Ultimate Hacklab – Self Paced (SP)

Ultimate hacklab – Self Paced (SP) – prep for hacking challenge lab exams like OSCP, LPT, eCPPT, and soon even the new CEH is going to be a hacking challenge lab as well.

If you really want to know what it takes to pass hack lab challenge-based exams like OSCP, LPT, eCPPT then ultimate hacklab is for you and it’s only $50.

The InfoSec Addicts Ultimate hacklab – Self Paced (SP) – is best way for you to practice the skills required for almost any hands-on lab based penetration testing/ethical hacking certification.

The Ultimate hacklab – Self Paced (SP) – gives you the opportunity to follow along with a structured and very detailed training program, and/or make your way through the labs and just ask for help whenever you get stuck. You can run almost any tool and try almost attack in the environment. The class is self-paced. You can sign-up ANYTIME, and start IMMEDIATELY.

The program outlines how to create your own lab environment or you can connect to the InfoSec Addicts lab environment with almost any platform (Windows, Mac OS X, Kali Linux, other Linux distros) to go through the lab exercises.

Class syllabus:

  • Module 1: Connecting via VPN to the lab network
    • Connecting to the VPN with Windows
    • Connecting to the VPN with Mac OS X
    • Connecting to the VPN with Linux
    • Connecting to the VPN with Kali
  • Module 2: Scanning
    • Nmap
    • Net-Discover
  • Module 3: Module X: Enumeration
    • nmap NSE
    • rpcinfo/showmount
    • nbtstat
    • enum4linux
  • Module 4: Brute-forcing
    • Hydra
    • Medussa
  • Module 5: Vulnerability Scanning
    • Nessus
    • OpenVas
  • Module 6: Attacking web servers/web apps
    • Manual XSS/SQL Injection/LFI/RFI
    • Nikto
    • Dirbuster
    • Burp Suite
    • w3af
    • Arachni
  • Module 7: Compiling/Modifying Exploit code
    • Compiling code in Windows
    • Compiling code in Linux
    • Finding offsets
    • Changing out shellcode
  • Module 8: Client-Side Exploitation
    • Metasploit
    • Social Engineering Toolkit
  • Module 9: Transferring files
    • FTP
    • TFTP
    • VBscript
    • Debug,exe
    • wget/linux/bitsadmin
    • PowerShell
  • Module 10: Privilege Escalation
    • Linux
      • SUID binaries
      • Shell escapes
    • Windows
      • Identifying vulnerable services/misconfigurations
      • beR00t.exe
  • Module 11: Data-mining a compromised host
  • Module 12: Hashcracking
  • Module 13: Pivoting
    • Netcat/Socat pivot
    • SSH Pivot
    • Metasploit pivot
  • Module 14: Lateral movement
    • psexec
    • smbexec
    • winexe
  • Module 15: Data Exfiltration
    • ICMP Tunneling
    • DNS Tunneling
  • Module 16: Reporting

 

Lab Network Access

Targets in the lab network will change on the 1st of every month. Students have the option to purchase 3 months access to the lab environment.

 

Students will receive:

  • Up to 124 hours of CPEs (24 CPE for the actual training and the rest come from labs and challenges completed by the students)
  • Several virtual machines
  • Courseware access
  • Lab Manual
  • Lab access

 

Class Videos

Each course module has a corresponding video that demonstrates the task being performed. So you can see each individual lesson’s skill or task that is being described actually being performed.

Support

Each student will have access to an InfoSec Addicts Group (infosecaddicts.com) for the class. Additionally, this is where they can work with other students on lab exercises, homework, and challenges. An InfoSec Addicts class mentor will be assigned to the group to answer questions (allow one day for responses). Likewise, a Customer Relationship Manager will get assigned to the class to manage questions and support issues.

 

Class Schedule

The class is self-paced. You can sign-up ANYTIME, and start IMMEDIATELY.

Fill out this form below to sign up for the class.

$50.00Select options

 

 

Was sick, my mother passed away, but now I’m back on track

I want to thank all of you well wishers. The last few months have been crazy for me. I’ve been in and out of the hospital several times, my mother passed away a few days ago, my birthday was on the day I burried my mother (Mother’s Day).

My mother was very sick so honestly her passing was a painful but good thing as her suffering is finally over. My family got together and had a celebration of her life instead of a funeral.

Python

So again to all of you thank you.

My medical issues are under control now, and we’ve dealt with my mother’s passing so I’m back to work next week.

I’ll be teaching Advanced Metasploit, and Python as night classes so I decided to bundle them for $100 (they are usually $100 each).

Click here to register for this class bundle for only $100

https://infosecaddicts.com/next-level-metasploit/
Next-Level Metasploit 21st and 23rd of May 2018
– Mon, May 21, 2018 7:00 PM – 9:00 PM EDT
– Wed, May 23, 2018 7:00 PM – 9:00 PM EDT

Python

This is an advanced Metasploit course that will focus on the fundamentals of Ruby (specifically for Metasploit), metasploit automation, and writing auxilliary modules and exploits for Metasploit.

