“ANN'S AURORA” - SANS Computer Forensics

More documents

Recommendations

Info

ERIK HJELMVIK: NETWORK MINER .92 • Updated for Contest #6 • Now properly extracts HTTP file transfers • Better guesses server/client when 3-way handshake is missing <strong>Forensics</strong>Contest.com Contest #6: “Ann’s Aurora” © 2010 Lake Missoula Group, LLC
ERIK HJELMVIK: NETWORK MINER .92 • Here you can see how Network Miner automatically identified the HTTP file transfers • There is an HTML page and a GIF • Lots of handy details (filename, size, etc) • Right click to open the file <strong>Forensics</strong>Contest.com Contest #6: “Ann’s Aurora” © 2010 Lake Missoula Group, LLC
Page 1 and 2: SANS FORENSIC CHALLENGE: “ANN’S
Page 3 and 4: CONTEST #6: “ANN’S AURORA” :
Page 5 and 6: THE CONTEST • You are the investi
Page 7 and 8: SOLVING THE CRIME Q: What was the f
Page 9 and 10: SOLVING THE CRIME Vick's computer m
Page 11 and 12: SOLVING THE CRIME Q: When was the T
Page 13 and 14: SOLVING THE CRIME In packet 17, the
Page 15 and 16: SOLVING THE CRIME • There is some
Page 17 and 18: SOLVING THE CRIME • There is some
Page 19 and 20: SOLVING THE CRIME Subsequently, the
Page 21 and 22: SOLVING THE CRIME Q: When was the T
Page 23 and 24: BEHIND THE CURTAIN: EXPLOIT DESCRIP
Page 25 and 26: THE ATTACK (2) • The attacker los
Page 27 and 28: ISSUES WITH THE ATTACK • Victim i
Page 29 and 30: WINNER & FINALISTS • Winner! - We
Page 31 and 32: WESLEY MCGREW: PCAPLINE Example r
Page 33: • Drill down WESLEY MCGREW: • V
Page 37 and 38: ERIK HJELMVIK: NETWORK MINER .92
Page 39 and 40: LEENDERT PIETER VAN DRIMMELEN: PEXT
Page 41 and 42: ERIC KOLLMANN: CONTEST6.PL • Get
Page 43 and 44: CONGRATULATIONS, AND THANKS! • On

“ANN'S AURORA” - SANS Computer Forensics

Create successful ePaper yourself

Delete template?

Save as template?