From c822fec3594203e08515d14ff799e3f2014174e1 Mon Sep 17 00:00:00 2001 From: doomedraven Date: Fri, 21 Aug 2026 21:22:26 +0200 Subject: [PATCH 1/4] feat(web): Modernize HTML templates, rewrite hexdump.js, and fix process tree recursion cycles --- SKILLS.md | 2 +- conf/default/auxiliary.conf.default | 3 + conf/default/cuckoo.conf.default | 2 + installer/cape2.sh | 12 +- modules/processing/behavior.py | 95 ++-- web/analysis/views.py | 10 +- web/static/css/style.css | 4 +- web/static/js/hexdump.js | 413 +++++++++--------- web/templates/analysis/behavior/_tree.html | 2 +- .../analysis/generic/_file_info.html | 8 +- web/templates/analysis/generic/_floss.html | 8 +- web/templates/analysis/generic/_java.html | 2 +- web/templates/analysis/generic/_office.html | 2 +- web/templates/analysis/generic/_pdf.html | 2 +- web/templates/analysis/generic/_xlmmacro.html | 2 +- web/templates/analysis/network/_cif.html | 4 - web/templates/analysis/network/_dns.html | 4 - web/templates/analysis/network/_hosts.html | 4 - web/templates/analysis/network/_http.html | 55 ++- web/templates/analysis/network/_icmp.html | 4 - web/templates/analysis/network/_irc.html | 4 - web/templates/analysis/network/_smtp.html | 4 - .../analysis/network/_suricata_alerts.html | 4 - .../analysis/network/_suricata_files.html | 2 - .../analysis/network/_suricata_http.html | 4 - .../analysis/network/_suricata_tls.html | 4 - web/templates/analysis/network/_tcp.html | 15 +- web/templates/analysis/network/_udp.html | 6 +- web/templates/analysis/network/index.html | 7 +- web/templates/analysis/overview/_info.html | 2 +- .../analysis/overview/_statistics.html | 62 +-- web/templates/analysis/overview/_summary.html | 23 +- web/templates/analysis/report.html | 42 +- web/templates/submission/index.html | 2 +- 34 files changed, 403 insertions(+), 416 deletions(-) diff --git a/SKILLS.md b/SKILLS.md index 917316c680a..523a68de4ce 100644 --- a/SKILLS.md +++ b/SKILLS.md @@ -68,7 +68,7 @@ CAPE (Config And Payload Extraction) is a malware analysis sandbox derived from ### Coding Standards (PEP 8+) * **Imports:** Explicit imports only (`from lib import a, b`). No `from lib import *`. Group standard library, 3rd party, and local imports. -* **Strings:** Use double quotes (`"`) for strings. (This line was corrected from the original prompt to reflect the actual change needed for the example.) +* **Strings:** Use double quotes (`"`) for strings. * **Logging:** Use `import logging; log = logging.getLogger(__name__)`. Do not use `print()`. * **Exceptions:** Use custom exceptions from `lib/cuckoo/common/exceptions.py` (e.g., `CuckooOperationalError`). diff --git a/conf/default/auxiliary.conf.default b/conf/default/auxiliary.conf.default index 21018cdb1db..306cb2b226e 100644 --- a/conf/default/auxiliary.conf.default +++ b/conf/default/auxiliary.conf.default @@ -10,6 +10,9 @@ windows_static_route_gateway = 192.168.1.1 evtx = no human_windows = yes human_linux = no +# If enabling procmon: +# You must download Procmon.exe from https://learn.microsoft.com/en-us/sysinternals/downloads/procmon +# And place it to: analyzer/windows/bin/Procmon.exe procmon = no recentfiles = no screenshots_windows = yes diff --git a/conf/default/cuckoo.conf.default b/conf/default/cuckoo.conf.default index 539dacf009c..9eea7a3e188 100644 --- a/conf/default/cuckoo.conf.default +++ b/conf/default/cuckoo.conf.default @@ -246,6 +246,8 @@ analysis = 0 mongo = no # Clean orphan files in mongodb unused_files_in_mongodb = no +# Deduplicated files +files = no [central_mode] # Central control-plane mode (off = current single-node behavior; analyses stay on the local diff --git a/installer/cape2.sh b/installer/cape2.sh index 11d3f2cea30..7cbde057b98 100755 --- a/installer/cape2.sh +++ b/installer/cape2.sh @@ -561,17 +561,17 @@ server { } # SSL configuration listen 443 ssl http2; - //listen [::]:443 ssl http2; - //listen 443 http3 reuseport; # UDP listener for QUIC+HTTP/3 - ssl on; - //ssl_protocols TLSv1.3; # QUIC requires TLS 1.3 + #listen [::]:443 ssl http2; + listen 443 http3 reuseport; # UDP listener for QUIC+HTTP/3 + #ssl on; # Obsolete in Nginx > 1.25.1 + ssl_protocols TLSv1.2 TLSv1.3; # QUIC requires TLS 1.3 ssl_certificate /etc/letsencrypt/live/$1/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/$1/privkey.pem; ssl_client_certificate /etc/ssl/certs/cloudflare.crt; ssl_verify_client on; - //add_header Alt-Svc 'quic=":443"'; # Advertise that QUIC is available - //add_header QUIC-Status $quic; # Sent when QUIC was used + add_header Alt-Svc 'h3=":443"; ma=86400'; # Advertise that QUIC is available + add_header QUIC-Status $quic; # Sent when QUIC was used server_name $1 www.$1; location / { diff --git a/modules/processing/behavior.py b/modules/processing/behavior.py index d6d2598b4a3..633b888cade 100644 --- a/modules/processing/behavior.py +++ b/modules/processing/behavior.py @@ -1153,29 +1153,6 @@ class ProcessTree: def __init__(self): self.processes = [] - self.tree = [] - - def add_node(self, node, tree): - """Add a node to a process tree. - @param node: node to add. - @param tree: processes tree. - @return: boolean with operation success status. - """ - # Walk through the existing tree. - ret = False - for process in tree: - # If the current process has the same ID of the parent process of - # the provided one, append it the children. - if process["pid"] == node["parent_id"]: - process["children"].append(node) - ret = True - break - # Otherwise try with the children of the current process. - else: - if self.add_node(node, process["children"]): - ret = True - break - return ret def event_apicall(self, call, process): for entry in self.processes: @@ -1195,34 +1172,54 @@ def event_apicall(self, call, process): ) def run(self): - children = [] - - # Walk through the generated list of processes. - for process in self.processes: - has_parent = False - # Walk through the list again. - for process_again in self.processes: - if process_again == process: - continue - # If we find a parent for the first process, we mark it as - # as a child. - if process_again["pid"] == process["parent_id"]: - has_parent = True - break - - # If the process has a parent, add it to the children list. - if has_parent: - children.append(process) - # Otherwise it's an orphan and we add it to the tree root. + # Index processes by PID. + # This implementation uses an iterative approach to build the tree and detects cycles + # to prevent infinite recursion or excessive depth that causes JSON serialization issues. + node_lookup = {p["pid"]: p for p in self.processes} + roots = [] + + # Initialize children list for all processes + for p in self.processes: + p["children"] = [] + + for p in self.processes: + parent_pid = p.get("parent_id") + + # Check if parent exists and is not self (self-parenting treated as root) + if parent_pid in node_lookup and parent_pid != p["pid"]: + parent = node_lookup[parent_pid] + + # Cycle Detection: Traverse ancestry to ensure 'p' is not an ancestor of 'parent' + curr = parent + is_cycle = False + # Use a simple counter or set to avoid infinite checks if the map has internal loops + depth = 0 + max_depth = 100 + + while depth < max_depth: + if curr is p: + is_cycle = True + break + + # Move up to the next parent + curr_parent_pid = curr.get("parent_id") + if curr_parent_pid in node_lookup and curr_parent_pid != curr["pid"]: + curr = node_lookup[curr_parent_pid] + depth += 1 + else: + # Reached a root or unknown parent + break + + if not is_cycle: + parent["children"].append(p) + else: + # Cycle detected or depth limit hit, treat as root to avoid breaking JSON + log.warning("Cycle or deep nesting detected for process %s (parent %s). treating as root.", p["pid"], parent_pid) + roots.append(p) else: - self.tree.append(process) - - # Now we loop over the remaining child processes. - for process in children: - if not self.add_node(process, self.tree): - self.tree.append(process) + roots.append(p) - return self.tree + return roots class NetworkMap: diff --git a/web/analysis/views.py b/web/analysis/views.py index 18ba39da562..a0b29ac94c4 100644 --- a/web/analysis/views.py +++ b/web/analysis/views.py @@ -45,7 +45,7 @@ from lib.cuckoo.common.config import Config from lib.cuckoo.common.constants import ANALYSIS_BASE_PATH, CUCKOO_ROOT from lib.cuckoo.common.path_utils import path_exists, path_get_size, path_mkdir, path_read_file, path_safe -from lib.cuckoo.common.utils import delete_folder, yara_detected +from lib.cuckoo.common.utils import delete_folder, get_files_storage_path, yara_detected from lib.cuckoo.common.web_utils import category_all_files, my_rate_minutes, my_rate_seconds, perform_search, rateblock, statistics from lib.cuckoo.core.database import Database, TasksMixIn from lib.cuckoo.core.data.task import TASK_PENDING, Task @@ -3582,6 +3582,10 @@ def file(request, category, task_id, dlfile): # Self Extracted support folder if not path_exists(path): path = os.path.join(CUCKOO_ROOT, "storage", "analyses", str(task_id), "selfextracted", file_name) + + if not path_exists(path) and len(file_name) == 64: + path = get_files_storage_path(file_name) + elif category in ("droppedzipall", "procdumpzipall", "CAPEzipall"): if web_cfg.zipped_download.download_all: sub_cat = category.replace("zipall", "") @@ -3601,6 +3605,10 @@ def file(request, category, task_id, dlfile): path = buf if not path_exists(path): path = os.path.join(CUCKOO_ROOT, "storage", "analyses", str(task_id), "selfextracted", file_name) + + if not path_exists(path) and len(file_name) == 64: + path = get_files_storage_path(file_name) + elif category == "networkzip": buf = os.path.join(CUCKOO_ROOT, "storage", "analyses", task_id, "network", file_name) path = buf diff --git a/web/static/css/style.css b/web/static/css/style.css index aadb771bd2f..fc8b123ecdb 100644 --- a/web/static/css/style.css +++ b/web/static/css/style.css @@ -563,8 +563,8 @@ pre { .table tbody tr.system > th, .table tbody tr.windows > td, .table tbody tr.windows > th { - background-color: inherit; /* inherit the TR background-color */ - color: inherit; /* inherit the TR text color */ + background-color: inherit; /* inherit the TR background-color */ + color: inherit; /* inherit the TR text color */ } /* Hover/focus states */ diff --git a/web/static/js/hexdump.js b/web/static/js/hexdump.js index 6d2ac9f077b..f4096aa6d62 100644 --- a/web/static/js/hexdump.js +++ b/web/static/js/hexdump.js @@ -1,239 +1,222 @@ - -/* +/** * hexy js - https://github.com/a2800276/hexy.js * modified for cuckoo/web -*/ + * Updated with changes from https://gist.github.com/username1565/18878422a72ef0e7f05edf72536b6ed9 + */ + +var base64 = { + _keyStr: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=", + + decode: function(input) { + var output = []; + var chr1, chr2, chr3; + var enc1, enc2, enc3, enc4; + var i = 0; + + input = input.replace(/[^A-Za-z0-9\+\/\=]/g, ""); + + while (i < input.length) { + enc1 = this._keyStr.indexOf(input.charAt(i++)); + enc2 = this._keyStr.indexOf(input.charAt(i++)); + enc3 = this._keyStr.indexOf(input.charAt(i++)); + enc4 = this._keyStr.indexOf(input.charAt(i++)); + + chr1 = (enc1 << 2) | (enc2 >> 4); + chr2 = ((enc2 & 15) << 4) | (enc3 >> 2); + chr3 = ((enc3 & 3) << 6) | enc4; + + output.push(chr1); + + if (enc3 != 