 

https://infosecaddicts.com/python-infosec-professionals/
Python for InfoSec Professionals 28th and 30th of May 2018
– Mon, May 28, 2018 7:00 PM – 9:00 PM EDT
– Wed, May 30, 2018 7:00 PM – 9:00 PM EDT

Python

This is a Python for security professionals course. In this course I’ll be covering both log and pcap analysis with Python, as well as network/web app testing with Python.

This course is really designed for people that are NOT very comfortable with programming.

 

Class Videos

Each class will be recorded and made available to the students via email. So you can keep up with the class even if you have to miss time or even a whole day.

Support

Each student will receive access to an InfoSec Addicts Group (infosecaddicts.com) for the class. Groups are where students can ask questions outside of the regular class hours, work with other students on lab exercises, homework, and challenges.

A class mentor is assigned to the InfoSec Addicts Group to answer questions (allow one day for responses).

Similarly, a Customer Relationship Manager is assigned to the class to manage questions and support issues.

 

Class Schedules

Next-Level Metasploit 21st and 23rd of May 2018

– Mon, May 21, 2018 7:00 PM – 9:00 PM EDT
– Wed, May 23, 2018 7:00 PM – 9:00 PM EDT

Python for InfoSec Professionals 28th and 30th of May 2018

– Mon, May 28, 2018 7:00 PM – 9:00 PM EDT
– Wed, May 30, 2018 7:00 PM – 9:00 PM EDT

 

Click here to register for this class bundle for only $100

 

 

Unlimited classes:

If you know that you are interested in this class as well as other InfoSec classes then you should consider the unlimited classes package for $49.99 per month. You can find out more about it by clicking on the link below:

https://infosecaddicts.com/unlimited-classes/

 

NOTE: Due to Joe McCray’s travel and work schedule (ex: short notice consulting/training engagements or changes to those engagements) classes may reschedule or cancel. In these situations a refund will NOT be granted as the class will re-run the following week, or additional days will be added to the class schedule to make up for this.

Ultimate hacklab – prep for hacking challenge lab exams like OSCP, LPT, eCPPT

Ultimate hacklab – prep for hacking challenge lab exams like OSCP, LPT, eCPPT, and soon even the new CEH is going to be a hacking challenge lab as well.

If you really want to know what it takes to pass hack lab challenge-based exams like OSCP, LPT, eCPPT then ultimate hacklab is for you.

The InfoSec Addicts ultimate hacklab is best way for you to practice the skills required for almost any hands-on lab based penetration testing/ethical hacking certification.

The ultimate hacklab gives you the opportunity to follow along with a structured and very detailed training program, and/or make your way through the labs and just ask for help whenever you get stuck. You can run almost any tool and try almost attack in the environment.

You can connect to the lab environment with almost any platform (Windows, Mac OS X, Kali Linux, other Linux distros).

Class syllabus:

  • Module 1: Connecting via VPN to the lab network
    • Connecting to the VPN with Windows
    • Connecting to the VPN with Mac OS X
    • Connecting to the VPN with Linux
    • Connecting to the VPN with Kali
  • Module 2: Scanning
    • Nmap
    • Net-Discover
  • Module 3: Module X: Enumeration
    • nmap NSE
    • rpcinfo/showmount
    • nbtstat
    • enum4linux
  • Module 4: Brute-forcing
    • Hydra
    • Medussa
  • Module 5: Vulnerability Scanning
    • Nessus
    • OpenVas
  • Module 6: Attacking web servers/web apps
    • Manual XSS/SQL Injection/LFI/RFI
    • Nikto
    • Dirbuster
    • Burp Suite
    • w3af
    • Arachni
  • Module 7: Compiling/Modifying Exploit code
    • Compiling code in Windows
    • Compiling code in Linux
    • Finding offsets
    • Changing out shellcode
  • Module 8: Client-Side Exploitation
    • Metasploit
    • Social Engineering Toolkit
  • Module 9: Transferring files
    • FTP
    • TFTP
    • VBscript
    • Debug,exe
    • wget/linux/bitsadmin
    • PowerShell
  • Module 10: Privilege Escalation
    • Linux
      • SUID binaries
      • Shell escapes
    • Windows
      • Identifying vulnerable services/misconfigurations
      • beR00t.exe
  • Module 11: Data-mining a compromised host
  • Module 12: Hashcracking
  • Module 13: Pivoting
    • Netcat/Socat pivot
    • SSH Pivot
    • Metasploit pivot
  • Module 14: Lateral movement
    • psexec
    • smbexec
    • winexe
  • Module 15: Data Exfiltration
    • ICMP Tunneling
    • DNS Tunneling
  • Module 16: Reporting

 

Lab Network Access

Targets in the lab network will change on the 1st of every month. Students have the option to purchase 3 months access to the lab environment.

 

Training Sessions and Final Mission:

Students will attack the servers and workstations in a different lab environment than the April training environment. These servers are much harder to penetrate than standard servers in the typical production environment. Similarly, these vulnerabilities are difficult to exploit (on purpose).

 

Students will receive

  • Up to 40 hours of CPEs (6 CPE for the actual training and the rest come from labs and challenges completed by the students)
  • Several virtual machines
  • Courseware slides
  • Lab Manual
  • Lab access

 

Class Videos

Students will receive all class recordings via their emails. This will help them keep up with the class even if they have to miss time or even a whole day.

