-
Notifications
You must be signed in to change notification settings - Fork 14
/
README.html
2364 lines (1960 loc) · 117 KB
/
README.html
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>FORENSICS</title>
<style>
/* CSS Crime Scene Style*/
* {
box-sizing: border-box;
margin: 2;
padding: 2;
}
body {
font-family: Arial, sans-serif;
background-color: rgb(22, 22, 24); /* Dark gray background */
color: #fff; /* White text color */
margin: 40px; /* Margin for better readability */
}
/* Titles */
h1, h2, h3, h4, h5, h6 {
color: #fff; /* White text color */
}
/* Elements with yellow details */
hr, blockquote, table, thead, tbody, tfoot, tr, td, th {
border-color: rgb(226, 181, 25); /* Yellowish color for borders */
}
/* Links within content */
a {
color: rgb(226, 26, 65); /* Reddish color for links */
text-decoration: none; /* Remove underline by default */
}
a:hover {
text-decoration: underline; /* Underline on hover */
}
</style>
</head>
<body>
<h1>DIGITAL FORENSICS AND INCIDENT RESPONSE (DFIR)</h1>
<blockquote><h3>"These programs were never about terrorism: they're about economic spying, social control and diplomatic manipulation. They're about power." (Edward Snowden)</h3></blockquote>
<p align="center"><img src="https://github.com/RENANZG/My-Forensics/assets/53377291/a4ef4137-7b20-4df0-8678-1f48be665386" title="The Treachery of Images (1929) - René Magritte"/></p>
<!-- ################################## -->
<hr>
<h3>BASIC STRATEGY</h3>
<table style="width: 100%" cellspacing="0" cellpadding="0">
<thead>
<tr>
</tr>
</thead>
<tbody>
<tr>
<td align="center" valign="top"><b>Crime Triangle</b></td>
<td align="center" valign="top"><b>Basic Investigative Metodology</b></td>
</tr>
<tr>
<td align="center" valign="top">
<img src=".data/crime_triangle.png" title="Crime Triangle">
</td>
<td align="left" valign="top">
<p>
<b>• 5W:</b> Who, What, When, Where and Why<br>
<b>• PDCA Cycle:</b> Plan, Do, Check and Act<br>
<b>• Root Cause Analysis (RCA):</b><br>
<ol>
<li>Identify and describe the problem clearly</li>
<li>Establish a timeline from the normal situation until <br>
the problem occurs</li>
<li>Distinguish between the root cause and other causal <br>
factors (e.g., using event correlation)</li>
<li>Establish a causal graph between the root cause<br>
and the problem</li>
</ol>
</p>
</td>
</tr>
</tbody>
</table>
<br>
<h4>The criminal investigation must be protected from leaks by following a logical sequence:</h4>
<ol>
<li>Exhaust the data collection in open sources (OSINT) or closed sources (CSINT, AML Intelligence);</li>
<li>Hidden monitoring and tracking measures (SIGINT, HUMINT...);</li>
<li>With concrete evidence of the practices investigated and exhaustion of remote possibilities, launch the operation itself with the publication of the investigation. At this stage, search and seizure warrants, temporary or preventive arrest and statements will be taken.</li>
</ol>
<!-- ################################## -->
<br>
<hr>
<h3>FORENSIC SUITES</h3>
<table style="width: 100%" cellspacing="0" cellpadding="0">
<thead>
<tr>
</tr>
</thead>
<tbody>
<tr>
<td align="center" valign="top" style="width: 50%"><b>FLOSS</b><br>Free/Libre and Open Source Software</td>
<td align="center" valign="top" style="width: 50%"><b>PROPRIETARY</b><br>Cyber-surveillance Industry</td>
</tr>
<tr>
<td align="left" valign="top" style="width: 50%">
• Drive Badger<br><a href="https://drivebadger.com">https://drivebadger.com</a> <a href="https://github.com/drivebadger/drivebadger">(GitHub)</a><br>
• SIFT Workstation<br><a href="https://sans.org/tools/sift-workstation" target="_blank" rel="noopener noreferrer">https://sans.org/tools/sift-workstation</a><br>
• Parrot Security<br><a href="https://parrotsec.org">https://parrotsec.org</a><br>
• Kali Linux<br><a href="https://kali.org">https://kali.org</a><br>
• CAINE<br><a href="https://caine-live.net">https://caine-live.net</a><br>
• CSI Linux<br><a href="https://csilinux.com">https://csilinux.com</a><br>
• IPED Digital Forensic Tool<br><a href="https://github.com/sepinf-inc/IPED">https://github.com/sepinf-inc/IPED</a><br>
• Avilla Forensics (Mobile Forensic)<br><a href="https://github.com/AvillaDaniel/AvillaForensics">https://github.com/AvillaDaniel/AvillaForensics</a><br>
• Mobile Verification Toolkit (MVT)<br><a href="https://docs.mvt.re/en/latest">https://docs.mvt.re/en/latest</a><br>
• Tsurugi Linux<a href="https://tsurugi-linux.org/"><br>https://tsurugi-linux.org/</a><br>
• REMnux<a href="https://remnux.org/"><br>https://remnux.org</a><br>
• Bitscout<a href="https://github.com/vitaly-kamluk/bitscout"><br>https://github.com/vitaly-kamluk/bitscout</a><br>
• Debian Forensics Packages<br><a href="https://packages.debian.org/unstable/forensics-all">https://packages.debian.org/unstable/forensics-all</a><br>
• Eric Zimmerman's tools (Freeware)<br><a href="https://ericzimmerman.github.io/#!index.md">https://ericzimmerman.github.io/#!index.md</a><br>
• Paladin® (Freeware)<br><a href="https://sumuri.com/product/paladin-lts/">https://sumuri.com/software/paladin/</a><br>
• Forensic Toolkit (FTK)® - Lite (Freeware) <br><a href="https://exterro.com/ftk-product-downloads/how-to-run-ftk-imager-from-a-flash-drive-imager-lite" target="_blank" rel="noopener noreferrer">https://exterro.com/forensic-toolkit</a><br>
• Magnet Forensic® - Mobile Extractor (Freeware)<br><a href="https://magnetforensics.com/" target="_blank" rel="noopener noreferrer">https://magnetforensics.com</a><br>
• Windows® Forensic Environment WinFE (Freeware)<br><a href="https://winfe.net/home" target="_blank" rel="noopener noreferrer">https://winfe.net</a><br>
• NirSoft® (Freeware)<br><a href="https://nirsoft.net/computer_forensic_software.html">https://nirsoft.net</a><br>
• MiTeC® (Freeware)<br><a href="https://mitec.cz">https://mitec.cz</a><br>
• Medusa Box® (Easy J-TAG)<br> <a href="https://medusabox.com/">https://medusabox.com</a><br> ╰┈➤<a href="https://medusabox.com/eng/features/features">Models Features</a><br> ╰┈➤<a href="https://aliexpress.com/w/wholesale-medusa-box.html">Aliexpress</a><br>
• Octoplus Box® (Easy J-TAG)<br><a href="https://octoplusbox.com">https://octoplusbox.com</a><br> ╰┈➤<a href="https://octoplusbox.com/en/features/models/">Models Features</a><br> ╰┈➤<a href="https://aliexpress.com/w/wholesale-octoplus-box.html">Aliexpress</a><br>
</td>
<td align="left" valign="top" style="width: 50%;">
• Cellebrite®<br><a href="https://cellebrite.com/" target="_blank" rel="noopener noreferrer">https://cellebrite.com</a><br>
