Practical content from industry professionals on digital forensics · data recovery · cyber security · KVKK compliance.
Command injection is when user input passes unsafely into an OS command, letting the attacker run commands on the server, leading to remote code execution (RCE). Types, parameterized call and allow list defense, detection with KAOS and FAQs.
Read moreMalware analysis is understanding what a suspicious file does and how far it spread, in a controlled environment. A table of static, dynamic, sandbox and reverse engineering approaches, a safe analysis environment and connecting to defense with IOCs.
Read morePassword cracking is finding the password that produces a given hash. Why a hash can be cracked, a table of dictionary and rule based methods, Hashcat and John the Ripper, defense with Argon2 bcrypt and salt, and FAQs.
Read moreA JWT is a portable identity token signed by the server; if misconfigured, an attacker can craft their own. alg none, missing signature checks, key confusion and weak key attacks, the logout problem and a secure JWT checklist.
Read moreIDOR is accessing another person's data by changing an identifier, and is a subtype of Broken Access Control, number one on the OWASP Top 10. Types, how it is found, the UUID misconception, server side authorization and proper defense.
Read moreCSRF is a web flaw that tricks the browser of a logged in user into sending requests on their behalf. How it works, a table comparing it with XSS, SameSite cookie and CSRF token defenses, common mistakes and how to test it.
Read moreA write blocker is a device that provides only read access to a storage device and blocks writes. Why the operating system silently writes to a disk, how a write blocker works, the difference between hardware and software blockers, its place in the forensic process, its importance in data recovery and common mistakes.
Read moreBrowser forensics reveals what a user did online from browser traces. The artifacts the browser keeps, data living in SQLite, the incognito reality, recovering deleted history, the examination flow and timestamp pitfalls.
Read moreSteganography is the art of hiding the existence of data; a message is concealed inside an innocent file imperceptibly. Its difference from encryption, LSB and file structure techniques, a table of steganalysis detection methods, its role in exfiltration and evidence concealment, evidence integrity and false positive risk.
Read moreEmail forensics technically examines who an email truly came from and whether it was altered. Why the sender address is not evidence, the Received lines in the header and how to read them, SPF DKIM DMARC results, how to collect it as evidence (raw .eml, hash) and common mistakes.
Read moreddrescue is a free open source tool that images a failing or bad sector disk in a way suitable for data recovery. Its difference from dd, the easy data first strategy, the vital map file, two pass basic usage, rules for working with a failing disk, where ddrescue falls short and common mistakes.
Read moreSSRF is when an attacker tricks an application into making a request on the server's behalf, and it is dangerous enough to compromise a server in the cloud. How it works, why the cloud metadata service is so critical, SSRF types, defense with an allow list, verification and the OWASP A10 framework.
Read more