diff --git a/SKILLS.md b/SKILLS.md
index 917316c680a..523a68de4ce 100644
--- a/SKILLS.md
+++ b/SKILLS.md
@@ -68,7 +68,7 @@ CAPE (Config And Payload Extraction) is a malware analysis sandbox derived from
### Coding Standards (PEP 8+)
* **Imports:** Explicit imports only (`from lib import a, b`). No `from lib import *`. Group standard library, 3rd party, and local imports.
-* **Strings:** Use double quotes (`"`) for strings. (This line was corrected from the original prompt to reflect the actual change needed for the example.)
+* **Strings:** Use double quotes (`"`) for strings.
* **Logging:** Use `import logging; log = logging.getLogger(__name__)`. Do not use `print()`.
* **Exceptions:** Use custom exceptions from `lib/cuckoo/common/exceptions.py` (e.g., `CuckooOperationalError`).
diff --git a/conf/default/auxiliary.conf.default b/conf/default/auxiliary.conf.default
index 21018cdb1db..306cb2b226e 100644
--- a/conf/default/auxiliary.conf.default
+++ b/conf/default/auxiliary.conf.default
@@ -10,6 +10,9 @@ windows_static_route_gateway = 192.168.1.1
evtx = no
human_windows = yes
human_linux = no
+# If enabling procmon:
+# You must download Procmon.exe from https://learn.microsoft.com/en-us/sysinternals/downloads/procmon
+# And place it to: analyzer/windows/bin/Procmon.exe
procmon = no
recentfiles = no
screenshots_windows = yes
diff --git a/conf/default/cuckoo.conf.default b/conf/default/cuckoo.conf.default
index 539dacf009c..9eea7a3e188 100644
--- a/conf/default/cuckoo.conf.default
+++ b/conf/default/cuckoo.conf.default
@@ -246,6 +246,8 @@ analysis = 0
mongo = no
# Clean orphan files in mongodb
unused_files_in_mongodb = no
+# Deduplicated files
+files = no
[central_mode]
# Central control-plane mode (off = current single-node behavior; analyses stay on the local
diff --git a/installer/cape2.sh b/installer/cape2.sh
index 11d3f2cea30..7cbde057b98 100755
--- a/installer/cape2.sh
+++ b/installer/cape2.sh
@@ -561,17 +561,17 @@ server {
}
# SSL configuration
listen 443 ssl http2;
- //listen [::]:443 ssl http2;
- //listen 443 http3 reuseport; # UDP listener for QUIC+HTTP/3
- ssl on;
- //ssl_protocols TLSv1.3; # QUIC requires TLS 1.3
+ #listen [::]:443 ssl http2;
+ listen 443 http3 reuseport; # UDP listener for QUIC+HTTP/3
+ #ssl on; # Obsolete in Nginx > 1.25.1
+ ssl_protocols TLSv1.2 TLSv1.3; # QUIC requires TLS 1.3
ssl_certificate /etc/letsencrypt/live/$1/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/$1/privkey.pem;
ssl_client_certificate /etc/ssl/certs/cloudflare.crt;
ssl_verify_client on;
- //add_header Alt-Svc 'quic=":443"'; # Advertise that QUIC is available
- //add_header QUIC-Status $quic; # Sent when QUIC was used
+ add_header Alt-Svc 'h3=":443"; ma=86400'; # Advertise that QUIC is available
+ add_header QUIC-Status $quic; # Sent when QUIC was used
server_name $1 www.$1;
location / {
diff --git a/web/analysis/views.py b/web/analysis/views.py
index 18ba39da562..a0b29ac94c4 100644
--- a/web/analysis/views.py
+++ b/web/analysis/views.py
@@ -45,7 +45,7 @@
from lib.cuckoo.common.config import Config
from lib.cuckoo.common.constants import ANALYSIS_BASE_PATH, CUCKOO_ROOT
from lib.cuckoo.common.path_utils import path_exists, path_get_size, path_mkdir, path_read_file, path_safe
-from lib.cuckoo.common.utils import delete_folder, yara_detected
+from lib.cuckoo.common.utils import delete_folder, get_files_storage_path, yara_detected
from lib.cuckoo.common.web_utils import category_all_files, my_rate_minutes, my_rate_seconds, perform_search, rateblock, statistics
from lib.cuckoo.core.database import Database, TasksMixIn
from lib.cuckoo.core.data.task import TASK_PENDING, Task
@@ -3582,6 +3582,10 @@ def file(request, category, task_id, dlfile):
