diff --git a/README.md b/README.md index ffcc69a..e1b90fe 100644 --- a/README.md +++ b/README.md @@ -14,9 +14,9 @@ ![](images_for_README/main_demo.gif) -Imagine this: You come across some mysterious text ๐งโโ๏ธ `5f4dcc3b5aa765d61d8327deb882cf99` and you wonder what it is. What do you do? +Imagine this: You come across some mysterious text ๐งโโ๏ธ `0x52908400098527886E0F7030069857D2E4169EE7` or `dQw4w9WgXcQ` and you wonder what it is. What do you do? -Well, with `what` all you have to do is ask `what "5f4dcc3b5aa765d61d8327deb882cf99"` and `what` will tell you! +Well, with `what` all you have to do is ask `what "0x52908400098527886E0F7030069857D2E4169EE7"` and `what` will tell you! `what`'s job is to **identify _what_ something is.** Whether it be a file or text! Or even the hex of a file! What about text _within_ files? We have that too! `what` is recursive, it will identify **everything** in text and more! @@ -24,13 +24,13 @@ Well, with `what` all you have to do is ask `what "5f4dcc3b5aa765d61d8327deb882c ## ๐ฆ Wannacry -![](images_for_README/Screenshot%202021-05-09%20162158.png) +![](images_for_README/wantocry_demo.png) You come across a new piece of malware called WantToCry. You think back to Wannacry and remember it was stopped because a researcher found a kill-switch in the code. When a domain, hardcoded into Wannacry, was registered the virus would stop. -You use `What` to identify all the domains in the malware, and use a domain registrar API to register all the domains. If Wannacry happens again, you can stop it in minutes - not weeks. +You use `What` to identify all the domains in the malware, and use a domain registrar API to register all the domains. ## ๐ฆ Faster Analysis of Pcap files @@ -38,7 +38,9 @@ You use `What` to identify all the domains in the malware, and use a domain regi Say you have a `.pcap` file from a network attack. `What` can identify this and quickly find you: -- All hashes +- All URLs +- Emails +- Phone numbers - Credit card numbers - Cryptocurrency addresses - Social Security Numbers diff --git a/images_for_README/Screenshot 2021-05-09 162158.png b/images_for_README/Screenshot 2021-05-09 162158.png deleted file mode 100644 index 72d4373..0000000 Binary files a/images_for_README/Screenshot 2021-05-09 162158.png and /dev/null differ diff --git a/images_for_README/demo.cast b/images_for_README/demo.cast deleted file mode 100644 index 9340955..0000000 --- a/images_for_README/demo.cast +++ /dev/null @@ -1,21 +0,0 @@ -{"version": 2, "width": 120, "height": 30, "timestamp": 1620569822, "env": {"SHELL": "/usr/bin/zsh", "TERM": "xterm-256color"}} -[0.100362, "o", "\u001b[1m\u001b[7m%\u001b[27m\u001b[1m\u001b[0m \r \r\u001b]2;bee@DESKTOP-K6QO13M:/mnt/c/Users/brand/Documents/Projects/what\u0007"] -[0.101128, "o", "\u001b]1;..Projects/what\u0007"] -[0.281091, "o", "\r\u001b[0m\u001b[27m\u001b[24m\u001b[J\u001b[01;32mโ \u001b[36mwhat\u001b[00m \u001b[01;34mgit:(\u001b[31mmain\u001b[34m) \u001b[33mโ\u001b[00m \u001b[K"] -[0.281247, "o", "\u001b[?1h\u001b=\u001b[?2004h"] -[0.698987, "o", "\u001b[7mpython3 -m PyWhat \"0x52908400098527886E0F7030069857D2E4169EE730000000000004\"\u001b[27m"] -[1.016849, "o", "\u001b[76D\u001b[27mp\u001b[27my\u001b[27mt\u001b[27mh\u001b[27mo\u001b[27mn\u001b[27m3\u001b[27m \u001b[27m-\u001b[27mm\u001b[27m \u001b[27mP\u001b[27my\u001b[27mW\u001b[27mh\u001b[27ma\u001b[27mt\u001b[27m \u001b[27m\"\u001b[27m0\u001b[27mx\u001b[27m5\u001b[27m2\u001b[27m9\u001b[27m0\u001b[27m8\u001b[27m4\u001b[27m0\u001b[27m0\u001b[27m0\u001b[27m9\u001b[27m8\u001b[27m5\u001b[27m2\u001b[27m7\u001b[27m8\u001b[27m8\u001b[27m6\u001b[27mE\u001b[27m0\u001b[27mF\u001b[27m7\u001b[27m0\u001b[27m3\u001b[27m0\u001b[27m0\u001b[27m6\u001b[27m9\u001b[27m8\u001b[27m5\u001b[27m7\u001b[27mD\u001b[27m2\u001b[27mE\u001b[27m4\u001b[27m1\u001b[27m6\u001b[27m9\u001b[27mE\u001b[27mE\u001b[27m7\u001b[27m3\u001b[27m0\u001b[27m0\u001b[27m0\u001b[27m0\u001b[27m0\u001b[27m0\u001b[27m0\u001b[27m0\u001b[27m0\u001b[27m0\u001b[27m0\u001b[27m0\u001b[27m4\u001b[27m\""] -[1.017045, "o", "\u001b[?1l\u001b>\u001b[?2004l\r\r\n"] -[1.017242, "o", "\u001b]2;python3 -m PyWhat \"0x52908400098527886E0F7030069857D2E4169EE730000000000004\"\u0007\u001b]1;python3\u0007"] -[1.441147, "o", "\u001b[1;38;5;183mPossible language (ISO-639-1 code):\u001b[0m \u001b[31mca\u001b[0m 86% probability \u001b[31mso\u001b[0m 14% probability.\r\n\r\n"] -[1.445585, "o", "\r\n\u001b[1;38;5;183mPossible Identification\u001b[0m\r\nโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโณโโโโโโโโโโโโโโโโโโโณโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ\r\nโ\u001b[1;38;5;183m \u001b[0m\u001b[1;38;5;183mMatched Text \u001b[0m\u001b[1;38;5;183m \u001b[0mโ\u001b[1;38;5;183m \u001b[0m\u001b[1;38;5;183mIdentified as \u001b[0m\u001b[1;38;5;183m \u001b[0mโ\u001b[1;38;5;183m \u001b[0m\u001b[1;38;5;183mDescription \u001b[0m\u001b[1;38;5;183m \u001b[0mโ\r\nโกโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ"] -[1.445809, "o", "โโโโโโโโโฉ\r\nโ 0x52908400098527886E0F7030069857D2E4169EE7 โ Ethereum Wallet โ Click here to analyse in the browser โ\r\nโ โ โ https://etherscan.io/address/0x52908400098527886E0Fโฆ โ\r\nโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโค\r\nโ 30000000000004 โ Diners Club Card โ Credit Card Number โ\r\nโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโ"] -[1.44599, "o", "โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโค\r\nโ 5290840009852788 โ MasterCard โ Payment Issuer for Bank Cards โ\r\nโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโค\r\nโ 0x529084000 โ YouTube Video ID โ Click here to analyse in the browser โ\r\nโ โ โ https://www.youtube.com/watch?v=0x529084000 โ\r\nโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโผโโโโโ"] -[1.446143, "o", "โโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโค\r\nโ 527886E0F70 โ YouTube Video ID โ Click here to analyse in the browser โ\r\nโ โ โ https://www.youtube.com/watch?v=527886E0F70 โ\r\nโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโค\r\nโ 30069857D2E โ YouTube Video ID โ Click here to analyse in the browser โ\r\nโ โ "] -[1.446269, "o", " โ https://www.youtube.com/watch?v=30069857D2E โ\r\nโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโค\r\nโ 4169EE73000 โ YouTube Video ID โ Click here to analyse in the browser โ\r\nโ โ โ https://www.youtube.com/watch?v=4169EE73000 โ\r\nโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโดโโโโโโโโโโโโโโโโโโโดโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ"] -[1.446403, "o", "โโโโโโโโโ\r\n"] -[1.53822, "o", "\u001b[1m\u001b[7m%\u001b[27m\u001b[1m\u001b[0m \r \r"] -[1.538435, "o", "\u001b]2;bee@DESKTOP-K6QO13M:/mnt/c/Users/brand/Documents/Projects/what\u0007\u001b]1;..Projects/what\u0007"] -[1.721396, "o", "\r\u001b[0m\u001b[27m\u001b[24m\u001b[J\u001b[01;32mโ \u001b[36mwhat\u001b[00m \u001b[01;34mgit:(\u001b[31mmain\u001b[34m) \u001b[33mโ\u001b[00m \u001b[K"] -[1.721539, "o", "\u001b[?1h\u001b=\u001b[?2004h"] -[6.896348, "o", "\u001b[?2004l\r\r\n"] diff --git a/images_for_README/main_demo.gif b/images_for_README/main_demo.gif index 6d46e16..a8c5359 100644 Binary files a/images_for_README/main_demo.gif and b/images_for_README/main_demo.gif differ diff --git a/images_for_README/pcap.demo b/images_for_README/pcap.demo deleted file mode 100644 index 6a77212..0000000 --- a/images_for_README/pcap.demo +++ /dev/null @@ -1,34 +0,0 @@ -{"version": 2, "width": 270, "height": 69, "timestamp": 1620560298, "env": {"SHELL": "/usr/bin/zsh", "TERM": "xterm-256color"}} -[0.114175, "o", "\u001b[1m\u001b[7m%\u001b[27m\u001b[1m\u001b[0m \r \r"] -[0.11521, "o", "\u001b]2;bee@DESKTOP-K6QO13M:/mnt/c/Users/brand/Documents/Projects/what\u0007\u001b]1;..Projects/what\u0007"] -[0.341134, "o", "\r\u001b[0m\u001b[27m\u001b[24m\u001b[J\u001b[01;32mโ \u001b[36mwhat\u001b[00m \u001b[01;34mgit:(\u001b[31mmain\u001b[34m) \u001b[33mโ\u001b[00m \u001b[K"] -[0.341386, "o", "\u001b[?1h\u001b=\u001b[?2004h"] -[0.810533, "o", "\u001b[7mpython3 -m PyWhat fixtures/FollowTheLeader.pcap\u001b[27m"] -[1.499535, "o", "\u001b[47D\u001b[27mp\u001b[27my\u001b[27mt\u001b[27mh\u001b[27mo\u001b[27mn\u001b[27m3\u001b[27m \u001b[27m-\u001b[27mm\u001b[27m \u001b[27mP\u001b[27my\u001b[27mW\u001b[27mh\u001b[27ma\u001b[27mt\u001b[27m \u001b[27mf\u001b[27mi\u001b[27mx\u001b[27mt\u001b[27mu\u001b[27mr\u001b[27me\u001b[27ms\u001b[27m/\u001b[27mF\u001b[27mo\u001b[27ml\u001b[27ml\u001b[27mo\u001b[27mw\u001b[27mT\u001b[27mh\u001b[27me\u001b[27mL\u001b[27me\u001b[27ma\u001b[27md\u001b[27me\u001b[27mr\u001b[27m.\u001b[27mp\u001b[27mc\u001b[27ma\u001b[27mp"] -[1.49968, "o", "\u001b[?1l\u001b>"] -[1.49988, "o", "\u001b[?2004l\r\r\n"] -[1.500076, "o", "\u001b]2;python3 -m PyWhat fixtures/FollowTheLeader.pcap\u0007\u001b]1;python3\u0007"] -[2.013793, "o", "\u001b[1;38;5;183mPossible language (ISO-639-1 code):\u001b[0m \u001b[31men\u001b[0m 100% probability.\r\n\r\n"] -[2.026831, "o", "\r\n\u001b[1;38;5;183mPossible Identification\u001b[0m\r\nโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโณโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโณโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ\r\nโ\u001b[1;38;5;183m \u001b[0m\u001b[1;38;5;183mMatched Text \u001b[0m\u001b[1;38;5;183m \u001b[0mโ\u001b[1;38;5;183m \u001b[0m\u001b[1;38;5;183mIdentified as \u001b[0m\u001b[1;38;5;183m \u001b[0mโ\u001b[1;38;5;183m \u001b[0m\u001b[1;38;5;183mDescription \u001b[0m\u001b[1;38;5;183m \u001b[0mโ\r\nโกโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ"] -[2.027106, "o", "โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโฉ\r\nโ ctfa{terrific_traffic} โ CTF Flag โ General Capture The Flag Event's Flag โ\r\nโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโค\r\nโ Accept-Lang โ YouTube Video ID โ Click here to analyse in the browser https://www.youtube.com/watch?v=Accept-Lang โ\r\nโ"] -[2.027279, "o", "โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโค\r\nโ Accept-Enco โ YouTube Video ID โ Click here to analyse in the browser