• NSO Group®<br><a href="https://nsogroup.com/" target="_blank" rel="noopener noreferrer">https://nsogroup.com</a><br>
• Cognyte®<br><a href="https://cognyte.com/" target="_blank" rel="noopener noreferrer">https://cognyte.com</a><br>
• Check Point®<br><a href="https://checkpoint.com" target="_blank" rel="noopener noreferrer">https://checkpoint.com</a><br>
• Team Cymru®<br><a href="https://team-cymru.com" target="_blank" rel="noopener noreferrer">https://team-cymru.com</a><br>
• BriefCam®<br><a href="https://briefcam.com/" target="_blank" rel="noopener noreferrer">https://briefcam.com/</a><br>
• Forensic Toolkit (FTK)® <br><a href="https://exterro.com/forensic-toolkit" target="_blank" rel="noopener noreferrer">https://exterro.com/forensic-toolkit</a><br>
• Magnet Forensic®<br><a href="https://magnetforensics.com/" target="_blank" rel="noopener noreferrer">https://magnetforensics.com</a><br>
• Variston®<br><a href="https://variston.net" target="_blank" rel="noopener noreferrer">https://variston.net</a><br>
• Intellexa®<br><a href=no refer" target="_blank" rel="noopener noreferrer">no refer</a><br>
• Cytrox®<br><a href="no refer" target="_blank" rel="noopener noreferrer">no refer</a><br>
• Cy4Gate®<br><a href="https://cy4gate.com/" target="_blank" rel="noopener noreferrer">https://cy4gate.com/</a><br>
• PARS Defense®<br><a href="https://parsdefense.com" target="_blank" rel="noopener noreferrer">https://parsdefense.com</a><br>
• Candiru®<br><a href="https://saito.tech" target="_blank" rel="noopener noreferrer">https://saito.tech/</a><br>
• Harpia Tech®<br><a href="https://harpia.tech/english.html" target="_blank" rel="noopener noreferrer">https://harpia.tech</a><br>
• Visual Cortex®<br><a href="https://visualcortex.com/" target="_blank" rel="noopener noreferrer">https://visualcortex.com</a><br>
• Oxygen Forensic®<br><a href="https://oxygen-forensic.wedatasolution.com/" target="_blank" rel="noopener noreferrer">https://oxygen-forensic.wedatasolution.com</a><br>
• MSAB®<br><a href="https://msab.com/" target="_blank" rel="noopener noreferrer">https://msab.com</a><br>
• GMDSOFT®<br><a href="https://gmdsoft.com/" target="_blank" rel="noopener noreferrer">https://gmdsoft.com</a><br>
• Verint Systems®<br><a href="https://verint.com/" target="_blank" rel="noopener noreferrer">https://verint.com</a><br>
• Cyber Arm®<br><a href="https://cyber-arm.com/services" target="_blank" rel="noopener noreferrer">https://cyber-arm.com/services</a><br>
• Cobalt Strike®<br><a href="https://cobaltstrike.com" target="_blank" rel="noopener noreferrer">https://cobaltstrike.com</a><br>
• Lumi Networks®<br><a href="https://lumi.network" target="_blank" rel="noopener noreferrer">https://lumi.network</a><br>
• Clear View AI®<br><a href="https://clearview.ai" target="_blank" rel="noopener noreferrer">https://clearview.ai</a><br>
• Lockheed Martin®<br><a href="https://lockheedmartin.com" target="_blank" rel="noopener noreferrer">https://lockheedmartin.com/</a><br>
• MOBILedit®<br><a href="https://mobiledit.com/mobiledit-forensic" target="_blank" rel="noopener noreferrer">https://mobiledit.com</a><br>
• Crowd Strike®<br><a href="https://crowdstrike.com" target="_blank" rel="noopener noreferrer">https://crowdstrike.com</a><br>
• Binalyze®<br><a href="https://binalyze.com" target="_blank" rel="noopener noreferrer">https://binalyze.com</a><br>
• LexisNexis®<br><a href="https://risk.lexisnexis.com" target="_blank" rel="noopener noreferrer">https://risk.lexisnexis.com</a><br>
• NetQuest®<br><a href="https://netquestcorp.com" target="_blank" rel="noopener noreferrer">https://netquestcorp.com</a><br>
• Gamma®<br><a href="https://gamma.co.uk" target="_blank" rel="noopener noreferrer">https://gamma.co.uk</a><br>
• Memento Labs®<br><a href="https://mem3nt0.com" target="_blank" rel="noopener noreferrer">https://mem3nt0.com</a><br>
• CYSource®<br><a href="https://cysrc.com" target="_blank" rel="noopener noreferrer">https://cysrc.com</a><br>
• Maltego®<br><a href="https://maltego.com" target="_blank" rel="noopener noreferrer">https://maltego.com</a><br>
• Thorn's Safer®<br><a href="https://thorn.org/" target="_blank" rel="noopener noreferrer">https://thorn.org</a><br>
</td>
</tr>
</tbody>
</table>
<sub>Browse: https://dimse.info</sub>
<!-- ################################## -->
<hr>
<h3>FORENSIC TOOLS</h3>
<h4>• Evidence ProjectForensics Tools Catalogue</h4>
<h4><a href="https://dftoolscatalogue.eu/dftc.home.php">https://dftoolscatalogue.eu</a></h4>
<h4>• NIST - Forensics Tools Catalogue</h4>
<h4><a href="https://toolcatalog.nist.gov/search/">https://toolcatalog.nist.gov</a></h4>
<h4>• S&T partners and NIST - Computer Forensic Tool Testing (CFTT)</h4>
<h4><a href="https://dhs.gov/science-and-technology/nist-cftt-reports">https://dhs.gov/science-and-technology/nist-cftt-reports</a></h4>
<!-- ################################## -->
<hr>
<sub>
<p><b>Interesting information</b></p>
<a href="https://socradar.io/beyond-the-veil-of-surveillance-private-sector-offensive-actors-psoas">• Beyond the Veil of Surveillance: Private Sector Offensive Actors (PSOAs)</a>
<a href="https://zdnet.com/article/burn-drown-or-smash-your-phone-forensics-can-extract-data-anyway">• Burn, drown, or smash your phone: Forensics can extract data anyway</a>
<a href="https://arstechnica.com/information-technology/2021/01/how-law-enforcement-gets-around-your-smartphones-encryption">• How law enforcement gets around your smartphone’s encryption</a>
<a href="https://youtube.com/watch?v=EmWsW_p_ta4">• Cellphone data used to solve murder case from 2 years ago, police say</a>
<a href="https://youtube.com/watch?v=wzSgLpNrr2E">• The Stingray: How Law Enforcement Can Track Your Every Move</a>
<a href="https://youtube.com/watch?v=DH7edXaZS0A">• Police are tracking you and your license plates</a>
<a href="https://youtube.com/watch?v=ASYm-3NJ-GA&t=40s">• SCOTUS: Police Need Search Warrant to Ping cell Phones</a>
<a href="https://eff.org/deeplinks/2023/09/eff-michigan-court-governments-shouldnt-be-allowed-use-drone-spy-you-without">• EFF to Michigan Court: Governments Shouldn’t Be Allowed to Use a Drone to Spy on You Without a Warrant</a>
<a href="https://theintercept.com/document/motion-to-suppress-aerial-surveillance-evidence-in-u-s-vs-muhammed-momtaz-alazhari">• Motion to Suppress Aerial Surveillance Evidence in U.S. vs Muhammed Momtaz Alazhari</a>
<a href="https://nytimes.com/2008/02/22/technology/22chip.html">• Researchers Find Way to Steal Encrypted Data - NYT (2008)</a>