# Self Extracted support folder
if not path_exists(path):
path = os.path.join(CUCKOO_ROOT, "storage", "analyses", str(task_id), "selfextracted", file_name)
+
+ if not path_exists(path) and len(file_name) == 64:
+ path = get_files_storage_path(file_name)
+
elif category in ("droppedzipall", "procdumpzipall", "CAPEzipall"):
if web_cfg.zipped_download.download_all:
sub_cat = category.replace("zipall", "")
@@ -3601,6 +3605,10 @@ def file(request, category, task_id, dlfile):
path = buf
if not path_exists(path):
path = os.path.join(CUCKOO_ROOT, "storage", "analyses", str(task_id), "selfextracted", file_name)
+
+ if not path_exists(path) and len(file_name) == 64:
+ path = get_files_storage_path(file_name)
+
elif category == "networkzip":
buf = os.path.join(CUCKOO_ROOT, "storage", "analyses", task_id, "network", file_name)
path = buf
diff --git a/web/static/css/style.css b/web/static/css/style.css
index aadb771bd2f..fc8b123ecdb 100644
--- a/web/static/css/style.css
+++ b/web/static/css/style.css
@@ -563,8 +563,8 @@ pre {
.table tbody tr.system > th,
.table tbody tr.windows > td,
.table tbody tr.windows > th {
- background-color: inherit; /* inherit the TR background-color */
- color: inherit; /* inherit the TR text color */
+ background-color: inherit; /* inherit the TR background-color */
+ color: inherit; /* inherit the TR text color */
}
/* Hover/focus states */
diff --git a/web/static/js/hexdump.js b/web/static/js/hexdump.js
deleted file mode 100644
index 6d2ac9f077b..00000000000
--- a/web/static/js/hexdump.js
+++ /dev/null
@@ -1,239 +0,0 @@
-
-/*
- * hexy js - https://github.com/a2800276/hexy.js
- * modified for cuckoo/web
-*/
-
-var hexy = function (buffer, config) {
- var h = new Hexy(buffer, config)
- return h.toString()
-}
-
-var Hexy = function (buffer, config) {
- var self = this
-
- config = config || {}
-
- self.buffer = buffer // magic string conversion here?
- self.width = config.width || 16
- self.numbering = config.numbering == "none" ? "none" : "hex_bytes"
-
- switch (config.format) {
- case "none":
- case "twos":
- self.format = config.format
- break
- default:
- self.format = "fours"
- }
-
- self.caps = config.caps == "upper" ? "upper" : "lower"
- self.annotate = config.annotate == "none" ? "none" : "ascii"
- self.prefix = config.prefix || ""
- self.indent = config.indent || 0
- self.html = config.html || false
- self.offset = config.offset || 0
- self.length = config.length || -1
-
- self.display_offset = config.display_offset || 0
-
- if (self.offset) {
- if (self.offset < self.buffer.length) {
- self.buffer = self.buffer.slice(self.offset)
- }
- }
-
- if (self.length !== -1) {
- if (self.length <= self.buffer.length) {
- self.buffer = self.buffer.slice(0,self.length)
- }
- }
-
- for (var i = 0; i!=self.indent; ++i) {
- self.prefix = " "+self.prefix
- }
-
- var pos = 0
-
- this.toString = function () {
- var str = ""
-
- if (self.html) { str += "
\n"}
- //split up into line of max `self.width`
- var line_arr = lines()
-
- //lines().forEach(function(hex_raw, i)
- for (var i = 0; i!= line_arr.length; ++i) {
- var hex_raw = line_arr[i],
- hex = hex_raw[0],
- raw = hex_raw[1]
- //insert spaces every `self.format.twos` or fours
- var howMany = hex.length
- if (self.format === "fours") {
- howMany = 4
- } else if (self.format === "twos") {
- howMany = 2
- }
-
- var hex_formatted = ""
-
-
- for (var j =0; j< hex.length; j+=howMany) {
- var s = hex.substr(j, howMany)
- hex_formatted += s + " "
- }
-
- var addr = (i*self.width)+self.offset+self.display_offset;
- if (self.html) {
- odd = i%2 == 0 ? " even" : " odd"
- str += "
"
- }
- str += self.prefix
-
- if (self.numbering === "hex_bytes") {
- str += pad(addr, 8) // padding...
