Edit README & change logo · stuxnet999/MemLabs@009c0bb · GitHub
@@ -1,53 +1,68 @@
1-
![logo](./Images/logo.png)
1+
<img src="./Images/MemLabs-logo.png" alt="MemLabs" class="center">
2+
---
3+4+
## **Table of contents**
5+6+
1. [About MemLabs](https://github.com/stuxnet999/MemLabs#About-MemLabs)
7+
2. [Motivation](https://github.com/stuxnet999/MemLabs#motivation)
8+
3. [Structure of Repository](https://github.com/stuxnet999/MemLabs#structure-of-the-repository)
9+
4. [Tools and Frameworks](https://github.com/stuxnet999/MemLabs#tools-and-frameworks)
10+
5. [Flag Submission](https://github.com/stuxnet999/MemLabs#flag-submission)
11+
- [Email Format](https://github.com/stuxnet999/MemLabs#email-format)
12+
6. [Resources](https://github.com/stuxnet999/MemLabs#resources)
13+
7. [Feedback & suggestions](https://github.com/stuxnet999/MemLabs#feedback--suggestions)
14+
8. [Usage](https://github.com/stuxnet999/MemLabs#usage)
15+
9. [Author](https://github.com/stuxnet999/MemLabs#author)
16+17+
## **About MemLabs** :mag:
218319
MemLabs is an educational, introductory set of CTF-styled challenges which is aimed to encourage students, security researchers and also CTF players to get started with the field of **Memory Forensics**.
4205-
## **Motivation**
21+
## **Motivation** :dart:
622723
The main goal of creating this repository was to provide a reliable platform where individuals can learn, practice and enhance their skills in the field of memory forensics. As of the CTF-style, well, what better & interesting way to learn security than by playing CTFs?
824925
I also believe these labs can be used by anyone to help others become good with the essentials and fundamentals of memory forensics.
102611-
## **Structure Of The Repository**
27+
## **Structure of repository**
12281329
| Directory | Challenge Name | Level Of Difficulty |
1430
|:----:|:----:|:----:|
15-
|Lab 0 | Never Too Late Mister | Sample challenge |
16-
|Lab 1 | Beginner's Luck | Easy |
17-
|Lab 2 | A New World | Easy |
18-
|Lab 3 | The Evil's Den | Easy - Medium |
19-
|Lab 4 | Obsession | Medium |
20-
|Lab 5 | Black Tuesday | Medium - Hard |
21-
|Lab 6 | The Reckoning | Hard |
31+
|Lab 0 | [Never Too Late Mister](./Lab%200) | Sample challenge |
32+
|Lab 1 | [Beginner's Luck](./Lab%201) | Easy |
33+
|Lab 2 | [A New World](./Lab%202) | Easy |
34+
|Lab 3 | [The Evil's Den](./Lab%203) | Easy - Medium |
35+
|Lab 4 | [Obsession](./Lab%204) | Medium |
36+
|Lab 5 | [Black Tuesday](./Lab%205) | Medium - Hard |
37+
|Lab 6 | [The Reckoning](./Lab%206) | Hard |
22382339
To aid first-timers to understand how to approach CTF challenges & usage of volatility, please refer [Lab 0](https://github.com/stuxnet999/MemLabs/tree/master/Lab%200) which comes with a elaborate walkthrough & I hope it will be a great way to start MemLabs!
24402541
All the memory dumps are that of a Windows system.
264227-
## **Tools and Frameworks**
43+
> **Note**: The level of difficulty specified may not be fully accurate as it depends on the individual. I've tried my best to categorize them after receiving feedback from beginners to the field.
44+45+
## **Tools and frameworks** :hammer_and_wrench:
284629-
I'd suggest everyone use [The Volatility Framework](https://github.com/volatilityfoundation/volatility/) for analysing the memory images.
47+
I'd suggest everyone use [**The Volatility Framework**](https://github.com/volatilityfoundation/volatility/) for analysing the memory images.
304831-
To install the necessary tools required for this lab,
49+
Please execute the [**setup.sh**](./setup.sh) file to install all the required dependencies in your system.
325033-
```bash
34-
$ sudo apt install volatility
35-
$ sudo apt install ghex
36-
```
51+
> **Note**: Windows users can download the executable file from [here](https://www.volatilityfoundation.org/26).
37523853
As these labs are quite introductory, there is no need for installing more tools. However, if the user wishes, they can install many other forensic tools.
