Hacking Articles Tips Tricks Videos Tutorials

Etl-Parser - Event Trace Log File Parser In Pure Python

Event Trace Log file reader in pure Python etl-parser is a pure Python 3 parser library for ETL Windows log files. ETL is the default format for ETW as well as the default format for the Kernel logger. etl-parser has no system dependencies, and will work well on both Windows and Linux. Since this format is not documented, we merged information from the blog of Geoff Chappel and reverse engineering activities conducted by Airbus CERT team. What is ETL and why is it a pain to work with? Consider ETL as a container, like AVI is for video files. Reading ETL is similarly frustrating as reading an AVI file without the right codec. etl-parser tries to solve this problem by including parsers for the following well known log formats: ETW manifest base provider TraceLogging MOF for kernel log How to use etl-parser? etl-parser offers two scripts. The first script, etl2xml transforms all known ETL events into XML: etl2xml -i example.etl -o example.xml The second script, etl2pcap transforms network captures created through netsh into the pcap file format: netsh start trace capture=yesnetsh stop traceetl2pcap -i NetTrace.etl -o NetTrace.pcap You can also use etl-parser as a library: from etl.etl import IEtlFileObserver, build_from_streamfrom etl.system import SystemTraceRecordfrom etl.perf import PerfInfofrom etl.event import Eventfrom etl.trace import Tracefrom etl.wintrace import WinTraceclass EtlFileLogger(IEtlFileObserver): def on_system_trace(self, event: SystemTraceRecord): """Mof kernel message with Process Id and Thread Id""" mof = event.get_mof() # Invoke MOF parser def on_perfinfo_trace(self, event: PerfInfo): """Mof kernel message with timestamp""" mof = event.get_mof() # Invoke MOF parser def on_trace_record(self, event: Trace): """unknown""" def on_event_record(self, event: Event): """ETW event this is what you search""" # Choose the "parse_" function which corresponds to your event message = event.parse_tracelogging() # Invoke TraceLogging parser me ssage = event.parse_etw() # Invoke Manifest based parser def on_win_trace(self, event: WinTrace): """unknown""" etw = event.parse_etw()with open("example.etl", "rb") as etl_file: etl_reader = build_from_stream(etl_file.read()) etl_reader.parse(EtlFileLogger()) Installation etl-parser is available from pip: pip install etl-parser Alternatively, you can install etl-parser using setup.py: git clone https://github.com/airbus-cert/etl-parser.gitcd etl-parserpip install -e . Missing a parser? If you encounter a parsing error, please open an issue on the Airbus CERT GitHub repository. Why an ETL Parser? The EVTX log format is fairly well documented, with lots of libraries and tools available today. This is not true for ETL: at time of development, there is no significant open-source project that we know of and the ETL format is not well documented. ETL is massively used by Windows system programmers to log useful artifacts: C:\Windows\System32\WDI\LogFiles\BootPerfDiagLogger.etl C:\Windows\System32\WDI\LogFiles\ShutdownPerfDiagLogger.etl NetTrace.etl via netsh C:\Windows\System32\WDI\<GUID>\<GUID>\snapshot.etl etc. A lot of new APIs such as Tracelogging or WPP are based on ETW. These APIs are used extensively by Microsoft developers for Windows. Tracelogging is addressed by etl-parser, WPP will be addressed in a future release. Microsoft offers a lot of consumers that create ETL traces, such as xperf.exe, logman.exe, netsh.exe, etc. We believe it is a gold mine for DFIR analysts. Credits This project is under copyright of the Airbus Computer Emergency Response Team (CERT) and distributed under the Apache 2.0 license Geoff Chappel for all information on his blog License etl-parser is released under the Apache 2.0 license. Download Etl-Parser
Read more...

8 views13:49

6 views13:50

Hacking Articles Tips Tricks Videos Tutorials

5 views13:50

Hacking Articles Tips Tricks Videos Tutorials

Photo

Hacking on Medium
About Pre Security THM learning path.

https://cdn-images-1.medium.com/max/1122/1*i1OW4_ckJKnHcchNlJqrqQ.png
I like THM because as they say the best way to learn, is by doing. Their content is guided with interactive exercises placed in safe…

Continue reading on Medium »

6 views13:50

Hacking Articles Tips Tricks Videos Tutorials

Photo

Hacking on Medium
هک شده توسط مجرمان سایبری معدن طلا برای داده های شخصی و دسترسی به تمام حساب های دیگر شما است.