Support

Each student will have access to an InfoSec Addicts Group (infosecaddicts.com) for the class. Groups are where students can ask questions outside of the regular class hours. Additionally, this is where they can work with other students on lab exercises, homework, and challenges. A Strategic Security class mentor will be assigned to the InfoSec Addicts Group to answer questions (allow one day for responses). Likewise, a Customer Relationship Manager will get assigned to the class to manage questions and support issues.

 

Class Schedule

June 25th and 27th 2018 from 7pm to 10pm EST

Fill out this form below to sign up for the class.

$200.00Select options

 

NOTE: Due to Joe McCray’s travel and work schedule (ex: short notice consulting/training engagements or changes to those engagements) classes may reschedule or cancel. In these situations a refund will NOT be granted as the class will re-run the following week, or additional days will be added to the class schedule to make up for this.

Offensive Cyber Expert Bundle

Do you really want to be the guy or girl that can just flat out hack! I’m talking about where it just doesn’t matter what’s in front of you – you know that you can figure it out.

It doesn’t matter if you are up against Linux, Windows Server 2016, SharePoint, web apps, or custom apps where you need to modify public exploit code to attack them.

If that’s what you want to be then this is the course bundle for you.

For today only you can purchase this entire class bundle for only $200 – just click the add to cart below:

$200.00Select options

 

linux

Being proficient in Linux in the InfoSec world today is an absolute must. This is the class that you absolutely want to take to not only get familiar with Linux but to learn how to use Linux to perform InfoSec tasks instead of just the basics of the operating system.

 

For today only you can purchase this entire class bundle for only $200 – just click the add to cart below:

$200.00Select options

 

powershell

Just like with Linux being proficient in PowerShell in the InfoSec world today is an absolute must because all of the Microsoft technologies today heavily utilize PowerShell. This is the class that you absolutely want to take to not only get familiar with PowerShell but to learn how to use PowerShell to perform InfoSec tasks.

 

For today only you can purchase this entire class bundle for only $200 – just click the add to cart below:

$200.00Select options

 

Offensive Cyber Operations
Offensive PowerShell with Cyber Range

This is the class where the rubber meets the road. This is the class where you put it all on the line and find out what works in the real world and what doesn’t. The Cyber Range is a full blown modern Windows environment (Windows Server 2016, Active Directory 2016, and SharePoint 2016 multi server farm)

 

For today only you can purchase this entire class bundle for only $200 – just click the add to cart below:

$200.00Select options

 

Exploit development

This is a fun class. 64bit exploit development. Learn how to write exploits, learn how to modify public exploit to suit your needs.

 

For today only you can purchase this entire class bundle for only $200 – just click the add to cart below:

$200.00Select options

 

 

Unlimited classes:

If you know that you are interested in this class as well as other InfoSec classes then you should consider the unlimited classes package for $49.99 per month. You can find out more about it by clicking on the link below:

https://infosecaddicts.com/unlimited-classes/

NOTE: Due to Joe McCray’s travel and work schedule (ex: short notice consulting/training engagements or changes to those engagements) classes may reschedule or cancel. In these situations a refund will NOT be granted as the class will re-run the following week, or additional days will be added to the class schedule to make up for this.

Offensive PowerShell with Cyber Range

Offensive PowerShell class with Cyber Range

On the 24th of March from 10am EST to 4pm  EST we will run the first online Offensive PowerShell course with our new Cyber range. The Cyber Range is a full blown modern Windows environment (Windows Server 2016, Active Directory 2016, and SharePoint 2016 multi server farm).

powershell

Here is your chance to use what you learned in the PowerShell class, and get a chance to use all of the popular PowerShell tools such as:

 

Cyber Range

Students will receive cyber range access on the 22nd of March and maintain access to the new cyber range until the end of April.

Support

Each student will receive access to an InfoSec Addicts Group for the class. Groups are where students can ask questions outside of the regular class hours, work with other students on lab exercises, homework, and challenges.

A class mentor is assigned to the InfoSec Addicts Group to answer questions (allow one day for responses).

Similarly, a Customer Relationship Manager is assigned to the class to manage questions and support issues.

Class Schedule

This class is going to run on Saturday the 24th of March from 10am EST to 4pm EST.

 

Class Cost

The class cost is regularly $500, but you can get it for $200 if you sign up before February 19th.

Fill out this form to sign up for the class.

$200.00Select options

 

Unlimited classes:

If you know that you are interested in this class as well as other InfoSec classes then you should consider the unlimited classes package for $49.99 per month. You can find out more about it by clicking on the link below:

https://infosecaddicts.com/unlimited-classes/

 

NOTE: Due to Joe McCray’s travel and work schedule (ex: short notice consulting/training engagements or changes to those engagements) classes may reschedule or cancel. In these situations a refund will NOT be granted as the class will re-run the following week, or additional days will be added to the class schedule to make up for this.

Free Advanced Network Penetration Testing webinar

network penetration testingIn this FREE webinar Joe McCray will cover the fundamentals of the network penetration testing, and how to perform basic penetration testing tasks. This webinar is designed for people with little to no network penetration testing experience.

