Memory Forensics with Volatility
forensics · medium · +45 XP
Target
GET /api/lab/volatility-101/pslist (process list from mock memdump)
GET /api/lab/volatility-101/cmdline?pid=... (command line of one process)
GET /api/lab/volatility-101/malfind?pid=... (hex of suspicious memory pages)
POST /api/lab/volatility-101/submit body {malicious_pid}
Goal: one process has a hollowed RWX page in its memory and a cmdline pointing to a temp dir. Find its PID and submit it. The flag is returned for the correct PID.
// AI hint · first is free · then 1 credit or 5 XP
// attack console
/api/lab/volatility-101/
// reuse on the cli
// submit flag
// no solves yet
// start of forensics
next
Write a YARA Rule
1 of 13 · forensics
// go deeper
- Practice this in a legal lab: Volatile Memory Acquisition
- Practice this in a legal lab: Detect DLL Injection in Memory
- Practice this in a legal lab: Write a YARA Rule
- Read the writeup: Memory Forensics Speed Run: Volatility 3 Triage in 10 Minutes
- Read the writeup: Memory Forensics Cheatsheet: Volatility 3 Rapid Triage