Andy's Digital Forensics

2019年8月18日星期日

\\IP\d$

\\192.168.11.11\d$

2019年8月11日星期日

how to get the windows IP configure from a disk

Browse to %SystemRoot%\System32\Config of the attached drive
Open System.dat
Browse to HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces
There may be several interfaces listed. Just start clicking, and you'll find the correct interface. The IP address, as well as any other static network information (subnet mask, default gateway, etc)

the information is loacated on the system hive and locate the correct path .

2019年7月17日星期三

how to use logparse to parse IIS log

logparser -i:IISW3C "select date, time ,cs-method, cs-uri-stem, c-ip, cs-uri-query, cs(User-Agent) from LogFiles\W3SVC1\*.log where sc-status <> 404" -o:CSV

2019年5月24日星期五

webgoat 8.0.0 M25 XSS (mitigated)

It’s your turn!
Try to prevent this kind of XSS by creating a clean string inside of the saveNewComment() function. Use the "antisamy-slashdot.xml" as policy file for this example:

==================== the following doesn't pass the test ========

import org.owasp.validator.html.*;
import MyCommentDAO;
import org.owasp.validator.html.AntiSamy;
import org.owasp.validator.html.Policy;

public class AntiSamyController {

//aspantisamy/Java/antisamy-smoketest/src/main/webapp/WEB-INF/policies/antisamy-slashdot.xmu
//static String policyFileName ="antisamy-slashdot.xml";
//public static Policy policy ;
//public static AntiSamy antisamy;
//antisamy= new Antisamy();
//policy=Policy.getInstance(policyFileName);
//String XSSPossible ="<script> alert('vulnerable,');</script>";
public void saveNewComment(int threadID, int userID, String newComment){
// int thID = antiSamy.scan(XSSPossible , policy);
// int uID = antiSamy.scan(XSSPossible , policy);
// policy
// antisamy.setPolicy("antisamy-slashdot.xml");

String filename = Core.getConfiguration().getResourcesPath() +
AntiSamy antisamy=new AntiSamy();
Policy policy= Policy.getInstance("src/main/webapp/WEB-INF/policies/antisamy-slashdot.xml");
CleanResults cr=antisamy.scan( newComment ,policy );
String nCom= cr.getCleanHTML();
MyCommentDAO.addComment(threadID, userID, cr.getCleanHTML());
}
}

2019年5月23日星期四

WEBGOAT 8.0.0.M25 XSS mitigated

Reflective XSS
See the HTML file below which passes data to a JSP file.

<html>
<body>
<form action = "main.jsp" method = "POST">
First Name: <input type = "text" name = "first_name">
<br />
Last Name: <input type = "text" name = "last_name" />
<input type = "submit" value = "Submit" />
</form>
</body>
</html>
Here is the JSP file:

<html>

<head>
<title>Using GET and POST Method to Read Form Data</title>
</head>

<body>
<h1>Using POST Method to Read Form Data</h1>
<table>
<tbody>
<tr>
<td><b>First Name:</b></td>
<td><%= request.getParameter("first_name")%></td>
</tr>
<tr>
<td><b>Last Name:</b></td>
<td>
<%= request.getParameter("last_name")%>
</td>
</tr>
</tbody>
</table>
</body>

</html>
As you can see the JSP file prints unfiltered user input which is never a good idea. You want people to accesses the page like this:

http://hostname.com/mywebapp/main.jsp?first_name=John&last_name=Smith
But what happens if someone uses this link:

http://hostname.com/mywebapp/main.jsp?first_name=<script>alert("XSS Test")</script>
It is your turn!
Try to prevent this kind of XSS by escaping the url parameters in the JSP file:

<html>
<head>
<title>Using GET and POST Method to Read Form Data</title>
</head>
<body>
<h1>Using POST Method to Read Form Data</h1>
<table>
<tbody>
<tr>
<td><b>First Name:</b></td>
<td>YOUR CODE HERE</td>
</tr>
<tr>
<td><b>Last Name:</b></td>
<td>YOUR CODE HERE</td>
</tr>
</tbody>
</table>
</body>
</html>
＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝＝

<%@taglib prefix="e" uri="https://www.owasp.org/index.php/OWASP_Java_Encoder_Project" %>
<html>
<head>
<title>Using GET and POST Method to Read Form Data</title>
</head>
<body>
<h1>Using POST Method to Read Form Data</h1>
<table>
<tbody>
<tr>
<td><b>First Name:</b></td>
<td>${e:forHtml(param.first_name)}</td>
</tr>
<tr>
<td><b>Last Name:</b></td>
<td>${e:forHtml(param.last_name)}</td>
</tr>
</tbody>
</table>
</body>
</html>

2019年3月17日星期日

windows SAM user check

as title
SAM is located at
C:\Windows\System32\config\SAM

2019年1月6日星期日

鑑識作業系統是 64 或是 32

https://support.microsoft.com/en-gb/help/556009

https://www.thewindowsclub.com/where-are-the-windows-registry-files-located-in-windows-7

2019年8月18日 星期日

\\IP\d$

2019年8月11日 星期日

how to get the windows IP configure from a disk

2019年7月17日 星期三