This webinar will be held on the 1st of February at 1pm EST

Click the link below to sign up for this webinar:

https://attendee.gotowebinar.com/register/6831470640505615106

network penetration testing

Advanced Burp Suite

Burp

Burp Suite is one of the most popular web application security testing tools. It has a ton of features and can do everything from intercepting and modifying HTTP requests/responses in real time, to scanning web applications for vulnerabilities, to brute forcing login forms, to testing the entropy of session tokens, and it even allows you to increase its functionality by writing plugins for it.

As awesome as the tool is – surprisingly few people are really comfortable with it. I decided to put together a 2-day workshop on the advanced features of the tool.

Burp
This workshop picks up where the original Burp Suite (http://infosecaddicts.com/burp-suite-workshop/) course left off. It assumes the student has strong familiarity with web application security fundamentals, the OWASP top 10, basic application testing with Burp Suite.

This workshop will cover:
– Integrating Burp and SoapUI for webservices testing
– Integrating SQLMap, and w3af
– Developing your own plugins (Note: you’ll need Eclipse for this)

 

 Burp

To answer a few questions I’ve received:

  • Yes it will be recorded for those of you that can’t attend
  • True, it will be a live/interactive workshop so you can ask me questions during the event.
  • Yes you get the virtual machines as soon as you signup for the event

 

Class Date and Time

  • Mon, Dec 4, 2017 7:00 PM – 9:00 PM EST

  • Wed, Dec 6, 2017 7:00 PM – 9:00 PM EST

 

Videos

Each class will be recorded and made available to the students via email. So you can keep up with the class even if you have to miss time or even a whole day.

Extraction of Cookies in iOS Forensics

  • Why is it essential for an examiner to get some files of interest from an iOS device?

    cookies

All activities of an iOS device user are stored inside the device in different formats and for various purposes as well. This evidence is apparently collected for the sake of serving the iOS user in the very first place. However, this is not the complete case. It is because the evidence obtained and stored cookies are even much more than what the user could ask for or need.

Information just like locations, messages, contacts, web surfing habits, notes, pictures and more are available on iOS devices storage media. Many of them come with time-stamped data.

From the forensics point of view, such data becomes much more and more valuable. This is since businesses begin to grow larger nowadays using iOS devices. It urges examiners to cope with any new technologies or software releases. It could offer any help with the forensics procedure and smooth extraction of data and acquisition of it.

  • Cookies of browser inside /private/var/mobile/Library

  • What is meant by cookies in the first place? cookies

Cookies are often utilized by a web page to help provide a user with web pages customized to a very great extent. Users get identified in this manner while they are assisted with personalized results and experience.

A user may be asked to get necessary information filled up when browsing a web page which makes use of it. Names and interests may be the sort of information asked for when it comes to a website depending on cookies. The browser used by the user is the one responsible for storing this critical data on the device for further usage by the site afterward. The browser gets such cookies essentially from this sever in the very first place essentially.

From the perspective of websites, it is an important aspect to have the cookies stored on a computer. It is because such cookies get sent over to the server hosting the site whenever this website is visited. Accordingly, custom pages are sent to the user depending on such cookies.

Have you ever visited a website which welcomes you with your name or shows to you the last time when you visited the site? This website is using cookies to serve you with a customized experience better when visiting their website.

Let’s talk more about exciting stuff of the cookies file. What can be found inside it in particular? Basically, inside the file, there must be informed about the website there in the first place. Moreover, some personal information could be stored along with the information about the website. It is generally in the case that the user provides the site with such information. Otherwise, they will not be included.

It is interesting to know that most of such information will be of text format at the end of the day. Nonetheless, useful websites send such cookie data into the browser in an encrypted form. The fact that they want to secure the data to a great extent, so the reason for this encryption attributes. It is to ensure that they will not make sense even when extracted and acquired in some way or another.

From the perspective of an examiner performing forensics investigation, this data is very crucial in the process. It is because they represent some preferences of the user along with data such as their names and interests. It would help someone interested in an investigation to get data of interest from such cookies.

In such cookies, several vital parameters are passed through such for identification and related purposes intended by the cookies mainly. Typically, the given parameters are like illustrated in the following points:

  • The name of the cookie.
  • The value of the cookie.
  • The expiration date of the cookie: this determines how long the cookie will remain in an active status in the browser of the user.
  • The path for the cookie is valid. Web pages outside of that way cannot use the cookie.
  • The domain for the cookie is valid. It makes the cookie accessible to pages on any of the servers in an area.
  • The need for a secure connection: this indicates that the cookie can only be used under the condition of having a secure server.
  • How to perform such extraction of cookies?

    cookies

It is considered a significant source of evidence when it comes to forensics investigations to get the data extracted from the browser cookies. Such cookies are attached to the very popular Safari browser. The file which contains these vitally essential cookies is named cookies.binarycookies.

The different main characteristic of the standard browsers and Safari browser lies in the storage of cookies. Browsers such as Internet Explorer store their cookies data inside a plain text format file or they utilize an SQLite database format residing inside the folder of history. Safari, on the other hand, gets its browser cookies stored inside a binary format file.

It is therefore worth noting that opening such a binary format file requires a sort of specific software for this reason in the first place. Such tools could be like iPhone Extractor or any HEX editor to be able to grasp what is there inside such files of interest.

For sure we have opened such files to go through what could be inside such data. When we did that, we figured out that whenever there is a header inside the record, one or more pages are coming after it. Inside each page, there exists one or even more cookies residing there.

