Join us for the Honeynet Workshop 2024: May 27th–29th, Copenhagen, Denmark

Forensic Challenge 4 - VoIP

01 Jun 2010
Challenge 4 - VoIP - (provided by Ben Reardon from the Australian and Sjur Eivind Usken from Norwegian Chapter) takes you into the world of voice communications on the Internet. VoIP with SIP is becoming the de-facto standard for voice communication on the Internet. As this technology becomes more common, malicious parties have more opportunities and stronger motives to take control of these systems to conduct nefarious activities. This Challenge is designed to examine and explore some of attributes of the SIP and RTP protocols.

Challenge 3 - Banking Troubles

28 Mar 2010
Challenge 3 - Banking Troubles - (provided by Josh Smith and Matt Cote from The Rochester Institute of Technology Chapter, Angelo Dell’Aera from the Italian Chapter and Nicolas Collery from the Singapore Chapter) is to investigate a memory image of an infected virtual machine. The challenge has been completed on May 12th 2010. Skill Level: Difficult The Challenge: Company X has contacted you to perform forensics work on a recent incident that occurred.

Forensic Challenge 2 - Browsers under attack

17 Feb 2010
Challenge 2 - browsers under attack - (provided by Nicolas Collery from the Singapore Chapter and Guillaume Arcas from the French Chapter) is to investigate a network attack but of a different kind. Skill Level: Intermediate The Challenge: A network trace with attack data is provided. (Note that the IP address of the victim has been changed to hide the true location.) Analyze and answer the following questions: List the protocols found in the capture.

Challenge 1 - pcap attack trace

18 Jan 2010
Forensic Challenge 2010 Challenge 1 - pcap attack trace - (provided by Tillmann Werner from the Giraffe Chapter) is to investigate a network attack. Skill Level: Intermediate The Challenge: A network trace with attack data is provided. (Note that the IP address of the victim has been changed to hide the true location.) Analyze and answer the following questions: Which systems (i.e. IP addresses) are involved? (2pts) What can you find out about the attacking host (e.