Live Linux Forensics training coming up @WWHackinFest Deadwood! Let's do some daily Linux Forensics trivia as a lead-up! wildwesthackinfest.com/deadw…

Sep 6, 2022 · 1:31 PM UTC

34
50
2
95
Daily Linux Forensics Trivia #1 -- Name two places in the Linux file system where the file type is encoded. wildwesthackinfest.com/deadw…
1
8
6
Trivia Answer #1 — File type was originally only stored in the inode. It was later added to directory entries so that commands like “ls -F” would not have to read every inode in a directory in order to display the file type.
1
3
Load newest
Daily Linux Forensics Trivia #14 - If the default log rotation policy has not been changed, roughly how many days worth of logs should you expect to find on a Linux system?
2
1
Trivia Answer #14 - Standard log rotation happens weekly and four weeks of old logs are saved. So you could end up with anywhere from 28-35 days of logs online.
1
5
Replying to @hal_pomeranz @WWHackinFest
Daily Linux Forensics Trivia #16 - How many bits are block addresses in EXT4?
1
2
3
Trivia Answer #16 - EXT4 uses 48-bit block addresses. Apparently the developers were concerned that 64-bit addresses would result in file systems that were so large that they could potentially not be fsck-ed in a reasonable amount of time.
1
1
4
Replying to @hal_pomeranz @WWHackinFest
Daily Linux Forensics Trivia #18 - During an IR you find a script used by the attackers that is gathering known_hosts and id_* files from user $HOME/.ssh directories. What would the attacker use these files for?
3
2
Trivia Answer #18 - @MalwareJake points out that determining attacker intent is always difficult, but known_hosts files plus SSH keys (id_* files) are useful for attempts at lateral movement. Enabling the HashKnownHosts option and using strong pass phrases on keys slows attackers
3
Replying to @hal_pomeranz @WWHackinFest
Daily Linux Forensics Trivia #19 - What data can you find in $HOME/.lesshst?
2
Trivia Answer #19 - Congrats to @lux_amalgamated for checking in with the correct answer! $HOME/.lesshst tracks search terms and shell eacape commands entered by the user in the “less” program. It DOES NOT track which files the used has viewed.
1
Load more