It is also essential to make sense of the sizes of each field constructing the cookies of such file. The signature field occupies 4 bytes by default to store the COOK header. In the meanwhile, another field named as Number of pages makes up 4 bytes to store Little Endian Integer. There is also another field called Page Size, and this one uses up 4 bytes of the storage to have another Little Endean Integer saved. An area named Page, on the other hand, varies in size according to the size of the cookies itself. Finally, the tail field has a capacity of eight bytes to store a Hash for the checksum possibly.

Resources

https://www.sans.org/reading-room/whitepapers/forensics/forensic-analysis-ios-devices-34092

http://resources.infosecinstitute.com/ios-forensics/

Extraction of applications,photos,passwords – iOS forensics

  • What are the files of interest in the first place? ios applications

Extraction of applications,photos,passwords – iOS forensics – There are several directories that one can find for investigation purposes inside an iOS. It is irrespective of whatever the device model is. The structure of directories is common among all iOS devices. The layout utilized for it is a UNIX layout. It is very vital to mention that different file formats exist in this case. Thus, there are some files of format XML, binary data, or SQL databases.

Alright, so how are we going to investigate such files without getting to know their actual location on the device? Initially, data of the default application gets stored inside the following path: private/var/mobile/Library folder. In other words, data of apps like Address Book, Mail, Calendar, Maps, Notes, YouTube, Safari, Texting, Weather and Voicemail applications. On the other hand, some other apps like NFL 2012, Shazam or AroundMe which essentially get downloaded from iTunes have their data stored in the following path: private/var/mobile/Applications.

  • Downloaded applications from iTunes in private/var/mobile/Applications ios applications

The folder: Mobile/Application is always in a dynamic status especially whenever a new application gets downloaded from iTunes. When this happens, basically a new directory gets automatically created inside this folder. Such a file contains all the embedded files that an application needs and originally comes. Also, a unique identifier of 32-character alphanumeric values. This identifier will use by any iOS devices produced by Apple after that.

An example of such an identifier could be something like“GA07A3WW- 0E39-33OJ-B947-9CAA16688G22”. When dealing with this application iOS devices is perceive as an id which is consistent and used it. By default, there are some subfolders contained by an application:

  • Documents folder: this has all the files which are relevant to an application.
  • Temp folder: any files which are runtime and temporary reside there.
  • Library folder: any data which is cached or preferences are included in this folder.

There are also some other files which are commonly found in an application folder in an iOS device. Such records are like info.plist, resourcerules.plist and applestores.db. However, configuration files, plist files, and XML data could be found varying and different according to the application itself. It also happens that some vitally essential data for an investigation process could be existent inside such folders. Such include cookies, usernames, and passwords.

  • Photos inside private/var/mobile/media/DCIM

ios applications

All photos could be found in the media/DCIM folder.  These are photos either taken via the phone itself or synced from another device. All images will have timestamp metadata. If a picture is received through the camera of the device itself, then it will reside inside a folder named 100APPLE. It will have a name which is order sequentially. It is according to when the photo was taken in comparison to the others.

To elaborate on this point, naming such photos will begin with “IMG_0001” and then this number will get incremented by one each time a new picture takes no matter how many images got removed in the way through. Taking into consideration, it shall conclude that any missing numbers throughout the used range will indicate that its associated photo is deleting for some reason.

Sometimes it is essential and most importantly exciting to get to know what programs or applications were installed on the machine before it becomes on its current state at the time of forensics. It could be identified through the folder of DCIM/999Apple. Inside this folder, all taken screenshots will be found, which will eventually help with the investigation process. Navigating through these photos will show whether a banned application suspected to have been running on the device was installed or not.

  • Keystrokes inside /private/var/mobile/Library/Keyboard ios applications

A text file named dynamic-text.dat is considered a dynamic dictionary for an iOS device. It is one of the most important directories to investigate through because every written word by the user gets stored in this dictionary at the time it gets typed. Applications like Notes, Safari, Messages, Facebook will have any typed words inside them get entered into this dynamic dictionary. In fact, any applications which are open for a text input get their text data stored in this dynamic dictionary.

The rationale behind such dictionary lies in aiding a user with the typing process. On the other hand, this aspect is perceived as a source of a precious information because common words can come to be known and hence become a keyword for searching.

The downside of this dictionary is that it does not include a timestamp metadata of its reserved words. Accordingly, the time in which a word was typed cannot be identified through this dynamic dictionary.

There is an SQLite database named UserDictionary.sqlite in which all manual auto-corrections get stored. The importance of such database from the perspective of an examiner is that any keywords could be identified whether they are technical ones, special ones, of the Standard English language, or even any acronyms which could become all of the great vitality to the investigation process.

  • Passwords inside /private/var/Keychains ios applications

The keychain of Apple to manage passwords is the one that is mostly in use when it comes to passwords of iOS applications. A database file called keychain-2.db is utilized for the sake of having different accounts and passwords which used to be utilized on the device previously. The are several tables used for saving this information. They include cert, genp, inet, keys, sqlite_sequence, and tversion.

