DokuWiki

It's better when it's simple

User Tools

Site Tools

Trace:
namespaces

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision		Previous revision
Next revisionBoth sides next revision
namespaces [2017-10-16 22:11] – Revert edits by 82.77.133.61 90.96.166.87namespaces [2024-04-14 20:09] – 105.112.17.95
Line 1: Line 1:
-====== Namespaces ======+====== Malware Analysis Methodologies ======
  
-A namespace is similar to a directory or folder, while pages are similar to files. 
-In [[DokuWiki]]  you can use namespaces to categorize your pages. For names of namespaces the same restrictions hold as for [[pagename|pagenames]]. 
-  
-A default DokuWiki installation comes with the built-in namespaces: //wiki// and //playground//. This is a [[logs:website|Test]] 
  
-===== Creating Namespaces ===== 
  
-You don't need to create namespaces separately; simply create pages with colons in the [[pagename]].  +==== Introduction ====
-The token after the last colon will be the name of the page itself, while all other tokens are namespaces.  +
-All namespaces used in your pagename that don't exist already will be created by DokuWiki automatically.+
  
-A namespace can be created in the media manager after having selected a file on the local computer and adding a ''name:'' (of namespace wanted) just before the media file name and then clicking  ''upload''. This will create on the fly the namespace (folder) for the file media, visible after a refresh of the windows. +Malware analysis methodologies involve systematic approaches to understanding the behavior, purpose, and impact of malicious software (malware), like viruses, worms, Trojans, and ransomware. It is like dissecting malware samples to reveal their inner workings and uncovering their intended targets and actions. Here’s an outline of a typical methodology, which is often refined and adapted based on the specific goals of the analysis and the type of malware being examined;
  
-In DokuWiki pages are created as in every other wiki. Simply create a link to a non existing page, follow this link, and click on Create this page. See also [[.:page#create_a_page|Adding pages]].+1. **Preparation**; 
 +   - **Define Objectives**: We need to determine the goals of the analysis, such as identifying the malware's functionality, origins, propagation methods, or potential countermeasures.\\ 
 +   - **Establish Environment**: We need to set up a controlled and isolated environment for analysis, such as a virtual machine or a dedicated sandbox, to prevent the malware from affecting our production systems.
  
-^  Examples:  ^^ +2. **Static Analysis**: 
-|example\\ .example\\ .:example|refers to the page "example" in the **current** namespace.| +   - **File Identification**: We have to identify the malware file(s) under investigation, which could be an executable, document, script, or other forms of malicious code.\\ 
-|:example|refers to the page "example" in the **root** namespace.| +   - **File Metadata**: We then need to extract metadata such as file size, creation/modification timestamps, digital signatures, and embedded resources to gather initial insights.\\ 
-|..example\\ ..:example\\ .:..:example|refers to the page "example" in the **parent** namespace| +   - **Hashing and Signature Matching**: We generate file hashes next and compare them against known malware signatures to determine if the file is already documented as malicious.\\ 
-|wiki:example|refers to the page "example" in the namespace "wiki". The namespace "wiki" is located **beneath the root** namespace.| +   - **File Structure Analysis**: After that, we examine the structure of the file, including headers, sections, and embedded components, to understand its internal organization.\\ 
-|ns1:ns2:example\\ :ns1:ns2:example|refers to the page "example" in the namespace ns2. The namespace ns2 is located beneath the namespace ns1; the namespace ns1 is located **beneath the root** namespace.| +   - **String Analysis**: We then extract and analyze strings within the file, including plaintext strings, encoded/encrypted data, URLs, and API function calls, for potential indicators of malicious behavior.\\ 
-|.ns1:ns2:example\\ .:ns1:ns2:example|refers to the page "example" in the namespace ns2. The namespace ns2 is located beneath the namespace ns1; the namespace ns1 is located **beneath the current** namespace.| +   - **Code Disassembly/Decompilation**: Lastly, we disassemble or decompile the executable code to analyze the assembly language or high-level code, respectively, for suspicious or malicious instructions.
-|..ns1:ns2:example\\ ..:ns1:ns2:example|refers to the page "example" in the namespace ns2. The namespace ns2 is located beneath the namespace ns1; the namespace ns1 is located **beside the current** namespace (i.e. both ns1 and the current namespace are beneath the same parent namespace, wherever according to the root namespace this parent may be located itself).| +
-|.ns1:ns2:\\ .:ns1:ns2:|refers to the page "start" in the namespace ns2. The namespace ns2 is located beneath the namespace ns1; the namespace ns1 is located beneath the current namespace.\\ \\ (The default page can be named something other than "start" by adjusting the [[config:startpage]] configuration setting.)| +
  
-:!: Gotcha: The syntax for relative and absolute internal links is non-unique and complex relative to directory and filename conventions.+3. **Dynamic Analysis**: 
 +   - **Execution Environment Setup**: We have to execute the malware sample in a controlled environment while monitoring its behavior to capture runtime activities without affecting the host system. 
 +   - **Behavioral Monitoring**: Then we observe and record the malware's actions during execution, such as file system changes, network communications, process interactions, registry modifications, and system calls. 
 +   - **Network Traffic Analysis**: We capture and analyze network traffic generated by the malware to identify communication protocols, command-and-control (C2) servers, data exfiltration, or other network-based behaviors. 
 +   - **Memory Analysis**: We need to analyze the malware's runtime memory usage, including loaded modules, API calls, data structures, and potential injection techniques, using tools like memory forensics frameworks. 
 +   - **Malware Interaction**: We have to interact with the malware dynamically, such as providing simulated inputs or observing responses to specific stimuli, to trigger different behaviors or stages of operation.
  