64) { + output.push(chr2); + } + if (enc4 != 64) { + output.push(chr3); + } + } + return output; // Retorna array de bytes + } +}; var hexy = function (buffer, config) { - var h = new Hexy(buffer, config) - return h.toString() -} + var h = new Hexy(buffer, config); + return h.toString(); +}; var Hexy = function (buffer, config) { - var self = this - - config = config || {} - - self.buffer = buffer // magic string conversion here? - self.width = config.width || 16 - self.numbering = config.numbering == "none" ? "none" : "hex_bytes" - - switch (config.format) { - case "none": - case "twos": - self.format = config.format - break - default: - self.format = "fours" - } - - self.caps = config.caps == "upper" ? "upper" : "lower" - self.annotate = config.annotate == "none" ? "none" : "ascii" - self.prefix = config.prefix || "" - self.indent = config.indent || 0 - self.html = config.html || false - self.offset = config.offset || 0 - self.length = config.length || -1 - - self.display_offset = config.display_offset || 0 - - if (self.offset) { - if (self.offset < self.buffer.length) { - self.buffer = self.buffer.slice(self.offset) - } - } + var self = this; + config = config || {}; - if (self.length !== -1) { - if (self.length <= self.buffer.length) { - self.buffer = self.buffer.slice(0,self.length) + // --- Lógica de unificación de tipos (traída de hexdump2.js) --- + // Normalizamos cualquier entrada a un Array o String binario para procesarlo + if (buffer instanceof ArrayBuffer) { + buffer = new Uint8Array(buffer); } - } - - for (var i = 0; i!=self.indent; ++i) { - self.prefix = " "+self.prefix - } - - var pos = 0 - - this.toString = function () { - var str = "" - - if (self.html) { str += "
\n"} - //split up into line of max `self.width` - var line_arr = lines() - - //lines().forEach(function(hex_raw, i) - for (var i = 0; i!= line_arr.length; ++i) { - var hex_raw = line_arr[i], - hex = hex_raw[0], - raw = hex_raw[1] - //insert spaces every `self.format.twos` or fours - var howMany = hex.length - if (self.format === "fours") { - howMany = 4 - } else if (self.format === "twos") { - howMany = 2 - } - - var hex_formatted = "" - - - for (var j =0; j< hex.length; j+=howMany) { - var s = hex.substr(j, howMany) - hex_formatted += s + " " - } - - var addr = (i*self.width)+self.offset+self.display_offset; - if (self.html) { - odd = i%2 == 0 ? " even" : " odd" - str += "
" - } - str += self.prefix - - if (self.numbering === "hex_bytes") { - str += pad(addr, 8) // padding... - str += ": " - } - - var padlen = 0 - switch(self.format) { - case "fours": - padlen = self.width*2 + self.width/2 - break - case "twos": - padlen = self.width*3 + 2 - break - default: - padlen = self.width * 2 + 1 - } - - str += rpad(hex_formatted, padlen) - if (self.annotate === "ascii") { - str+=" " - var ascii = raw.replace(/[\000-\040\177-\377]/g, ".") - str += escape(ascii) - } - if (self.html) { - str += "
\n" - } else { - str += "\n" - } + // Si es Uint8Array, lo convertimos a array normal para facilitar manejo + if (buffer.constructor === Uint8Array) { + buffer = Array.from(buffer); } - if (self.html) { str += "
\n"} - return str - } - - var lines = function() { - var hex_raw = [] - for (var i = 0; i= self.buffer.length ? self.buffer.length : i+self.width, - slice = self.buffer.slice(begin, end), - hex = self.caps === "upper" ? hexu(slice) : hexl(slice), - raw = slice.toString('ascii') - - hex_raw.push([hex,raw]) + // -------------------------------------------------------------- + + self.buffer = buffer; + self.width = config.width || 16; + self.numbering = config.numbering == "none" ? "none" : "hex_bytes"; + self.format = (config.format === "none" || config.format === "twos") ? config.format : "fours"; + self.caps = config.caps == "upper" ? "upper" : "lower"; + self.annotate = config.annotate == "none" ? "none" : "ascii"; + self.prefix = config.prefix || ""; + self.indent = config.indent || 0; + self.html = config.html || false; + self.should_escape = config.escape !