<a href="https://nakedcapitalism.com/2019/02/reverse-location-search-warrant-a-new-personal-data-hoovering-exercise-brought-to-you-by-google.html">• “Reverse Location Search Warrant”: A New Personal Data Hoovering Exercise Brought to You by Google (2019)</a>
<a href="https://nakedcapitalism.com/2021/07/as-un-human-rights-chief-urges-stricter-rules-snowden-calls-for-end-to-spyware-trade.html">• As UN Human Rights Chief Urges Stricter Rules, Snowden Calls for End to Spyware Trade (2021)</a>
<a href="https://forensicscijournal.com/articles/jfsr-aid1039.pdf">• Forensics Journal Comparative analysis of mobile forensic proprietary tools: an application in forensic investigation (2022)</a>
</sub>
<!-- ################################## -->
<br>
<hr>
<h3>INTERCEPTION PLATFORMS</h3>
<p>Comparison between <a href="https://drivebadger.com">Drive Badger</a> <a href="https://github.com/drivebadger/drivebadger">(GitHub)</a> with other lawful interception platforms. Visit: <a href="https://docs.google.com/spreadsheets/d/1Ux0WeL-K4NOZTEQgJXuRzHPcG_ewKmcMNADuFhamytg/edit#gid=1460165261" target="_blank" rel="noopener noreferrer">Official sheet</a> or the <a href="https://github.com/RENANZG/My-Forensics/blob/main/03_DOCUMENTS/Workrounds/Drive_Bagder_-_Comparison_Of_Lawful_Interception_Platforms.pdf" target="_blank" rel="noopener noreferrer">PDF</a> version in our repo. <sub>Credits for the panel: <a href="https://github.com/tomaszklim">Tomasz Klim</a>.</sub></p>
<img src="https://github.com/RENANZG/My-Forensics/blob/main/.data/Drive_Bagder1_-_Comparison_Of_Lawful_Interception_Platforms-1.png?raw=true" title="Drive Bagder 1 - Comparison Of Lawful Interception Platforms" style="width:100%">
<!-- ################################## -->
<br>
<hr>
<h3>Exploit and Spyware Vendor</h3>
<table>
<tbody>
<tr>
<td>
<strong>Zero-day Exploit (2023)</strong>
</td>
<td>
<strong>Associated Spyware Vendor</strong>
</td>
</tr>
<tr>
<td>
<a href="https://thehackernews.com/2023/04/apple-releases-updates-to-address-zero.html">CVE-2023-28205 and CVE-2023-28206</a> (Apple iOS)
</td>
<td>
Variston (BridgeHead)
</td>
</tr>
<tr>
<td>
<a href="https://thehackernews.com/2023/04/google-releases-urgent-chrome-update-to.html">CVE-2023-2033</a> (Google Chrome)
</td>
<td>
Intellexa/Cytrox (Predator)
</td>
</tr>
<tr>
<td>
<a href="https://thehackernews.com/2023/04/google-chrome-hit-by-second-zero-day.html">CVE-2023-2136</a> (Google Chrome)
</td>
<td>
Intellexa/Cytrox (Predator)
</td>
</tr>
<tr>
<td>
<a href="https://thehackernews.com/2023/05/webkit-under-attack-apple-issues.html">CVE-2023-32409</a> (Apple iOS)
</td>
<td>
Variston (BridgeHead)
</td>
</tr>
<tr>
<td>
<a href="https://thehackernews.com/2023/06/zero-day-alert-google-issues-patch-for.html">CVE-2023-3079</a> (Google Chrome)
</td>
<td>
Intellexa/Cytrox (Predator)
</td>
</tr>
<tr>
<td>
<a href="https://thehackernews.com/2023/09/apple-rushes-to-patch-zero-day-flaws.html">CVE-2023-41061 and CVE-2023-41064</a> (Apple iOS)
</td>
<td>
NSO Group (Pegasus)
</td>
</tr>
<tr>
<td>
<a href="https://thehackernews.com/2023/09/apple-rushes-to-patch-3-new-zero-day.html">CVE-2023-41991, CVE-2023-41992, and CVE-2023-41993</a> (Apple iOS)
</td>
<td>
Intellexa/Cytrox (Predator)
</td>
</tr>
<tr>
<td>
<a href="https://thehackernews.com/2023/09/update-chrome-now-google-releases-patch.html">CVE-2023-5217</a> (Google Chrome)
</td>
<td>
Candiru (DevilsTongue)
</td>
</tr>
<tr>
<td>
<a href="https://thehackernews.com/2023/10/arm-issues-patch-for-mali-gpu-kernel.html">CVE-2023-4211</a> (Arm Mali GPU)
</td>
<td>
Cy4Gate (Epeius)
</td>
</tr>
<tr>
<td>
<a href="https://thehackernews.com/2023/10/qualcomm-releases-patch-for-3-new-zero.html">CVE-2023-33063</a> (Qualcomm Adreno GPU)
</td>
<td>
Variston (BridgeHead)
</td>
</tr>
<tr>
<td>
<a href="https://thehackernews.com/2023/10/qualcomm-releases-patch-for-3-new-zero.html">CVE-2023-33106 and CVE-2023-33107</a> (Qualcomm Adreno GPU)
</td>
<td>
Cy4Gate (Epeius)
</td>
</tr>
<tr>
<td>
<a href="https://thehackernews.com/2023/12/zero-day-alert-apple-rolls-out-ios.html">CVE-2023-42916 and CVE-2023-42917</a> (Apple iOS)
</td>
<td>
PARS Defense
</td>
</tr>
<tr>
<td>
<a href="https://thehackernews.com/2023/12/urgent-new-chrome-zero-day.html">CVE-2023-7024</a> (Google Chrome)
</td>
<td>
NSO Group (Pegasus)
</td>
</tr>
</tbody>
</table>
<!-- ################################## -->
<br>
<hr>
<h3>NATIONAL CYBER SECURITY AGENCIES</h3>
<table style="width:830px" cellspacing="0" cellpadding="0">
<thead>
<tr>
</tr>
</thead>
<tbody>
<tr>
<td valign="top" style="width:25%">
<a href="https://cisa.gov/">US — CISA</a><br>
<a href="https://cyber.gc.ca/en">CA — Cyber</a><br>
<a href="https://csirtamericas.org/en">Americas — CSIRT</a><br>
</td>
<td valign="top" style="width:25%">
<a href="https://enisa.europa.eu">EU — ENISA</a><br>
<a href="https://ncsc.gov.uk">UK — NCSC</a><br>
<a href="https://english.ncsc.nl">NL — NCSC</a><br>
<a href="https://bsi.bund.de/EN">DE — BSI</a><br>
<a href="https://cyber.gouv.fr/en">FR — ANSSI</a><br>
<a href="https://ccn-cert.cni.es/es/">ES — CCN-CERT</a><br>
<a href="https://acn.gov.it/en">IT — ACN</a><br>
<a href="https://nki.gov.hu/en">HU — NKI</a><br>
<a href="https://nukib.cz/en">CZ — NUKIB</a><br>
<a href="https://nsm.no/areas-of-expertise/cyber-securitynorwegian-national-cyber-security-centre-ncsc">NO — NCSC</a><br>
</td>
<td valign="top" style="width:25%">
<a href="https://gov.il/en/departments/israel_national_cyber_directorate/govil-landing-page">IS — INCD</a><br>
<a href="https://cyber.gov.au">AU — Cyber</a><br>
<a href="https://cert.govt.nz">NZ — CERT</a><br>
<a href="https://ncsc.govt.nz">NZ — NCSC</a><br>
</td>
<td valign="top" style="width:25%">
<a href="https://kisa.or.kr/EN">KR — KISA</a><br>
<a href="https://jpcert.or.jp/english">JP — Cert</a><br>
<a href="https://nisc.go.jp/eng/index.html">JP — NISC</a><br>
<a href="https://csa.gov.sg">SG — CSA</a><br>
</td>
</tr>
</tbody>
</table>
<!-- ############################## -->
<br>
<hr>
${\color{Blue}\textbf{1.PASSIVE FORENSICS}}$
👷🛠️UNDER CONSTRUCTION🚧🏗<br>
<details>
<summary>1.01 Forensic standards</summary>
<br>
<p>Visit our repo tree: <a href="https://github.com/RENANZG/My-Forensics/tree/main/2.FORENSIC">2.FORENSIC</a></p>
<div>
<details>
<summary><b>Standards</b></summary>
<br>
<h4>NIST — National Institute of Standards and Technology</h4>
<h6>Visit: https://nist.gov/standards</h6>
<h4>ASTM International</h4>
<h5>Subcommittee E30.12 on Digital and Multimedia Evidence</h5>