Inside this database, there is a great deal of valuable data that could be found there such as Voicemail passwords, wireless access point key phrases and device login passcodes. While some of these passwords may be stored in an encrypted format, some others could be found in an understandable form. Nevertheless, for those encrypted ones, a password cracker utility could be seen in this case. For instance, an examiner may depend on Elcomsoft’s iPhone Password Breaker, where the extracted keychain file should be given to get such files decrypted.

Resources

https://www.sans.org/reading-room/whitepapers/forensics/forensic-analysis-ios-devices-34092

http://resources.infosecinstitute.com/ios-forensics/

Artifacts of an IOS device

Artifacts of an IOS device

  1. plist file:

    IOS device

    1. This important file is located inside the folder of the root application.
    2. Relevant information about the device of interest may be revealed from this critical file. Such information includes the name of the used Apple Account and the date when the iPhone device was primarily purchased by the user. The importance of such information may vary according to the case being investigated.
    3. One of the following files will appear in each directory of an application on the iOS device:
      1. AccountURLBagType: in a string format.
      2. CreditDisplayString: in a string format.
      3. AccountServiceTypes: in a Number format.
      4. DidFallbackToPassword: in a Boolean format.
      5. AccountStoreFront: in a string format
      6. AccountIsNewCustomer: in a Boolean format.
      7. AccountKind: in a Number format.
      8. AccountAvailableServiceTypes: in a Number format.
      9. AppleID: in a string format.
      10. AccountSocialEnabled: in a Boolean format.
      11. AccountSource: in a String format
      12. DSPersonID: in a Number format.
      13. PurchaseDate: in a string format.
  2. Timestamps

    IOS device

    1. It’s essential to understand timestamps. That is to know the timing of a piece of evidence on the device.
    2. Most timestamps used in an iOS device are MAC absolute timestamps.
    3. To get such types of timestamps that are converted into an understandable format, we can use one of the commonly available sources online that perform such conversion.
    4. Another method that could get such MAC absolute time converted is to depend on the date command with a u switch on MAC. This will get the time turned into local time on the device or UTC.
  3. Databases:

    IOS device

    1. The most commonly used database format inside an iOS device is the SQLite database. It is used for the sake of getting most of the data that is stored and organized inside the device. In fact, most phone platforms rely heavily on the same SQLite databases for storing their data. Examples of such platforms are Windows Phone operating system which used to operate on Nokia smartphones in the past for instance.
    2. Data of Apple applications gets stored inside such SQLite databases. Data of any third-party applications could get stored inside the same sort of databases as well.
    3. For the sake of getting an SQLite database opened and investigated through, there has to be a tool used for this purpose. Fortunately, there exist several open source applications coming at a zero price to perform this task and make us grasp what is inside the database. In general, SQLite Database Browser is considered to be the best and mostly utilized application to display an SQLite database file. It comes with a command line utility and an interesting GUI as well.
  4. Property List Files:
    1. Formats of data inside an iOS device are mostly of .plist formats or as more formally referred to as Property List Files.
    2. What are the main kinds of data that could get stored inside such plist format files? Any configuration information, preferences, and settings have this file formats on the iOS devices.
    3. To get such file formats opened, you can choose between two methods. While you can just open them using any text editor, plist Editor is a must to use to get these files parsed.
  5. Configuration Files:

    IOS device
    Note that there is an excellent value in extracted configuration files from the forensics point of view. The reason for that lies in the variety of such files that could be of great importance when extracted. The following points will list the different files of these:

    1. Information of the device and account: the plist file inside: /private/var/root/Library/Lockdown/data_ark.plist has information about the device and the account holder of the device.
    2. Information about the account: the Sqlite database file inside: /private/var/mobile/Library/Accounts/Accounts3.sqlite has information about the used account. On the other hand, the plist file inside /private/var/mobile/Library/ DataAccess/AccountInformation.plist contains account’s information for that account which was responsible for setting up applications on the iOS device.
    3. Airplane Mode: the plist file located inside: /private/var/root/Library/Preferences/com.apple.preferences.network.plist. has in fact information about the state of the iOS device in the present period whether airplane mode is enabled for it or it is disabled.
    4. List of installed applications: the plist file inside /private/var/mobile/Library/Caches/com.apple.mobile.installation.plist has a complete list of all the applications which are installed on the iOS device. Also, a path to the files of each application is contained inside this plistfile as well. Mapping GUIDs to a specific application will be guided and undoubtedly aided by such valuable file.
    5. AppStore settings: the plist file inside /private/var/mobile/Library/Preferences/com.apple.AppStore. plist contains the last search store, which could be a plus for identifying preferences of the iOS device user.
    6. Information of Configuration and Settings: the folder is having the following location of: /private/var/mobile/Library/preferences/ contains several plist files which have settings of Apple applications and configurations.
    7. Lockdown certificate Information: inside the folder of /private/var/root/Library/Lockdown/Pair_records/ there shall be existing all computers that are paired with the iOS device, and all the lockdown/pairing certificates as well.
    8. Information about the network: the plist file inside /private/ var/preferences/Systemconfiguration/com.apple.network.identification.plist has some cached information about Internet Protocol (IP) networking such as devices like routers or network addressed and servers that were utilized by the iOS device in the past. Timestamps of such information are all available inside this exciting file.
    9. Notification log: the plist file inside/private/var/mobile/Library/BullitenBoard/ClearedSections.plist has a log of the notifications which were displayed inside the iOS device. This also extends to any cleared notifications of the device.
    10. Passwords: from iOS 7 till iOS 10, the following path to the mentioned database had the password contained and saved in there but definitely in an encrypted format yet it could also be cracked: /private/var/keychains/Keychain-2.db
    11. Information about the SIM card: inside the plist file which is located in: /private/var/wireless/Library/Preferences/com.apple.commcenter.plist there resides several important data about the most recently used SIM card. In fact, ICCID and IMSI of the SIM are included in this plist file.
    12. Springboard: the order in which applications are displayed inside each screen of the iOS device is contained inside the plist file located in the following path: /private/var/mobile/Library/Preferences/com.apple.springboard.plist
    13. System Logs: the folder where all the logs are contained of every activity performed on the iOS device is located inside: /private/var/logs/
    14. Wi-Fi Networks: the plist file inside /private/var/preferences/ SystemConfiguration/com.apple.wifi.plist has all the configured and familiar Wi-Fi Networks to the iOS device. Each of such Wi-Fi network has its timestamp which essentially indicates the timing of the connection to such network and some other important information could be gathered from this plist file as well.

