FreeBSD developer (ports committer) working in the field of cybersecurity / developer of FileInsight-plugins / Black Hat USA 2021 Arsenal speaker / OSCP+
Joined October 2009
- Tweets2.9K
- Following1.2K
- Followers931
- Likes499
Pinned Tweet
FileInsight-plugins is a large collection of plugins for McAfee FileInsight hex editor. It provides useful features for malware surface analysis and supports some encodings, compression algorithms, and crypto algorithms not supported by CyberChef. github.com/nmantani/FileInsi…
MANTANI Nobutaka retweeted
I just released iwatobi, a new Sigma-based Linux DFIR tool specifically designed to detect php2shell attacks.
Nothing fancy yet, but hopefully it will be useful to some.
If you're doing Linux IR, give it a try! Issues and PRs to help improve it are always welcome!
github.com/Yamato-Security/i…
php2shell攻撃の検知に特化した、SigmaベースのLinux DFIRツール「iwatobi」を公開しました！
まだシンプルなツールですが、少しでも役に立てば嬉しいです。Linux環境でIRを担当されている方は、ぜひ試してみてください！改善のためのIssueやPRも大歓迎です！
github.com/Yamato-Security/i…
🤖 Made with AI
MANTANI Nobutaka retweeted
I'm developing ntfsfind and ntfsdump, tools for searching and extracting files directly from disk images.
Both tools support VMware snapshots without merging or converting VMDKs.
NTFS Spinal Cord Sword - SIPDEP sumeshi.github.io/posts/work… #dfir
MANTANI Nobutaka retweeted
For anyone who wants to check out @r3nzsec 's amazing IRFlow Timeline (to replace Timeline Explorer) but have to use Windows or Linux, I compiled binaries for those platforms. Feel free to submit issues if you find any bugs.
DFIRなどでTimeline Explorerより遥かに優れている「IRFlow Timeline」を使いたいけど、Macを持っていない！という方のために、Windows版とLinux版のリリースパッケージを作りました。
Windows Binary: github.com/Yamato-Security/i…
Linux Binary: github.com/Yamato-Security/i…
Website: r3nzsec.github.io/irflow-tim…
MANTANI Nobutaka retweeted
pstrings: a parallel strings extractor.
- 5.5 GB in 14 s (~278x faster than Sysinternals strings, ~10x faster than bstrings)
- ASCII + UTF16LE in a single pass
- UTF8 / CP932 / ISO-2022-JP / EUCKR / GB18030 / GBK / Big5 / Windows-1251
🔗 github.com/herosi/pstrings
#DFIR #forensics
MANTANI Nobutaka retweeted
Fileless execution on Linux still leaves (a lot of) observable behavior.
My latest research identifies five common patterns and maps each to the telemetry and detection rules that underlie them.
Read it here ↓
elastic.co/security-labs/thr…
MANTANI Nobutaka retweeted
After the Defcon CTF this year I have been seeing a lot of people talk about the "death of the CTF" because of agentic tooling.
I had written a whitepaper on this back in march analyzing first blood times on Hack the Box machines.
The writing has been on the wall for a while. It has, for at least a year or so, been about agentic engineering at the top level and not about cyber skills.
suzulabs.com/suzu-labs-blog/…
MANTANI Nobutaka retweeted
Huge respect to api monitor. It's such a beautiful tool for windows apps but hasn't been updated for ages. wanted to keep that spirit alive so built a fresh one.
Currently tracking 30k apis. very early alpha so expect some bugs.☺️
would love your feedback and bug reports.
repo: github.com/kernullist/KnWin3…
Thank you so much, folks, for your kind words. Though there are great cheat sheets and tips for OSCP+ available, I would like to share some of my tips.
I mainly practiced at PEN-200 challenge labs and Hack The Box. Proving Grounds is also a good place for practice. (1/16)
It took about three years to pass the OSCP+. I had a blank period for over one year because I supervised and co-authored a few Japanese tech books in my private time, and I did not have enough time. I restarted my OSCP+ challenge around last December. (15/16)