Int 3: Deep Packet Inspection - Menganalisis Protokol Layer Aplikasi

cd ~ && mkdir forensics-int3 && cd forensics-int3

# 1. HTTP Analysis - cari data sensitif
python3 << 'PYEOF'
print("=== HTTP Data Exfiltration Detection ===")
http_samples = [
    ("POST /upload.php HTTP/1.1", "Host: attacker.com", "creditcard=4111222233334444&cvv=123"),
    ("GET /index.html HTTP/1.1", "Host: google.com", ""),
    ("POST /api/login HTTP/1.1", "Host: bank.com", "user=admin&password=trustno1"),
    ("GET /secret/keys.txt HTTP/1.1", "Host: internal-server.local", ""),
]

for req, host, body in http_samples:
    suspicious = False
    if any(k in body for k in ['creditcard', 'password', 'secret']):
        suspicious = True
    if 'internal-server' in host or 'attacker' in host:
        suspicious = True
    print(f"  {'🚩' if suspicious else '✅'} {req[:40]:40} | {host:30} | {body[:30]}")
PYEOF

# 2. DNS Analysis - cari tunneling / C2
echo ""
echo "=== DNS Tunneling Detection ==*"
python3 << 'PYEOF'
dns_queries = [
    ("google.com", 50, "normal"),
    ("cdn.google.com", 100, "normal"),
    ("aklsjdflkasjdflkjasdlkfj.malware-c2.com", 1, "🚩 Subdomain sangat panjang - DNS tunneling!"),
    ("bca.co.id", 5, "normal"),
    ("xn--alskdjf8347hf.malware.com", 1, "🚩 Random subdomain - DGA (Domain Generation Algorithm)"),
    ("asdf1234.malware-c2.com", 1, "🚩 C2 domain pattern"),
]

print(f"{'Domain':<55} {'Count':<8} {'Keterangan'}")
print("-"*80)
for d, c, note in dns_queries:
    print(f"{d:<55} {c:<8} {note}")
PYEOF

# 3. FTP Analysis  
echo ""
echo "=== FTP Credential Capture ==="
echo "USER: attacker_user"
echo "PASS: P@s5w0rd123!"
echo "🚩 FTP mengirim kredensial dalam PLAINTEXT!"
echo ""

# 4. SMTP Analysis
echo "=== SMTP Email Content ==="
echo "MAIL FROM: <[email protected]>"
echo "RCPT TO: <[email protected]>"
echo "DATA: Klik link ini untuk verifikasi akun Anda: http://phishing-site.com"
echo "🚩 Email phishing terdeteksi dari konten SMTP!"