- str += ": "
- }
-
- var padlen = 0
- switch(self.format) {
- case "fours":
- padlen = self.width*2 + self.width/2
- break
- case "twos":
- padlen = self.width*3 + 2
- break
- default:
- padlen = self.width * 2 + 1
- }
-
- str += rpad(hex_formatted, padlen)
- if (self.annotate === "ascii") {
- str+=" "
- var ascii = raw.replace(/[\000-\040\177-\377]/g, ".")
- str += escape(ascii)
- }
- if (self.html) {
- str += "
\n"
- } else {
- str += "\n"
- }
- }
- if (self.html) { str += "
\n"}
- return str
- }
-
- var lines = function() {
- var hex_raw = []
- for (var i = 0; i= self.buffer.length ? self.buffer.length : i+self.width,
- slice = self.buffer.slice(begin, end),
- hex = self.caps === "upper" ? hexu(slice) : hexl(slice),
- raw = slice.toString('ascii')
-
- hex_raw.push([hex,raw])
- }
- return hex_raw
-
- }
-
- var hexl = function (buffer) {
- var str = ""
- for (var i=0; i!=buffer.length; ++i) {
- if (buffer.constructor == String) {
- str += pad(buffer.charCodeAt(i), 2)
- } else {
- str += pad(buffer[i], 2)
- }
- }
- return str
- }
- var hexu = function (buffer) {
- return hexl(buffer).toUpperCase()
- }
-
- var pad = function(b, len) {
- var s = b.toString(16)
-
- while (s.length < len) {
- s = "0" + s
- }
- return s
- }
- var rpad = function(s, len) {
- for (var n = len - s.length; n!=0; --n) {
- if (self.html) {
- s += " "
- } else {
- s += " "
- }
-
- }
- return s
- }
-
- var escape = function (str) {
- str = str.split("&").join("&")
- str = str.split("<").join("<")
- str = str.split(">").join(">")
- return str
- }
-
-
-}
-
-/**
- * the following code is hacked up from the jquery base64 codec plugin
- * removed 80% of its guts though...
- * jQuery Plugin - base64 codec
- * @lisence MIT License https://github.com/yatt/jquery.base64/blob/master/license.txt
- * @author yatt/brainfs http://d.hatena.ne.jp/yatt http://twitter.com/brainfs
- * @version 0.0.1
- * @info
- */
-
-var base64 = new function()
-//
-{
- var utfLibName = "utf";
- var b64char = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
- var b64encTable = b64char.split("");
- var b64decTable = [];
- for (var i=0; i>> 16;
- dat[j+1] = (tmp >>> 8) & 0xff;
- dat[j+2] = tmp & 0xff;
- }
- // 補完された 0x0 分削る
- if (md) dat.length -= [0,0,2,1][md];
-
- return dat;
- }
-
-}
diff --git a/web/templates/analysis/generic/_file_info.html b/web/templates/analysis/generic/_file_info.html
index fdff27ff6d0..5dc25d1e7d9 100644
--- a/web/templates/analysis/generic/_file_info.html
+++ b/web/templates/analysis/generic/_file_info.html
@@ -407,7 +407,7 @@ File
-
{% for string in file.strings %}{{string}}
{% endfor %}
+
{% for string in file.strings %}{{string}}
{% endfor %}
@@ -418,7 +418,7 @@ File
-
{% for string in file.dotnet_strings %}{{string}}
{% endfor %}
+
{% for string in file.dotnet_strings %}{{string}}
{% endfor %}
@@ -429,7 +429,7 @@ File
-
{{file.data|escape}}
+
{{file.data|escape}}
@@ -440,7 +440,7 @@ File
-
{{file.decoded_files|escape}}
+
{{file.decoded_files|escape}}
diff --git a/web/templates/analysis/generic/_floss.html b/web/templates/analysis/generic/_floss.html
index da479839592..074d8f13771 100644
--- a/web/templates/analysis/generic/_floss.html
+++ b/web/templates/analysis/generic/_floss.html
@@ -10,7 +10,7 @@ FL
Decoded Strings
-
{% for string in file.floss.decoded_strings %}{{string}}
{% endfor %}
+
{% for string in file.floss.decoded_strings %}{{string}}
{% endfor %}
@@ -21,7 +21,7 @@ Decoded Strings
Stack Strings
-
{% for string in file.floss.stack_strings %}{{string}}
{% endfor %}
+
{% for string in file.floss.stack_strings %}{{string}}
{% endfor %}
@@ -32,7 +32,7 @@ Stack Strings
Tight Strings
-
{% for string in file.floss.tight_strings %}{{string}}
{% endfor %}
+
{% for string in file.floss.tight_strings %}{{string}}