https://www.youtube.com/watch?v=Accept-Enco โ\r\nโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ"] -[2.027429, "o", "โโโโโโโโโโโโโโค\r\nโ Upgrade-Ins โ YouTube Video ID โ Click here to analyse in the browser https://www.youtube.com/watch?v=Upgrade-Ins โ\r\nโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโค\r\nโ cure-Reques โ YouTube Video ID โ Click here to analyse in the browser https://www.youtube.com/watch?v=cure-Reques โ\r\nโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ"] -[2.027637, "o", "โผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโค\r\nโ ache-Contro โ YouTube Video ID โ Click here to analyse in the browser https://www.youtube.com/watch?v=ache-Contro โ\r\nโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโค\r\nโ ontent-Leng โ YouTube Video ID โ Click here to analyse in the browser https://www.youtube.com/watch?v=ontent-Leng "] -[2.027816, "o", "โ\r\nโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโค\r\nโ fic_traffic โ YouTube Video ID โ Click here to analyse in the browser https://www.youtube.com/watch?v=fic_traffic โ\r\nโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ"] -[2.027945, "o", "โโโโโโโโโโโโโโโโโค\r\nโ 10.0.2.5 โ Internet Protocol (IP) Address โ Universal address pointing to an entity on the web. โ\r\nโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโค\r\nโ Host: 10 โ Key:Value โ Typically username:password or key:value โ\r\nโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ"] -[2.028055, "o", "โโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโค\r\nโ User-Agent: Mozilla โ Key:Value โ Typically username:password or key:value โ\r\nโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโค\r\nโ /5.0 (X11; Linux x86_64; rv:60 โ Key:Value โ Typically username:password or key:value "] -[2.028195, "o", " โ\r\nโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโค\r\nโ Accept: text โ Key:Value โ Typically username:password or key:value โ\r\nโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ"] -[2.028359, "o", "โโโโโโโโโโโโโโโโโโโโค\r\nโ Accept-Language: en-US โ Key:Value โ Typically username:password or key:value โ\r\nโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโค"] -[2.02847, "o", "\r\nโ Accept-Encoding: gzip โ Key:Value โ Typically username:password or key:value โ\r\nโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโค\r\nโ Connection: keep-alive โ Key:Value โ Typically username:password or key:value โ\r\nโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโ"] -[2.028626, "o", "โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโค\r\nโ Upgrade-Insecure-Requests: 1 โ Key:Value โ Typically username:password or key:value โ\r\nโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโค\r\nโ Pragma: no-cache โ Key:Value โ Typically username:password or key:value โ\r\nโโโโโโโโโโโโ"] -[2.028755, "o", "โโโโโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโค\r\nโ Cache-Control: no-cache โ Key:Value โ Typically username:password or key:value โ\r\nโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ"] -[2.029291, "o", "โโโค\r\nโ Server: SimpleHTTP โ Key:Value โ Typically username:password or key:value โ\r\nโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโค\r\nโ Date: Sun, 14 Jul 2019 02:42:13 โ Key:Value โ Typically username:password or key:value