Digital Forensics for Pentesters - Hands-on | Discount Coupon for Udemy Course

A short overview of what to expect and what to bring to get the most from this course.

A short overview video of the expectations for this section.

In this short video, you will learn how to easily download ISO and OVA files used in the course.

In this lab, you will learn how to install CSI Linux. CSI Linux was developed by Computer Forensics, Incident Response, and Competitive Intelligence professionals to meet the current needs of their clients, government agencies, and the industry.

In this first lab, you will learn how to access the Kali Linux Live Boot Menu and to start Kali Linux using the Forensic Mode feature.

In this short video and lab, you will learn how to create a full virtual install of Kali using VirtualBox.

In this short video, you will learn how to create a virtual install of Windows 10 using VirtualBox. widows 10 will be used throughout the course as a forensic target.

The Metasploitable2 virtual machine is an intentionally vulnerable version of Ubuntu Linux designed for testing security tools and demonstrating common vulnerabilities.

From time to time, Virtualbox will not have a network available for some network types. In this video, we see how this can be easily fixed.

When configuring two or more devices to use the same network type, you may encounter an issue with VirtualBox issuing the same IP address to both devices This is an easy fix.

A Kali Linux Live image on a CD/DVD/USB/PXE can allow you to have access to a full bare metal Kali install without needing to alter an already-installed operating system. This allows for quick easy access to the Kali toolset with all the advantages of a bare metal install.

In this first lab, you are introduced to two complementary forensic tools; both built into  Kali  Linux.  
These are Brian Carrier's tools Autopsy and  Sleuth  Kit. In this first lab, you will acquire a forensics image for analysis to help investigate a case using the forensics case management tool, Autopsy.

In this first lab, we address the first step that a forensic investigator takes after being brought into an investigation, acquiring evidence in a way that is forensically sound and can be used in a court of law.

You can copy and paste the following URL into your web browser to access the VDI disk image used in this lab.

https://www.dropbox.com/s/c731ygsjqyy3e3y/lecture.vdi?dl=0

In the short video presentation, you will learn how to use Autopsy to examine a forensic disk image.

In this lab, you will learn how to use the WebMap Nmap Dashboard application to generate a PDF report of your Nmap scan results.

In this short video and lab, you will learn how to use two OSINT tools available within the CSI Linux Analyst. 

Since the video was produced, CSI Linux has had a major upgrade. Strangely enough, little brother is now only designed to carry out information gathering on a French, Swiss, Luxembourgish, or Belgian person. There are no US or any other modules.

In this lesson, you will learn how to find someone's social media accounts using the OSINT tool, sherlock.

In this short video, you will be given an overview of some of the features inside the OSINT Framework and see why this might be a great tool for OSINT.

In this short video and lab presentation, you will learn how to prepare and use the CSI Linux Analyst and CSI Gateway for secure anonymous access while using the Shodan search engine.

In this short video and lab, you will learn how to find vulnerable devices on the Internet using the Shodan search engine.

In this short video and lab, you will learn how to use Shodan for finding vulnerable databases.

In this video, students will see how easy it is to attach an external USB device attached to their host machine to Kali.

In this lab, you will learn how to create a forensic copy of the Windows registry.

In this lab, you will learn how to perform a forensics analysis of the Windows registry for finding forensic information relevant to a criminal investigation.

In this lesson, you will learn how to dump the credentials for any Wi-Fi network a suspect or target machine may have authenticated with in the past.

In this lecture, you will learn the fundamentals of analyzing the contents of an email header.

In this lab, you will learn how to retrieve information on archived items, even after the folders have been deleted or the external drive has been disconnected from a suspect’s machine.

Starting with Windows 7, Microsoft Windows provides the ability for the operating system to track user window viewing preferences specific to Windows Explorer. This information, called “ShellBag” information, is stored in several locations within the Windows Registry in the Windows Operating System.

In this lesson, you will learn how to extract thumbnail images from the thumbcache_*.db and iconcache_*.db database files starting with Windows 7. Thumbnail cache files have been used by law enforcement agencies to prove that a file of interest was stored on a Windows systems hard drive even if deleted. When a user deletes a file, its thumbnail remains in the cached file.

In this lesson, you will learn how to perform a forensic analysis of a Windows memory acquisition.

Live-Forensicator is a PowerShell script that will aid Forensic Investigators and Incidence responders in carrying out a quick live forensic investigation. It achieves this by gathering different system information for further review for anomalous behavior or unexpected data entry.

Ghidra is present in CSI Linux but needs Java installed to run. Since CSI Linux is built using Ubuntu and Ubuntu does not come with Java, we will need to install it.

In this lesson, you will be introduced to some of the higher-level features of Ghidra. Ghidra is a software reverse engineering (SRE) framework developed by NSA’s Research Directorate for NSA’s cybersecurity mission. Ghidra helps analyze malicious code and malware and can give cybersecurity professionals a better understanding of potential vulnerabilities in their networks and systems.

In our previous lesson, we learned about some of the high-level features in Ghidra. We will continue where our previous lab left off by reverse engineering a simple executable, crackme0x00.exe.

In the short lesson, we will continue with learning reverse engineering by decompiling a simple executable labeled crackme0x05.exe.

In this lesson, we will reverse engineer the WannaCry Ransomware to examine the killswitch discovered by Marcus Hutchins, aka MalwareTech. Marcus reverse Engineered WannaCry and found the program checks a particular URL that was not registered and inactive. If the domain remained inactive, the ransomware would install. Once Marcus registered the domain, it shut down the ransomware.

Windows Sysinternal Tools is a suite of more than 70 freeware utilities that was initially developed by Mark Russinovich and Bryce Cogswell that is used to monitor, manage and troubleshoot the Windows operating system, and which Microsoft now owns and hosts on its TechNet site.

Process Explorer is a free task manager and system monitor software for the Windows operating systems. Process Explorer is a more powerful version of Task Manager, a program usually used to get information about computer performance and resource usage. However, process Explorer offers many features not present in Task Manager – it will show you the detailed information about each process, provide you the CPU usage tracking for processes, figure out which process has loaded a DLL file, enable you to kill or suspend a process, interactively set the priority of a process, and much more.

Process Explorer is an advanced process management utility that picks up where Task Manager leaves off. It will show you detailed information about a process including its icon, command-line, full image path, memory statistics, user account, security attributes, and more. When you zoom in on a particular process you can list the DLLs it has loaded or the operating system resource handles it has open. A search capability enables you to track down a process that has a resource opened, such as a file, directory, or Registry key, or to view the list of processes that have a DLL loaded.

In this short video and lab, you will learn how to use Steghide to hide an image inside another image and then extract that same hidden image.

In this lab, you will learn how to examine and manipulate the EXIF metadata hidden in an image file.

In this lesson, you will be presented with an overview of Wireshark.

In this lesson, you will learn about the different capture options available in Wireshark.

In this short video presentation, you will be introduced to the tollbar icons in Wireshark.

In this short lab, you will learn how to install a wireless adapter in Kali Linux.

In this lab, you will learn how to audit a wireless network for weak authentication.

In this short video presentation, you will learn how to configure Wireshark for capturing wireless traffic.

In this short video, you will learn how to capture and examine a three-way TCP handshake using Wireshark.

In this lab, you will learn how to build your lab environment for this Capture the Flag exercise. 

In this lab, you will learn what tools you can learn to capture the first flag of the CTF.

In this lab, you will learn what tools you can learn to capture flag #2 for this CTF.

This is the lab and video on how to capture the third flag for this CTF. This is a long one with lots to learn so take your time.

In this last video for this CTF, you will learn how to capture the fourth and final flag for this exercise.