Luffyのメモ

カウンター
RSS feed meter for http://d.hatena.ne.jp/Luffy/
LUFFYのアンテナ
此処は物事をすぐに忘れるので何回も同じ事を書く為の個人メモです。

 

2014-04-04

[] [forensics] SuperTimeline

【旧】
# mount -o loop,ro,show_files,streams_interface=windows,offset=32256 /mnt/hgfs/image.dd /mnt/windows_mount
# log2timeline -z Japan -p -r -f winxp /mnt/windows_mount -w supertimeline.txt
# l2t_process -b supertimeline.txt > supertimeline.csv

【新】
# log2timeline.py -o 63 --parsers "win7" /cases/timeline/myhost.dump image.dd
# psort.py -w /cases/timeline/myhost.sorted.csv /cases/timeline/myhost.dump

【Windows】
log2timeline.exe -o 63 -z Japan -p --vss myhost.dump image.dd
psort.exe -z Japan -w supertimeline.txt myhost.dump

http://plaso.kiddaland.net/usage/upgrading-from-0-x-branch

2014-02-14

[] Fluentd mongodb

/etc/td-agent/td-agent.conf

<source>
  type tail
  path /var/log/httpd/access_log
  pos_file /var/log/td-agent/apache2.access_log.pos
  format apache2
  tag mongo.apache.access
</source>
<match mongo.apache.access>
    type mongo
    database apache
    collection access
    host localhost
    port 27017
</match>

2014-01-07

[] INetSim: Internet Services Simulation Suite

サーバ,DNS,HTTPなど

INetSim: Internet Services Simulation Suite - Project Homepage
screenshot

# Available service names are:
# dns, http, smtp, pop3, tftp, ftp, ntp, time_tcp,
# time_udp, daytime_tcp, daytime_udp, echo_tcp,
# echo_udp, discard_tcp, discard_udp, quotd_tcp,
# quotd_udp, chargen_tcp, chargen_udp, finger,
# ident, syslog, dummy_tcp, dummy_udp, smtps, pop3s,
# ftps, irc, https


/etc/inetsim/inetsim.conf
service_bind_address 192.168.1.1
dns_default_ip 192.168.1.1
上記項目を自IP「192.168.1.1」に変更

remnux@remnux:/var/log/inetsim$ inetsim
INetSim 1.2.3 (2012-10-01) by Matthias Eckert & Thomas Hungenberg
Using log directory:      /var/log/inetsim/
Using data directory:     /var/lib/inetsim/
Using report directory:   /var/log/inetsim/report/
Using configuration file: /etc/inetsim/inetsim.conf
Parsing configuration file.
Configuration file parsed successfully.
=== INetSim main process started (PID 3521) ===
Session ID:     3521
Listening on:   192.168.1.1
Real Date/Time: Tue Jan  7 02:09:26 2014
Fake Date/Time: Tue Jan  7 02:09:26 2014 (Delta: 0 seconds)
 Forking services...
  * ident_113_tcp - started (PID 3536)
  * time_37_tcp - started (PID 3538)
  * daytime_13_tcp - started (PID 3540)
  * tftp_69_udp - started (PID 3532)
  * dns_53_tcp_udp - started (PID 3523)
  * time_37_udp - started (PID 3539)
  * daytime_13_udp - started (PID 3541)
  * quotd_17_tcp - started (PID 3546)
  * echo_7_tcp - started (PID 3542)
  * discard_9_udp - started (PID 3545)
  * quotd_17_udp - started (PID 3547)
  * finger_79_tcp - started (PID 3535)
  * chargen_19_udp - started (PID 3549)
  * irc_6667_tcp - started (PID 3533)
  * ntp_123_udp - started (PID 3534)
  * chargen_19_tcp - started (PID 3548)
  * dummy_1_udp - started (PID 3551)
  * discard_9_tcp - started (PID 3544)
  * dummy_1_tcp - started (PID 3550)
  * syslog_514_udp - started (PID 3537)
  * echo_7_udp - started (PID 3543)
  * smtps_465_tcp - started (PID 3527)
  * pop3s_995_tcp - started (PID 3529)
  * ftp_21_tcp - started (PID 3530)
  * smtp_25_tcp - started (PID 3526)
  * ftps_990_tcp - started (PID 3531)
  * pop3_110_tcp - started (PID 3528)
  * http_80_tcp - started (PID 3524)
  * https_443_tcp - started (PID 3525)
 done.
Simulation running.