<h6>Visit: https://www.astm.org/get-involved/technical-committees/committee-e30/subcommittee-e30/jurisdiction-e3012</h6>
<h4>The PCI Security Standards Council (PCI SSC)</h4>
<h6>Visit: https://www.pcisecuritystandards.org</h6>
<p><b>ISO/IEC — International Electrotechnical Commission</b></p>
<h6>Visit: https://iso27001security.com</h6>
<h6>Official - Information security, cybersecurity and privacy protection — https://iso.org/standard/27001</h6>
<ul>
<li><A HREF="https://iso27001security.com/html/27000.html">ISO/IEC 27000 — ISO27k overview & glossary</a></li>
<li><A HREF="https://iso27001security.com/html/27001.html">ISO/IEC 27001 — formal ISMS specification</a></li>
<li><A HREF="https://iso27001security.com/html/27002.html">ISO/IEC 27002 — infosec controls catalogue</a></li>
<li><A HREF="https://iso27001security.com/html/27003.html">ISO/IEC 27003 — ISMS implementation guide</a></li>
<li><A HREF="https://iso27001security.com/html/27004.html">ISO/IEC 27004 — infosec measurement [metrics]</a></li>
<li><A HREF="https://iso27001security.com/html/27005.html">ISO/IEC 27005 — info[sec] risk management</a></li>
<li><A HREF="https://iso27001security.com/html/27006.html">ISO/IEC 27006-n — ISMS & PIMS certification </a></li>
<li><A HREF="https://iso27001security.com/html/27007.html">ISO/IEC 27007 — <I>management system</I> auditing</a></li>
<li><A HREF="https://iso27001security.com/html/27008.html">ISO/IEC TS 27008 — <I>security controls</I> auditing</a></li>
<li><A HREF="https://iso27001security.com/html/27009.html">ISO/IEC 27009 — sector variants of ISO27k</a></li>
<li><A HREF="https://iso27001security.com/html/27010.html">ISO/IEC 27010 — for inter-org comms</a></li>
<li><A HREF="https://iso27001security.com/html/27011.html">ISO/IEC 27011 — ISMS for telecoms</a></li>
<li><A HREF="https://iso27001security.com/html/27013.html">ISO/IEC 27013 — ISMS & ITIL/service mgmt</a></li>
<li><A HREF="https://iso27001security.com/html/27014.html">ISO/IEC 27014 — infosec governance</a></li>
<li><A HREF="https://iso27001security.com/html/27016.html">ISO/IEC TR 27016 — infosec economics</a></li>
<li><A HREF="https://iso27001security.com/html/27017.html">ISO/IEC 27017 — cloud security controls</a></li>
<li><A HREF="https://iso27001security.com/html/27018.html">ISO/IEC 27018 — cloud privacy</a></li>
<li><A HREF="https://iso27001security.com/html/27019.html">ISO/IEC 27019 — process control in energy industry</a></li>
<li><A HREF="https://iso27001security.com/html/27021.html">ISO/IEC 27021 — competences for ISMS pro’s</a></li>
<li><A HREF="https://iso27001security.com/html/27022.html">ISO/IEC TS 27022 — ISMS processes</a></li>
<li><A HREF="https://iso27001security.com/html/27031.html">ISO/IEC 27031 — ICT element of business continuity</a></li>
<li><A HREF="https://iso27001security.com/html/27032.html">ISO/IEC 27032 — Internet security</a></li>
<li><A HREF="https://iso27001security.com/html/27033.html">ISO/IEC 27033-n — network security</a></li>
<li><A HREF="https://iso27001security.com/html/27034.html">ISO/IEC 27034-n — application security</a></li>
<li><A HREF="https://iso27001security.com/html/27035.html">ISO/IEC 27035-n — incident management</a></li>
<li><A HREF="https://iso27001security.com/html/27036.html">ISO/IEC 27036-n — ICT supply chain & cloud</a></li>
<li><A HREF="https://iso27001security.com/html/27037.html">ISO/IEC 27037 — digital evidence [eForensics]</a></li>
<li><A HREF="https://iso27001security.com/html/27038.html">ISO/IEC 27038 — document redaction</a></li>
<li><A HREF="https://iso27001security.com/html/27039.html">ISO/IEC 27039 — intrusion prevention</a></li>
<li><A HREF="https://iso27001security.com/html/27040.html">ISO/IEC 27040 — storage security</a></li>
<li><A HREF="https://iso27001security.com/html/27041.html">ISO/IEC 27041 — incident investigation assurance</a></li>
<li><A HREF="https://iso27001security.com/html/27042.html">ISO/IEC 27042 — analysing digital evidence</a></li>
<li><A HREF="https://iso27001security.com/html/27043.html">ISO/IEC 27043 — incident investigation</a></li>
<li><A HREF="https://iso27001security.com/html/27050.html">ISO/IEC 27050-n — digital forensics</a></li>
<li><A HREF="https://iso27001security.com/html/27070.html">ISO/IEC 27070 — virtual roots of trust</a></li>
<li><A HREF="https://iso27001security.com/html/27071.html">ISO/IEC 27071 — trusted connections</a></li>
<li><A HREF="https://iso27001security.com/html/27099.html">ISO/IEC 27099 — ISMS for PKI</a></li>
<li><A HREF="https://iso27001security.com/html/27100.html">ISO/IEC TS 27100 — cybersecurity overview/concepts</a></li>
<li><A HREF="https://iso27001security.com/html/27102.html">ISO/IEC 27102 — cyber-insurance</a></li>
<li><A HREF="https://iso27001security.com/html/27103.html">ISO/IEC 27103 — ISMS for cybersecurity</a></li>
<li><A HREF="https://iso27001security.com/html/27110.html">ISO/IEC TS 27110 — cybersecurity frameworks</a></li>
<li><A HREF="https://iso27001security.com/html/27400.html">ISO/IEC 27400 — IoT security and privacy</a></li>
<li><A HREF="https://iso27001security.com/html/27550.html">ISO/IEC TR 27550 — privacy engineering</a></li>
<li><A HREF="https://iso27001security.com/html/27553.html">ISO/IEC 27553-n — mobile device biometrics</a></li>
<li><A HREF="https://iso27001security.com/html/27555.html">ISO/IEC 27555 — deleting PII/personal data</a></li>
<li><A HREF="https://iso27001security.com/html/27556.html">ISO/IEC 27556 — privacy preferences</a></li>
<li><A HREF="https://iso27001security.com/html/27557.html">ISO/IEC 27557 — privacy risk management</a></li>
<li><A HREF="https://iso27001security.com/html/27559.html">ISO/IEC 27559 — de-identification of personal data</a></li>
<li><A HREF="https://iso27001security.com/html/27560.html">ISO/IEC TS 27560 — privacy consent record structure</a></li>
<li><A HREF="https://iso27001security.com/html/27563.html">ISO/IEC TR 27563 — AI use case security & privacy</a></li>
<li><A HREF="https://iso27001security.com/html/27570.html">ISO/IEC TS 27570 — smart city privacy</a></li>
<li><A HREF="https://iso27001security.com/html/27701.html">ISO/IEC 27701 — managing privacy with an ISMS</li>
<li><A HREF="https://iso27001security.com/html/27799.html">ISO 27799 — information security in healthcare</a></li>
</ul>
<p><b>RFC</b></p>
<p><b>Best Current Practices (BCP)</b></p>
<ul>
<li><a href="https://ietf.org/rfc/rfc1918.txt"> RFC 1918 / BCP 5: Address Allocation for Private Internets</a></li>