References

https://www.sans.org/reading-room/whitepapers/forensics/forensic-analysis-ios-devices-34092http://resources.infosecinstitute.com/ios-forensics/

Analysis of AddressBook and Call History data

Analysis of AddressBook and Call History data

  • Analysis of artifacts on iOS devices

Throughout the following paragraphs, I will be going through a discussion about the objects on an iOS device and their interpretation. That is regardless whether it was the user’s interaction that generated them or the device itself along with its features. However, most of the extracted artifacts will be of one of two main formats. These are either the .plist files used for the sake of configuration files or of SQL database file formats.

Let’s discuss the way in which data is stored on an iOS device in the very first place. The location where most of the data reside inside the iOS device is located inside /private/var/mobile or /User/ which is the symlink pointing to the same directory referred to before. To elaborate, /private/var/mobile/Application – /User/Application points to this actual path.

  • /User/Applications/######-####-####-####-########### – #: this actually gets the UUID for the device represented.
  • <Application_Home>/AppName.app: inside this file, any bundle of the application on the iOS device get included. It is worth noting that such file does not get backed up.
  • <Application_Home>/Documents/: inside this folder, any data files which are to relate to applications on the iOS device get included there.
  • <Application_Home>/Library/: if any files are particular or specific for an application, they exist there inside this folder.
  • <Application_Home>/Library/Preferences/: any preference files that are there for applications, they will be all contained in this directory folder.
  • <Application_Home>/Library/Caches/ inside this folder, there exist any support files that are required specifically for a certain application. Such directory folder does not get backed up as well.
  • <Application_Home>/tmp/ any temporary files are contained there inside such folder.

 

  • AddressBook inside /private/var/mobile/Library/AddressBook addressbook

Investigating through the address book of an iOS device is a significant step. That is more so for an examiner when doing the investigation process. The importance of it could be simply summarized. That is in the fact that all personal contacts of a user will be clear and ready for investigation once the acquisition of his or her addressbook is undertaken successfully.

Several tables are residing inside the SQLite database file of addressbook named Addressbook.sqlitedb. In fact, there are two tables which are interesting for the sake of the investigation process essentially.

First of all, there is the table called ABPerson. It contains new files such as first name, last name, organization, notes, birthday, job title, nickname, prefix and more. There is a name for the index of this cool table. Such name is in fact ROWID.

Secondly, there is another cool table called ABMultiValue residing inside the addressbook database. Inside this new table, essential data about the stored contacts such as the used emails and phone numbers permanently stored inside an element of the table called “value.” That shall be linked to the user’s data and names found inside the other table of ABPerson. The index of the ABMultiValue table is called record_id.

From these points, I have to mention accordingly that there is a relationship between the ABPerson table and ABMultiValue table on one side, and all other tables inside the database on another team. In fact, such a relationship is of type one to many. That is where several tables are linked to ABPerson table and ABMultiValue table through the ROWID and record_id respectively.

  • Call history inside /private/var/Library/CallHistory

  • addressbook

A database file with the name of call_history.db is actually of great importance. It is particularly so when it comes to an examiner performing a forensic investigation on an iOS device of any kind. This database file will help an examiner get to understand and know the conducted cellular calls and have this data stored inside it.

There are in fact four main tables, and they are all of interest to an examiner. One of such tables is called the “call” table. Inside such table, there will be some exciting data such as the phone number, date, duration and reference ID of the contact.

It is crystal clear that the field of phone number will be responsible for displaying the phone numbers inside the call history. On the other hand, the date field comes at the time format of EPOC. As a result, this time format will need to get converted into an understandable time format. To elaborate, this form will display the number of seconds since the time of 00:00:00 UTC on 1 January 1970. The duration field is for sure relied on for the sake of getting to know the duration of time spent on such phone call with a specific phone number.

Another field is called the id field. The importance of such an area is that it has the id used for this number by the phone. Using this id, and attempting to link it to the id found in the addressbook, this number will be able to get grasped to belong to which contact name and so. However, sometimes such number is not listed inside the addressbook. Accordingly, this means that there is no id specified for it by the device. In this case, the field ID of will display a negative one value to indicate that there is no actual id stored for this phone number.

