What
is this?
Imagine this: You come across some mysterious text 0x52908400098527886E0F7030069857D2E4169EE7
or dQw4w9WgXcQ
and you wonder what it is. What do you do?
Well, with what
all you have to do is ask what "0x52908400098527886E0F7030069857D2E4169EE7"
and what
will tell you!
what
's job is to identify what something is. Whether it be a file or text! Or even the hex of a file! What about text within files? We have that too! what
is recursive, it will identify everything in text and more!
Use Cases
Wannacry
You come across a new piece of malware called WantToCry. You think back to Wannacry and remember it was stopped because a researcher found a kill-switch in the code.
When a domain, hardcoded into Wannacry, was registered the virus would stop.
You use What
to identify all the domains in the malware, and use a domain registrar API to register all the domains.
Faster Analysis of Pcap files
Say you have a .pcap
file from a network attack. What
can identify this and quickly find you:
- All URLs
Author
- BlogMay 2, 2022Lupo - Malware IOC Extractor and Debugging module for Malware Analysis Automation
- BlogMay 2, 2022DDexec - a technique to run binaries filelessly and stealthily on Linux using dd to replace the shell with another process
- BlogApril 28, 2022ADReaper - A fast enumeration tool for Windows Active Directory Pentesting written in Go
- BlogApril 27, 2022Shhhloader - SysWhispers Shellcode Loader