Sunday, November 11, 2018

posted to github

https://github.com/xnih/satori

3 modules so far:

  • dhcp
  • tcp
  • useragent

Speed increase of anywhere from 7.5 to 20.4 times faster than my old windows version.


I have not run all my old pcaps through it at this point, but did run a few from my last sans course through it to find a few bugs I had.

Fingerprint files for each of those 3 have been updated, with a number more hopefully coming with the next week.

I also hope to get smb done before long, as I do see there is an smb one in pypacker (missed it before).


Sunday, November 4, 2018

Satori rewrite update

Real life/work always gets in the way.....

Lost 2 weeks to work related fun, but finally had a chance to revisit the rewrite this weekend and parse some of the tcp pcaps I've gathered in the past month or so to feed it.

tcp.xml has been updated with a number of newer OS's.  Since it had been 4+ years or so since I'd last updated it, there were a lot of Windows OS's to add to it.  I did find it interesting that I can tell the difference between windows 10 - build 14393 (and potentially earlier) to 15063 and greater!  Something changed in the tcp stack between those builds.  Also added some 2012 and 2016 server fingerprints and a few others such as some newer OS X ones.  By no means complete with what I have, but when you're that far behind on things, takes awhile to start adding things again!

As for the rewrite itself, got some command line options so you can choose which modules you want to use (tcp is done, dhcp is next to be worked on).  Not sure what all ones I'll port, but moving along.  Also got code in place to choose the file you want to read in, instead of just having it hard coded.  Neither huge accomplishments, but something I had to get fixed to make it even partially usable.

I also got things broken out into different files, initially was all one big jumble, but hey, i'm not really a programmer, I hack stuff together to make it work! 

Hope to have something out on github for testing in the near future, but all depends on free time.