Practical content from industry professionals on digital forensics · data recovery · cyber security · KVKK compliance.
XSS is when an attacker injects JavaScript into a web page and runs it in other users' browsers. The Stored, Reflected and DOM based types, session theft and account takeover impacts, the definitive solution of output encoding, additional layers such as CSP and HttpOnly, the role of modern frameworks and verification methods.
Read moreSQL injection is when user input mixes into a database query and changes its logic, and it remains one of the most common critical flaws. How it works, the types (classic, blind, time based), the definitive solution of parameterized queries, why hand cleaning is not enough, defense in depth and verification methods.
Read moreThe OWASP Top 10 is a free international reference listing the ten highest risk vulnerability categories in web applications. The full 2021 list, each category explained and defended, why Broken Access Control is first, how to use the OWASP Top 10 and its relationship with compliance standards.
Read moreYARA is a free open source malware identification tool that matches files and memory against patterns and goes beyond hash based detection. The three sections of a rule (meta, strings, condition), the art of writing good rules, the balance between too narrow and too broad, file and memory scanning, reducing false positives and a learning path.
Read moreThe Windows Registry is one of the richest evidence sources in forensics: which USB was plugged in, which program ran, which file was opened. The hive structure and on disk locations, the questions the registry answers, the difference between RegRipper Registry Explorer and RECmd, deleted key recovery, transaction logs and a learning path.
Read moreKAPE is a free triage tool that collects and parses only valuable artifacts from a Windows system within minutes. The difference between triage and full imaging, the Target and Module logic, which artifacts are collected, the relationship with Eric Zimmerman tools, a five step triage flow, evidence integrity rules and a learning path.
Read morePlaso is the free open source tool that gathers time information from hundreds of sources in a disk image into one chronological timeline. The log2timeline and psort commands, the four step logic of an examination, the data abundance pitfall, time zone and timestomp pitfalls, visualization with Timesketch and a learning path.
Read moreX-Ways Forensics is far smaller, faster and cheaper than FTK and EnCase, and a favourite of experienced examiners. Its portability, speed and cost advantages, the steep learning curve, the Volume Snapshot concept, a four stage learning path, an X-Ways FTK EnCase Autopsy comparison and common mistakes.
Read moreThe critical concept in mobile forensics is extraction levels: logical, file system and physical. Why physical extraction is usually impossible on modern devices, how deleted data survives in SQLite freelist and WAL, Cellebrite UFED and Magnet AXIOM alongside free ALEAPP and iLEAPP, an eight step examination flow and an artifact map.
Read moreWireshark examines network traffic at packet level and shows where data went in a leak. Capture versus display filters, the seven step order for examining a PCAP, reading metadata in TLS traffic (SNI, JA3, beacon patterns), an exfiltration pattern table, lawful practice data, legal boundaries and six common mistakes.
Read moreVolatility is the free open source framework for analyzing memory dumps. What lives in memory but not on disk, the order of volatility and why you must not power off, capture tools, Volatility 2 versus 3, a core plugin table, the six step logic of an examination, lawful practice data and six common mistakes.
Read moreEnCase Forensic is OpenText's commercial forensics suite. Why it became entrenched in court work, the lasting legacy of the E01 format, a realistic four stage learning path, why EnScript sets examiners apart, the two phases of EnCE and what it really measures, plus an EnCase FTK Autopsy comparison.
Read more