digital-forensics-labs/digital-forensics-lab
1
0
Fork 0
mirror of https://github.com/frankwxu/digital-forensics-lab.git synced 2026-04-10 12:13:44 +00:00
Code Issues Packages Projects Releases Wiki Activity

preparing networking forensics labs, unfinished

Browse Source
This commit is contained in:
Frank Xu
2023-03-12 13:23:09 -04:00
parent e69f385f66
commit e24f5fbc9a
26 changed files with 404 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

BIN
Networking_Forensics/lab_files/SYN_Flood/mySYNFloodCapture.pcap Normal file
View File

Binary file not shown.

11
Networking_Forensics/lab_files/SYN_Flood/synflood.py Normal file
View File

@@ -0,0 +1,11 @@
from scapy.all import *
def send_syn(target_ip_address, target_port, number_of_packets_to_send = 4, size_of_packet = 65000):
ip = IP(dst=target_ip_address)
tcp = TCP(sport=RandShort(), dport=target_port, flags="S")
raw = Raw(b"X" * size_of_packet)
p = ip / tcp / raw
send(p, count=number_of_packets_to_send, verbose=0)
print('send_syn(): Sent ' + str(number_of_packets_to_send) + ' packets of '+ str(size_of_packet) + 'size to ' + target_ip_address + ' on port ' + str(target_port))
send_syn(target_ip_address = "127.0.0.1", target_port= 80)

BIN
Networking_Forensics/lab_files/f0335017_She_died_in_February_at_the_age_of_74.doc Normal file
View File

Binary file not shown.

BIN
Networking_Forensics/lab_files/traffic/arp.pcap Normal file
View File

Binary file not shown.

BIN
Networking_Forensics/lab_files/traffic/arp_poison.pcap Normal file
View File

Binary file not shown.

BIN
Networking_Forensics/lab_files/traffic/basic.log Normal file
View File

Binary file not shown.

BIN
Networking_Forensics/lab_files/traffic/building_20201108_221645.jpg Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 67 KiB

12
Networking_Forensics/lab_files/traffic/image.html Normal file
View File

@@ -0,0 +1,12 @@
<!DOCTYPE html>
<html>
<body>
<h1>My First Heading</h1>
<p>My first paragraph.</p>
<img src="building.jpg" alt="UB"/>
</body>
</html>

BIN
Networking_Forensics/lab_files/traffic/image.log Normal file
View File

Binary file not shown.

BIN
Networking_Forensics/lab_files/traffic/image2.log Normal file
View File

Binary file not shown.

BIN
Networking_Forensics/lab_files/traffic/smtp.pcap Normal file
View File

Binary file not shown.

72
Networking_Forensics/lab_files/wlan_decrypt/crackWEP40_GPU.py Normal file
View File

@@ -0,0 +1,72 @@
# Generated By ChatGPT DGL
# Write Python code that generates all possible combinations of 8 characters,
# with each character consisting of either a lowercase or uppercase English letter and
# also has a function to check the XOR sum of the 0th, 3rd, 6th characters,
# the XOR sum of the 1st, 4th, 7th characters,
# and the XOR sum of the 2nd and 5th characters.
# Also add function to check sha1 hash of the combination startwith 0xff7b948953ac
# Use Pytorch framework to use GPU
import torch
import string
import hashlib
import time
import itertools
def generate_combinations_test(device):
ascii_codes = [ord(char) for char in "cgwpkexz"]
return torch.tensor([ascii_codes], dtype=torch.uint8, device=device)
def generate_combinations(device):
characters = string.ascii_lowercase
combinations = torch.tensor([list(map(ord, chars)) for chars in itertools.product(
characters, repeat=8)], dtype=torch.uint8, device=device)
return combinations
def check_xor_sum(combination):
xor_sum_0_3_6 = combination[:, 0].int(
) ^ combination[:, 3].int() ^ combination[:, 6].int()
xor_sum_1_4_7 = combination[:, 1].int(
) ^ combination[:, 4].int() ^ combination[:, 7].int()
xor_sum_2_5 = combination[:, 2].int() ^ combination[:, 5].int()
return (xor_sum_0_3_6 == 0x6b) & (xor_sum_1_4_7 == 0x76) & (xor_sum_2_5 == 0x12)
def add_xy_and_check_sha1(valid_combinations, device):
letters = 'abcdefghijklmnopqrstuvwxyz'
xy_combinations = torch.tensor(
[[ord(x), ord(y)] for x in letters for y in letters], dtype=torch.uint8, device=device)
final_results = []
for combination in valid_combinations:
for xy in xy_combinations:
new_combination = torch.cat((combination[:3], xy[0].unsqueeze(
0), combination[3:6], xy[1].unsqueeze(0), combination[6:]), dim=0)
sha1_hash = hashlib.sha1(
new_combination.cpu().numpy().tobytes()).hexdigest()
if sha1_hash.startswith('ff7b948953ac'):
final_results.append(new_combination)
return final_results
if torch.cuda.is_available():
device = torch.device("cuda")
else:
device = torch.device("cpu")
combinations = generate_combinations(device)
num_combinations = combinations.shape[0]
start_time = time.time()
valid_combinations = combinations[check_xor_sum(combinations)]
valid_combinations = add_xy_and_check_sha1(valid_combinations, device)
if len(valid_combinations) > 0:
print(valid_combinations[0].char().cpu().numpy().tolist())
else:
print("No valid combinations found")
end_time = time.time()
print("Processing took %.2f seconds for %d combinations" %
(end_time - start_time, num_combinations))