/var/log/inetsim/service.log

[2014-01-07 02:30:34] [3812] [dns_53_tcp_udp 3814] [192.168.1.2] connect
[2014-01-07 02:30:34] [3812] [dns_53_tcp_udp 3814] [192.168.1.2] recv: Query Type A, Class IN, Name xxxxxxxxx.ddo.jp
[2014-01-07 02:30:34] [3812] [dns_53_tcp_udp 3814] [192.168.1.2] send: xxxxxxxxx.ddo.jp 3600 IN A 127.0.0.1
[2014-01-07 02:30:34] [3812] [dns_53_tcp_udp 3814] [192.168.1.2] disconnect
[2014-01-07 02:30:34] [3812] [dns_53_tcp_udp 3814] [192.168.1.2] stat: 1 qtype=A qclass=IN qname=xxxxxxxxx.ddo.jp
[2014-01-07 02:45:06] [4033] [http_80_tcp 4105] [192.168.1.2:1065] recv: Host: xxxxxxxxx.ddo.jp
[2014-01-07 02:45:06] [4033] [http_80_tcp 4105] [192.168.1.2:1065] recv: Connection: Keep-Alive
[2014-01-07 02:45:06] [4033] [http_80_tcp 4105] [192.168.1.2:1065] recv: Cache-Control: no-cache
[2014-01-07 02:45:06] [4033] [http_80_tcp 4105] [192.168.1.2:1065] recv: Pragma: no-cache
[2014-01-07 02:45:06] [4033] [http_80_tcp 4105] [192.168.1.2:1065] info: Request URL: http://xxxxxxxxx.ddo.jp/usr/Y-Vm6St6fBt9BgNTez6BOK
[2014-01-07 02:45:06] [4033] [http_80_tcp 4105] [192.168.1.2:1065] info: No matching file extension configured. Sending default fake file.
[2014-01-07 02:45:06] [4033] [http_80_tcp 4105] [192.168.1.2:1065] send: HTTP/1.1 200 OK
[2014-01-07 02:45:06] [4033] [http_80_tcp 4105] [192.168.1.2:1065] send: Server: INetSim HTTP Server
[2014-01-07 02:45:06] [4033] [http_80_tcp 4105] [192.168.1.2:1065] send: Connection: Close
[2014-01-07 02:45:06] [4033] [http_80_tcp 4105] [192.168.1.2:1065] send: Content-Length: 258
[2014-01-07 02:45:06] [4033] [http_80_tcp 4105] [192.168.1.2:1065] send: Content-Type: text/html
[2014-01-07 02:45:06] [4033] [http_80_tcp 4105] [192.168.1.2:1065] send: Date: Tue, 07 Jan 2014 07:45:06 GMT
[2014-01-07 02:45:06] [4033] [http_80_tcp 4105] [192.168.1.2:1065] info: Sending file: /var/lib/inetsim/http/fakefiles/sample.html
[2014-01-07 02:45:06] [4033] [http_80_tcp 4105] [192.168.1.2:1065] stat: 1 method=GET url=http://xxxxxxxxx.ddo.jp/usr/Y-Vm6St6fBt9BgNTez6BOK sent=/var/lib/inetsim/http/fakefiles/sample.html postdata=

2013-12-24

2013-12-19

 
無料アクセス解析2php
OpenSSH
はてな開始日付:2004-03-24
Cisco関連 :2004-03-23
Nokia関連 :2004-03-22
SEIL関連 :2004-03-21