39544055
The preferred OS would be Linux. However, you can also use Windows (WSL) or macOS.
415642-
## **Flag Submission**
57+
## **Flag submission** :triangular_flag_on_post:
43584459
Please mail the flags of each lab to <memlabs.submit@gmail.com>
45604661
Please have a look at the following example to better understand how to submit the solution.
47624863
Suppose you find 3 flags in a particular lab,
496450-
+ flag{stage1_is_n0w_d0n3} 
65+
+ flag{stage1_is_n0w_d0n3}
5166
+ flag{stage2_is_n0w_d0n3}
5267
+ flag{stage3_is_n0w_d0n3}
5368
@@ -57,43 +72,46 @@ Concatenate all the flags like this: **flag{stage1_is_n0w_d0n3} flag{stage2_is_n
57725873
All the labs will follow the same flag format unless specified otherwise.
597460-
### **Email Format**
75+
### **Email format**
61766277
Please follow the following guidelines when sending the solution. Below is a sample:
63786479
**Email Subject**: [MemLabs Solution Submission] [Lab-x]
658081+
> **x** indicates the Lab number. Ex: 1,2,3 etc..
82+6683
![Email-Picture](./Images/Submission.png)
67846885
Email your solution to memlabs.submit@gmail.com
69867087
If the solution is correct, then the participant will receive a confirmation mail.
718872-
## **Feedback & Suggestions**
89+
## **Feedback & suggestions**
73907491
I'd love the community's feedback regarding these labs. Any suggestions or improvements are always welcome. Please email it to me or contact my via Twitter: [@_abhiramkumar](https://www.twitter.com/_abhiramkumar).
759276-
## **Resources**
93+
## **Resources** :rocket:
779478-
New to CTFs? Don't know what CTFs are? Have a look at https://ctftime.org/ctf-wtf/
95+
This section contains resources which I've composed myself and some others which I have used when I learnt memory forensics. I hope this resources will help everyone in not only solving these labs but also in exploring more areas in memory forensics.
799680-
+ [Volatility Command Reference](https://github.com/volatilityfoundation/volatility/wiki/Command-Reference)
81-
+ [My Personal Blog](https://stuxnet999.github.io) (You can have a look here to better understand on how to approach a CTF challenge)
97+
+ [**Basics of Memory Forensics**](https://stuxnet999.github.io/volatility/2020/08/18/Basics-of-Memory-Forensics.html)
98+
+ [**Volatility Windows Command Reference**](https://github.com/volatilityfoundation/volatility/wiki/Command-Reference)
99+
+ [**Sans DFIR Memory Forensics cheat sheet**](https://digital-forensics.sans.org/media/volatility-memory-forensics-cheat-sheet.pdf)
8210083-
## **Author**
101+
If you're interested to play more CTFs or want to try more challenges,
102+
+ [**AboutDFIR - Challenges & CTFs**](https://aboutdfir.com/education/challenges-ctfs/)
103+
+ [**CTFtime.org**](https://ctftime.org/)
8410485-
P. Abhiram Kumar
105+
## **Usage**
8610687-
Cyber Forensics, [Team bi0s](https://www.twitter.com/teambi0s)
107+
MemLabs is completely free to anyone to use. If you wish to use MemLabs in your workshops, classes or use the labs anywhere else, it is my humble request to you to use the original links to the labs and please mention my name as well. For any other queries, please contact me.
8810889-
+ Mail: abhiram1999@gmail.com
90-
+ Twitter: [@_abhiramkumar](https://www.twitter.com/_abhiramkumar)
91-
+ Personal Blog: [stuxnet999.github.io](https://stuxnet999.github.io)
109+
## **Author** :bust_in_silhouette:
9211093-
This repository is brought to you by [Team bi0s](https://twitter.com/teambi0s). You can view other popular open soure project from bi0s at https://github.com/teambi0s.
111+
P. Abhiram Kumar
9411295-
Team bi0s also conducts various flagship CTF events like
113+
Digital Forensics, [**Team bi0s**](https://www.twitter.com/teambi0s)
9611497-
+ InCTF International
98-
+ InCTF Nationals - India's first Hacking contest.
99-
+ Amrita InCTF Junior - The only cybersecurity contest for school students in India.
115+
+ Mail: **abhiram1999@gmail.com**
116+
+ Twitter: [**@_abhiramkumar**](https://www.twitter.com/_abhiramkumar)
117+
+ Personal Blog: [**stuxnet999.github.io**](https://stuxnet999.github.io)