احتمالاً شما اینجا هستید که می‌پرسید، هک ایمیل شده است، چگونه آن را برطرف کنم؟” اگر کمی خوش شانس تر باشید، ممکن است کاملا مطمئن نباشید که…

Continue reading on Medium »

7 views13:50

Hacking Articles Tips Tricks Videos Tutorials

8 views15:06

Hacking Articles Tips Tricks Videos Tutorials

KitPloit - PenTest Tools!
Etl-Parser - Event Trace Log File Parser In Pure Python

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Kitploit – Maintenance in Progress

Kitploit is temporarily under maintenance. We’ll be back shortly with improvements.

8 viewsedited 15:06

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
Looking for the 2013 Weheartit database leak

Does anyone have? All I can find are posts on forums that make you create an account and comment before you can get the link. After jumping through the hoops the link is always dead.

Any help would be most appreciated. Thanks!

submitted by /u/reddit_user_name
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Looking for the 2013 Weheartit database leak

Does anyone have? All I can find are posts on forums that make you create an account and comment before you can get the link. After jumping...

8 viewsedited 17:47

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
How did someone hack into my iPhone?

I had an iphone 7plus and it started opening desktop browsers in safari, and I had web history of stuff I didn't even look up. When I would call someone it would say my contacts name and then '3 others' my battery was constantly dieing so I went into my phone settings and went to find my iPhone. First it opened in the app, showed my location and everything was fine. THEN it automatically opened in a web browser and my location was correct but something didn't feel right. The phone indicator on my address on the map turned black then disappeared. So I accidentally swiped a browser open and it opened github and the page said this.

"Welcome back! Click your favorite users email account". -shows both my personal and icloud email

So I started going through his settings on whatever he was using and I came across a purchase he made saying this:

"Thank you for your purchase! You now have unlimited access to the users auidio and camera"

I touched the camera icon on his web panel and my camera opened up!!!

I flipped out!

I shut off my mobile data, Bluetooth, wifi, all internet access to my phone so I could investigate.

This person copied and pasted a link accessing my icloud account into all of my phones contacts bc after looking further, it was a "gateway" for his followers (yes followers, like Instagram. I even saw the comments people left about me! And my pictures!!) To gain access to my phone too.

He was in my phone like a parasite. I took screen shots of everything while I went through all of what he had access to and called apple.

apple did NOTHING. They kept telling me to change my password and I was explaining to them he is watching all my key strokes so it doesn't matter how many times I change my password.

How can someone get access like that to a phone?

I saw all the screen shots he took of my banking and other personal information it was hell.

I was hysterical paranoid for months

submitted by /u/Amb_301
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

How did someone hack into my iPhone?

I had an iphone 7plus and it started opening desktop browsers in safari, and I had web history of stuff I didn't even look up. When I would call...

11 viewsedited 17:48

Hacking Articles Tips Tricks Videos Tutorials

9 views17:51

Hacking Articles Tips Tricks Videos Tutorials

Photo

Hacking on Medium
Do you know about the Immortal Rootkit?

From the earliest times to the present day, humans have been evolving towards technology along with malware. There are various kind of…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Medium

Do you know about the Immortal Rootkit?

From the earliest times to the present day, humans have been evolving towards technology along with malware. There are various kind of…

8 viewsedited 17:51

Hacking Articles Tips Tricks Videos Tutorials

8 views17:51

Hacking Articles Tips Tricks Videos Tutorials

8 views17:51

Hacking Articles Tips Tricks Videos Tutorials

Photo

Hacking on Medium
Smart Travel!

https://cdn-images-1.medium.com/max/1000/1*gvae_XIs_OsV-6BuKqlLRQ.jpeg
Being a person who loves to travel and go to places ,here are some things I’ve come across that can help you in making your journey more…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Medium