Better WHOIS Lookups

Origin AS/WHOIS lookups via scripts, use DNS-based lookups at Team Cymru:

nslookup -type=TXT 31.108.90.216.origin.asn.cymru.com

Javascript Decoding

Some excellent articles:

https://isc2.sans.org/diary.html?storyid=1917

http://isc.sans.org/diary.html?storyid=2268

Or just override the write and evaluation features with custom functions, slap them on the front, and run them through spidermonkey.

Finding Files and Counting Lines at the Windows Command Prompt

An article about some Windows basics that are rather important in the forensics world.

http://isc.sans.org/diary.html?storyid=2244

Determining USB Keys in Windows

reg query "\\%1\HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR"

Perl Scripting to Decode Encoded or Escaped Pages

Basic form

> cat file.htm | perl -pe 's///ge'

Now fill in the searches and substitution functions between the slashes. Final form:

> echo "test1%202%203%20" | perl -pe 's/\%(..)/chr(hex($1))/ge'
test1 2 3

Security Apache/PHP

http://isc.sans.org/diary.html?storyid=2163

Searching for a File of a Given Date in DOS

Important in Windows forensics work. Care of Mike S.

The date to check is xx/xx/xxxx. The command to do the search would be something along these lines:

dir c:\*.* /a /t:c /s | find "xx/xx/xxxx" > results.txt