try backtrack

In the 4th post into this thread, I elaborate a bit on Backtrack.

In a nutshell, Backtrack isn't going to teach basic NSM (network security monitoring) or how to perform forensics or incident handling. Backtrack has a good set of tools included but those are useless if one doesn't know how to use the tools, and even if one becomes knowledgeable in using the tools, they'll probably not know what they're looking at when perusing output from those tools. Core skills need to be developed first, and once that is done, a good foundation is established. Bad foundation = house that will eventually have issues that will be seriously difficult to remedy.

2 members found this post helpful.

For myself i can run as sudo all day long. Simply because i am the one who installed the OS on the computer. Everyone else in that class uses Windows 7 except for me and a friend of mine.

EDIT: Using ubuntu because yes, backtrack does have some nice tools. But if i need the tools i can simply get them on ubuntu. That, and what unix said about the foundation.

Check out the winning papers for the Honeynet Project Challenges. In particular, I think Challenge 5 would be a good one to try for someone just starting out.

1 members found this post helpful.

NICE! I hadn't even thought of honeypots and honeynets. I haven't even run one before (although I understand the concept behind them).

Keep them coming, guys!

Speaking of honeypots...........

https://code.google.com/p/kippo/

I use this when I'm at home on a Thursday night (my Friday...) drinking a few beers and in the mood to relax and have fun....

Yeah, I find the various tools and techniques people use to solve the challenges really interesting. I can't wait to see how people utilize the Linux memory image for the current challenge. Another cool thing is you don't even have to setup a honeypot, they provide the evidence from real attacks for anyone to download and analyze.

I was a finalist in one of the SANS Network Forensic Contests, which will continue providing challenges in analyzing PCAPs soon. Anyone interested in analyzing network traffic should definitely check that site out as well.

Cheers!

Dead link? :[

Works for me man. Try searching for kippo on google if it really doesn't work for you.

Working now actually. May have just been where i was earlier!

Yeah probably. What do you think of that one? I started using it a lot lately. I just might edit up the source code to do a few more things... If I make it better, I will probably submit my changes to the next version.

I must say, sounds and looks promising. I however do not have a use for it myself since a lot of the work i am doing is either in class or at home, instead of in a working environment. Unless you can suggest a couple ways for me to use it haha.

Like i said though, nice job.

You can always fire it up when you are at home

Very true. Need to fix my ubuntu boot though. -.- Gonna go post that issue actually. Maybe there is a fix without me having to totally reinstall. D:

Ok cool. Create a new thread though, thanks.

Josh