sroberts

Volatility Learning Resources

• Volatility - An advanced memory forensics framework
• Introduction to Volatility
• Volatility | Linux Forensics

Learning Exercises & Examples

• Honeynet | Challenge 7 Forensic Analysis of a Compromised Server
• Google Code | SampleMemoryImages

sroberts

• 10: Pocket Knife
• 13: Wallet
• 16: Watch
• 18: ?
• 21: Flask

sroberts

• Hubot
• Hubot VTR Scripts & Hubot VTR Rhodey
• ChatOps at GitHub - @jnewland
• The Programming Butler: Hubot Scripts Explained
• Code School: Learn CoffeeScript
• Presentation: Using Robots to Fight Bad Guys - @sroberts

sroberts

#!/usr/bin/env python
# encoding: utf-8
"""
freegeoip-geolookup.py

Created by Scott Roberts.
Copyright (c) 2015. All rights reserved.

A basic Maltego script to geolocate IPv4Addresses using Freegeoip.net.

sroberts

# For a 1-1 transform, so we create one location entity based
# on the geolocation data.
trx.addEntity("maltego.Location", "New York, NY")

# This can also be placed in a loop and will result in multiple entities.
locations = ["New York", "Washington DC", "San Francisco"]
for location in locations:
  trx.addEntity("maltego.Location", location)

sroberts

# Create a Maltego Transform Exception
trx.addException("We're out of gummy bears!!! Abort.")
 
# ThrowExceptions returns the errored transform.
trx.throwExceptions()

sroberts

# Import MaltegoTransform-Python library
# from MaltegoTransform import MaltegoEntity
from MaltegoTransform import MaltegoTransform

sroberts

# This returns the transform as an XML representation that Maltego
# uses to update the graph.
trx.returnOutput()

sroberts

# Set up your Transform object. This is the basis for returning results.
trx = MaltegoTransform()

sroberts

Keybase proof

I hereby claim:

• I am sroberts on github.
• I am sroberts (https://keybase.io/sroberts) on keybase.
• I have a public key ASBN2JRFuuB8vzXzq06VSCrmaXjHU9q0LR4K6aM6UUujkgo

To claim this, I am signing this object: