Insecure Direct Object Reference Prevention Progressive Enhancements and Graceful Degradation RisksĪuthentication and Input/Output validationĪuthorization and access token explicit invalidation To keep client open client will send a packed with one byte of data to the server and not increment the TCP sequence number.Credential and Personally Identifiable Information (PII) Input hints TCP keep alive - used on very long lived connections. !(_alive “Replace with Double PIPE” _alive_ack) SMB - Closing a File (Close AndX Request/Response) SMB - Unlocking a File (Locking AndX Request/Response) SMB - Reading from a File (Read AndX Request/Response) SMB - Locking a File for Access (Locking AndX Request/Response) SMB - Opening a File (NT Create AndX Request/Response) SMB - Obtain Directory/File Metadata (Trans2 Request/Response) SMB - Accessing Services (Tree Connect AndX Request/Response) SMB - Session Establishment (Setup AndX Request/Response) Rule out the IP and show just requests to other hosts

Convert a field value to lowercase before eval Http and lower(okie) contains “username”’Ĭase-insensitive. Match traffic that contains the string ‘username’ in the cookie value (case-sensitive manner) ‘ = 1 and > 5 and contains “cz.cc”’ĭNS replies containing more than 5 responses for a query against a known hostile domain HTTP traffic on a nonstandard port that contains the word “stolen” (not tcp.port = 80 and not tcp.port = 8080) and http contains “stolen”’ This was my Wireshark Filter Cheatsheet for GNFA when I certified in May of 2019.

Wireshark filters cheat sheet for http