The Best Online Tech Courses Available

Disclaimer: I am not a employee of any of the online course platforms mentioned nor an I sponsored by any of the instructors who course(s) I recommend. I have purchases all courses with my own money.



Criteria
My criteria for evaluating a course are based on:

• Target Audience: Is there a clear explanation as to who the target audience is for the course?
• Supplemental Content: Is there additional content to help aid in teaching or reinforcing a skill?
• Instructor Participation: Is there interaction with the students (i.e. answer questions, etc)?
• Update(s): Are there significant updates to the course to keep if relevant?

Study Skills
Before one embarks on their journey of learning it is best to understand the actual learning process and the variations for which it can occur. 

Website
Udemy

Course(s) Title
Improve Your Focus
Improve Memory

Price
The price of the course(s) will vary based on which promotional sale discount is in effect at the time of ones purchase.

Content
The courses might seem like they cover commonly known knowledge on the subject matter but it's taken a step further by intricacies that encompass the successes and the deficiencies of them. The author provides the why, what, and how to improve the efficiency of ones ability to Focus and to Memorize information. Each course is composed multiple sections filled with short videos, self assessment test, games, and additional websites & videos for one to consume. The author is very enthusiastic about the topics and has a smooth voice to convey his messages.

Personal Note
I found the presented information from the courses quite helpful as they have shown me where my personal deficiencies lie in regards to being able to focus on content and maintain it in memory. Everyone is different but I believe understanding where your personal deficiencies lie will aid in your ability to succeed with your studies especially for technology related studying.

Cloud Computing
With cloud computing being implemented into more organizational environments every year acquiring skills in the discipline is a requirement for future job advancement. For learning multiple skill sets and vendor specific cloud certifications the following is a great resource.

Website
Acloud.guru

Price
Subscription base with price options that vary per the length of ones choice subscription.

Content
Amazon Web Services (AWS), Microsoft Azure, and Google Cloud. The content is updated regularly to keep in line with any changes to the vendor specific certifications. The supplemental content comes by way of labs that follow up lessons to reinforce the core message of the lessons. There is a skill progression per course which recommends one takes the courses in order for maximum value. One can take comfort in knowing courses designed for beginners don't require any prerequisites cloud knowledge or experience making it a great way to break into the field.

Free 7-Day Trial
Trial

Personal Note
I purchased their Amazon Solutions Architect Associate certification training and used it to pass my certificate exam. I have bought several other of their courses pertaining to AWS and will look to pass more certification exams in the near future.

Cyber Security
In the world of Cyber Security certifications are an important part of field. In various industries where cyber security professional are employed specific certification are required for one to even have the ability to sit for an interview let alone be employed in the position. With that being said the once expensive pay wall that separated cyber security professionals from high quality and effective training for Cyber Security certifications has been removed with the advent of multiple online arenas like Cybrary, Linux Academy, etc. 

Website
Infosec4tc

Price
The price of the course(s) will vary based on which promotional sale discount is in effect at the time of ones purchase.

Content
There are various courses on all the major technical (Linux+, OSCP, Smart Phone Forensics) and management level cyber security certifications (CISM, CISSP, CCSP). The author provides a plethora of additional material for each of the course offerings. The author has a high pass rate for the various cyber security certifications.

Free Course
Build Your Career in Information Security from Scratch

Personal Note
I have purchased and am currently working through the Ethical Hacking Bundle. It has several courses focused on teaching one the skills sets needed to pass the Offensive Security Certified Professional exam. 


Conclusion
There is a vast number of readily available and low cost online courses to allow one to take the necessary steps to advance their career in the field of cyber security. Your future development is in your hands. I will leave you with these inspirational words from Yoda, "There is no TRY, only DO." So use this information wisely, share it with others, and enjoy your educational journey.



Social Media
Facebook:
https://www.facebook.com/BDavisCS/

Twitter:
@BDavis_CyberSec

Forensics: Imaging a Drive

Background 

This blog post will cover how to image a hard drive(s) of a workstation/desktop computer. The process for imaging a large scale server will differ from these steps.   

