Тёмный

Intro to Sleuthkit for Forensics (PicoCTF #39 'sleuthkit-apprentice') 

John Hammond
Подписаться 1,7 млн
Просмотров 15 тыс.
50% 1

Help the channel grow with a Like, Comment, & Subscribe!
❤️ Support ➡ j-h.io/patreon ↔ j-h.io/paypal ↔ j-h.io/buymeacoffee
Check out the affiliates below for more free or discounted learning!
🖥️ Zero-Point Security ➡ Certified Red Team Operator j-h.io/crto
💻Zero-Point Security ➡ C2 Development with C# j-h.io/c2dev
👨🏻‍💻7aSecurity ➡ Hacking Courses & Pentesting j-h.io/7asecurity
📗Humble Bundle ➡ j-h.io/humblebundle
🐶Snyk ➡ j-h.io/snyk
🌎Follow me! ➡ j-h.io/discord ↔ j-h.io/twitter ↔ j-h.io/linkedin ↔ j-h.io/instagram ↔ j-h.io/tiktok
📧Contact me! (I may be very slow to respond or completely unable to)
🤝Sponsorship Inquiries ➡ j-h.io/sponsorship
🚩 CTF Hosting Requests ➡ j-h.io/ctf
🎤 Speaking Requests ➡ j-h.io/speaking
💥 Malware Submission ➡ j-h.io/malware
❓ Everything Else ➡ j-h.io/etc

Опубликовано:

 

26 апр 2022

Поделиться:

Ссылка:

Скачать:

Готовим ссылку...

Добавить в:

Мой плейлист
Посмотреть позже
Комментарии : 18   
@yttos7358
@yttos7358 2 года назад
For those who want to do it on the command line you can use `icat` to `cat` out the contents of a specific inode. The inode he displayed in during autopsy was 2371, you also need to tell it the offset `-o` of the filesystem partition you are looking for (use mmls again) and then feed that to `iconv` So this is what I used at the end of it `iconv
@ductive
@ductive 9 месяцев назад
You can do the same without iconv.
@lab-at-home
@lab-at-home 2 года назад
That is cool. When I solved this challenge I just extracted the filesystem with binwall and looked into the files, but this tool seems to be really cool
@moustafakashen3610
@moustafakashen3610 Год назад
LOVE YOUR CONTENT!
@lordspacecake5565
@lordspacecake5565 2 года назад
Awsome video, great tool to have.
@bladesvlogs4965
@bladesvlogs4965 Год назад
Wow, that was impressive 👍
@shiv_sagar72
@shiv_sagar72 2 года назад
great video thnks man
@harsh2314
@harsh2314 2 года назад
Your reactions were relatable... most of the time it needs a simple task for us to solve the problem but we can't just get it 😂
@h3bb1
@h3bb1 2 года назад
Hey John, thansk for the videos. They are both fun and super interesting. I wanted to ask you, do you have a video on what you are doing in the terminal at the end, when you echo out the flag and the finish command? Or is this maybe just basic terminal stuff?
@Stroopwafe1
@Stroopwafe1 2 года назад
It was in one of the earlier episodes in this series, where the solution was so simple he made those 2 commands. Can't remember exactly which one though, sorry
@rasraster
@rasraster Год назад
Am I missing something obvious? Couldn't he have just decoded the hex in that flag.uni.txt file, right off the bat?
@TigerWalts
@TigerWalts 2 года назад
Three hundred megabytes of hard drive capacity! What can that do for you? Three hundred file cabinets of storage capacity! That's right That's on one disk! You couldn't get close to that on a floppy disk
@forheuristiclifeksh7836
@forheuristiclifeksh7836 4 месяца назад
5:00
@feverwilly
@feverwilly 2 года назад
The WIndows version is better it was redone in Java in Windows.
@chiragvyas5720
@chiragvyas5720 2 года назад
Yeah that is what I also think.
@bhagyalakshmi1053
@bhagyalakshmi1053 Год назад
Codo automatically shell
@Lacsap3366
@Lacsap3366 Год назад
All I did in this challenge was to mount the root partition as a loop device by hand and just cat out the flag.uni.txt
@jorjo1061
@jorjo1061 Год назад
Yeah same but autopsy seems cool as well
Далее
DFS101: 7.4 Data Recovery - The Sleuth Kit
23:15
Просмотров 12 тыс.
I Worked For MrBeast, He's A Sociopath
50:39
Просмотров 9 млн
How to not get hacked: real example
13:55
Просмотров 399 тыс.
Intro to Wireshark (PicoCTF 2022 #17 'packets-primer')
12:09