W3-2/3 Lua (7/10)


   On Tuesday I decided to study up on Lua. I thought that it might help me gain a greater understanding of Wireshark or at least using its filters. I was still playing with Wireshark but this time around I was mostly just worried about writing filter commands. Lua is quite a nifty little programming language as its syntax is very minimalist and is flexible enough to be written in a variety of styles. I found out the Lua can be used to write dissectors (protocol parser), post-dissectors (used to add items to a dissection tree after all the dissectors have finished), and taps (a script meant to catch data from frames). Though in general it is preferable to use C to write dissectors because it is faster due to better available debugging tools, however one might find some use in prototyping dissectors in Lua.
    
       I would play around with mixing aliases and standard values. I was basically trying to see how many different ways I could write effectively the same filter without changing the logic of the filter (“HTTP” or “tcp.port == 80” not “tcp.port >79 and tcp.port <81”). I wanted to look for “lingual synonyms” not “structural synonyms”. In the end it wasn’t very exciting, but it let me play with the flexibility of the language.
   
     I was also curious how valuable experience with Lua was and where is it best to be applied. In general, the industry is not really clamoring for Lua scribes. It’s certainly not a bad skill to have but there are plenty of better skills to master and languages to learn. Despite Lua’s flexibility it has very limited use in the industry. The only specific thing that I could find it used for was game engines, which is neat but quite a niche field.  It is also great to embed in a C language or to use with a C compiler but past that it’s just not powerful enough. The language is easy to read, requires minimal syntax, and is supposed to have quick run time speed but those are merely just luxuries. It is usually outclassed by Python which is also very flexible and a lot more powerful. Lua can do a lot of things, but it can’t do a lot of things the best.
  
     I feel like this was time well spent. Since I can traverse Wireshark’s filters a little bit better and I now have a slightly better understanding of Wireshark. I may practice with Lua some more on my own time because I like using C++ but I’m not super motivated to do so. I know if I’m ever trying to embed onto a C language or if I was trying to work with a C compiler then Lua would be my top candidate to use. I’m feeling more comfortable with Wireshark, but I still need more experience this is a great start though. Thus far I really like that I am learning more and more as time goes on.

Comments

Post a Comment

Popular posts from this blog

W7-2/3 On Being Prepared & Further Recommendations (8/11)

   One can never be fully prepared. There is always more that a person can do to prepare themselves. I wish that before starting this internship that I would have had a better understanding of the basic concepts of cyber security (e.g. passive and active defense, vulnerability factors, etc.). I also wish that I had prior experience with all the tools and software I used. If you can find out the tools used at an internship, then it’s a good idea to try and learn some of those tools. Your internship will require less training and more application which will make the experience more productive for you. If you cannot find out what tools your internship will use, then it isn’t a bad idea to browse freeware related to that field (e.g. Maltego and Zed Attack Proxy for digital forensics and pen testing respectively). Most places are trying to save money, so they probably use freeware to some capacity. The most popular freeware is your best bet and even if they don’t use it, the...
Read more

W2-2/3 Network Mapping (7/5)

On Thursday we covered network mapping. The process of network mapping usually consists of four phases: identify the space of IP addresses you are monitoring and partition the space into different categories (1). Examine the IP space (2), identify blind and confusing traffic (3), and identify clients and servers (4).    During phase one the mapping of the inventory is undetermined and remains to be IP space. A security inventory should monitor every resource's address (that it is able to) on the network (i.e. anything within or on the network an attacker can access), what resources a service is running on, at the very minimum. During phase two cyber security personal should also consider enumerating roles to make searching easier; identifying VPNs, NATs, DHCP, and proxies; keep centrality or volume metrics (e.g. monthly ephemeral summaries); per-host white lists; and monitoring the versions of all services on a particular resource. Ask what addresses make up the network?...
Read more

W1-2/3 Prioritization (6/27)

   On Wednesday we covered prioritization. What is the most important thing to respond to first? How do we determine what is and what isn't more important? How do we assess the risk being taken? How much risk is too much risk? While some matters may be more general, a lot of prioritization will be based upon what the establishment is doing, who would target them, what resources does the establishment have for defense, etc. The effectiveness of cyber response teams is determined by how appropriate the prioritization of incidents is. Randomly responding and less formalized response protocols/orders (e.g. stacks/LIFO or queues/FIFO) will hinder the potential security capabilities of an establishment. One cannot prioritize for random or abstract orders and expect any type of long-term success. It is best to make decision making and risk taking as formalized as possible. What you do is just as important as what you do first. Basically, some things are more important to attend to ri...
Read more