Purpose 
Imaging is used to create a 1 to 1 copy of a drive. Forensics will be performed on the copy of the drive to gather evidence. The Chain of Custody is used to ensure that the processes used to obtain the image and the forensic evidence will hold up in legal proceedings.  

Requirements
Live Boot USB/CD  

• Create a Live Boot USB/CD of a forensics oriented operating system. For the purpose of this blog post we will be using Kali Linux. 

Zero Drive

• Zero Drive refers to a drive that has been over written with zeros.  

Methodology
When Imaging a drive for the purpose of evidence collection one must always adhere to the Chain of Custody[1]. The Chain of Custody is a set of standards and procedures designed to preserve the integrity of the data collected for legal proceedings. 


Use Cases
There will be two primary scenarios for acquiring a forensic image:

• The hard drive is NOT connected to the computer.
• Solution: Attach the drive to a forensic workstation using a Write Blocking mechanism.
• The hard drive is still connected to a powered down computer.
• Solution: Use a Forensic Live USB/CD and have the computer boot from the attached USB/CD. 

 Concepts 

• Reasons to Split an Image File:
• If the media you are imaging is larger than the media it is being imaged too, then split the image into smaller files for transferring across multiple devices.
• If you are trying to transfer a large FAT32 Image, then you must split it into files less than 4gigs in size. This is do to the fact that FAT32 supports a maximum file size of 4GB.

How To

Create a Zero Drive
Steps:
1. Boot into Kali Linux.
2. Connect the drive.
3. Run the following command:

• sudo dc3dd wipe=/dev/sda dc3dd
• This will over right all data on the drive using zeros.

Acquiring The Image[2]

Steps:

1. Identify

• Verify the drive to be imaged from the list of available drives. Using 1 of 2 methods:

• Run command the following command to show a list of available drives:
• fdisk -I
• If the drive is removed from the computer then compare the physical label on the drive to the output from the following command:
• hdparm -I /dev/sda
• Disk Name will be in the format of:
• /dev/sDN
• D - device
• N - name
• To Image the whole drive DO NOT include a number in the drive name
• Incorrect:  /dev/sda1, /dev/sda2, etc
• Correct: /dev/sda

• Select a location (a Zero Drive) to save the image file to using the following command:
• df -h: displays see the location of where your external Drive is mounted.

2. Run The dc3dd tool

• To Image a FAT32 drive you will need to split the Image file using the following:
• “hofs” option
• Requires that you add the Format Specifier to the file name.
• Format Specifier - is used to set a pattern for a sequence of file extensions.
• BEST Practice: always use three numerical digits at the end of your .img naming scheme because AFF only recognizes names in that format.
• Example: If you included “00” to the end of the file extension .img, then the file set would be the following .img.00, .img.01, .img.02, ext
• “ofsz” option
• Purpose: set the maximum size of each file in the sets of files specified.
• For FAT32 set the file size to under 4GB.

• Syntax:
• dc3dd if=Name_Of_Disk_To_Image /Full_Path_Of_Location_To_Save_The_Disk_Image/Image_Name.img
• example:
• Dc3dd if=/dev/sda /media/root/47bf-5c55/forensics/cases/
• Add option(s) to the command for hashing
• “hof” option
• Purpose: write output to a file or device.
• To use it place it in front of the “/Full_Path_Of_Location_To_Save_The_Disk_Image/Image_Name.img”
• Syntax:
• hof=/Full_Path_Of_Location_To_Save_The_Disk_Image/Image_Name.img
• “hash” option
• Purpose: compute an ALGORITHM hash of the input and also of any outputs specified.
• Place it at the end of the “hof” command
• Syntax:
• hash=(select one of the following:)md5,sha1,sha-256,sha-512
• “log” option
• Purpose: Log input/output statistics, diagnostics, and total hashes of input and output to file.
• Syntax:
• log=Full_Path_of_Location_to_Store_log_files/Log_File_Name.log

