https://xn--e-br-noa.de/ 2026-10-10T00:13:33+00:00 https://xn--e-br-noa.de/ https://xn--e-br-noa.de/lib/exe/fetch.php?media=wiki:dokuwiki.svg text/html 2026-09-01T06:26:50+00:00 Anonymous (anonymous@undisclosed.example.com) https://xn--e-br-noa.de/doku.php?id=ex:htb:updown:start&rev=1788244010&do=diff UpDown NMAP nmap -sS 10.129.57.148 Starting Nmap 7.92 ( https://nmap.org ) at 2022-12-31 14:06 GMT Nmap scan report for 10.129.57.148 Host is up (0.087s latency). Not shown: 998 closed tcp ports (reset) PORT STATE SERVICE 22/tcp open ssh 80/tcp open http Nmap done: 1 IP address (1 host up) scanned in 8.19 seconds text/html 2026-06-18T15:03:54+00:00 titannet (titannet@undisclosed.example.com) https://xn--e-br-noa.de/doku.php?id=soc:start&rev=1781795034&do=diff SOC text/html 2026-06-18T15:03:46+00:00 titannet (titannet@undisclosed.example.com) https://xn--e-br-noa.de/doku.php?image=soc%3Atemplate.7z&ns=soc&rev=1781795026&tab_details=history&media_do=diff&do=media <img src="https://xn--e-br-noa.de/lib/images/fileicons/svg/7z.svg" alt="template.7z" loading="lazy" width="500" height="500" /> text/html 2026-06-18T15:00:43+00:00 titannet (titannet@undisclosed.example.com) https://xn--e-br-noa.de/doku.php?id=windows:prefetch:start&rev=1781794843&do=diff Prefetch #![allow(clippy::unwrap_used, clippy::expect_used)] use std::path::PathBuf; use std::fs; use std::path::Path; use chrono::{DateTime, Utc}; /// based on https://docs.rs/crate/prefetch-core/0.1.0/source/examples/pf_dump.rs fn filetime_to_datetime(ft: i64) -> DateTime<Utc> { // FILETIME epoch (1601-01-01) -> Unix epoch (1970-01-01) const EPOCH_DIFF_100NS: i64 = 116_444_736_000_000_000; let unix_100ns = ft - EPOCH_DIFF_100NS; let secs = unix_100ns / 10_000_000; … text/html 2026-06-18T14:51:38+00:00 titannet (titannet@undisclosed.example.com) https://xn--e-br-noa.de/doku.php?id=soc:irt:playbooks:windows_disk&rev=1781794298&do=diff Windows Disk Image * Assumes basic setup from setup * All command below should be * copied to a “IR log” text/md file * edited as needed * executed with output copied back to “IR log” * recommendation: move commands/output from text/html 2026-06-18T11:34:42+00:00 titannet (titannet@undisclosed.example.com) https://xn--e-br-noa.de/doku.php?id=soc:irt:playbooks:wireshark&rev=1781782482&do=diff Wireshark tshark -nr <your_capture.cap> -Y "dns.flags.response == 0" -T fields -e dns.qry.name -e dns.qry | sort | uniq -c text/html 2022-12-31T14:13:40+00:00 ebaer (ebaer@undisclosed.example.com) https://xn--e-br-noa.de/doku.php?image=ex%3Ahtb%3Aupdown%3Aex_htb_updown1.png&ns=ex%3Ahtb%3Aupdown&rev=1672496020&tab_details=history&media_do=diff&do=media <img src="https://xn--e-br-noa.de/lib/exe/fetch.php?w=500&amp;h=500&amp;tok=4be0ad&amp;media=ex:htb:updown:ex_htb_updown1.png" alt="ex_htb_updown1.png" loading="lazy" width="500" height="500" /> text/html 2022-12-22T09:38:37+00:00 ebaer (ebaer@undisclosed.example.com) https://xn--e-br-noa.de/doku.php?image=ex%3Ahtb%3Aambassador%3Ahtb-ambassador-1.jpg&ns=ex%3Ahtb%3Aambassador&rev=1671701917&tab_details=history&media_do=diff&do=media <img src="https://xn--e-br-noa.de/lib/exe/fetch.php?w=500&amp;h=500&amp;tok=eb084a&amp;media=ex:htb:ambassador:htb-ambassador-1.jpg" alt="htb-ambassador-1.jpg" loading="lazy" width="500" height="500" />