Cave Confessions

2018 Goals

Mon, 01 Jan 2018 00:00:00 +0000

I am not normally a person who makes goals on New Years. I’m not really a goal setter in general, or at least I haven’t been. What I am, though, is a habit builder. I think that building new habits for my betterment is the right way to go. I think being accountable helps me to stay on track to actually make my habits stick. And to that end, here are some goals that I have for some new habits I’m attempting to build.

Professional

I would like to be more engaged in the information security community, actually contributing to the dialogue and not just watching it go by.
- Tweet More (no real objective here)
- Write more blog posts (at least once a month)
- Submit at least 5 talks this year
Finish building out home lab
- rebuild ESXi server with new components
- setup vms for testing
  - Metasploitable
  - Mutillidae
  - DVWA
  - Bwapp
  - pwnedhub
- Create my own web app for testing
Develop a tool for web application testing
- I have a few ideas for this, but not actually started to code anything up yet.

Health / Fitness

I commited to my sister that I will join here for a sprint triathalon this summer. (I know, I’m not sure what I was thinking)
- Swimming
  - Learn and practice Total Immersion swimming technique
  - Do an open water swim (the tri is a pool swim, but I would personally like to get to the point where I’m comfortable enough to do an open water swim)
- Biking
  - Learn and practice the Zendurance biking techniques
- Running
  - Learn and practice Chi Running techniques

Personal

Focus on the positive to build a better mental state
Learn a new technology
Learn a new language

Photo by Thought Catalog on Unsplash

BSides NOLA 2017

Sun, 02 Apr 2017 00:00:00 -0500

On April 1st I was honored by being able to speak again at BSides NOLA. There were so many wonderful talks, I really wish there are more mes so I could have attended them all.

My Talk was focused on looking at XSS (Cross Site Scripting) and really digging into the harm that can really be done, when someone else can control your browser. If you missed it, booooo, it was an awesome talk. But, here are the slides if you want to see what I covered.

Slides can be found here
Demo / Lab environment can be found here

The Web's Most Wanted

Sun, 01 May 2016 00:00:00 -0500

OWASP has a top ten list that ranks the most critical attacks against web applications. At the top of this list is Injection Attacks. SQL injection is one of this type of attacks. This post is a walk through of what the attack is and a look at more advanced versions of the attack.

SQL Primer

The Structured Query Language (SQL) is the language of databases. This is the language that humans use to talk to databases to get information out or put information in. It should be noted that SQL is supported by most all Relational Database Management Systems (RDBMS). These include MySQL, MSSQL, PostgreSQL, SQLite, and Oracle to name a few of the more popular ones.

Database Structure

A database is an organized collection of data. The data itself is located in tables within the database. There are other items within a databases, but for our purposes here we are only concerned with the data in the tables.

A table is a collection of related data held in a structured format. The data is divided by vertical columns, or fields. Each record of data is a row in the table. A table has a limited and specified number of columns, but an unlimited number of rows possible.

SQL Commands

SQL provides several commands for altering and querying the database for the purposes of this primer we will focus on four main commands SELECT, INSERT, UPDATE, DELETE. These commands can be split into two categories based on what effect they have on the data.

Modify Data

These commands are used to add / change / remove data from a table in a database. These commands are INSERT, UPDATE, and DELETE respectively.

INSERT

This command is used to add data into table. The grammar for this command is:

INSERT INTO table_name [( column_identifier [, column_identifier]...)] VALUES (insert_value[, insert_value]...)

table_name: The name of the table where the data is being inserted
column_identifier: The name of the column to map the inserted value to
insert_value: The value to be inserted into the column identified with the same index as the value to be inserted.

Examples:

INSERT INTO users VALUES (1, 'bob', 'password');
INSERT INTO example (id, name, description) VALUES (42, 'Tart', 'It is so yummy');

UPDATE

This command is used to change data in a table. It’s grammar is:

UPDATE table_name
     SET column_identifier = {expression | NULL }
          [, column_identifier = {expression | NULL}]...
     [WHERE search_condition]

table_name: The name of the table where the data is being inserted
column_identifier: The name of the column whose value is being changed
expression: This is the value that column is being set to.
search_condition: This is an expression that is used to filter the table so only specified rows are altered.