Resources 
1. An Open Extensible Format for Disk Imaging
2. Digital Forensics with Kali Linux
    ISBN: 9781783989225

 
References
1. Chain of Custody
2. Digital Forensics with Kali Linux
    ISBN: 9781783989225


Social Media
Facebook:
https://www.facebook.com/BDavisCS/

Twitter:
@BDavis_CyberSec

Cyber Security Analyst (Part 3 of 3)

Writing Snort Signatures

This series will cover analyzing the common data types found in cyber security incidents; Netflow,  Domain(s) & IP address(es), PCAP. The format of the posts will be as follows Background information, Concepts & Techniques, Tools, and Recommended reading and/or videos.


Background
Intrusion Detection Systems (IDS) perform network packet inspection for predefined criteria. Its capabilities are to alert and/or collect Packet Capture (PCAP) data related to the predefined criteria.

Overview
For the purpose of this blog we are going to be reviewing the Snort IDS. The information in this blog is design to help people create Snort signatures.

 When creating snort rules remember that you might not have complete inbound/outbound traffic sensor coverage of your network. The longer the duration of PCAP collection the larger the file.  Include documentation on why you are collecting/alerting on the information provided in your signature. Have a set review period for when you will re-evaluate the effectiveness of the signature based on the data collected and its false positive to true positive ratio.

Operators[1]

• \ - used to indicate the end of a line.
• Negation "!" - tells Snort to match any IP address except the one indicated by the listed IP address.
• [] - are used in the "Rules Action" section to define a set.
• () - the contents inside the parenthesis are the "Rule Options" section.
• Range ":" - used to define a range of numbers for the rule to take action on. The start of the range goes on the left of the : The end on the right side.
• Directional "->" - indicates the orientation or direction of the traffic that the rule applies to.
• BiDirectional "<>" - tells Snort to consider the address/port pairs in either the source or destination orientation.

Basics

• Most rules are single line.
• To do multiple line rules use the backslash \ to end the line.
• Rule are divided into two logical section, "Rule header" and "Rule Options".
• Rule Header: contains the rule's action, protocol, source and destination IP addresses and netmask, and the source and destination ports information. The text up to the first parenthesis is the rule header.
• Rule Option: contains alert messages and information on which parts of the packet should be inspected to determine if the rule actions should be taken. The contents enclosed in the parenthesis contains the rule options.
• (Best Practices) Separate the "Rule header" and "Rule options" onto separate lines making it easier to view both sections.

Rule Components

Rule Header = (Action + Protocol + SourceIP + Source Port) Directional or BiDirectional notation (destIP + destport)

Rule Options = Message + Flow + Reference + Classtype + sid/rev

Snort  Rule equation = Rule Header + Rule Options



Rule Creation Steps

1. Rule action

• Rule action(s) take effect on one of the supported protocols the user can specify.
• 
  
• There are 5 default "Rule Actions" available to in Snort:
• Alert - generate an alert using the selected alert method, and then log the packet.
• Log - log the packet.
• Pass - ignore the packet.
• Activate-alert and then turn on another dynamic rule.
• Dynamic - remain idle until activated by an activate rule, then act as a log rule.

2. Protocols

• After the "Rule Action" is chosen the next field in the rule is the "Protocol"
• Snort analyzes the following protocols TCP, UDP, ICMP, and IP.

3. IP Address

• The keyword "any" may be used to define any address.
• Write IP addresses in numeric four octate format and include a CIDR block. 
• (i.e. xxx.xxx.xxx.xxx/24)
• CIDR block indicates the netmask (range of IP addresses) that should be applied to the rule's address and any incoming packets that are tested against the rule.

4. Port Numbers

• After the "Protocol" is chosen the next field in the rule is the "Port Number".
• The keyword "any" may be used to define any port number.