76
Networking_Forensics/lab_files/wlan_decrypt/crackWEP40_GPU_Improved_v1.py Normal file
View File

@@ -0,0 +1,76 @@
# Generated By ChatGPT DGL
# Write Python code that generates all possible combinations of 8 characters,
# with each character consisting of either a lowercase or uppercase English letter and
# also has a function to check the XOR sum of the 0th, 3rd, 6th characters,
# the XOR sum of the 1st, 4th, 7th characters,
# and the XOR sum of the 2nd and 5th characters.
# Also add function to check sha1 hash of the combination startwith 0xff7b948953ac
# Use Pytorch framework to use GPU
# Generated By ChatGPT DGL
# Write Python code that generates all possible combinations of 8 characters,
# with each character consisting of either a lowercase or uppercase English letter and
# also has a function to check the XOR sum of the 0th, 3rd, 6th characters,
# the XOR sum of the 1st, 4th, 7th characters,
# and the XOR sum of the 2nd and 5th characters.
# Also add function to check sha1 hash of the combination startwith 0xff7b948953ac
# Use Pytorch framework to use GPU
import torch
import string
import hashlib
import time
import itertools
def generate_combinations_test(device):
ascii_codes = [ord(char) for char in "cgwpkexz"]
return torch.tensor([ascii_codes], dtype=torch.uint8, device=device)
def check_xor_sum(combination):
xor_sum_0_3_6 = combination[:, 0].int(
) ^ combination[:, 3].int() ^ combination[:, 6].int()
xor_sum_1_4_7 = combination[:, 1].int(
) ^ combination[:, 4].int() ^ combination[:, 7].int()
xor_sum_2_5 = combination[:, 2].int() ^ combination[:, 5].int()
return (xor_sum_0_3_6 == 0x6b) & (xor_sum_1_4_7 == 0x76) & (xor_sum_2_5 == 0x12)
def add_xy_and_check_sha1(valid_combinations, device):
letters = 'abcdefghijklmnopqrstuvwxyz'
xy_combinations = torch.tensor(
[[ord(x), ord(y)] for x in letters for y in letters], dtype=torch.uint8, device=device)
final_results = []
for combination in valid_combinations:
for xy in xy_combinations:
new_combination = torch.cat((combination[:3], xy[0].unsqueeze(
0), combination[3:6], xy[1].unsqueeze(0), combination[6:]), dim=0)
sha1_hash = hashlib.sha1(
new_combination.cpu().numpy().tobytes()).hexdigest()
if sha1_hash.startswith('ff7b948953ac'):
final_results.append(new_combination)
return final_results
if torch.cuda.is_available():
device = torch.device("cuda")
else:
device = torch.device("cpu")
start_time = time.time()
characters = string.ascii_lowercase
valid_combinations=[]
for e in torch.tensor([list(map(ord, chars)) for chars in itertools.product(
characters, repeat=8)], dtype=torch.uint8, device=device):
if check_xor_sum(e):
valid_combinations.append(e)
print(e)
valid_combinations = add_xy_and_check_sha1(valid_combinations, device)
if len(valid_combinations) > 0:
print(valid_combinations[0].char().cpu().numpy().tolist())
else:
print("No valid combinations found")
end_time = time.time()
print("Processing took %.2f seconds for " %
(end_time - start_time))