<li><a href="https://ietf.org/rfc/rfc2350.txt"> RFC 2350 / BCP 21: Expectations for Computer Security Incident Response</a></li>
<li><a href="https://ietf.org/rfc/rfc2505.txt"> RFC 2505 / BCP 30: Anti-Spam Recommendations for SMTP MTAs</a></li>
<li><a href="https://ietf.org/rfc/rfc2644.txt"> RFC 2644 / BCP 34: Changing the Default for Directed Broadcasts in Routers</a></li>
<li><a href="https://ietf.org/rfc/rfc2827.txt"> RFC 2827 / BCP 38: Network Ingress Filtering: Defeating Denial of Service Attacks which employ IP Source Address Spoofing</a></li>
<li><a href="https://ietf.org/rfc/rfc3013.txt"> RFC 3013 / BCP 46: Recommended Internet Service Provider Security Services and Procedures</a></li>
<li><a href="https://ietf.org/rfc/rfc3227.txt"> RFC 3227 / BCP 55: Guidelines for Evidence Collection and Archiving</a></li>
<li><a href="https://ietf.org/rfc/rfc3360.txt"> RFC 3360 / BCP 60: Inappropriate TCP Resets Considered Harmful</a></li>
<li><a href="https://ietf.org/rfc/rfc3365.txt"> RFC 3365 / BCP 61: Strong Security Requirements for Internet Engineering Task Force Standard Protocols</a></li>
<li><a href="https://ietf.org/rfc/rfc4086.txt"> RFC 4086 / BCP 106: Randomness Requirements for Security</a></li>
<li><a href="https://ietf.org/rfc/rfc4107.txt"> RFC 4107 / BCP 107: Guidelines for Cryptographic Key Management</a></li>
<li><a href="https://ietf.org/rfc/rfc5068.txt"> RFC 5068 / BCP 134: Email Submission Operations: Access and
Accountability Requirements</a></li>
<li><a href="https://ietf.org/rfc/rfc5358.txt">RFC 5358 / BCP 140: Preventing Use of Recursive Nameservers in Reflector Attacks</a></li>
<li><a href="https://ietf.org/rfc/rfc5406.txt">RFC 5406 / BCP 146: Guidelines for Specifying the Use of IPsec Version 2</a></li>
</ul>
<p><b>Standards</b></p>
<ul>
<li><a href="https://ietf.org/rfc/rfc2142.txt"> RFC 2142: Mailbox Names for Common Services, Roles and Functions</a></li>
<li><a href="https://ietf.org/rfc/rfc2246.txt"> RFC 2246: The TLS Protocol Version 1.0</a></li>
<li><a href="https://ietf.org/rfc/rfc2554.txt"> RFC 2554: SMTP Service Extension for Authentication</a></li>
<li><a href="https://ietf.org/rfc/rfc3168.txt"> RFC 3168: The Addition of Explicit Congestion Notification (ECN) to IP</a></li>
<li><a href="https://ietf.org/rfc/rfc3207.txt"> RFC 3207: SMTP Service Extension for Secure SMTP over Transport Layer Security</a></li>
<li><a href="https://ietf.org/rfc/rfc3369.txt"> RFC 3369: Cryptographic Message Syntax (CMS)</a></li>
<li><a href="https://ietf.org/rfc/rfc3370.txt"> RFC 3370: Cryptographic Message Syntax (CMS) Algorithms</a></li>
<li><a href="https://ietf.org/rfc/rfc3834.txt"> RFC 3834: Recommendations for Automatic Responses to Electronic Mail</a></li>
<li><a href="https://ietf.org/rfc/rfc4033.txt"> RFC 4033: DNS Security Introduction and Requirements</a></li>
<li><a href="https://ietf.org/rfc/rfc4034.txt"> RFC 4034: Resource Records for the DNS Security Extensions</a></li>
<li><a href="https://ietf.org/rfc/rfc4035.txt"> RFC 4035: Protocol Modifications for the DNS Security Extensions</a></li>
<li><a href="https://ietf.org/rfc/rfc4051.txt"> RFC 4051: Additional XML Security Uniform Resource Identifiers (URIs)</a></li>
<li><a href="https://ietf.org/rfc/rfc4055.txt">RFC 4055: Additional Algorithms and Identifiers for RSA Cryptography for use in the Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile</a></li>
<li><a href="https://ietf.org/rfc/rfc4056.txt">RFC 4056: Use of the RSASSA-PSS Signature Algorithm in Cryptographic Message Syntax (CMS)</a></li>
<li><a href="https://ietf.org/rfc/rfc4109.txt">RFC 4109: Algorithms for Internet Key Exchange version 1 (IKEv1)</a></li>
<li><a href="https://ietf.org/rfc/rfc4217.txt">RFC 4217: Securing FTP with TLS</a></li>
<li><a href="https://ietf.org/rfc/rfc4250.txt">RFC 4250: The Secure Shell (SSH) Protocol Assigned Numbers</a></li>
<li><a href="https://ietf.org/rfc/rfc4251.txt">RFC 4251: The Secure Shell (SSH) Protocol Architecture</a></li>
<li><a href="https://ietf.org/rfc/rfc4252.txt">RFC 4252: The Secure Shell (SSH) Authentication Protocol</a></li>
<li><a href="https://ietf.org/rfc/rfc4253.txt">RFC 4253: The Secure Shell (SSH) Transport Layer Protocol</a></li>
<li><a href="https://ietf.org/rfc/rfc4254.txt">RFC 4254: The Secure Shell (SSH) Connection Protocol</a></li>
<li><a href="https://ietf.org/rfc/rfc4255.txt">RFC 4255: Using DNS to Securely Publish Secure Shell (SSH) Key Fingerprints</a></li>
<li><a href="https://ietf.org/rfc/rfc4256.txt">RFC 4256: Generic Message Exchange Authentication for the Secure Shell Protocol (SSH)</a></li>
<li><a href="https://ietf.org/rfc/rfc4301.txt">RFC 4301: Security Architecture for the Internet Protocol</a></li>
<li><a href="https://ietf.org/rfc/rfc4302.txt">RFC 4302: IP Authentication Header</a></li>
<li><a href="https://ietf.org/rfc/rfc4303.txt">RFC 4303: IP Encapsulating Security Payload (ESP)</a></li>
<li><a href="https://ietf.org/rfc/rfc4308.txt">RFC 4308: Cryptographic Suites for IPsec</a></li>
<li><a href="https://ietf.org/rfc/rfc4344.txt">RFC 4344: The Secure Shell (SSH) Transport Layer Encryption Modes</a></li>
<li><a href="https://ietf.org/rfc/rfc4346.txt">RFC 4346: The Transport Layer Security (TLS) Protocol Version 1.1</a></li>
<li><a href="https://ietf.org/rfc/rfc4359.txt">RFC 4359: The Use of RSA/SHA-1 Signatures within Encapsulating
Security Payload (ESP) and Authentication Header (AH)</a></li>
<li><a href="https://ietf.org/rfc/rfc4366.txt">RFC 4366: Transport Layer Security (TLS) Extensions</a></li>
<li><a href="https://ietf.org/rfc/rfc4513.txt">RFC 4513: Lightweight Directory Access Protocol (LDAP): Authentication Methods and Security Mechanisms</a></li>
<li><a href="https://ietf.org/rfc/rfc4871.txt">RFC 4871: DomainKeys Identified Mail (DKIM) Signatures</a></li>
<li><a href="https://ietf.org/rfc/rfc4959.txt">RFC 4959: IMAP Extension for Simple Authentication and Security Layer (SASL) Initial Client Response</a></li>
<li><a href="https://ietf.org/rfc/rfc4985.txt">RFC 4985: Internet X.509 Public Key Infrastructure Subject Alternative Name for Expression of Service Name</a></li>
<li><a href="https://ietf.org/rfc/rfc5070.txt">RFC 5070: The Incident Object Description Exchange Format</a></li>
<li><a href="https://ietf.org/rfc/rfc5321.txt">RFC 5321: Simple Mail Transfer Protocol</a></li>
<li><a href="https://ietf.org/rfc/rfc5322.txt">RFC 5322: Internet Message Format</a></li>
<li><a href="https://ietf.org/rfc/rfc5901.txt">RFC 5901: Extensions to the IODEF-Document Class for Reporting Phishing</a></li>