โ\r\nโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโ"] -[2.029535, "o", "โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโค\r\nโ Content-type: text โ Key:Value โ Typically username:password or key:value โ\r\nโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโค\r\nโ Content-Length: 105 โ Key:Value โ Typically username:password or key:value โ\r\nโโโโโโโโโ"] -[2.029599, "o", "โโโโโโโโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโค\r\nโ Last-Modified: Sun โ Key:Value โ Typically username:password or key:value โ\r\nโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ"] -[2.029663, "o", "โโโโโโค\r\nโ , 14 Jul 2019 02:41:10 โ Key:Value โ Typically username:password or key:value โ\r\nโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโค\r\nโ
Here is your flag: ctfa โ Key:Value โ Typically username:password or key:value โ\r\nโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโดโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโดโโโโโโโโ"] -[2.029777, "o", "โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ\r\n"] -[2.141197, "o", "\u001b[1m\u001b[7m%\u001b[27m\u001b[1m\u001b[0m \r \r\u001b]2;bee@DESKTOP-K6QO13M:/mnt/c/Users/brand/Documents/Projects/what\u0007"] -[2.141434, "o", "\u001b]1;..Projects/what\u0007"] -[2.358181, "o", "\r\u001b[0m\u001b[27m\u001b[24m\u001b[J\u001b[01;32mโ \u001b[36mwhat\u001b[00m \u001b[01;34mgit:(\u001b[31mmain\u001b[34m) \u001b[33mโ\u001b[00m \u001b[K"] -[2.358368, "o", "\u001b[?1h\u001b=\u001b[?2004h"] -[13.3214, "o", "\u001b[?2004l\r\r\n"] diff --git a/images_for_README/pcap_demo.gif b/images_for_README/pcap_demo.gif index 0463e08..df9793f 100644 Binary files a/images_for_README/pcap_demo.gif and b/images_for_README/pcap_demo.gif differ diff --git a/images_for_README/wantocry_demo.png b/images_for_README/wantocry_demo.png new file mode 100644 index 0000000..29eb6ef Binary files /dev/null and b/images_for_README/wantocry_demo.png differ diff --git a/images_for_README/wireshark.cast b/images_for_README/wireshark.cast deleted file mode 100644 index 020bb81..0000000 --- a/images_for_README/wireshark.cast +++ /dev/null @@ -1,21 +0,0 @@ -{"version": 2, "width": 120, "height": 35, "timestamp": 1620570076, "env": {"SHELL": "/usr/bin/zsh", "TERM": "xterm-256color"}} -[0.09899, "o", "\u001b[1m\u001b[7m%\u001b[27m\u001b[1m\u001b[0m \r \r\u001b]2;bee@DESKTOP-K6QO13M:/mnt/c/Users/brand/Documents/Projects/what\u0007\u001b]1;..Projects/what\u0007"] -[0.283394, "o", "\r\u001b[0m\u001b[27m\u001b[24m\u001b[J\u001b[01;32mโ \u001b[36mwhat\u001b[00m \u001b[01;34mgit:(\u001b[31mmain\u001b[34m) \u001b[33mโ\u001b[00m \u001b[K"] -[0.283557, "o", "\u001b[?1h\u001b=\u001b[?2004h"] -[0.789521, "o", "\u001b[7mpython3 -m PyWhat fixtures/FollowTheLeader.pcap\u001b[27m"] -[1.552938, "o", "\u001b[47D\u001b[27mp\u001b[27my\u001b[27mt\u001b[27mh\u001b[27mo\u001b[27mn\u001b[27m3\u001b[27m \u001b[27m-\u001b[27mm\u001b[27m \u001b[27mP\u001b[27my\u001b[27mW\u001b[27mh\u001b[27ma\u001b[27mt\u001b[27m \u001b[27mf\u001b[27mi\u001b[27mx\u001b[27mt\u001b[27mu\u001b[27mr\u001b[27me\u001b[27ms\u001b[27m/\u001b[27mF\u001b[27mo\u001b[27ml\u001b[27ml\u001b[27mo\u001b[27mw\u001b[27mT\u001b[27mh\u001b[27me\u001b[27mL\u001b[27me\u001b[27ma\u001b[27md\u001b[27me\u001b[27mr\u001b[27m.