5. The Direction Operator

• Directional -> - indicates the orientation or direction of the traffic that the rule applies to.
• BiDirectional <> - tells Snort to consider the address/port pairs in either the source or destination orientation.

Detection Options[1]
Content
Allows the user to set rules that search for specific content in the packet payload and trigger response based on that data. Whenever a content option pattern match is performed, the Boyer-Moore pattern match function is called and the (rather computationally expensive) test is performed against the packet contents. If data exactly matching the argument data string is contained anywhere within the packets payload, the test is successful and the remainder of the rule option tests are performed.
Be aware that this test is case sensitive.
Options:

• nocase
• Used to specify that the Snort should look for the specific pattern, ignoring case.
• rawbytes
• Used to look at the raw packet data, ignoring any decoding that was done by pre-processors.
• depth
• Used to specify how far into a packet Snort should search for the specified pattern based on a chosen byte value.
• only values greater than or equal to the pattern length can be searched. The minimum byte value is 1 and the maximum byte value is 65535.
• Syntax:
• depth: [<number>|<var_name>]
• offset
• Used to specify where to start searching for a pattern within a packet based on a chosen byte value.
• The byte ranges from -65535 to 65535.
• Syntax:
• offset:[<number>|<var_name>]
• distance
• Used to specify how far into a packet Snort should ignore before starting to search for the specified pattern relative to the end of the previous pattern match.
• syntax:
• distance:[<byte_count>|<var_name>]
• within
• Used to make sure that at most N bytes are between pattern matches using the content keyword.
• Syntax:
• within:[<byte_count>|<var_name>]
• http_client_body
• Used to restrict the search to the body of an HTTP client request.
• Syntax:
• http_client_body

References
1. Snort


Social Media
Facebook:
https://www.facebook.com/BDavisCS/

Twitter:
@BDavis_CyberSec

Cyber Security Analyst (Part 2 of 3)

PCAP Data Analysis

This series will cover analyzing the common data types found in cyber security incidents; Netflow,  Domain(s) & IP address(es), PCAP. The format of the posts will be as follows Background information, Concepts & Techniques, Tools, and Recommended reading and/or videos.



The information in this blog is design to help people analyzing PCAP data. There are many programs which can automate the manipulation and organization of PCAP data for the end user. I believe it is always a good idea to know how to perform these task manually because every environment will be different. For the purpose of this blog post we'll be covering the use of open source PCAP analysis tool Wireshark.


Tools
The list tool is a free open source tool for Linux and Windows:

• Wireshark

Background
Having a working understanding of the PCAP filters are essential to being able to read PCAP data.

A. Wireshark  Filters [1]
1. HTTP header information

• Description: used to analyze the packet HTTP header information
• Syntax:
• http."option"
• Commonly used "option(s)"
• http.user_agent
• http.response
• http.connection

  2. TCP session information

• Description: used to analyze the packet TCP session information
• Syntax:
• tcp."option(s)"
• Commonly used "option(s)"
• tcp.analysis.flags
• tcp.flags
• tcp.srcport

3. SSL connection

• Description: used to determine if an SSL connection was established.
• Syntax
•  
• Commonly used "option(s)"
• ssl.handshake

4.  System communications

• Description: used to determine who the system is trying to communicate with and how often.
• Syntax:
• dns."option(s)"."option(s)"
• Commonly used "option(s)"
• dns.qry.name
• dns.resp.addr
• dns.resp.name

5. Text search

• Description: used to search for specific text inside of a packet.
• Syntax:
• frame contains "text"
• Common text to search for
• "Dos"
• ".exe"

Concepts & Techniques
Two things to look for in PCAP when looking for signs of potential malicious activity are magic numbers and Base64.

A. Magic Numbers [2]
Common in programs across many operating systems. Magic numbers implement strongly typed data and are a form of in-band signaling to the controlling program that reads the data type(s) at program run-times. Detecting such constraints in files is a simple and effective way of distinguishing between many file formats and can yield further run-time information.