{% endfor %}
@@ -43,7 +43,7 @@ Tight Strings
Static Strings
-
{% for string in file.floss.static_strings %}{{string}}
{% endfor %}
+
{% for string in file.floss.static_strings %}{{string}}
{% endfor %}
diff --git a/web/templates/analysis/generic/_java.html b/web/templates/analysis/generic/_java.html
index a5dd91f3f8e..e23a7d8c355 100644
--- a/web/templates/analysis/generic/_java.html
+++ b/web/templates/analysis/generic/_java.html
@@ -7,7 +7,7 @@ Java D
{% if file.java and file.java.decompiled %}
-
{{file.java.decompiled}}
+
{{file.java.decompiled}}
{% else %}
diff --git a/web/templates/analysis/generic/_office.html b/web/templates/analysis/generic/_office.html
index e914afbe30d..0b99b388d0d 100644
--- a/web/templates/analysis/generic/_office.html
+++ b/web/templates/analysis/generic/_office.html
@@ -123,7 +123,7 @@
diff --git a/web/templates/analysis/generic/_pdf.html b/web/templates/analysis/generic/_pdf.html
index cecf97dc2fa..52d7ab1fd84 100644
--- a/web/templates/analysis/generic/_pdf.html
+++ b/web/templates/analysis/generic/_pdf.html
@@ -132,7 +132,7 @@
Size: {{obj.Size}} bytes
Offset: {{obj.Offset}}
-
{{obj.Data|linebreaksbr}}
+
{{obj.Data|linebreaksbr}}
diff --git a/web/templates/analysis/generic/_xlmmacro.html b/web/templates/analysis/generic/_xlmmacro.html
index 0127e2b4144..96914e013a5 100644
--- a/web/templates/analysis/generic/_xlmmacro.html
+++ b/web/templates/analysis/generic/_xlmmacro.html
@@ -6,7 +6,7 @@
-
{% for line in file.office.XLMMacroDeobfuscator.Code %}{{line}}
{% endfor %}
+
{% for line in file.office.XLMMacroDeobfuscator.Code %}{{line}}
{% endfor %}
diff --git a/web/templates/analysis/network/_cif.html b/web/templates/analysis/network/_cif.html
index 00e8f6f18c5..878e7889caf 100644
--- a/web/templates/analysis/network/_cif.html
+++ b/web/templates/analysis/network/_cif.html
@@ -30,10 +30,6 @@ CIF
{% endfor %}
- {% else %}
-
{% endif %}
diff --git a/web/templates/analysis/network/_dns.html b/web/templates/analysis/network/_dns.html
index 0a6b0521b68..9ae02d903b5 100644
--- a/web/templates/analysis/network/_dns.html
+++ b/web/templates/analysis/network/_dns.html
@@ -82,7 +82,9 @@ DNS Reque
{% else %}
-
No domains contacted.
+
+ No DNS requests recorded.
+
{% endif %}
diff --git a/web/templates/analysis/network/_hosts.html b/web/templates/analysis/network/_hosts.html
index 4326aca1a53..9c82abbf46e 100644
--- a/web/templates/analysis/network/_hosts.html
+++ b/web/templates/analysis/network/_hosts.html
@@ -70,7 +70,9 @@ Hosts
{% else %}
-
No hosts contacted.
+
+ No host connections recorded.
+
{% endif %}
diff --git a/web/templates/analysis/network/_http.html b/web/templates/analysis/network/_http.html
index af715355e64..898662ca1fd 100644
--- a/web/templates/analysis/network/_http.html
+++ b/web/templates/analysis/network/_http.html
@@ -22,6 +22,8 @@ HTTP Re
{% else %}
Request:
{% endif %}
+ Hexdump
+
{% for value in http.request|network_rn %}
{{value}}
{% endfor %}
@@ -34,6 +36,8 @@ HTTP Re
{% else %}
Response:
{% endif %}
+ Hexdump
+
{% for value in http.response|network_rn %}
{{value}}
{% endfor %}
@@ -73,23 +77,46 @@ HTTP Re
{% for request in network.http %}
| {{request.uri}} {% if request.source == "behavior" %}behavior{% endif %} |
- {{request.data}} |
- {% if settings.NETWORK_PROC_MAP %}
-
- {% if request.process_name %}
- {{ request.process_name }}{% if request.process_id %} ({{ request.process_id }}){% endif %}
- {% else %}
- -
- {% endif %}
- |
- {% endif %}
+
+ Hexdump
+ {{request.data}}
+ {% if settings.NETWORK_PROC_MAP %}
+ |
+ {% if request.process_name %}
+ {{ request.process_name }}{% if request.process_id %} ({{ request.process_id }}){% endif %}
+ {% else %}
+ -
+ {% endif %}
+ |
+ {% endif %}
+
{% endfor %}
-{% else %}
-
-
No HTTP(s) requests performed.