Examples:

UPDATE users SET username = 'bobby' WHERE id = 1;

DELETE

This command is used to remove a row from a table. The grammar for this command is:

DELETE FROM table_name [WHERE search_condition]

table_name: The name of the table where the data is being inserted
serch_condition: This is an expression that is used to filter the table so only specified rows are removed.

Retrieve Data

This is the heart of SQL. It is all well and good to modify the data in a database but what people really want is the ability to query that data, and generate pretty reports. To actually get the data out of the database the all powerful SELECT statement is needed.

SELECT

This command is truely the work horse command of the Structured Query Language. Which also means that the grammar for this command can be immensely complicated. The simplest form of the grammar for this command is:

SELECT [ALL | DISTINCT] select_list
     FROM table_list
          [WHERE search_condition]
               [order_by_clause]

select_list: This is a comma seperated list of the columns that are to be returned, or the wildcard (*) if all columns are to be returned.
table_list: This is a comma seperated list of tables to use for the data source. This could be made even more complicated by including JOIN statements. (due to the complexity of joining tables, it will be left to the reader to learn about them on their own)
search_condition: This is an expression that is used to filter the table(s) so only specified rows are returned.
order_by_clause: This specifies the colums to be sorted on, and in which direction

Examples:

SELECT * FROM example_table;
SELECT id, username, password FROM users WHERE id = 1;
SELECT id, price, name FROM items ORDER BY price ASC;

UNION

One more SQL command that needs to be understood is UNION. This command is used to combine the output of multiple SELECT statements into one result set. The big thing to keep in mind with union queries is that the queries being combined need to be returning the same number of columns, and the order will matter because the data types need to match or be convertable.

select_query UNION [ALL] select_query

select_query: This is a valid SELECT query

Examples:

SELECT id, name FROM users UNION SELECT id, name FROM employees;

SQL Injection

SQL Injection attacks come about when code uses unvalidated and/or unsanitized to dynamically construct queries that are sent to the backend database. When this happens, the risk is now open to be attacked by malicious actors. So what exactly does this look like?

<?php
if(isset($_POST['Submit']){
    $user = $_POST['user'];
    $pass = $_POST['password'];
    $re = mysql_query(
        "SELECT * FROM users " .
        "WHERE user_name = '$user' AND password = '$pass'"
    );

    if(mysql_num_rows($re) == 0){
        print 'Incorrect username or password';
    }else{
        print 'Welcome';
    }
}
?>

In this example code we can see that the username and the password are plucked directly from the POST and place right into the query that is being executed. This problem can be demonstrated easily by thinking about what happens when malicious content is POSTed. For Examples:

user: admin
pass: ' OR '1'='1

If this is what is sent to the page above then there is a problem. Let’s look at what the created query actually is with these values.

SELECT * FROM users WHERE user_name = 'admin' AND password = '' OR '1'='1'

We can see that event with the extra single quotes (‘) in the pass value, the created query is still valid and will execute. So what is this query asking?

Is the user_name ‘admin’
Also make sure that the password is blank, or 1 is equal to 1.

With this question, the password should never be blank, but 1 is always equal to 1, so the password check has essentailly been negated. If there is a user that has the name ‘admin’ then, that is the row that will be returned. This is a classic example of authentication bypass using SQL Injection.

In this world of data-driven web applications there are cases where the data being retrieved from the database is displayed back on the page. When this data is being filtered in some way based on user input, or input that could be manipulated by a user, then the circumstances create a situation where an attacker could query and alter the data at whim.

Next Time

This is the first in a series of post that will dive into the wonderful world of SQL injection. The next will focus on UNION based SQL Injections which is a way to easily see the information that is being extracted.

BSides NOLA 2016

Fri, 22 Apr 2016 18:05:56 -0500

On April 16th I had the pleasure of speaking at BSides NOLA. The conference was excellent, as usual. I learned an absolute ton of cool new information, and was able to meet and speak with really smart people. I am particularly interested in looking into database forensics a lot more.

My particular talk was titled “The Web’s Most Wanted.” I had a great time giving the talk. And from what I can tell it was well received. I will be rolling out a couple new blog posts covering the material from the talk over the next couple of days. So, please stay tuned for that.

Slides from my talk can be found here
Demo / Lab environment can be found here

About Me

Sun, 20 Mar 2016 15:25:11 -0400

I have over a decade of experience as a software developer, with a majority of that time specialized in security design and development. I have a core background in Java, .Net, Python, Go, and secure design and development. I am experienced and well practiced in .Net and Java enterprise technologies, web services, agile methodologies, open source, and test-driven development. I have worked with a variety of platforms (Windows, Mac OS X, Linux, Unix), databases (PostgreSQL, MySQL, MSSQL, Oracle), J2EE Application Servers, software development methodologies, and development environments and tools.