• GIF image file:
• ASCII cod 
• "GIF89a" (47 49 46 38 39 61) 
• "GIF87a" (47 49 46 38 37 61)

• JPEG image file:
• Begins with "FF D8" and ends with "FF D9"

• Postscript file:
• start with "%!" (25 21)

• MS-DOS exe file:
• start with 
• "MZ" (4D 5A)
• "ZM" (5A 4D) - is NOT as common

B. Base64 [3]
A group of similar encoding schemes that represent binary data in an ASCII string format by translating it into a Radix-64 representation. Base64 encoding schemes are commonly used when there is a need to encode binary that needs to be stored and transferred over media that are designed to deal with textual data. This is done to ensure that the data remains intact without modification during transport.

• Characters [A-Z], [a-z],[0-9],[+],[/]
• Padding: 
• "==" indicates last group contained only 1 bytes. 
• "=" indicates that it contained 2 bytes.

References 

1. Wireshark Filters
2. Magic Numbers
3. Base64
   

Recommended Reading and/or Videos

• Real Digital Forensics: Computer Security and Incident Response by Keith J. Jones, Richard Bejtlich, and Curtis W. Rose.
• ISBN-13: 978-0321240699
   
• Extrusion Detection: Security Monitoring for Internal Intrusions by Richard Bejtlich, foreword by Marcus Ranum.
• ISBN-13: 978-0321349965

 
Social Media
Facebook:
https://www.facebook.com/BDavisCS/

Twitter:
@BDavis_CyberSec

Cyber Security Analyst (Part 1 of 3)

Netflow Data Analysis
This series will cover analyzing the common data types found in cyber security incidents; Netflow,  Domain(s) & IP address(es), PCAP. The format of the posts will be as follows Background information, Concepts & Techniques, Tools, and Recommended reading and/or videos. 



The information in this blog is design to help people analyzing Netflow data. There are many programs which can automate the manipulation and organization of Netflow data for the end user. I believe it is always a good idea to know how to perform these task manually because every environment will be different.



Background
Having a working understanding of the Threeway Handshake, Session Flags, Port Numbers, and Domain Name System (DNS) are essential to being able to read Netflow data.

A. Threeway Handshake

• Threeway Handshake is used to establish a connection between a client and a server. 
• Client is a device which request services. 
• Server is a provider of services to clients. 
• Threeway Handshake Process: 
1. Client sends a "SYN" flag to the server  
2. Server responses with "SYN-ACK"   
3. Client sends a "ACK" flag  
4. The connection is now complete. 

B. Session Flags [1]

• URG (1 bit)  indicates that the Urgent pointer field is significant 
• ACK (1 bit)  indicates that the Acknowledgment field is significant. All packets after the initial SYN packet sent by the client should have this flag set. 
• PSH (1 bit)  Push function. Asks to push the buffered data to the receiving application. 
• RST (1 bit)  Reset the connection SYN (1 bit)  Synchronize sequence numbers. Only the first packet sent from each end should have this flag set. Some other flags change meaning based on this flag, and some are only valid for when it is set, and others when it is clear. 
• FIN (1 bit)  No more data from sender

C. Port Numbers [2]

• Port Numbers can be linked to certain applications and services to give one a better idea of the type of activity which is occurring during the communication they are observing. 
• Port number: 1 - 1023 well know server services. 
• Port numbers 1024 - 5000 ephemeral port numbers. 
• An ephemeral port is a short-lived transport protocol port for Internet Protocol (IP) communications allocated automatically from a predefined range by the TCP/IP software.

D.  Domain Naming System (DNS)

• DNS interactions are required for all internet activity.
• DNS Process:
1. Client issues a DNS query.
2. A DNS Server accepts the query.
3. If the first DNS server does not know the answer to the query request, then it will ask additional DNS servers.
4. When the DNS server receives the answer to the DNS query, it returns the Domain to the client.

