SWLUG/๋””์ง€ํ„ธ ํฌ๋ Œ์‹ (2-1) 7

[๋””์ง€ํ„ธ ํฌ๋ Œ์‹ ์Šคํ„ฐ๋””] 3์ฃผ์ฐจ: ๋ฌธ์ œ ํ’€์ด

์ด๋ฒˆ ์ฃผ ์Šคํ„ฐ๋”” ๋ฒ”์œ„: https://inf.run/zmPL [์ง€๊ธˆ ๋ฌด๋ฃŒ] ๊ธฐ์ดˆ๋ถ€ํ„ฐ ๋”ฐ๋ผํ•˜๋Š” ๋””์ง€ํ„ธํฌ๋ Œ์‹ | ํ›ˆ์ง€์† - ์ธํ”„๋Ÿฐํ›ˆ์ง€์† | ๊ธฐ์ดˆ๋ถ€ํ„ฐ ๋”ฐ๋ผํ•˜๋Š” ๋””์ง€ํ„ธํฌ๋ Œ์‹ ๊ฐ•์˜์ž…๋‹ˆ๋‹ค. ๊ฐ•์˜๋ฅผ ๋”ฐ๋ผํ•˜๋‹ค๋ณด๋ฉด "๋ฌผ ํ๋ฅด๋“ฏ, ์ž์—ฐ์Šค๋Ÿฝ๊ฒŒ" ์‹ค๋ ฅ์ด ๋Š˜์–ด๊ฐ€๋Š” ๊ฐ•์˜๋ฅผ ์ถ”๊ตฌํ•ฉ๋‹ˆ๋‹ค., ์ดˆ๋ณด์ž ๋ˆˆ๋†’์ด์— ๋”ฑ ๋งž์ถ˜, ์›๋ฆฌ๋ฅผ ์ดํ•ดํ•˜๋Š” ๋””์ง€ํ„ธwww.inflearn.com  ์ด๋ฏธ์ง€ ์ธํฌ ํ†ตํ•ด ์šด์˜์ฒด์ œ๋ฅผ ์‹๋ณ„ํ•ด์คŒ 1GB ์ •๋„์—ฌ์„œ ์‹๋ณ„ํ•˜๋Š” ๋ฐ์— ์‹œ๊ฐ„์ด ์กฐ๊ธˆ ๊ฑธ๋ฆผ.  netscan: connections, sockets๋ฅผ ํฌํ•จํ•œ ๋” ๋งŽ์€ ๊ธฐ๋Šฅ (Windows xp) connections: "ํ˜„์žฌ ์—ฐ๊ฒฐ๋œ" TCP ํ†ต์‹ ์— ๋Œ€ํ•œ ์ •๋ณด sockets: ์‘๋‹ต๋ฐ›๊ธฐ๋ฅผ ๊ธฐ๋‹ค๋ฆฌ๊ณ  ์žˆ๋Š” ๋ชจ๋“  ํ”„๋กœํ† ์ฝœ์— ๋Œ€ํ•œ socket ์ •๋ณด cmdline: ํ”„๋กœ์„ธ์Šค๊ฐ€ ์‹คํ–‰๋  ..

