Great Scott Gadgets HackRF One – Receptor de señales de Radio
This is the HackRF One, a Software Defined Radio (SDR) peripheral capable of transmission or reception of radio signals from 10MHz to 6GHz. Designed to enable test and development of modern and next generation radio technologies, HackRF One is an open source hardware platform that can be used as a USB peripheral or programmed for stand-alone operation. If you are wondering what a SDR actually is, it’s OK we can help. A Software Defined Radio is essentially a radio communication device that implements the use of software instead of the typically implemented hardware (these would include mixers, amps, and modulators […]
iTextsharp
iText is a PDF library that allows you to CREATE, ADAPT, INSPECT and MAINTAIN documents in the Portable Document Format (PDF): Generate documents and reports based on data from an XML file or a database Create maps, exploiting numerous interactive features available in PDF Add bookmarks, page numbers, watermarks, and other features to existing PDF documents Split or concatenate pages from existing PDF files Fill out interactive forms Serve dynamically generated or manipulated PDF documents to a web browser iText is used by Java, .NET, Android and GAE developers to enhance their applications with PDF functionality. iTextSharp is the .NET […]
The Volatility Framework
The Volatility Framework is a completely open collection of tools, implemented in Python under the GNU General Public License, for the extraction of digital artifacts from volatile memory (RAM) samples. The extraction techniques are performed completely independent of the system being investigated but offer visibilty into the runtime state of the system. The framework is intended to introduce people to the techniques and complexities associated with extracting digital artifacts from volatile memory samples and provide a platform for further work into this exciting area of research. More information https://github.com/volatilityfoundation/volatility
Seguridad informática con PowerShell
Introducción Confidencialidad
1 2 3 4 5 | #Habilitar BitLocker Enable-BitLocker -MountPoint "f:" -RecoveryPasswordProtector -UsedSpaceOnly -Verbose #Deshabilitar BitLocker Disable-BitLocker -MountPoint "f:" |
Integridad
1 2 3 4 5 6 7 | #Calcular hash para un archivo Get-FileHash D:\power\fichero.txt -Algorithm MD5 Get-FileHash D:\power\fichero.txt -Algorithm SHA1 Get-FileHash D:\power\fichero.txt -Algorithm SHA256 Get-FileHash D:\power\fichero.txt -Algorithm SHA384 Get-FileHash D:\power\fichero.txt -Algorithm SHA512 Get-FileHash D:\power\fichero.txt -Algorithm RIPEMD160 |
Seguridad física Analizar el hardware de los equipos de la empresa
1 2 3 4 5 6 7 8 9 10 11 | $credenciales=Get-Credential 1..254 | %{ (Get-WmiObject Win32_AutochkSetting -ComputerName ('192.168.1.'+$_) -Credential $credenciales).SettingID (Get-WmiObject Win32_BaseBoard -ComputerName ('192.168.1.'+$_) -Credential $credenciales).Manufacturer (Get-WmiObject Win32_BIOS -ComputerName ('192.168.1.'+$_) -Credential $credenciales).Version (Get-WmiObject Win32_Bus -ComputerName ('192.168.1.'+$_) -Credential $credenciales).DeviceID Get-WmiObject Win32_Processor -ComputerName ('192.168.1.'+$_) -Credential $credenciales Get-WmiObject Win32_SystemEnclosure -ComputerName ('192.168.1.'+$_) -Credential $credenciales Get-WmiObject Win32_Battery -ComputerName ('192.168.1.'+$_) -Credential $credenciales Get-WmiObject Win32_Printer -ComputerName ('192.168.1.'+$_) -Credential $credenciales } |
Ver dispositivos conectados (móviles, almacenamiento USB, etc.)