Concepts & Techniques
The Netflow data is used to confirm activity through correlation of information across different mediums. For example correlating network traffic with system logs to determine what the system was doing at the specific point in time. When analyzing Netflow data keep the following in mind:

• Netflow data can be queried like a database.
• Organize the data according to the "Time" field preferably the start time option. 
• You may not be able to see the complete session due to network a lack of network coverage.
• Go back a week or a month from the initial date of the suspicious traffic in order to try and establish a normal behavioral pattern to compare the infected system to. 
• A few common attacks that can be observed in Netflow:
• Beaconing
• DDoS
• TCP Reset attack

 

Tools
The list tools are free open source tools for Linux and Windows respectively:

• tcpdump
• WinPCAP

These tools will allow you to capture Netflow data from the network interface of your PC. I recommend practicing observing the Netflow data from your PC while it is idle in order to see which services are continuously communicating with the internet and browsing the web.


Recommended Reading and/or Videos

• Real Digital Forensics: Computer Security and Incident Response by Keith J. Jones, Richard Bejtlich, and Curtis W. Rose.
• ISBN-13: 978-0321240699
   
• Extrusion Detection: Security Monitoring for Internal Intrusions by Richard Bejtlich, foreword by Marcus Ranum.
• ISBN-13: 978-0321349965

References 

1. Transmission Control Protocol
2. Ephemeral Port

Social Media
Facebook:
https://www.facebook.com/BDavisCS/

Twitter:
@BDavis_CyberSec

Cuckoo Sandbox Installation (Part 4 of 4)

This is 4 of a 4 part series on the installation of Cuckoo Sandbox. Part 4 will focus on preparing the guess Operating System of the Virtual Machine for use with the Cuckoo Sandbox.

Patch Management
One of the keys to using Cuckoo successfully is to track the applied patches/updates to your guess Operating System (OS) and application(s) also known as a baseline. The baseline eliminates specific vulnerabilities in certain software based on the applied patch/update level. A baseline allows one to rule out malware which effects vulnerabilities covered by your baseline. My recommendation is to have your baseline patched/updated between 1 - 3 months behind the current month. This is because every environment handles patches/updates differently which can lead to delays in rolling out patches/updates. 


Guess Operating System
Cuckoo supports Linux, Unix, and Windows operating systems. While Linux and Unix Operating systems are targets for malware, Windows is the most used Operating System in the business sector and therefore will be the Operating Systems of focus for this post. My recommendations are to test malware samples on Windows 7 (32-bit/64-bit) or Windows 10 (32-bit/64-bit). 


Steps

1. Guess Operating System Configurations

• Disable the Windows Firewall
• Disable the Windows Defender
• Reason for disabling the above is that organizations use third party vendors to manage those functions (i.e. Norton anti-virus, Sonic wall, etc)

• If possible, set automatic updates to "notify when updates are available and let me chose which ones to download and install."

2. Cuckoo Dependencies [1]

• Download and install Python 2.7
• (Optional) Download and install Python Image Library 1.1.7 for Python 2.7 
• Transfer the Cuckoo Agent via a temporary shared folder between the host and guess operating system.

3. Additional Software

• Install the following commonly used programs: Microsoft Office (2007, 2010, 2013), Adobe Flash player, Adobe Reader, and Java.

4. Plugins

• Add commonly used browser plugins  

5. Paranoid Fish (Pafish)

• Purpose is to help one determine if their Sandbox is detectable by malware.
• Some malware has the capability to detects the presents of a sandbox. If it detects one it will fail to execute preventing one from obtaining any analytical information from it.  
• Installation:
• Download the executable file Paranoid Fish to your Virtual Machine.
• Install the executable.
• Run it.

References
1. Cuckoo Sandbox Documentation.


Social Media
Facebook:
https://www.facebook.com/BDavisCS/

Twitter:
@BDavis_CyberSec

Cuckoo Sandbox Installation (Part 3 of 4)

This is 3 of a 4 part series on the installation of Cuckoo Sandbox. Part 3 will focus on editing the configuration files for the Cuckoo Sandbox. 