I hold a collection of certifications including Certified Information System Security Professional (CISSP), GIAC Security Essentials (GSEC), GIAC Certified Intrusion Analyst (GCIA), GIAC Certified Incident Handler (GCIH), and GIAC Certified Web Application Penetration Tester (GWAPT). I also have my Masters of Computer Science from the University of New Orleans.

XXE - The Ugly Side of XML

Sat, 06 Feb 2016 16:00:00 -0600

The eXtensible Markup Language (XML) has a very long and lustrious reputation for being he go-to language for storing and transferring self describing data. Unfortunately though, XML’s root have presented a problem that can plauge many improperly configured parsers. This problem is known as eXternal XML Entity attacks (XXE).

Extensible Markup Language (XML)

Extensible Markup Language (XML) is designed to be a markup language that expresses data in a format that is both human and machine readable. It is defined by the W3C’s XML 1.0 Specification. XML is actually a subset of the Standard Generalized Markup Language (SGML) and it is from this specification that XML inherited the Document Type Definition (DTD). DTD is a language that allows for the definition of the schema used within an XML document. This is an example of an XML document used to define the layout of web page (XHTML) that includes the DTD header that is used to define the acceptable tags in the page:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE html PUBLIC
	"-//W3C//DTD XHTML 1.0 Transitional//EN"
	"DTD/xhtml1-transitional.dtd">
<html
	xmlns="http://www.w3.org/1999/xhtml"
	xml:lang="en" lang="en">
	<head>
		<title>Page Title</title>
	</head>

	<body bgcolor="#FFFFFF" link="#000000" text="red">
		<p>Page Content</p>
	</body>
</html>

Document Type Definition (DTD)

The Document Type Definition (DTD) defines the building blocks of the XML document. It does this by laying out the acceptable elements and attributes allowed in the document. This definition can be made either inline (in the document), or held in an external document.

DTD contains another definition type called ENTITY. The entity definition works like a variable or a macro, in that it will allow for the definition of large or unwieldy data that can be stored in a single variable that can be used in several places within the document. There are two ways to use this definition.

<!ENTITY author "Joshua Barone" >

This would allow for the substitution to be used in the document.

<name>&author;</name>

Which would be rendered as:

<name>Joshua Barone</name>

There is also the ability to make a parameter definition. These simply add the % character to denote the type:

<!ENTITY % author "Joshua Barone" >
<!ENTITY % awesome "&author; is awesome!" >

This would be used as before:

<message>&awesome;<message>

Which would be rendered as:

<message>Joshua Barone is awesome!</message>

The magic that happened here with the parameter definition is that it’s Content could be used in the definition of another entity. This will become important later.

The Attack

All of this was lead up to the actual attack. The XML eXternal Entity (XXE) attacks work my leveraging the fact that DTD entities can be defined in an external source. These external definitions are defined by using the SYSTEM attribute to denote that the document is to be parsed and included. These definitions have the following syntax:

<!ENTITY name SYSTEM "uri" >

Where name specifies the name of the entity that will hold the contents of the parsed document, and uri refers to the URI where the document can be found. Because it is a URI that is used, is where the danger really lies. The URI can be used to reference all of the following:

Payload Document: A document where a more complex XXE attack can be staged `http://evil.com/payload.dtd`
Local File: Reference any document stored on the local machine that the current user context has access to. `file:///etc/passwd`
Filters: Languages like php, java, and others provide specific syntax for defining filters in the URI `php://filter/convert.base64-encode/resource=index.php`

And there are others. The only limitation is in the imagination to abuse the URI.

Billion Laughs Attack

The Billion Laughs Attack is a simple denial of service (DOS) style of attack using XXEs. It works by using the expansion properties of the DTD language.

