JAWAHARLAL NEHRU TECHNOLOGICAL UNIVERSITY HYDERABAD

UNIT - I

BASIC ANALYSIS: Basic Static Techniques, Malware Analysis in Virtual, Machines, Basic Dynamic Analysis

UNIT - II

ADVANCED STATIC ANALYSIS: A Crash Course in x86 Disassembly, IDA Pro, Recognizing C Code Constructs in Assembly Analyzing Malicious Windows Programs

UNIT - III

ADVANCED DYNAMIC ANALYSIS: Debugging, vi Brief Contents, Olly Dbg, Kernel Debugging with WinDbg

UNIT - IV

MALWARE FUNCTIONALITY: Malware Behavior, Covert Malware Launching, Data Encoding, Malware-Focused Network Signatures

UNIT - V

ANTI-REVERSE-ENGINEERING: Anti-Disassembly, Anti-Debugging, Anti-Virtual Machine Techniques, Packers and Unpacking

TEXTBOOKS:

• 1. Michael Sikorski and Andrew Honig, “Practical Malware Analysis : The Hands-On Guide to Dissecting Malicious Software”, No Starch Press,2012.

REFERENCES:

• 1. Jamie Butler and Greg Hoglund, “Rootkits: Subverting the Windows Kernel”, Addison-Wesley, 2005.
• 2. Dang, Gazet, Bachaalany, “Practical Reverse Engineering”, Wiley, 2014.
• 3. Reverend Bill Blunden, “The Rootkit Arsenal: Escape and Evasion in the Dark Corners of the System” Second Edition, Jones & Bartlett, 2012. M.Tech- I Year – II Semester (Cyber Forensics /Cyber Security & Information Security) ETHICAL HACKING LAB PART-I ETHICAL HACKING LAB (Indicative list of experiments)
• 1. Using Active and Passive Techniques for scanning Networks, Enumeration, sniffing to Enumerate Network Hosts.
• 2. Conducting Active and Passive Footprinting and Reconnaissance against Target.
• 3. Using Armitage to Attack the Network.
• 4. Using Metasploit to Attack a Remote System - Scanning Networks, Enumeration, Sniffers, Evading IDS, Firewalls, and Honeypots.
• 5. Using Malware – Dark Comet for System Hacking, Trojans and Backdoors, Viruses and Worms.
• 6. Using the SHARK Remote Administration Tool for System Hacking, Trojans and Backdoors, Viruses and Worms.
• 7. Attacking a System- Using the SYSTEM account – System Hacking, Intrusion Detection – Evading IDS, Firewalls, and Honeypots.
• 8. Web-Based Hacking Servers and Applications for exploitation with IPv6 – System Hacking, Denial of Service, SQL Injection – Hacking Webservers, Hacking Web Applications, SQL Injection, LaunchingaBuffer Overflow – System Hacking, Buffer Overflow.
• 9. Cryptography - Breaking Windows Passwords –System Hacking, Using John the Ripper to Crack Linux Passwords – System Hacking, Using Certificates to Encrypt Email–Cryptography. COMPUTER FORENSICS TOOLS LAB PART-I To perform the following tasks for the lab, Internet facility and open source tools should be provided.
• 1. Use a Web search engine, such as Google or Yahoo!, and search for companies specializing in computer forensics. Select three and write a two-to three-page paper comparing what each company does.(Project 1-1)
• 2. Search the Internet for articles on computer crime prosecutions. Find at least two. Write one to two pages summarizing the two articles and identify key features of the decisions you find in your search. (Project 1-5)
• 3. Use a Web search engine, search for various computer forensics tools.
• 4. Preparing and processing of investigations. Try to examine and identify the evidences from the drives. (Project 2-1)
• 5. Extracting of files that have been deleted.( (Project 2-4)
• 6. Illustrate any Data acquisition method and validate. Use an open source data acquisition tool.
• 7. You’re investigating an internal policy violation when you find an e-mail about a serious assault for which a police report needs to be filed. What should you do? Write a two-page paper specifying who in your company you need to talk to first and what evidence must be turned over to the police.(Project 5-2)
• 8. Create a file on a USB drive and calculate its hash value like FTK Imager. Change the file and calculate the hash value again to compare the files.(Project 5-4)
• 9. Compare two files created in Microsoft Office to determine whether the files are different at the hexadecimal level. Keep a log of what you find. (Project 6-1)
• 10. Illustrate the analysis of forensic data.
• 11. Illustrate the validating of forensic data.
• 12. Locate and extract Image (JPEG) files with altered extensions.(Project 10-1)
• 13. Examine or Investigate an E-mail message.

TEXT BOOK:

• 1. “Computer Forensics and Investigations”, Nelson, Phillips Enfinger, Steuart, Cengage Learning.

REFERENCES:

• 1. Brian Carrier , "File System Forensic Analysis" , Addison Wesley, 2005
• 2. Dan Farmer & Wietse Venema ,"Forensic Discovery", Addison Wesley, 2005
• 3. Eoghan Casey , ―Digital Evidence and Computer Crime ―, Edition 3, Academic Press, 2011
• 4. Chris Pogue, Cory Altheide, Todd Haverkos ,Unix and Linux Forensic Analysis DVD ToolKit, Syngress Inc. , 2008
• 5. Harlan Carvey ,Windows Forensic Analysis DVD Toolkit, Edition 2, Syngress Inc. , 2009
• 6. Harlan Carvey ,Windows Registry Forensics: Advanced Digital Forensic Analysis of the Windows Registry , Syngress Inc, Feb 2011
• 7. Eoghan Casey, Handbook of Digital Forensics and Investigation, Academic Press, 2009
• 8. Gonzales/ Woods/ Eddins, Digital Image Processing using MATLAB, 2nd edition, Gatesmark Publishing, ISBN 9780982085400
• 9. N.Efford, Digital Image Processing, Addison Wesley 2000, ISBN 0-201-59623-7
• 10. M Sonka, V Hlavac and R Boyle, Image Processing, Analysis and Machine Vision, PWS
• 11. 1999, ISBN 0-534-95393-
• 12. Pratt.W.K., Digital Image Processing, John Wiley and Sons, New York, 1978