\u001b[27mp\u001b[27mc\u001b[27ma\u001b[27mp"] -[1.553228, "o", "\u001b[?1l\u001b>\u001b[?2004l\r\r\n"] -[1.553401, "o", "\u001b]2;python3 -m PyWhat fixtures/FollowTheLeader.pcap\u0007\u001b]1;python3\u0007"] -[2.002895, "o", "\u001b[1;38;5;183mPossible language (ISO-639-1 code):\u001b[0m \u001b[31men\u001b[0m 100% probability.\r\n\r\n"] -[2.008034, "o", "\r\n\u001b[1;38;5;183mPossible Identification\u001b[0m\r\nโโโโโโโโโโโโโโโโโโโโโโโโโโณโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโณโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ\r\nโ\u001b[1;38;5;183m \u001b[0m\u001b[1;38;5;183mMatched Text \u001b[0m\u001b[1;38;5;183m \u001b[0mโ\u001b[1;38;5;183m \u001b[0m\u001b[1;38;5;183mIdentified as \u001b[0m\u001b[1;38;5;183m \u001b[0mโ\u001b[1;38;5;183m \u001b[0m\u001b[1;38;5;183mDescription \u001b[0m\u001b[1;38;5;183m \u001b[0mโ\r\nโกโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ"] -[2.008292, "o", "โโโโโโโโโฉ\r\nโ ctfa{terrific_traffic} โ CTF Flag โ General Capture The Flag Event's Flag โ\r\nโโโโโโโโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโค\r\nโ Accept-Lang โ YouTube Video ID โ Click here to analyse in the browser โ\r\nโ โ โ https://www.youtube.com/watch?v=Accept-Lang โ\r\nโโโโโโโโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโ"] -[2.008447, "o", "โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโค\r\nโ Accept-Enco โ YouTube Video ID โ Click here to analyse in the browser โ\r\nโ โ โ https://www.youtube.com/watch?v=Accept-Enco โ\r\nโโโโโโโโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโค\r\nโ Upgrade-Ins โ YouTube Video ID โ Click here to analyse in the browser โ\r\nโ โ โ https://www.youtube.com/watch?v=Upgrade-Ins โ\r\nโโโโโโโโ"] -[2.008583, "o", "โโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโค\r\nโ cure-Reques โ YouTube Video ID โ Click here to analyse in the browser โ\r\nโ โ โ https://www.youtube.com/watch?v=cure-Reques โ\r\nโโโโโโโโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโค\r\nโ ache-Contro โ YouTube Video ID โ"] -[2.008667, "o", " Click here to analyse in the browser โ\r\nโ โ โ https://www.youtube.com/watch?v=ache-Contro โ\r\nโโโโโโโโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโค\r\nโ ontent-Leng โ YouTube Video ID โ Click here to analyse in the browser โ\r\nโ โ โ https://www.youtube.com/watch?v=ontent-Leng โ\r\nโโโโโโโโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโ"] -[2.008924, "o", "โโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโค\r\nโ fic_traffic โ YouTube Video ID โ Click here to analyse in the browser โ\r\nโ โ โ https://www.youtube.com/watch?v=fic_traffic โ\r\nโโโโโโโโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโผโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโค\r\nโ 10.0.2.5 โ Internet Protocol (IP) Address โ Universal address pointing to an entity on the web. โ\r\nโโโโโโโโโโโโโโโโโโโโโโโโโโดโโโโโโโโโโโโโ"] -[2.009041, "o", "โโโโโโโโโโโโโโโโโโโโดโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโ\r\n"] -[2.100632, "o", "\u001b[1m\u001b[7m%\u001b[27m\u001b[1m\u001b[0m \r \r"] -[2.100865, "o", "\u001b]2;bee@DESKTOP-K6QO13M:/mnt/c/Users/brand/Documents/Projects/what\u0007\u001b]1;..Projects/what\u0007"] -[2.287021, "o", "\r\u001b[0m\u001b[27m\u001b[24m\u001b[J\u001b[01;32mโ \u001b[36mwhat\u001b[00m \u001b[01;34mgit:(\u001b[31mmain\u001b[34m) \u001b[33mโ\u001b[00m \u001b[K"] -[2.287193, "o", "\u001b[?1h\u001b=\u001b[?2004h"] -[6.905647, "o", "\u001b[?2004l\r\r\n"]