<?xml version="1.0"?>
<!DOCTYPE lolz [
 <!ENTITY lol "lol">
 <!ELEMENT lolz (#PCDATA)>
 <!ENTITY lol1 "&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;">
 <!ENTITY lol2 "&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;&lol1;">
 <!ENTITY lol3 "&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;">
 <!ENTITY lol4 "&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;&lol3;">
 <!ENTITY lol5 "&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;&lol4;">
 <!ENTITY lol6 "&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;&lol5;">
 <!ENTITY lol7 "&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;&lol6;">
 <!ENTITY lol8 "&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;&lol7;">
 <!ENTITY lol9 "&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;&lol8;">
]>
<lolz>&lol9;</lolz>

This incredibly small amount of code (< 1KB) will expand to take up approximately 3 gigabytes of memory. This happens due to the exponential growth that is happening due to how the entities are defined. The single lol9 will be replaced with 10 lol8 entities. Which are each replaced by 10 lol7 entities. And so on it goes.

File Exfiltration

This attacks uses the external nature of the ENTITY to include a file on the local system. Remember this is local to the system that is parsing the XML.

<?xml version="1.0"?>
<!DOCTYPE hacks [
 <!ENTITY passwd SYSTEM "file:///etc/passwd" >
]>
<hacks>&passwd;</hacks>

When this file is parsed, the hacks tags would contain the content of the servers passwd file.

Remote Code Execution

If the server that has this vulnerability is php and has the expect plugin installed, it may be open to even more insidious attacks. The expect pluginis designed to allow for a php application to run command line commands and interact with them. The plugin also allows for using the expect:// filter in a URI. Which means that it can be used in the XXE attack.

<?xml version="1.0"?>
<!DOCTYPE hacks [
 <!ENTITY cmd SYSTEM "expect://id" >
]>
<hacks>&cmd;</hacks>

This would execute the id command on the system and would place the results inside the hacks tags. This would allow an attacker to know exactly what context and prvilidges would be available for further commands or file requests.

And Many More…

There are many other things that could be done by leveraging XXE attacks. These could include Out-Of-Band attacks, that would still allow for exfiltration even when the contents of the XML aren’t being reflected back to the attacker. Or file uploads, which leverages attacks against Java parsers that will download jar files with these attacks.

Defending

To defend against this type of attack, it first needs to be understood what is vulnerable. The vulnerabilities lie in the parsing of the XML. Here are a few examples of where XML is being used and parsed:

File Uploadss
- Document Formats (OOXML, PDF, ODF, GXML, etc…)
- Configuration Files
- Image Formats (SVG, EXIF headers, etc…)
Network Protocols
- SOAP
- XMLRPC
- REST
- XMPP
- SAML

This is an incomplete list as there are more scenarios that need to be considered. That being considered, XXE defense comes down to one axiom.

Know thy parser

Once XXE attacks became known about, three different approaches were taken to solve the problem.

Don’t reflect the XML back to the user:

This approach is a more naive approach to fix the problem. It assumes That like the examples of above, the attack requires the inclusion of the attacking entity into a tag, whose contents are reflected back to the attacker. But this is certainly not the case. An attacker could make use of error messages, differences in timing, and even Out-Of-Band attack vectors to achieve the same ends.
Allow developers to disable external entity parsing:

This solution is a great step in the correct direction. However, it is still lacking. If the developers are not aware that this is something they even need to be concerned about, then how would they know to go looking for the feature that allows them to disable this.
External entity parsing disabled by default:

This is the solution. There are a few notes here though.
- Don’t turn it on
- Make sure the stay up to date / patched
- Use XSD instead of DTD for schema declarations.

If you are using a parser that relies on method #1, it would be best to change parsers. If you are using a parser that relies on method #2 then all the developers need to be aware of the dangers of XXE attacks and insure that external parsing is turned off.

My New Passion: Teaching

Tue, 26 May 2015 00:00:00 -0500

I have always been a person that loved to learn new things. I can be very obsessive in that way. When I find something that I am interested in, I begin to research and completely invest myself into that interest. Lately though I have been passionate about becoming a better software developer, architect, and security engineer. This means that I have been taking a lot of classes, certifications, and reading everything I can get my hands on. This has led to some interesting byproducts. Namely, being invited to join the SANS Mentor Program.

The SANS Mentor Program has provided me the opportunity to turn around and share what I have learned with others in a structured way. It took the pressure of creating the curriculum off of me, and just let me share. It inspired me, and I took the initiative to create my own short lunch and learn sessions to help share web application security practices that I had learned. It was really after these two events that I discovered I really enjoyed teaching. Not only is it rewarding for me to help others learn the things that I have learned, but it also has the excellent benefit for reinforcing the lessons that I was sharing.