[๋””์ง€ํ„ธ ํฌ๋ Œ์‹ ์Šคํ„ฐ๋””] 3์ฃผ์ฐจ

์Šคํ„ฐ๋”” ๋‚ด์šฉ: ๊ฐ•์˜ ๋“ฃ๊ณ  ๋”ฐ๋ผํ•˜๊ธฐ https://inf.run/zmPL [์ง€๊ธˆ ๋ฌด๋ฃŒ] ๊ธฐ์ดˆ๋ถ€ํ„ฐ ๋”ฐ๋ผํ•˜๋Š” ๋””์ง€ํ„ธํฌ๋ Œ์‹ | ํ›ˆ์ง€์† - ์ธํ”„๋Ÿฐํ›ˆ์ง€์† | ๊ธฐ์ดˆ๋ถ€ํ„ฐ ๋”ฐ๋ผํ•˜๋Š” ๋””์ง€ํ„ธํฌ๋ Œ์‹ ๊ฐ•์˜์ž…๋‹ˆ๋‹ค. ๊ฐ•์˜๋ฅผ ๋”ฐ๋ผํ•˜๋‹ค๋ณด๋ฉด "๋ฌผ ํ๋ฅด๋“ฏ, ์ž์—ฐ์Šค๋Ÿฝ๊ฒŒ" ์‹ค๋ ฅ์ด ๋Š˜์–ด๊ฐ€๋Š” ๊ฐ•์˜๋ฅผ ์ถ”๊ตฌํ•ฉ๋‹ˆ๋‹ค., ์ดˆ๋ณด์ž ๋ˆˆ๋†’์ด์— ๋”ฑ ๋งž์ถ˜, ์›๋ฆฌ๋ฅผ ์ดํ•ดํ•˜๋Š” ๋””์ง€ํ„ธwww.inflearn.com ์นจํ•ด ์‚ฌ๊ณ  ๋Œ€์‘ ๊ธฐ๋ฒ• -> ๋ฉ”๋ชจ๋ฆฌ ํฌ๋ Œ์‹๋ฉ”๋ชจ๋ฆฌ: ํ”„๋กœ๊ทธ๋žจ ์˜ฌ๋ผ๊ฐˆ ์ˆ˜ ์žˆ๋Š” ๊ณต๊ฐ„ ---- 1๊ฐ•. ๋„๊ตฌ ์„ค์น˜, ํ™˜๊ฒฝ ์„ค์ •, ๋ฌธ์ œ ๋‹ค์šด๋กœ๋“œ - Volatility- Windows Terminal- ์‹œ์Šคํ…œ ํ™˜๊ฒฝ ๋ณ€์ˆ˜ ์„ค์ •- ๋ฌธ์ œ ๋‹ค์šด๋กœ๋“œ- ํ„ฐ๋ฏธ๋„ ๋ช…๋ น์–ด ํ•™1) Volatility Wiki - Memory Samples2) CTF-d - GrrCon 2015     ..

[๋””์ง€ํ„ธ ํฌ๋ Œ์‹ ์Šคํ„ฐ๋””] 1์ฃผ์ฐจ

https://www.inflearn.com/course/%EA%B8%B0%EC%B4%88-%EB%94%94%EC%A7%80%ED%84%B8-%ED%8F%AC%EB%A0%8C%EC%8B%9D/dashboard [์ง€๊ธˆ ๋ฌด๋ฃŒ] ๊ธฐ์ดˆ๋ถ€ํ„ฐ ๋”ฐ๋ผํ•˜๋Š” ๋””์ง€ํ„ธํฌ๋ Œ์‹ ๊ฐ•์˜ - ์ธํ”„๋Ÿฐ๊ธฐ์ดˆ๋ถ€ํ„ฐ ๋”ฐ๋ผํ•˜๋Š” ๋””์ง€ํ„ธํฌ๋ Œ์‹ ๊ฐ•์˜์ž…๋‹ˆ๋‹ค. ๊ฐ•์˜๋ฅผ ๋”ฐ๋ผํ•˜๋‹ค๋ณด๋ฉด "๋ฌผ ํ๋ฅด๋“ฏ, ์ž์—ฐ์Šค๋Ÿฝ๊ฒŒ" ์‹ค๋ ฅ์ด ๋Š˜์–ด๊ฐ€๋Š” ๊ฐ•์˜๋ฅผ ์ถ”๊ตฌํ•ฉ๋‹ˆ๋‹ค., ์ดˆ๋ณด์ž ๋ˆˆ๋†’์ด์— ๋”ฑ ๋งž์ถ˜, ์›๋ฆฌ๋ฅผ ์ดํ•ดํ•˜๋Š” ๋””์ง€ํ„ธํฌ๋ Œ์‹ ์ž…www.inflearn.com ์‹ค์Šต์„ ์œ„ํ•ด FTK Imager ๋‹ค์šด๋กœ๋“œ๋ฅผ ํ•ด์•ผ ํ•œ๋‹ค.FTK Imager – ๋””์Šคํฌ ์ด๋ฏธ์ง€ ๊ด€๋ฆฌ ๋„ FTK Imager ๋‹ค์šด๋กœ๋“œ ์™„๋ฃŒ   Create Disk Image๋ฅผ ๋ˆŒ๋Ÿฌ์คŒ.  [Physical Drive] ํด๋ฆญ  ์†Œ์Šค ๋“œ๋ผ..