Video Instructions
Cuckoo Sandbox Installation Part 3


Steps

To edit the configuration files:

• Open a terminal
• Navigate to the directory of the configuration files 
• /home/YourUserName/Downloads/cuckoo/conf
• Open a specific file using nano editor
• nano FileName
• Replace the value on the right side of the equal sign with a corresponding value (i.e replace "yes" with "no", or change a numerical value). 
• Note: The items in "[ ]" are the section heads within the specific configuration file.  

• Nano editor Basics
• To save the edited file hold the "Ctrl" button on your keyboard and press the "x" button on your keyboard.
• Type "Y"

• How to Find the IP Address of your Windows virtual machine:
• 1. Power on the VM.
• 2. Open a command prompt and type the command:
• ipconfig  

• How to Find the Network Interface of your virtual machine:
• 1. Open a terminal
• 2. Type the command:
• ifconfig
• Look the IP Address range which your VM's IP Address falls within. To the left of the IP Address range will be the name of the Network Interface associated with it. Below is a picture containing an example:
•   
  

• How to Find the vmx_path:
• Type the following command:
•  find / -name "*.vmx"

• How to Find the IP Address of your host machine:
• 1. Open a terminal
• 2. Type the command:
• ifconfig

Configuration Files[1]

• cuckoo.conf 
• nano cuckoo.conf
• [cuckoo]
• memory_dump = on
• machinery = virtualbox or vmware

• [resultserver]
• ip = ip address of the host system not the virtual machine.

• auxiliary.conf
• nano auxiliary.conf
• [mitm]
• enable = yes

• [sniffer]
• interface = the network interface of your virtual machine

• vmware.conf
• nano vmware.conf 
• [vmware]
• machines = name of virtual machine
• interface = name of the network interface for the virtual machine
• [Name_of_the_Virtual_Machine]
• vmx_path = ../name_of_virtual_machine/ name_of_virtual_machine.vmx
• ip = ip address of the virtual machine

• processing.conf
• nano processing.conf
•  [memory]
• enable = yes

• memory.conf
• nano memory.conf
• [basic]
• guest_profile = volatility's profile name for your guest operating system
• Here are a list of profile names for the various Windows operating systems
•  
  

• reporting.conf
• nano reporting.conf 
• [reporthtml]
• enable = yes

• [mongodb]
• enable = yes

References  
1. Cuckoo Sandbox Configuration Files

Social Media
Facebook:
https://www.facebook.com/BDavisCS/

Twitter:
@BDavis_CyberSec 

Cuckoo Sandbox Installation (Part 2 of 4)

This is 2 of a 4 part series on the installation of Cuckoo Sandbox. Part 2 will focus on installing additional functionality to the Host Operating System for the Cuckoo Sandbox. 

Video Instructions
Cuckoo Sandbox Installation Part 2


Steps
All  commands are Italicize. To install the software open a terminal and copy & paste the commands. During the installation of the various software you will be prompted with the options of "Yes/No" type "Yes or Y" to all prompts.

1. Install Django-based web interface [1]

• sudo apt-get install mongodb

2. Install TCPdump [1]

• sudo apt-get install tcpdump
• sudo apt-get install libcap2-bin
• sudo setcap cap_net_raw,cap_net_admin=eip /usr/sbin/tcpdump
• getcap /usr/sbin/tcpdump

3. Install Volatility [2]

• sudo apt install git
• git clone https://github.com/volatilityfoundation/volatility.git
• Navigate to the volatility folder 
• cd /home/YourUserName/volatility
• sudo python setup.py install

4. Install Volatility Plug-ins

• Distorm3
• Download Distorm3  
• Navigate to the Downloads folder
• tar -xvzf distorm-3.4.0.tar.gz
• Navigate to the distorm-3.4.0 folder
• cd /home/YourUserName/Downloads/distorm-3.4.0
• sudo python setup.py install