<li><a href="https://ietf.org/rfc/rfc6045.txt">RFC 6045: Real-time Inter-network Defense (RID)</a></li>
<li><a href="https://ietf.org/rfc/rfc6409.txt">RFC 6409: Message Submission for Mail</a></li>
<li><a href="https://ietf.org/rfc/rfc6528.txt">RFC 6528: Defending against Sequence Number Attacks</a></li>
</ul>
<p><b>Informational</b></p>
<ul>
<li><a href="https://ietf.org/rfc/rfc1281.txt"> RFC 1281: Guidelines for the Secure Operation of the Internet</a></li>
<li><a href="https://ietf.org/rfc/rfc1321.txt"> RFC 1321: The MD5 Message-Digest Algorithm</a></li>
<li><a href="https://ietf.org/rfc/rfc1470.txt"> RFC 1470: Tools for Monitoring and Debugging TCP/IP Internets and Interconnected Devices</a></li>
<li><a href="https://ietf.org/rfc/rfc1750.txt"> RFC 1750: Randomness Recommendations for Security</a></li>
<li><a href="https://ietf.org/rfc/rfc2076.txt"> RFC 2076: Common Internet Message Headers</a></li>
<li><a href="https://ietf.org/rfc/rfc2196.txt"> RFC 2196: Site Security Handbook</a></li>
<li><a href="https://ietf.org/rfc/rfc2411.txt"> RFC 2411: IP Security Document Roadmap</a></li>
<li><a href="https://ietf.org/rfc/rfc2504.txt"> RFC 2504: Users Security Handbook</a></li>
<li><a href="https://ietf.org/rfc/rfc2577.txt"> RFC 2577: FTP Security Considerations</a></li>
<li><a href="https://ietf.org/rfc/rfc2979.txt"> RFC 2979: Behavior of and Requirements for Internet Firewalls</a></li>
<li><a href="https://ietf.org/rfc/rfc3067.txt"> RFC 3067: TERENA's Incident Object Description and Exchange Format Requirements</a></li>
<li><a href="https://ietf.org/rfc/rfc3098.txt"> RFC 3098: How to Advertise Responsibly Using E-Mail and Newsgroups or — how NOT to $$$$$ MAKE ENEMIES FAST! $$$$$</a></li>
<li><a href="https://ietf.org/rfc/rfc3164.txt">RFC 3164: The BSD syslog Protocol</a></li>
<li><a href="https://ietf.org/rfc/rfc3174.txt">RFC 3174: US Secure Hash Algorithm 1 (SHA1)</a></li>
<li><a href="https://ietf.org/rfc/rfc3330.txt">RFC 3330: Special-Use IPv4 Addresses</a></li>
<li><a href="https://ietf.org/rfc/rfc3511.txt">RFC 3511: Benchmarking Methodology for Firewall Performance</a></li>
<li><a href="https://ietf.org/rfc/rfc3631.txt">RFC 3631: Security Mechanisms for the Internet</a></li>
<li><a href="https://ietf.org/rfc/rfc3833.txt">RFC 3833: Threat Analysis of the Domain Name System (DNS)</a></li>
<li><a href="https://ietf.org/rfc/rfc3871.txt">RFC 3871: Operational Security Requirements for Large Internet Service Provider (ISP) IP Network Infrastructure</a></li>
<li><a href="https://ietf.org/rfc/rfc3964.txt">RFC 3964: Security Considerations for 6to4</a></li>
<li><a href="https://ietf.org/rfc/rfc4096.txt">RFC 4096: Policy-Mandated Labels Such as "Adv:" in Email Subject Headers Considered Ineffective At Best</a></li>
<li><a href="https://ietf.org/rfc/rfc4270.txt">RFC 4270: Attacks on Cryptographic Hashes in Internet Protocols</a></li>
<li><a href="https://ietf.org/rfc/rfc4272.txt">RFC 4272: BGP Security Vulnerabilities Analysis</a></li>
<li><a href="https://ietf.org/rfc/rfc4381.txt">RFC 4381: Analysis of the Security of BGP/MPLS IP Virtual Private Networks (VPNs)</a></li>
<li><a href="https://ietf.org/rfc/rfc4641.txt">RFC 4641: DNSSEC Operational Practices</a></li>
<li><a href="https://ietf.org/rfc/rfc4686.txt">RFC 4686: Analysis of Threats Motivating DomainKeys Identified Mail (DKIM)</a></li>
<li><a href="https://ietf.org/rfc/rfc4766.txt">RFC 4766: Intrusion Detection Message Exchange Requirements</a></li>
<li><a href="https://ietf.org/rfc/rfc4772.txt">RFC 4772: Security Implications of Using the Data Encryption Standard (DES)</a></li>
<li><a href="https://ietf.org/rfc/rfc4778.txt">RFC 4778: Current Operational Security Practices in Internet Service Provider Environments</a></li>
<li><a href="https://ietf.org/rfc/rfc4890.txt">RFC 4890: Recommendations for Filtering ICMPv6 Messages in Firewalls</a></li>
<li><a href="https://ietf.org/rfc/rfc4891.txt">RFC 4891: Using IPsec to Secure IPv6-in-IPv4 Tunnels</a></li>
<li><a href="https://ietf.org/rfc/rfc4942.txt">RFC 4942: IPv6 Transition/Coexistence Security Considerations</a></li>
<li><a href="https://ietf.org/rfc/rfc4986.txt">RFC 4986: Requirements Related to DNS Security (DNSSEC) Trust Anchor Rollover</a></li>
<li><a href="https://ietf.org/rfc/rfc4949.txt">RFC 4949: Internet Security Glossary, Version 2</a></li>
<li><a href="https://ietf.org/rfc/rfc6092.txt">RFC 6092: Recommended Simple Security Capabilities in Customer Premises Equipment (CPE) for Providing Residential IPv6 Internet Service</a></li>
<li><a href="https://ietf.org/rfc/rfc6274.txt">RFC 6274: Security Assessment of the Internet Protocol Version 4</a></li>
<li><a href="https://ietf.org/rfc/rfc6305.txt">RFC 6305: I'm Being Attacked by PRISONER.IANA.ORG!</a></li>
<li><a href="https://ietf.org/rfc/rfc6471.txt">RFC 6471: Overview of Best Email DNS-Based List (DNSBL) Operational Practices</a></li>
<li><a href="https://ietf.org/rfc/rfc6480.txt">RFC 6480: An Infrastructure to Support Secure Internet Routing</a></li>
<li><a href="https://ietf.org/rfc/rfc6561.txt">RFC 6561: Recommendations for the Remediation of Bots in ISP Networks</a></li>
<li><a href="https://ietf.org/rfc/rfc7123.txt">RFC 7123: Security Implications of IPv6 on IPv4 Networks</a></li>
</ul>
<p><b>Experimental / Historic</b></p>
<ul>
<li><a href="https://ietf.org/rfc/rfc4406.txt"> RFC 4406: Sender ID: Authenticating E-Mail</a></li>
<li><a href="https://ietf.org/rfc/rfc4408.txt"> RFC 4408: Sender Policy Framework (SPF) for Authorizing Use of Domains in E-Mail, Version 1</a></li>
<li><a href="https://ietf.org/rfc/rfc4765.txt"> RFC 4765: The Intrusion Detection Message Exchange Format (IDMEF)</a></li>
<li><a href="https://ietf.org/rfc/rfc4767.txt"> RFC 4767: The Intrusion Detection Exchange Protocol (IDXP)</a></li>
<li><a href="https://ietf.org/rfc/rfc6541.txt"> RFC 6541: DomainKeys Identified Mail (DKIM) Authorized Third-Party Signatures</a></li>
<li><a href="https://ietf.org/rfc/rfc6587.txt"> RFC 6587: Transmission of Syslog Messages over TCP </a></li>
</ul>
</details>
</div>
<br>
</details>
<!-- ########## -->
<details>
<summary>1.02 Forensic certs & training</summary>
<br>
<ul>
<li>
<p><a href="https://aboutdfir.com/education/certifications-training/">About DFIR - Certifications Training</a></p>
</li>
<li>
<p><a href="https://github.com/mikeroyal/Digital-Forensics-Guide">Mikeroyal - Digital Forensics Guide (Github)</a></p>
</li>
<li>
<p><a href="https://enisa.europa.eu/topics/training-and-exercises/trainings-for-cybersecurity-specialists/online-training-material">Enisa EU - Online Training Material</a></p>