With this new found discovery, I was encouraged to branch out a bit more and started offering to speak at NolaSec. I have received nothing but encouraging words from my peers at these various events. This helped embolden me further, to the point that I submitted a few talks to a few different conferences. I finally had a talked accepted and very much look forward to giving it, which I plan to write up that experience in another post.

In the last few weeks I have also joined up with Operation Spark and are teaching with them. This is super exciting for me, since the audience for this group is at-risk teens. I’m working with an amazing group of guys. And we are teaching a group of kids that are really sharp and are soaking up everything we share with them. So far it’s been a really great experience, and I look forward to seeing this all through.

Ghost to Hugo

Sun, 15 Mar 2015 10:35:29 -0500

I recently converted my blog from using Ghost to Hugo. I made the decision to do this for a few reasons, which I’ll explain below. As well as the process I used to do the conversion.

Why Leave Ghost?

Don’t get me wrong. I really liked Ghost. I think it was constructed really well with bloggers in mind. It comes with extremely pretty, functional, responsive designs that just work right out of the box. I found Ghost really easy to manage and using markdown for the posts just made writing fun. So why am I leaving? Well the biggest reason for me was security. I don’t really have time to keep up with my server the way that I wanted and needed to make sure that I have all the latest and greatest patches for node.js and Ghost. So I made the decision to go with a static site generator instead.

With a static site generator, I’m only serving up static html and resources. This eliminates a lot of possible vulnerabilities and need for maintenance out of the gate. So I found this very appealing. And hence the move.

Why Hugo?

I’ll be honest, Hugo was not the first static site generator that I tried. My first attempt was really with using Nikola. Being a huge fan and daily user of Python this just felt like the natural choice. I quickly decided though that this was not the platform for me. I found it a bit hard to get my head around, and even harder to port my current blog design over. Themes really seem to be where Nikola is lacking. I think if there was a better repository for them it might be a better choice. Though while trying to find a port of the Casper theme, the theme used by ghost, I discovered a ported theme for Hugo. So this led me to looking into Hugo. First thing I found is that it was written in Go. This was pretty awesome since I have started learning and working with Go and really just falling in love with it. I installed it and tried it out. It just worked and felt right.

The Move

I had been using Ghost for a while and so had a few posts that needed to move with me to Hugo. To make that happen I had to get creative. I found a post on the blog of the author of the Hugo Casper theme that talked about moving from Ghost to Hugo so I read it. I found that he had used php script to take the data from the Ghost export and create the markdown files used by Ghost. This seemed like an easy enough proposal. However, I’m not really a big fan of php (a long story for another time). So I figured I would do a quick port of the script to Python so I could get up and running quickly. The php script on the blog didn’t work without some help, the format of the json that Ghost exported seemed to have changed since the script was created. After a few minutes and few false starts I created the script:

#!/usr/bin/env python

import json
import datetime

with open('GhostData.json', 'rb') as data_file:
    ghost_data = json.load(data_file)

posts = ghost_data['db'][0]['data']['posts']

for post in posts:
    created_at = datetime.datetime.fromtimestamp(
        post['created_at']/1000).isoformat()
    title = post['title']
    slug = post['slug']
    markdown = post['markdown']
    draft = 'false' if post['published_at'] else 'true'
    published_at = (
        datetime.datetime.fromtimestamp(
            post['published_at']/1000).isoformat()
        if post['published_at']
        else datetime.datetime.fromtimestamp(
            post['created_at']/1000).isoformat()
    )

    with open('output/%s.md' % slug, 'w') as post_file:
        post_file.write('+++\n')
        post_file.write('date = "%s"\n' %
                        published_at.encode('utf8'))
        post_file.write('draft = "%s"\n' % draft.encode('utf8'))
        post_file.write('title = "%s"\n' % title.encode('utf8'))
        post_file.write('slug = "%s"\n\n' % slug.encode('utf8'))
        post_file.write('+++\n\n')
        post_file.write(markdown.encode('utf8'))

After that, simply moved the files from output to content/post and run hugo, and BAM I had a blog.

Publishing

With the move to the static site, I also decided to make publishing my blog posts easier. To accomplish this I setup a git repository on my server and configured a post-receive hook that would deploy my site for me.

#!/bin/bash

DEPLOY_DIR=<deploy directory>

GIT_WORK_TREE="$DEPLOY_DIR" git checkout -f

cd "$DEPLOY_DIR" && hugo -t casper --uglyUrls=true

This means when I’m ready to publish I simply do a git push deploy. It’s awesome!

