Nmap is powerful on its own, but using it well still means remembering the right flags, typing the full command correctly every time, and manually redirecting output somewhere useful if you actually w
Some of the most useful scripts in system administration aren't clever or complex, they're just the thing nobody wants to check manually, every day, forever. Disk space is a perfect example: running o
A packet capture is just a recording, raw traffic, frozen in time, with no built-in explanation of what any of it means. This lab worked through four completely different network attack patterns, cred
Every disk-based forensic technique I'd worked through earlier in this series shared one limitation: a disk image only shows what was written to storage. A sophisticated attack often doesn't look like
Deleting a disk partition feels, to an attacker trying to cover their tracks, like a clean way to make an entire set of files disappear at once. One action, and a whole section of the disk, every file
Every recovery technique I'd worked through earlier in this forensics series depended on the file system still knowing something about the file in question, a deleted entry that could be found, a hash
Every forensic tool I'd worked through up to this point operated on one file at a time: hash a file, check a hash, open a file to verify its format. This lab moved to a different scale entirely, takin
An attacker trying to sneak a file past a network administrator doesn't need sophisticated malware if a simpler trick works just as well: rename the file, change its extension, and let the system's ow
The previous lab in this module was about looking a hash up against the outside world, checking a suspicious file against VirusTotal's malware database. This one flipped the direction entirely: compar