</li>
<li>
<p><a href=""></a></p>
</li>
<li>
<p><a href=""></a></p>
</li>
</ul>
<br>
</details>
<!-- ########## -->
<details>
<summary>1.03 Online tools</summary>
<br>
<h4>Utilities</h4>
<h5>Message Header Analysis</h5>
<ul>
<li><a href="https://mha.azurewebsites.net">Message Header Analyzer (Azure)</a></li>
<li><a href="https://github.com/microsoft/MHA">Message Header Analyzer (GitHub)</a></li>
</ul>
<h5>Phishing and Email Reputation</h5>
<ul>
<li><a href="https://phishtank.org">PhishTank</a></li>
<li><a href="https://emailrep.io">Simple Email Reputation</a></li>
<li><a href="https://mxtoolbox.com/blacklists.aspx">Email Blacklist Check</a></li>
</ul>
<h5>Whois and DNS Lookup</h5>
<ul>
<li><a href="https://iana.org/whois">Whois</a></li>
<li><a href="https://viewdns.info">ViewDNS</a></li>
<li><a href="https://whoismydns.com">WhoisMyDNS</a></li>
<li><a href="https://nslookup.io">NSLookup</a></li>
<li><a href="https://my-addr.com">My-Addr</a></li>
<li><a href="https://mxtoolbox.com">MXToolbox</a></li>
<li><a href="https://dnsstuff.com">DNSstuff</a></li>
</ul>
<h5>Malware and Vulnerability Databases</h5>
<ul>
<li><a href="https://malpedia.caad.fkie.fraunhofer.de">Malpedia</a></li>
<li><a href="https://exploit-db.com">Exploit Database</a></li>
<li><a href="https://cvedetails.com">CVE Details</a></li>
<li><a href="https://fileinfo.co">FileInfo</a></li>
<li><a href="https://strontic.github.io/xcyclopedia">xCyclopedia</a></li>
<li><a href="https://winbindex.m417z.com">The Windows Binary Index</a></li>
<li><a href="https://applipedia.paloaltonetworks.com">Palo Alto Applipedia</a></li>
<li><a href="https://ultimatewindowssecurity.com/securitylog/encyclopedia">Windows Security Logs</a></li>
<li><a href="https://nvd.nist.gov">National Vulnerability Database (NVD)</a></li>
</ul>
<h5>Archiving Tools</h5>
<ul>
<li><a href="https://web.archive.org">Internet Archive (WayBackMachine)</a></li>
<li><a href="https://archive.ph">Archive Web Content</a></li>
<li><a href="https://archive.org">Internet Archive</a></li>
<li><a href="https://httrack.com">HTTrack</a></li>
<li><a href="https://perma.cc">Perma.cc</a></li>
</ul>
<h5>IP and MAC Address Tools</h5>
<ul>
<li><a href="https://ipvoid.com">IPVOID</a></li>
<li><a href="https://abuseipdb.com">AbuseIPDB</a></li>
<li><a href="https://grabify.link/">Grabify IP Logger</a></li>
<li><a href="https://iplogger.org">IP Logger</a></li>
<li><a href="https://iplogger.org/ip-tracker">IP Tracker</a></li>
<li><a href="https://iplogger.org/location-tracker">IP Location Tracker</a></li>
<li><a href="https://iplocation.net">IP Location</a></li>
<li><a href="https://iplogger.org/url_checker">URL Checker</a></li>
<li><a href="https://iplogger.org/mac-checker">MAC Address Lookup</a></li>
<li><a href="https://macvendors.com">MAC Vendor</a></li>
<li><a href="https://ip-api.com">Ip-api</a></li>
<li><a href="https://ipify.org">Ipify</a></li>
<li><a href="https://ipapi.co">Ipapi</a></li>
<li><a href="https://vpnapi.io">Vpnapi</a></li>
<li><a href="https://ipapi.com">Ipapi</a></li>
<li><a href="https://zmap.io">The ZMap Project</a></li>
<li><a href="https://wigle.net">WiGLE</a></li>
<li><a href="https://shodan.io">Shodan</a></li>
<li><a href="https://censys.io">Censys</a></li>
</ul>
<h5>URL and Virus Scanning</h5>
<ul>
<li><a href="https://urlscan.io">urlscan.io</a></li>
<li><a href="https://virustotal.com">Virus Total</a></li>
<li><a href="https://hybrid-analysis.com">Hybrid Analysis</a></li>
<li><a href="https://cuckoo.cert.ee">Cuckoo Sandbox</a></li>
<li><a href="https://otx.alienvault.com">AlienVault OTX</a></li>
<li><a href="https://exchange.xforce.ibmcloud.com">IBM X-Force Exchange</a></li>
<li><a href="https://talosintelligence.com/reputation_center">Cisco Talos</a></li>
<li><a href="https://maltiverse.com/collection">Maltiverse</a></li>
<li><a href="https://greynoise.io">GreyNoise</a></li>
<li><a href="https://isc.sans.edu">SANS Internet Storm Center</a></li>
<li><a href="https://intelx.io">Intelligence X</a></li>
<li><a href="https://metadefender.opswat.com">MetaDefender Cloud</a></li>
<li><a href="https://community.riskiq.com/home">RiskIQ Community Edition</a></li>
<li><a href="https://pulsedive.com">Pulsedive</a></li>
<li><a href="https://valhalla.nextron-systems.com">Valhalla YARA Rules</a></li>
<li><a href="https://any.run">ANY.RUN</a></li>
<li><a href="https://binvis.io">Binvis</a></li>
<li><a href="https://joesandbox.com">JoeSandbox</a></li>
</ul>
<h5>File Analysis and Reverse Engineering</h5>
<ul>
<li><a href="https://verexif.com/en/">Verexif</a></li>
<li><a href="https://revshells.com">Reverse Shell Generator</a></li>
<li><a href="https://hashes.com/en/decrypt/hash">Rainbow Tables (Hashes)</a></li>
<li><a href="https://en.wikipedia.org/wiki/Magic_number_(programming)">File Signatures ("Magic Numbers")</a></li>
<li><a href="https://en.wikipedia.org/wiki/List_of_file_signatures">List of File Signatures</a></li>
<li><a href="https://gchq.github.io/CyberChef">CyberChef</a></li>
<li><a href="https://explainshell.com">explainshell</a></li>
<li><a href="https://virusshare.com">VirusShare</a></li>
<li><a href="https://reverse.it">Reverse.IT</a></li>
</ul>
<h5>Utilities and Development Tools</h5>
<ul>
<li><a href="https://ctool.dev">Commonly Used Software Development Tools</a></li>
<li><a href="https://dehashed.com">DeHashed</a></li>
<li><a href="https://dencode.com">Dencode</a></li>
<li><a href="https://textfixer.com">Text Fixer</a></li>
<li><a href="https://ss64.com">SS64 Syntax Utils</a>
<li><a href="https://cryptii.com">Cryptii</a>
<li><a href="https://md5hashing.net">MD5Hashing</a></li>
<li><a href="https://tools4noobs.com">Tools4noobs</a></li>
<li><a href="https://regexr.com">RegExr</a></li>
<li><a href="https://regex-generator.olafneumann.org">Regex Generator</a></li>
<li><a href="https://www.regular-expressions.info"></a></li>
<li><a href="https://regex101.com">Regex101</a></li>
<li><a href="https://crontab.guru">Cron Expression Generator</a></li>
<li><a href="https://epochconverter.com">Epoch Converter</a></li>
<li><a href="https://patorjk.com/software/taag">Text to ASCII Art Generator</a></li>
</ul>
<h5>OSINT and Breach Checking</h5>
<ul>
<li><a href="https://haveibeenpwned.com">Have I Been Pwned</a></li>
<li><a href="https://namechk.com">Name OSINT</a></li>
<li><a href="https://breachdirectory.org">Breach Directory</a></li>
<li><a href="https://hunter.io">Hunter.io</a></li>