-
{% endif %}
+
+
diff --git a/web/templates/analysis/network/_icmp.html b/web/templates/analysis/network/_icmp.html
index 526cf7db7af..dd1b54a7c72 100644
--- a/web/templates/analysis/network/_icmp.html
+++ b/web/templates/analysis/network/_icmp.html
@@ -33,7 +33,9 @@ ICMP Tra
{% else %}
-
No ICMP traffic performed.
+
+ No ICMP Traffic recorded.
+
{% endif %}
diff --git a/web/templates/analysis/network/_irc.html b/web/templates/analysis/network/_irc.html
index e6d2961f209..3bb52b5a3bc 100644
--- a/web/templates/analysis/network/_irc.html
+++ b/web/templates/analysis/network/_irc.html
@@ -31,7 +31,9 @@ IRC Tr
{% else %}
-
No IRC requests performed.
+
+ No IRC Traffic recorded.
+
{% endif %}
diff --git a/web/templates/analysis/network/_smtp.html b/web/templates/analysis/network/_smtp.html
index a0971a15ee4..c391f430e93 100644
--- a/web/templates/analysis/network/_smtp.html
+++ b/web/templates/analysis/network/_smtp.html
@@ -83,7 +83,9 @@ SMTP T
{% else %}
-
No SMTP traffic performed.
+
+ No SMTP Traffic recorded.
+
{% endif %}
diff --git a/web/templates/analysis/network/_suricata_alerts.html b/web/templates/analysis/network/_suricata_alerts.html
index d1cf77ab04c..30bd9be0e31 100644
--- a/web/templates/analysis/network/_suricata_alerts.html
+++ b/web/templates/analysis/network/_suricata_alerts.html
@@ -84,7 +84,9 @@
-
No Suricata Alerts
+
+ No Suricata Alerts recorded.
+
{% endif %}
diff --git a/web/templates/analysis/network/_suricata_files.html b/web/templates/analysis/network/_suricata_files.html
index 425160afbdb..10845e40516 100644
--- a/web/templates/analysis/network/_suricata_files.html
+++ b/web/templates/analysis/network/_suricata_files.html
@@ -135,5 +135,8 @@
{% endfor %}
{% else %}
- Sorry! No Suricata Extracted files.
+
+
+
No Suricata extracted files found.
+
{% endif %}
diff --git a/web/templates/analysis/network/_suricata_http.html b/web/templates/analysis/network/_suricata_http.html
index a90a4d91f1e..7b352c9f31f 100644
--- a/web/templates/analysis/network/_suricata_http.html
+++ b/web/templates/analysis/network/_suricata_http.html
@@ -97,7 +97,9 @@ Suricata
{% else %}
-
No Suricata HTTP
+
+ No Suricata HTTP requests recorded.
+
{% endif %}
diff --git a/web/templates/analysis/network/_suricata_tls.html b/web/templates/analysis/network/_suricata_tls.html
index dbd0d2bf1f9..7ef1bd74981 100644
--- a/web/templates/analysis/network/_suricata_tls.html
+++ b/web/templates/analysis/network/_suricata_tls.html
@@ -73,7 +73,9 @@ Suricata T
{% else %}
-
No Suricata TLS
+
+ No Suricata TLS records found.
+
{% endif %}
diff --git a/web/templates/analysis/network/_tcp.html b/web/templates/analysis/network/_tcp.html
index 54f03cf8832..356270bcc9a 100644
--- a/web/templates/analysis/network/_tcp.html
+++ b/web/templates/analysis/network/_tcp.html
@@ -1,14 +1,9 @@
-
-
-
{% if network.tcp %}
-
+
TCP
-
+
| Source |
Source Port |
@@ -41,13 +36,7 @@ T
-
- {% else %}
-
-
No TCP connections recorded.
-
{% endif %}
-