Computer Forensic

first of all I dowload the file that will be the material for the exercises that have been uploaded to the mailing list, in this case its a file named practical.floppy.dd
sekarang lakukan perintah dibawah ini

STRUCTURE FILE TAR

STRUCTURE FILE TAR

The Unix TAR program is an archiver program which stores files in a single

archive without compression.

OFFSET Count TYPE Description

@section The Standard Format

A @dfn{tar tape} or file contains a series of records. Each record contains @code{RECORDSIZE} bytes. Although this format may be thought of as being on magnetic tape, other media are often used.

What this it Slack Space, Unallocated Space & Magic Number

SLACK SPACE

Slack space is a form of internal fragmentation, i.e. wasted space, on a hard disk. When a file is written to disk it’s stored at the “beginning” of the cluster. A cluster is defined as a collection of logically contiguous sectors and the smallest amount of disk space that can be allocated to hold a file. Rarely will there be an even match between the space available in a cluster (or collection of clusters for longer files) and the number of bytes in the file. Left over bytes in the cluster are unused, hence the name slack space.

Struktur File System

FAT16 is a file system that uses the allocation unit that has a limit of up to 16-bit, so it can store up to 216 units of allocation (65536 pieces). This file system has a capacity limit of up to 4 Gigabyte sizes only. Allocation unit size used by the FAT16 partition depends on the capacity that was about to be formatted

MBR

Master Boot Record (MBR) will be created when you create the first partition on the hard disk. It is very important data structure on the disk. The Master Boot Record contains the Partition Table for the disk and a small amount of executable code for the boot start. The location is always the first sector on the disk.

The first 446 (0x1BE) bytes are MBR itself, the next 64 bytes are the Partition Table, the last two bytes in the sector are a signature word for the sector and are always 0x55AA.

For our disk layout we have MBR:

Local root exploit

In this tutorial backtrack OS as ubuntu 10.4 As the victim and the attacker
DVWA first open on the address ubuntu http://192.168.56.1/dvwa after that change the security to medium.

This time I used a command execution as the entrance to gain root access to the victim

then enter the following command

the above statements are intended to backtrack as the victim in the listening position so that the linux attacker could log in as root,
after it entered the terminal and enter the following command ubuntu

commands is intended to connect the victim with port 4444, but we just go to the directory dvwa, not to gain root access   
it is time to execute payload

to be continue
  

Attack Vector Metasploit & Beef

 Attack Vector Metasploit & Beef

In the scenario this time I will try to exploit the web browser using the beef combined with metasploit.
First I create a web page that I put java.script that would make victims who access this web page will hook into the beef.