1 2 3 4 5 6 | Get-PnpDevice | Where-Object { $_.class -EQ 'USBDevice' } | Select-Object FriendlyName Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USBSTOR\*\*\' | Where-Object { $_.FriendlyName } | Select-Object FriendlyName Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\USB\*\*\' | Where-Object { $_.FriendlyName } | Select-Object FriendlyName Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\USB\*\*\' | Where-Object { $_.FriendlyName } | Select-Object FriendlyName Get-ItemProperty -Path 'Registry::HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\USBSTOR\*\*\' | Where-Object { $_.FriendlyName } | Select-Object FriendlyName |
Seguridad lógica Ver información sobre usuarios y grupos (usuario que ha iniciado sesión)
1 | [System.Security.Principal.WindowsIdentity]::GetCurrent() |
Crear usuarios y grupos (procedimiento de creación)
1 2 3 4 5 6 7 8 9 10 11 | #Es necesario abrir PowerShell como administrador #Crear un usuario local con contraseña en Windows 10 con PowerShell 5.1 $pass=ConvertTo-SecureString "11234aaa@@€dsf" -asplaintext -force New-LocalUser usuario -Password $pass #Crear un grupo local en Windows 10 con PowerShell 5.1 New-LocalGroup grupo #Añadir usuarios a un grupo local en Windows 10 con PowerShell 5.1 Add-LocalGroupMember -Member usuario -Group administradores |
Analizar el software de los equipos de la empresa
1 2 | #Programas instalados Get-Package |
Analizar los programas que están instalados en los equipos de la empresa y ver la relación que tienen con los procesos y servicios
1 2 3 4 | #Mostrar los procesos que se están ejecutando en relación con los servicios (solo llamadas WMI y más información) (Get-WmiObject -Class Win32_Service | Where-Object State -EQ 'Running') | %{ Write-Host $_.Name,$_.ProcessId,$_.State,(Get-WmiObject -Class win32_process | Where-Object ProcessId -EQ $_.ProcessId | select name, Path, ExecutablePath, CommandLine) } |
Analizar los programas que están instalados en los equipos de la empresa y ver la relación que tienen con […]
Artefactos
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 | #Shellbags #Más información https://digital-forensics.sans.org/blog/2011/07/05/shellbags Get-ChildItem HKCU:\Software\Microsoft\Windows\Shell Get-ChildItem HKCU:\Software\Microsoft\Windows\ #Registros HIVE Get-ChildItem HKLM:\SAM Get-ChildItem HKLM:\SECURITY Get-ChildItem HKLM:\SOFTWARE Get-ChildItem HKLM:\HARDWARE #Información sobre programas ejecutados (Prefetch) Get-ChildItem C:\Windows\Prefetch #Información sobre navegadores Get-ChildItem C:\Users\user\AppData\Local\Microsoft\Windows\History Get-ChildItem C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles #Ficheros temporales Get-ChildItem C:\Windows\Temp #Ficheros temporales de los usuarios Get-ChildItem C:\Users\user\AppData\Local\Temp #Información sobre el hardware Get-ChildItem C:\Windows\Inf #Información sobre USB Get-ChildItem HKLM:\SYSTEM\ControlSet001\Enum\USB Get-ChildItem HKLM:\SYSTEM\ControlSet001\Enum\USBSTOR Get-ChildItem HKLM:\SYSTEM\CurrentControlSet\Enum\USB Get-ChildItem HKLM:\SYSTEM\CurrentControlSet\Enum\USBSTOR Get-ChildItem 'HKLM:\SOFTWARE\Microsoft\Windows Portable Devices\Devices' Get-ChildItem 'HKLM:\SYSTEM\ControlSet001\Control\DeviceClasses' #Información acerca de las acciones de instalación durante la instalación Get-Content C:\Windows\setupact.log #Información sobre los errores de instalación durante la instalación Get-Content C:\Windows\setuperr.log |
Vulnhub
To provide materials that allows anyone to gain practical ‘hands-on’ experience in digital security, computer application & network administration. Download https://www.vulnhub.com/
Read Meta Information (ExifTool)
1 2 3 4 5 6 7 8 9 | #ExifTool is a platform-independent Perl library plus a command-line application for reading, writing and editing meta information in a wide variety of files. ExifTool supports many different metadata formats including EXIF, GPS, IPTC, XMP, JFIF, GeoTIFF, ICC Profile, Photoshop IRB, FlashPix, AFCP and ID3, as well as the maker notes of many digital cameras by Canon, Casio, FLIR, FujiFilm, GE, HP, JVC/Victor, Kodak, Leaf, Minolta/Konica-Minolta, Nikon, Nintendo, Olympus/Epson, Panasonic/Leica, Pentax/Asahi, Phase One, Reconyx, Ricoh, Samsung, Sanyo, Sigma/Foveon and Sony. #ExifTool is installed in the local ls F:\power\fotos\fotos | %{ $_ $meta=([xml](.\exiftool.exe $_.FullName -X)).rdf.description $meta } |