Hot Topics

snort

Network drawing with Clients, SecurityOnion and the Internet

Sniffing Decrypted TLS Traffic with Security Onion

| | Bro, curl, Decrypted, HTTPS, ids, netcat, NIDS, pcap, PCAP-over-IP, PolarProxy, Security Onion, securityonion, snort, ssl, Suricata, tcpreplay, TLS, Zeek
Wouldn't it be awesome to have a NIDS like Snort, Suricata or Zeek inspect HTTP requests leaving your network inside TLS encrypted HTTPS traffic? Yeah, we think so too! We have therefore ...
NETRESEC Network Security Blog
SEC-T 0x0B: Steve Miller - Reversing the TriStation Network Protocol

Reverse Engineering Proprietary ICS Protocols

| | BSI, Dragos, ICS, Nozomi, pcap, protocol, reverse, SCADA, SEC-T, snort, Steve Miller, TRISIS, TriStation, triton, Wireshark
One of the highlights at this year's SEC-T conference in Stockholm was Steve Miller's talk titled 'Reversing the TriStation Network Protocol'. In this talk Steve covered his quest to better understand the ...
NETRESEC Network Security Blog
Pony using curl to set: Accept-Encoding: identity, *;q=0

Detecting the Pony Trojan with RegEx using CapLoader

| | Accept-Encoding, curl, EmergingThreats, ids, Malware, malware-traffic-analysis.net, pony, quality factor, regex, regular expressions, rfc2616, rfc7231, snort, Suricata, trojan, video, videotutorial
This short video demonstrates how you can search through PCAP files with regular expressions (regex) using CapLoader and how this can be leveraged in order to improve IDS signatures. Your browser does ...
NETRESEC Network Security Blog
EH-Net - Kendall - Hacking Retro

Hacking Retro

| | /root, fragrouter, Hacking, highlight, ids, intrusion detection, Nmap, snort, Tutorial
Bring out your disco ball, your leg warmers, and your VHS tapes! While a lot of us watch the VH1 hit “I Love the 80s” for pop culture, I’m always drawn to ...
The Ethical Hacker Network
Toolsmith - GSE Edition: Scapy vs CozyDuke

Toolsmith – GSE Edition: Scapy vs CozyDuke

| | NFAT, nsm, python, Scapy, snort
In continuation of observations from my GIAC Security Expert re-certification process, I'll focus here on a GCIA-centric topic: Scapy. Scapy is essential to the packet analyst skill set on so many levels ...
HolisticInfoSec™