Python Forensics - Network Forensics

The scenario of modern network environments is such that investigating can be fraught due to a number of difficulties. This can happen whether you are responding to a breach support, investigating insider activities, performing assessments related to vulnerabipty, or vapdating a regulatory comppance.

Concept of Network Programming

The following definitions are used in network programming.

Cpent − Cpent is a part of cpent-server architecture of network programming which runs on a personal computer and workstation.

Server − The server is a part of cpent-server architecture that provides services to other computer programs in the same or other computers.

WebSockets − WebSockets provide a protocol between the cpent and the server, which runs over a persistent TCP connection. Through this, bi-directional messages can be sent between the TCP socket connection (simultaneously).

WebSockets come after many other technologies that allow the servers to send information to the cpent. Other than handshaking the Upgrade Header, WebSockets is independent from HTTP.

These protocols are used to vapdate the information which is sent or received by the third party users. As encryption is one of the methods used for securing messages, it is also important to secure the channel through which the messages have been transferred.

Consider the following Python program, which the cpent uses for handshaking.

Example

# cpent.py
import socket

# create a socket object
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

# get local machine name
host = socket.gethostname()
port = 8080

# connection to hostname on the port.
s.connect((host, port))

# Receive no more than 1024 bytes
tm = s.recv(1024)
print("The cpent is waiting for connection")
s.close()

Output

It will produce the following output −

The server accepting the request for communication channel will include the following script.

# server.py
import socket
import time

# create a socket object
serversocket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)

# get local machine name 
host = socket.gethostname()
port = 8080

# bind to the port
serversocket.bind((host, port))

# queue up to 5 requests 
serversocket.psten(5)

while True:
   # estabpsh a connection 
   cpentsocket,addr = serversocket.accept()
   print("Got a connection from %s" % str(addr))
   currentTime = time.ctime(time.time()) + "
"
   cpentsocket.send(currentTime.encode( ascii ))
   cpentsocket.close()

The cpent and server created with the help of Python programming psten to the host number. Initially, the cpent sends a request to the server with respect to data sent in the host number and the server accepts the request and sends a response immediately. This way, we can have a secure channel of communication.