What’s Next?

I decided that even though my one off python script worked, it didn’t bring everything over. It missed the tags, for example. Also, it was Python and not Go, this felt out of spirit with the whole change. So with that in mind, I’m working on a more comprehensive conversion tool in Go. I should have a write up all about it soon.

I also think that I should look into setting up a cron job on my server that can run every night and rebuild my site, in case there was post that was setup with a scheduled post date, future date.

Make The Web SQueaL

Mon, 24 Nov 2014 07:38:00 +0000

I gave my first public talk last week. It was a talk on SQL Injection that was given at this month’s NolaSec meetup. And, I have to say, I really enjoyed the experience.

The Talk

The talk was titled “Make The Web SQueaL: An Introduction to SQL Injection.” It was a pretty quick talk. The goal when written was to make a 20 minute-ish talk with room for questions at the end. And I think I got pretty close to that. It was really geared to being purely introductory. To that end it was very high level with a few slides devoted to what is SQL and SQL Injection. Then moving on to how SQL Injection works, and what can be done with it.

To go along with the talk I created a cool little lab environment, to help demonstrate exactly what SQL Injection is, but I think I did a poor job of introducing it at the end of the talk. My intent was to offer to demonstrate after all the talks were concluded, but those words escaped me while I was up there.

Links:

The Experience

The experience, for me, was the best part of the night. Many of my co-workers expressed interest in attending the meetup. I’ve given a few talks within the company before, on similar topics. And apparently that was enough to make them what to learn more and support me. It was extremely gratifying, and nerve wracking at the same time. A good handful of my coworkers made it out.

The talk itself made me a little nervous. During the introduction they pointed out that it was probably one of the largest groups they have had attend one these meetups. So, nothing like go big or go home. I presented my slides at a pretty good clip, but I kept watching the faces in the crowd and from what I could tell everyone was following. During the question and answer section. I got a really good group of questions, that helped let me know that what I talked about, was not only absorbed, but was being applied in their minds to the work they do.

In all. It was a great experience. And I very much look forward to doing it again.

I ❤ Vim

Fri, 15 Aug 2014 07:47:00 +0000

I have been using Vi/Vim for a few years now, as my editor of choice. I feel like I’m a fairly proficient user, but I find myself constantly discoving new aspects of Vi’s badassness.

As a simple example, last week I found myself making changes to several files. They all needed the same change. Go to the top of the page, and add a line to the second line. Find the occurance of specific string, and remove that line, perform search replace on next two.

The task of doing this was exrememly repetitive and even though I created a macro, it was still time consuming. So…. to the internets. It turns out there was a way in vim to perform the same command, or in this case vimscript, on every buffer loaded. So with a single line command, I was able to update all of the files in one go, and move on to more intersting work.

I’m happier all the time that I decided to use Vim as my go to editor. I’m still learning new things about it all the time, and becoming more and more productive.

TADpole v0.1

Fri, 25 Jul 2014 19:09:00 +0000

Today is my birthday. so what did I do with this day? I decided to finally get around to releasing TADpole. TADpole is the tool I created as part of my master’s thesis “Automated Timeline Anomaly Detection.” To be honest I’ve been hesitant to release this. I am a perfectionist and the code was written to prove out the research. But, I’m finally getting over my ego, and I present to you TADpole.

What is TADpole

TADpole is tool designed to aide forensic investigators during the initial triage of a system. The purpose of the tool is to determine if the system clock of the machine had been purposefully manipulated. An example of manipulation in this case would be someone changing the clock back two weeks to alter accounting information, then resetting the clock to current time. Currently TADpole only works for Windows systems.

How does it work

TADpole searches each file on a forensic disk image looking for Windows event log files. It then looks for entries in the log files that are anomalous. Once these anomalies are found, they are then correlated across multiple log files to increase the certainty that this anomaly is a true anomaly and not a mistake in the log file.

Where can you get it

The source code is available on my GitHub page https://github.com/jbarone/tadpole.

Welcome

Wed, 02 Jul 2014 09:48:00 +0000

This blog is intended to be a dumping ground of my thoughts and ideas on various topics. I plan to blog about everything from Information Security, to programming, to health and fitness. A fairly wide range, to be sure. I hope that you enjoy it, and come back often.

Thanks