Forensics Wiki - Changes related to "Category:Tools" [en]

Gurls

2013-05-20T19:47:08Z

Gurls

2013-05-20T14:35:04Z

Tcpflow

2013-05-20T14:21:59Z

‎Overview:

Gurls

2013-05-19T21:15:06Z

Gurls

2013-05-19T20:43:10Z

New page

Gruls is a bash script and is short for grep urls.

#!/bin/bash
protocol="(ftp|http|https|gopher|mailto|pop|smtp|news|nntp|telnet|whois|file|imap|prospero|peercast|ed2k|irc|aim|mime|ftam|pnm|rtsp|ldap)"
ip="([1-9][0-9]?|1[0-9]{2}|2[0-4][0-9]|25[0-4])\.((0|[1-9][0-9]?|1[0-9]{2}|2[0-4][0-9]|25[0-4])\.){2}([1-9][0-9]?|1[0-9]{2}|2[0-4][0-9]|25[0-4])"
fqdn="(\w(-?\w+)*\.)+[a-z]{2,}"
host="(${ip}|${fqdn})"
port="(:[0-9]+)?"
urlregexp="${protocol}://${host}${port}/?"

(
if [ "$1" ]
then
while [ "$1" ]
do
egrep -o "$urlregexp" "$1"
shift
done
else
egrep -o "$urlregexp" /dev/stdin
fi
) | sed 's;/$;;g'

@@ Line 3: / Line 3: @@
   #!/bin/bash
   protocol="(ftp|http|https|gopher|mailto|pop|smtp|news|nntp|telnet|whois|file|imap|prospero|peercast|ed2k|irc|aim|mime|ftam|pnm|rtsp|ldap)"
-  ip="([1-9][0-9]?|1[0-9]{2}|2[0-4][0-9]|25[0-4])\.((0|[1-9][0-9]?|1[0-9]{2}|2[0-4][0-9]|25[0-4])\.){2}([1-9][0-9]?|1[0-9]{2}|2[0-4][0-9]|25[0-4])"
+  ip4="([1-9][0-9]?|1[0-9]{2}|2[0-4][0-9]|25[0-4])\.((0|[1-9][0-9]?|1[0-9]{2}|2[0-4][0-9]|25[0-4])\.){2}([1-9][0-9]?|1[0-9]{2}|2[0-4][0-9]|25[0-4])"
   fqdn="(\w(-?\w+)*\.)+[a-z]{2,}"
-  host="(${ip}|${fqdn})"
+  host="(${ip4}|${fqdn})"
   port="(:[0-9]+)?"
   urlregexp="${protocol}://${host}${port}/?"
@@ Line 32: / Line 32: @@
   root@forensic# strings /dev/sdb1 | gurls > /tmp/urls
 ==See Also==
 * [[bulk_extractor]] provides similar functionality but on a much larger scale. Still, scripts like ''gurls'' are good for quickly searching through data.
-{{Linux}}

← Older revision		Revision as of 14:35, 20 May 2013
Line 32:		Line 32:

	root@forensic# strings /dev/sdb1 \| gurls > /tmp/urls		root@forensic# strings /dev/sdb1 \| gurls > /tmp/urls
		+
		+	==See Also==
		+	* [[bulk_extractor]] provides similar functionality but on a much larger scale. Still, scripts like ''gurls'' are good for quickly searching through data.

	{{Linux}}		{{Linux}}

@@ Line 10: / Line 10: @@
 '''tcpflow''' is a program that captures data transmitted as part of TCP connections (flows), and stores the data in a way that is convenient for protocol analysis and debugging. Each TCP flow is stored in its own file. Thus, the typical TCP flow will be stored in two files, one for each direction. tcpflow can also process stored ‘tcpdump’ packet flows.
-tcpflow is similar to ‘tcpdump’, in that both process packets from the wire or from a stored file. But it’s different in that it reconstructs the actual data streams and stores each flow in a separate file for later analysis.
+tcpflow is similar to ‘tcpdump’, in that both process packets from the wire or from a stored file. It's also similar to WireShark, in that both allow analysis of network traffic. But unlike either tcpdump or WireShark, tcpflow reconstructs thousands (or millions) of TCP connections at a time and saves the results in ordinary files, making it easy to analyze the data with conventional tools.
 tcpflow understands sequence numbers and will correctly reconstruct data streams regardless of retransmissions or out-of-order delivery.
 Jeremy Elson developed the first version of tcpflow in 1999 but stopped maintaining it in 2003. In 2006 Simson Garfinkel took over maintenance of the program and added:
@@ Line 25: / Line 43: @@
 tcpflow is based on the LBL Packet Capture Library (available from LBL) and therefore supports the same rich filtering expressions that programs like ‘tcpdump’ support. It should compile under most popular versions of UNIX; see the INSTALL file for details.
 == Distributions==

@@ Line 1: / Line 1: @@
-Gruls is a bash script and is short for grep urls.
+Gruls is a bash script and is short for grep urls :
   #!/bin/bash
@@ Line 21: / Line 21: @@
   fi
   ) | sed 's;/$;;g'