== false; + self.offset = config.offset || 0; + self.length = config.length || -1; + self.display_offset = config.display_offset || 0; + + // Manejo de slice y offset + if (self.offset) { + if (self.offset < self.buffer.length) { + self.buffer = self.buffer.slice(self.offset); + } } - return hex_raw - - } - - var hexl = function (buffer) { - var str = "" - for (var i=0; i!=buffer.length; ++i) { - if (buffer.constructor == String) { - str += pad(buffer.charCodeAt(i), 2) - } else { - str += pad(buffer[i], 2) - } + if (self.length !== -1) { + if (self.length <= self.buffer.length) { + self.buffer = self.buffer.slice(0, self.length); + } } - return str - } - var hexu = function (buffer) { - return hexl(buffer).toUpperCase() - } - - var pad = function(b, len) { - var s = b.toString(16) - while (s.length < len) { - s = "0" + s + // Indentación + for (var i = 0; i != self.indent; ++i) { + self.prefix = " " + self.prefix; } - return s - } - var rpad = function(s, len) { - for (var n = len - s.length; n!=0; --n) { - if (self.html) { - s += " " - } else { - s += " " - } - } - return s - } + this.toString = function () { + var str = ""; + if (self.html) { str += "
\n"; } - var escape = function (str) { - str = str.split("&").join("&") - str = str.split("<").join("<") - str = str.split(">").join(">") - return str - } + var line_arr = lines(); + for (var i = 0; i != line_arr.length; ++i) { + var hex_raw = line_arr[i], + hex = hex_raw[0], + raw = hex_raw[1]; -} + // Formatear grupos (fours o twos) + var howMany = hex.length; + if (self.format === "fours") { howMany = 4; } + else if (self.format === "twos") { howMany = 2; } -/** - * the following code is hacked up from the jquery base64 codec plugin - * removed 80% of its guts though... - * jQuery Plugin - base64 codec - * @lisence MIT License https://github.com/yatt/jquery.base64/blob/master/license.txt - * @author yatt/brainfs http://d.hatena.ne.jp/yatt http://twitter.com/brainfs - * @version 0.0.1 - * @info - */ + var hex_formatted = ""; + for (var j = 0; j < hex.length; j += howMany) { + var s = hex.substr(j, howMany); + hex_formatted += s + " "; + } -var base64 = new function() -// -{ - var utfLibName = "utf"; - var b64char = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; - var b64encTable = b64char.split(""); - var b64decTable = []; - for (var i=0; i"; + } + + str += self.prefix; + + if (self.numbering === "hex_bytes") { + str += pad(addr, 8); + str += ": "; + } + + var padlen = 0; + switch (self.format) { + case "fours": padlen = self.width * 2 + self.width / 2; break; + case "twos": padlen = self.width * 3 + 2; break; + default: padlen = self.width * 2 + 1; + } + + str += rpad(hex_formatted, padlen); + + if (self.annotate === "ascii") { + str += " "; + // Limpieza de caracteres no imprimibles para ASCII + var ascii = raw.replace(/[\000-\040\177-\377]/g, "."); + str += self.should_escape ? escape(ascii) : ascii; + } - var decoder = function(_b64) - { - _b64 = _b64.replace(/[^A-Za-z0-9\+\/]/g, ""); - var md = _b64.length % 4; - var j, i, tmp; - var dat = []; - - // replace 時 = も削っている。その = の代わりに 0x0 を補間 - if (md) for (i=0; i<4-md; i++) _b64 += "A"; - - for (j=i=0; i<_b64.length; i+=4, j+=3) - { - tmp = (b64decTable[_b64.charAt( i )] <<18) - | (b64decTable[_b64.charAt(i+1)] <<12) - | (b64decTable[_b64.charAt(i+2)] << 6) - | b64decTable[_b64.charAt(i+3)]; - dat[ j ] = tmp >>> 16; - dat[j+1] = (tmp >>> 8) & 0xff; - dat[j+2] = tmp & 0xff; + if (self.html) { str += "