-Paths are absolute if and only if they begin with "/".+4. **Code Analysis**: 
 +   - **Reverse Engineering**: We need to perform in-depth reverse engineering of the malware's code to understand its algorithms, encryption schemes, obfuscation techniques, and anti-analysis mechanisms. 
 +   - **Functionality Mapping**: We have to identify and map the malware's functionality, such as keylogging, data theft, privilege escalation, or persistence mechanisms, by analyzing code segments and control flow. 
 +   - **Code Logic Reconstruction**: We will then reconstruct higher-level logic and operational flows from the disassembled/decompiled code to comprehend the malware's operational patterns and decision-making processes.
  
-Links are absolute if and only if they have a ":" prefix or have no prefix but do have intermediate (or suffix) ":" +5. **Reporting and Documentation**: 
- +   - **Analysis Report**: We will compile a detailed report summarizing the findings from static and dynamic analysis, including malware characteristics, behavior patterns, IOCs (Indicators of Compromise), potential impact assessments, and recommended mitigation strategies. 
-Links relative to the current namespace may also begin with either "." or ".:" (".." or "..:" for parent namespace). +   - **Forensic Artifacts**: We then document and preserve forensic artifacts, such as captured network traffic, memory dumps, registry snapshots, and file system changes, for future reference, research, or legal purposes. 
- +   - **Collaboration and Sharing**: Lastly will share analysis results, IOCs, and relevant information with cybersecurity communities, threat intelligence platforms, or law enforcement agencies to contribute to collective defense efforts and improve cybersecurity awareness.
-===== Deleting namespaces ===== +
- +
-When all pages inside a namespace are removed (see [[page#delete_a_page|delete a page]]) the namespace logically doesn’t exist anymore. DokuWiki usually deletes the now empty directory as well. +
- +
-===== How  to rename namespaces? ===== +
- +
-==== Manual way ==== +
- +
-In order to rename a namespace manually you will have to: +
-  * Rename the folders that represent the namespace in: +
-    * ''data/pages'' +
-    * ''data/media'' (if this exists) +
-  * Remove metadata for the namespace under ''data/meta'' +
-  * Remove attic data for the namespace under ''data/attic'' (or move that over as well, if you want to preserve old versions) +
-   +
-For example, on a Unix host, you could: +
-  * ''mv /dokuwiki_base/data/pages/old_namespace /dokuwiki_base/data/pages/new_namespace'' +
-  * ''mv /dokuwiki_base/data/media/old_namespace /dokuwiki_base/data/media/new_namespace'' +
-  * ''rm -Rf /dokuwiki_base/data/meta/old_namespace'' +
-  * move: ''mv /dokuwiki_base/data/attic/old_namespace /dokuwiki_base/data/attic/new_namespace'' \\ or remove: ''rm -Rf /dokuwiki_base/data/attic/old_namespace''  +
-Note that the ''old_namespace'' and/or ''new_namespace'' words may need to be encoded if they are on a non-Latin character set (i.e. Greek, Russian, etc). +
- +
-  * Correct (by editing them) all the links to the pages under the //moved// namespace (you can discover those before moving the namespace by reviewing each page's [[backlinks]]). +
- +
-  * Browse each and every page under the new namespace. This will create the missing indexing information and metadata for the pages under the moved namespace. +
- +
-However, you will still have lots of junk left around. For example in ''data/changes.log'', various files under cache (including the ''.idx'' files etc). If possible you could just start from a ''blank state'' as follows (again under Unix) but be warned that this will mean losing all your historical information (i.e. ''recent changes''): +
- +
-  * ''cat /dev/null > /dokuwiki_base/data/changes.log'' +
-  * ''rm -Rf /dokuwiki_base/data/attic/*'' +
-  * ''rm -Rf /dokuwiki_base/data/cache/?'' +
-  * ''rm -Rf /dokuwiki_base/data/cache/*.idx'' +
-  * ''rm -Rf /dokuwiki_base/data/cache/purgefile'' +
-  * Browse each and every page of your Wiki. +
- +
-DISCLAIMER: I understand this is convoluted (and maybe I missed/messed a couple of things you should also do). All in all this is a PITA. You may also use a couple of [[plugins]] that are available for (re)building the searchindex for the complete wiki, erasing entire cache and/or old wiki revisions thus avoiding having to do this manually. +
- +
-===== Namespace Default Linking ===== +
- +
-It is possible to link to the default file of a namespace by ending the linkid +
-with a colon: %%[[foo:bar:]]%%. Which page the link links to is dependent on the +
-existence of certain named files. For %%[[foo:bar:]]%% the following pages are +
-checked: +
- +
-<code> +
-foo:bar:$conf['start'] +
-foo:bar:bar +
-foo:bar +
-</code> +
- +
-The pages are checked in that order and whatever page is found first will be linked to. [[config:autoplural|Autoplural]] linking is not done for those links. +
- +
-DokuWiki supports [[doku>Interwiki]] links. These are quick links to other Wikis. +
-For example this is a link to Wikipedia's page about Wikis: [[wp>Wiki]].+
namespaces.txt · Last modified: 2024-04-18 14:58 by 136.226.109.24
Except where otherwise noted, content on this wiki is licensed under the following license: CC Attribution-Share Alike 4.0 International
CC Attribution-Share Alike 4.0 International Donate Powered by PHP Valid HTML5 Valid CSS Driven by DokuWiki

Global DokuWiki Links