•  Yara [3]
•  Install autoreconf
• sudo apt-get install autoconf
• Install libtool-bin
• sudo apt-get install libtool-bin
• Download Yara
• Navigate to the Downloads folder
• tar -xvzf yara-3.5.0.tar.gz
• Navigate to the yara-3.5.0 folder
• cd /home/YourUserName/Downloads/yara-3.5.0
• ./bootstrap.sh
• ./configure --with-crypto --enable-magic --enable-cuckoo
• make
• sudo make install 
• sudo -H pip install yara-python

• PyCrypto [4]
• Download PyCrypto
• Navigate to the Downloads folder
• tar -xvzf pycrypto-2.6.1.tar.gz
• Navigate to the pycrypto-2.6.1 folder
• cd /home/YourUserName/Downloads/pycrypto-2.6.1
•  python setup.py build
• sudo python setup.py install

• Openpyxl [5]
• sudo -H pip install openpyxl

• UJSON [6]
• sudo -H pip install ujson

•  IPython [7]
• sudo -H pip install jupyter

5. Install Mitmproxy

• sudo apt-get install python3-pip python3-dev libssl-dev libtiff5-dev libjpeg8-dev zlib1g-dev libwebp-dev
• sudo pip3 install mitmproxy
• mitmproxy
• cd ~/.mitmproxy
• cp mitmproxy-ca-cert.p12 /home/YourUserName/Downloads/cuckoo/analyzer/windows/bin/cert.p12 
•  mitmdump = /usr/local/bin/mitmdump

References
1. Cuckoo Sandbox Documentation
2. Volatility Documentation
3. Yara Documentation
4. PyCrypto Documentation
5. OpenPyxl Documentation
6. UJSON Documentation
7. IPython Documentation


Social Media
Facebook:
https://www.facebook.com/BDavisCS/

Twitter:
@BDavis_CyberSec

Cuckoo Sandbox Installation (Part 1 of 4)

This is the first of four parts series on the "Installation of Cuckoo Sandbox." Part 1 will focus on preparing the Host Operating System. 

Video Instructions
Cuckoo Sandbox Installation Part 1

Background
In order to successfully install Cuckoo Sandbox you must setup the required environment. The required software is Linux, Python, and a virtualization platform (i.e Virtualbox or VMware Player).

Steps

All  commands are Italicize. To install the software open a terminal and copy & paste the commands. During the installation of the various software you will be prompted with the options of "Yes/No" type "Yes or Y" to all prompts. 

1. Linux

• Install Linux as your main operating system. This can be any distribution of Linux. (My choice was  Ubuntu 16.04).
• Run the update command to update your Linux distribution. 
• sudo apt-get update

2. Python libraries [1]

•   Install the dependencies 
•  sudo apt-get install python python-pip python-dev libffi-dev libssl-dev 

• Install libxml2-dev and libxslt-dev 
• sudo apt-get install libxml2-dev libxslt-dev

•  Install the requirements from the requirements text file using PyPI 
• Download Cuckoo Sandbox and extract it.  
• Command to extract the .tar.gz file: tar -xvzf 
• Example: tar -xvzf FileName.tar.gz
• Navigate to the cuckoo folder:
• cd /home/YourUserName/Downloads/cuckoo
• sudo -H pip install -r requirements.txt 
• sudo -H pip install --upgrade pip

 3. Virtualization Software

• Install VMware player
• Download VMWare Workstation Player for Linux
• Navigate to 
• cd/ home/YourUserName/Downloads

• sudo chmod u+x VMWare-Player-12.5.1-4542065.x86_64.bundle
• sudo ./VMWare-Player-12.5.1-4542065.x86_64.bundle

4. Create a user for cuckoo

• sudo adduser cuckoo

References:
1. Cuckoo Sandbox Documentation


Social Media
Facebook:
https://www.facebook.com/BDavisCS/

Twitter:
@BDavis_CyberSec