h 01mA security tester's toolkit