59
Networking_Forensics/lab_files/wlan_decrypt/crackWEP40_noGPU.py Normal file
View File

@@ -0,0 +1,59 @@
# Write Python code that generates all possible combinations of 8 characters,
# with each character is a lowercase English letter and also has a function, check_xor_sum,
# to check the XOR sum of the 0th, 3rd, 6th characters is 0x6b, the XOR sum of the 1st, 4th, 7th characters is 0x76,
# and the XOR sum of the 2nd and 5th characters is 0x12. If check_xor_sum returns true,
# remember these valid combinations. Then write a function to generate all combinations of two lower case characters,
# call x and y, insert x after 3rd position and insert y after 6th position of valid combinations.
# The resultant new combination is 10 characters long strings.
# Also add function to check sha1 hash of the 10-character strings starts with ff7b948953ac. Print final results.
import hashlib
import itertools
def check_xor_sum(string):
if ord(string[0]) ^ ord(string[3]) ^ ord(string[6]) == 0x6b and \
ord(string[1]) ^ ord(string[4]) ^ ord(string[7]) == 0x76 and \
ord(string[2]) ^ ord(string[5]) == 0x12:
return True
return False
def generate_8_char_combinations():
characters = 'abcdefghijklmnopqrstuvwxyz'
combinations = itertools.product(characters, repeat=8)
valid_combinations = []
for combination in combinations:
string = "".join(combination)
if check_xor_sum(string):
valid_combinations.append(string)
# valid_combinations = ["cgwpkexz"]
return valid_combinations
def insert_letters(valid_combinations):
characters = 'abcdefghijklmnopqrstuvwxyz'
new_combinations = []
for x in characters:
for y in characters:
for valid_combination in valid_combinations:
new_combination = valid_combination[:3] + x + \
valid_combination[3:6] + y + valid_combination[6:]
new_combinations.append(new_combination)
return new_combinations
def check_sha1_hash(new_combinations):
final_results = []
for new_combination in new_combinations:
sha1_hash = hashlib.sha1(new_combination.encode('utf-8')).hexdigest()
if sha1_hash.startswith("ff7b948953ac"):
final_results.append(new_combination)
return final_results
def main():
valid_combinations = generate_8_char_combinations()
new_combinations = insert_letters(valid_combinations)
final_results = check_sha1_hash(new_combinations)
print("Final results:")
for result in final_results:
print(result)
if __name__ == '__main__':
main()

55
Networking_Forensics/lab_files/wlan_decrypt/crackWEP40_noGPU_Improved_v1.py Normal file
View File

@@ -0,0 +1,55 @@
import itertools
import string
import hashlib
def generate_combinations():
characters = string.ascii_lowercase
combinations = itertools.product(characters, repeat=8)
# For testing only
# combinations = ["aaaaaaaa", "cgwpkexz", "cgwpkexa", "cgwpkexa", "cgwpkexa", "cgwpkexa"]
return combinations
def check_xor_sum(combination):
if ord(combination[0]) ^ ord(
combination[3]) ^ ord(combination[6]) != 0x6b :
return False
if ord(combination[1]) ^ ord(
combination[4]) ^ ord(combination[7]) != 0x76:
return False
if ord(combination[2]) ^ ord(combination[5]) != 0x12:
return False
return True
def insert_letters(valid_combination):
new_combinations = []
characters = 'abcdefghijklmnopqrstuvwxyz'
for x in characters:
for y in characters:
new_combination = tuple(list(valid_combination[:3]) + [x] +
list(valid_combination[3:6]) + [y] +
list(valid_combination[6:]))
new_combinations.append(new_combination)
return new_combinations
def check_sha1_hash(combination):
combination_str = ''.join(combination)
sha1_hash = hashlib.sha1(combination_str.encode('utf-8'))
return sha1_hash.hexdigest().startswith('ff7b948953ac')
cracked= False
for combination in generate_combinations():
# print("process: ", ''.join(combination))
if check_xor_sum(combination):
print("Match xor sum: ", ''.join(combination))
for comb_x_y in insert_letters(combination):
if check_sha1_hash(comb_x_y):
cracked = True
print("Cracked: ", ''.join(comb_x_y))
break
if cracked:
break

BIN
Networking_Forensics/lab_files/wlan_decrypt/file.xz Normal file
View File

Binary file not shown.

26
Networking_Forensics/lab_files/wlan_decrypt/findseed.py Normal file
View File

@@ -0,0 +1,26 @@
# https://www.vnsecurity.net/ctf%20-%20clgt%20crew/
# 2015/03/16/codegate-good-crypto.html
key=[0xa4,0x3d,0xf6,0xf3,0x74]
a, c, m = 0x000343fd, 0x269ec3, 0xFFFFFF
secret_key_bytes=5
for seed in range(1<<24):
correct = True
x = seed
for i in range(secret_key_bytes):
x = (a * x + c) & m
# shift 16 bits to right
# the same as check the second most significant byte
if (x>>16)!=key[i]:
correct = False
break
if correct:
print("Found it: ", hex(seed))
print("Verify: ")
for i in range(secret_key_bytes):
seed = (a* seed + c) & m
print(hex(seed>>16),hex(seed))