<li><a href="https://inteltechniques.com">Intel Techniques</a></li>
</ul>
<h5>Translation and Others Tools</h5>
<ul>
<li><a href="https://deepl.com/translator">DeepL</a></li>
<li><a href="https://markdowntoolbox.com">Markdown Toolbox</a></li>
<li><a href="https://latexeditor.lagrida.com">Online LaTeX Equation Editor</a></li>
<li><a href="https://mermaid.live">Mermaid</a></li>
<li><a href="https://tableconvert.com">Table Convert</a></li>
<li><a href="https://truben.no/table/">Table Editor 2</a></li>
<li><a href="https://divtable.com">Div Table</a></li>
<li><a href="https://evanhahn.github.io/ffmpeg-buddy/">ffmpeg buddy</a></li>
<li><a href="https://kutt.it">Kutt your links shorter</a></li>
<li><a href="https://grammarly.com">Grammarly</a></li>
</ul>
<p>For OSINT tools visit our repository: <a href="https://github.com/RENANZG/My-OSINT">My-OSINT</a></p>
<br>
</details>
<!-- ########## -->
<details>
<summary>1.04 Forensic tools</summary>
<br>
<h4>Forensics Tools Catalogues</h4>
<p>Evidence Project - <a href="https://dftoolscatalogue.eu/dftc.home.php">https://dftoolscatalogue.eu</a></p>
<p>NIST - <a href="https://toolcatalog.nist.gov/search/">https://toolcatalog.nist.gov</a></p>
<p>S&T partners and NIST - Computer Forensic Tool Testing (CFTT) - <a href="https://dhs.gov/science-and-technology/nist-cftt-reports">https://dhs.gov/science-and-technology/nist-cftt-reports</a></p>
<h4>Some tools</h4>
<ul>
<li><a href="https://sleuthkit.org/sleuthkit/">The Sleuth Kit (TSK)</a> <a href="https://github.com/sleuthkit/sleuthkit">(GitHub)</a></li>
<li><a href="https://autopsy.com">Autopsy</a></li>
<li><a href="https://github.com/WerWolv/ImHex">ImHex</a></li>
<li><a href="https://hashcat.net">Hashcat</a></li>
<li><a href="https://openwall.com/john/">John the Ripper</a></li>
<li><a href="https://github.com/drivebadger/drivebadger">Drive Badger — Covert Data Exfiltration Operations</a></li>
<li><a href="https://github.com/northloopforensics/Fetch">Making Maps for Investigators</a></li>
<li><a href="https://github.com/mxrch/GHunt">Offensive Google framework</a></li>
<li><a href="https://github.com/northloopforensics/Bitlocker_Key_Finder">Bitlocker Key Finder</a></li>
<li><a href="https://github.com/teamdfir/sift">SIFT</a></li>
<li><a href="https://github.com/keydet89/RegRipper3.0">RegRipper</a></li>
<li><a href="https://nomoreransom.org/en/index.html">No More Ransom</a></li>
<li><a href="https://docs.microsoft.com/en-us/sysinternals/downloads">MS Sysinternals</a></li>
<li><a href="https://winfe.net/download">WinFE</a></li>
</ul>
<h4>Image and video enhancement techniques</h4>
• <a href="https://github.com/upscayl/upscayl">Ppscayl</a><br>
• <a href="https://github.com/imagej/ImageJ">ImageJ</a><br>
• <a href="https://github.com/hollowaykeanho/Upscaler">Upscalers</a><br>
<h4>Computer-animated movies.</h4>
• <a href="https://github.com/stuffmatic/fSpy">fSpy</a><br>
<h4>Encryption workarounds:</h4>
<ol>
<li>Find the key.</li>
<li>Guess the key.</li>
<li>Compel the key.</li>
<li>Exploit a flaw in the encryption software.</li>
<li>Access plaintext while the device is in use.</li>
<li>Locate another plaintext copy.</li>
</ol>
<h4>Extraction Methods</h4>
<table>
<tbody>
<tr>
<td>Encryption:</td>
<td><p>Seize the encrypted files and decrypt them using a password or key and the appropriate decryption software. <br> OR<br> Seize the data while it is in an unencrypted state.</p></td>
</tr>
<tr>
<td>Virtualization:</td>
<td>Seize the virtual image file and open it with the correct password.<br>
OR<br>
Log into the virtual machine and seize the data while the virtual machine is turned on and in an unencrypted state.</td>
</tr>
<tr>
<td>Relational Database:</td>
<td>Seize all the files containing records. Obtain a copy of the database software and rebuild the database.<br>
OR<br>
Log into the database while it is live and employ the application used to create and manage the database as a search tool. Download the data using the method allowed by the application, either in the form of printouts or data files.</td>
</tr>
</tbody>
</table>
<br>
</details>
<!-- ########## -->
<details>
<summary>1.05 Cryptography</summary>
<br>
<h4>Encryption Workrounds</h4>
<p>Visit our repo tree: <a href="https://github.com/RENANZG/My-Forensics/tree/main/03_DOCUMENTS/Encryption">3.DOCUMENTS/Encryption</a></p>
<p>Encryption workarounds:</p>
<ol>
<li>Find the key.</li>
<li>Guess the key.</li>
<li>Compel the key.</li>
<li>Exploit a flaw in the encryption software.</li>
<li>Access plaintext while the device is in use.</li>
<li>Locate another plaintext copy.</li>
</ol>
<h4>Bruteforce</h4>
<p>Read the thread <a href="https://github.com/RENANZG/My-Forensics?tab=readme-ov-file#brute-force-attacks">Brute Force Attacks</a></p>
<h4>Cryptanalysis</h4>
<p>Visit our repo tree: <a href="https://github.com/RENANZG/My-Forensics/tree/main/03_DOCUMENTS/Cryptanalysis">03_DOCUMENTS/Cryptanalysis</a></p>
<h4>Steganography</h4>
<p></p>
<br>
</details>
<!-- ########## -->
<details>
<summary>1.06 Memory analysis</summary>
<br>
<h4>Volatile memory analysis</h4>
• Volatility<br>
https://volatilityfoundation.org/releases<br>
• Linux Memory Extractor (LiME)<br>
https://github.com/504ensicsLabs/LiME<br>
• Memory Analysis<br
https://www.memoryanalysis.net/amf<br>
• Cobalt Strike in memory<br>
https://andreafortuna.org/2020/11/22/how-to-detect-cobalt-strike-activity-in-memory-forensics/<br>
<h3>JTag, Chip-off and ISP forensics</h3>
<img src="https://github.com/RENANZG/My-Forensics/blob/main/.data/jtag_chip-off_isp.png" title="Hardware Exploitation" style="width:100%">
https://teeltech.com/ufaqs/what-is-jtag-chip-off-and-isp<br>
https://cellebritelearningcenter.com/mod/page/view.php?id=11903<br>
https://fletc.gov/jtag-chipoff-smartphones-training-program<br>
https://gillware.com/phone-data-recovery-services/jtag-chip-off-forensics<br>
https://gillware.com/phone-data-recovery-services/chip-off-forensics-services<br>
<h4>Researching support for phones in JTAG software</h4>
https://octoplusbox.com<br>
https://medusabox.com<br>
https://riffbox.org<br>
https://easy-jtag.com<br>
https://z3x-team.com<br>
<br>
</details>
<!-- ########## -->
<details>
<summary>1.07 Cryptocurrencies analysis</summary>
<br>
<h4>Cryptocurrencies analysis</h4>
https://github.com/OffcierCia/On-Chain-Investigations-Tools-List<br>
https://github.com/aaarghhh/awesome_osint_criypto_web3_stuff<br>
https://blocksherlock.com/home/blockchain-explorers<br>
https://tronscan.org<br>
https://etherscan.io<br>