Pitryriasis Rosea Scars Coco Butter

This post is going to try to forensic practice should be applied to a Cisco router or Cisco based.

First you have to be very clear grounds for attacking a router.
The main reasons are: For

attack a router:

• Make a denial of service attack (DoS) to the router and the network to which it belongs. Engage
• other through the routers. Forward
• network firewalls, IDS or other services.
• Monitor and record incoming or outgoing traffic on the network.
• Redirect network traffic to another point.

must also be clear philosophy work of a Cisco router. It is composed mainly of two memories which stores the data:

The reports are:

RAM:
memory is a persistent, meaning that what is stored in it is cleared at shutdown.

It stores:

• Active Configuration.
• PivotTables: ARP, Routing, NAT, ACL violations, statistics ...

protocols

Flash Memory:
is persistent, even turning off the computer, this memory is not erased.

In this report is stored:

• boot configuration.
• IOS system files.

To begin the analysis we have to take into account, based on data on the working philosophy of the router, a specific methodology, which consists of:

• not shut down or restart the router, obviously lose all data stored in RAM. Which are all important data for analysis without this data, the analysis does not make sense. Isolate
• network router, especially if the attack has already been done. Always careful not to disconnect the power. In some cases can be performed without isolation but after collecting information, to monitor if the activity continues. Sign
• for forensic analysis via the console port on the router and not through the network, because it would corrupt the scene. Recording the session
• complete analysis of the console log file.
• Run commands that display settings, but never run router configuration commands.
• After removing the volatile information, we can analyze the vulnerabilities of the router and scanning services through the network.

After

consider these recommendations, we turn to the commands that we have to use the console to remove the active configuration and pivot tables. The console session in which you run commands, should be recorded.

The commands are:

• show clock detail
• show version show running-config startup-
• show config show reload
• show ip route show ip arp show users
• show logging
• show ip interface show interfaces show tcp brief
• all
• show ip sockets
• show ip nat translations verbose
• show ip cache flow show ip cef
• show snmp user show snmp group
• show clock detail

We may also use an automated tool to collect this information, it is CREED (Cisco Router Evidence Extraction Disk). A self-bootable disk that runs a script to obtain this information by running these commands:

# terminal length 0
# dir / all
# show clock detail

# show ntp # show version
# show running-config
# show startup-config show reload

# # show ip route # show ip arp

# show
# show users
logging # show interfaces # show ip interfaces

# show access-lists
# show tcp brief all
# show ip sockets
# show ip nat translations verbose
# show ip cache flow
# show ip cef
# show snmp users
# show snmp groups
# show clock detail
# exit

After obtaining this information we will find vulnerabilities or services that have been able to compromise the security of the router.

use tools to analyze vulnerabilities as: Router Audit Tool (RAT) and Nipper.
To analyze service use: nmap, Torch Cisco, Cisco Snmp Tool ...

More information and downloads CREED (Cisco Router Evidence Extraction Disk):

More information and downloads Torch Cisco, Cisco Snmp Tool and Router Audit Tool (RAT) in the post "Tools to secure Cisco devices"

More information and download of Nipper in the post "Cisco Security Audit"

Source: Guru computing