Last, there is another field residing inside the call table; it is a fact named as the flags field. What is the importance of such field then? This area is utilized for the sake of indicating whether the phone call conducted with a specific phone number was an outbound call or an incoming call. It is worth noting that it is the case that if the call was a received one, then number four will be used for the sake of getting this data identified. Number five, on the other hand, will be depended on to annotate that the call was an outbound one.

References

http://resources.infosecinstitute.com/ios-forensics/

SQLite Databases and Plist Files

SQLite Databases and Plist Files

  • What about partitions?

Partitions are the components on which different data could get stored inside a device. It comes without saying that the mechanisms differ according to the user to specify partitions and allocate storage to them when it comes to computers or personal laptops. On the other hand, one does not have that much freedom when it comes to a mobile device. The manufacturer of such equipment is the one responsible for such allocation of resources. Hence, Apple is the first responsible for the way in which partitions are created inside their iOS devices.

In fact, there are two partitions on an iOS device: the firmware partition and the data partition. While the first one is aimed to contain the software for running the iOS device, the second is meant to include all the files and data which are used and desired by the iOS device user.

Let’s talk more about the firmware partition. This partition always has the rules of read-only as it does not allow writing except when an update is being installed at the moment. iTunes is the one responsible for the sake of getting the partition overwritten with a brand-new partition when performing an upgrade to the system.

The size of the firmware partition is in most cases something in between 0.9 and 2.7 GBs. The exact size is determined by the size of the NAND driver in fact. Whereas no user data is allowed to access such crucial partition, some critical files are maintained inside this barrier. Such files are like system files, upgrade files and necessary applications.

The data partition is another partition which is aimed to be in favor of the device’s user. All the data is maintained inside such barrier. Accordingly, when performing an investigation process, such partition is critical to collect evidence out from such data available. Both the portfolio of a user’s data and the iTunes applications can just be found all there inside this partition.

  • What about SQL Lite Databases? Plist

First of all, let’s take into consideration that SQLite format is an open source and it is widely used when it comes to mobile devices. Such database is referred to as a relational database. Also, a C programming library can carry such database efficiently and in a small size.

The standard of SQL-92 is adhered to by SQLite, yet not all of the features are included. Although the small size of such an SQLite database, there are a plenty of functions that could be performed by such compacted database.

SQLite databases are widely used by the iOS development community such that a lot of iOS applications depend on this kind of database to get their data organized. These applications could be exemplified by Calendar, Text Messages, Notes, Photos, andAddress Book. All of the data related to these apps are stored in SQLite databases. The primary three databases are actually: Call History, Address Book, and SMS databases.

Let’s think about this matter from another essential perceptive, the perceptive of an examiner who needs to check evidence on an iOS device.A stable database is then required for an investigation process to be performed to serve to the target of the forensics procedures. Well, from the experts’ experience, I can suggest using of Sourceforge.net.

Since Sourceforge.net has its SQLite browser, it can be relied on when it comes to viewing an SQLite database to collect evidence. All data-stores of SQLite can be displayed using this methodology. In the meanwhile, there is another good to use software named RazorSQL. Nevertheless, this software requires some fees under $100 to become a great solution at the end of the day. There is though a free SQLite Manager plugin available for you without any purchases if you are lucky enough to be one of the users of Firefox.

In addition to what was previously discussed, there is a browser available at the following link: http://sqlitebrowser.org/

Such connection provides a downloadable browser that could be installed on the examiner’s machine to use it. It offers a clear and accessible means of reading and exploring an SQLite database for further investigations.

  • What about Plists?

Both iOS devices and Macintosh devices utilize what is called the Property List (plist). It is, in fact, a data file and it is sometimes referred to as a property file. Such files are relied on when it comes to the process of storing data on the aforementioned operating systems.

At the very beginnings of iPhones and Mac OS devices, there was another format utilized which was named NeXSTEP. Also, binary formats were being used for the same purpose. On the other hand, an XLM format which is new came into existence and became used. The formats which could be found nowadays are either an XML format or a binary format.

What type of data could be found inside a plist file then? Data like strings, dates, Boolean values, numbers or binary values could all be stored inside plist files. Examples of the data which use plist file formats to get saved in our browsing history, favorites, configuration data, and others. All of the data of these kinds depend on plist files in the very first place.

How can such plist files be opened? Well, there is a chance that such file could open successfully with the use of a standard text editor. However, there is also another chance that it requires a particular viewer for the sake of getting it opened. An instance of the tools which could be used is plutil. It is, in fact, a tool which depends mainly on a command line interface.

What it does is that it aims to get the plist files which are mostly binary files converted into a format which could be scanned and understood by human beings. The operating systems that could provide suite such tool are Linux, Microsoft Windows, and also Mac OS. After the conversion is applied to the plist file, an XML property list is available, and tags are used to wrap the plist.

References

https://www.sans.org/reading-room/whitepapers/forensics/forensic-analysis-ios-devices-34092

http://resources.infosecinstitute.com/ios-forensics/

https://www.cclgroupltd.com/mobile-device-forensics-data-acquisition-types/