\n"; } + else { str += "\n"; } } - // 補完された 0x0 分削る - if (md) dat.length -= [0,0,2,1][md]; - return dat; - } + if (self.html) { str += "\n"; } + return str; + }; + + var lines = function () { + var hex_raw = []; + for (var i = 0; i < self.buffer.length; i += self.width) { + var begin = i; + var end = i + self.width >= self.buffer.length ? self.buffer.length : i + self.width; + var slice = self.buffer.slice(begin, end); + + var hex = self.caps === "upper" ? hexu(slice) : hexl(slice); + + // Convertir slice a string para la columna raw/ascii + var raw = ""; + for(var k=0; k < slice.length; k++) { + // Maneja tanto string como array de bytes + var charCode = (typeof slice === 'string') ? slice.charCodeAt(k) : slice[k]; + raw += String.fromCharCode(charCode); + } + + hex_raw.push([hex, raw]); + } + return hex_raw; + }; + + var hexl = function (buffer) { + var str = ""; + for (var i = 0; i != buffer.length; ++i) { + var byte = (typeof buffer === 'string') ? buffer.charCodeAt(i) : buffer[i]; + str += pad(byte, 2); + } + return str; + }; + + var hexu = function (buffer) { + return hexl(buffer).toUpperCase(); + }; + + var pad = function (b, len) { + var s = b.toString(16); + while (s.length < len) { s = "0" + s; } + return s; + }; + + var rpad = function (s, len) { + for (var n = len - s.length; n > 0; --n) { + if (self.html) { s += " "; } + else { s += " "; } + } + return s; + }; + + var escape = function (str) { + return str.replace(/&/g, "&") + .replace(//g, ">"); + }; +}; +/** + * Función Helper solicitada + * @param {string} str - Cadena en Base64 + * @param {string|number} mode - Ancho (ej. 16) + * @param {boolean} should_escape - Si se debe escapar HTML (default true) + */ +function renderHex(str, mode, should_escape) { + if (!str) return ""; + // Decodifica base64 a array de bytes y pasa a hexy + return hexy(base64.decode(str), { + width: mode ? parseInt(mode) : 16, + html: false, // Cambiar a true si necesitas HTML + escape: should_escape !== undefined ? should_escape : true + }); } diff --git a/web/templates/analysis/behavior/_tree.html b/web/templates/analysis/behavior/_tree.html index 5aa6ebefd75..0addca4a8a7 100644 --- a/web/templates/analysis/behavior/_tree.html +++ b/web/templates/analysis/behavior/_tree.html @@ -18,7 +18,7 @@
Proces {{process.name}} ({{process.pid}}) {% if process.commandline %} - {{ process.commandline }} + {{ process.commandline }} {% endif %} {% if detections2pid|get_detection_by_pid:process.pid %} {{ detections2pid|get_detection_by_pid:process.pid }} diff --git a/web/templates/analysis/generic/_file_info.html b/web/templates/analysis/generic/_file_info.html index fdff27ff6d0..5dc25d1e7d9 100644 --- a/web/templates/analysis/generic/_file_info.html +++ b/web/templates/analysis/generic/_file_info.html @@ -407,7 +407,7 @@
File
Strings
- 
{% for string in file.strings %}{{string}}
{% endfor %}
+ 
{% for string in file.strings %}{{string}}
{% endfor %}
@@ -418,7 +418,7 @@
File
.NET Strings
- 
{% for string in file.dotnet_strings %}{{string}}
{% endfor %}
+ 
{% for string in file.dotnet_strings %}{{string}}
{% endfor %}
@@ -429,7 +429,7 @@
File
Extracted Text
- 
{{file.data|escape}}
+ 
{{file.data|escape}}
@@ -440,7 +440,7 @@
File
Decoded File Content
- 
{{file.decoded_files|escape}}
+ 
{{file.decoded_files|escape}}
diff --git a/web/templates/analysis/generic/_floss.html b/web/templates/analysis/generic/_floss.html index da479839592..074d8f13771 100644 --- a/web/templates/analysis/generic/_floss.html +++ b/web/templates/analysis/generic/_floss.html @@ -10,7 +10,7 @@
FL
Decoded Strings
- 
{% for string in file.floss.decoded_strings %}{{string}}
{% endfor %}
+ 
{% for string in file.floss.decoded_strings %}{{string}}
{% endfor %}
@@ -21,7 +21,7 @@
Decoded Strings
Stack Strings
- 
{% for string in file.floss.stack_strings %}{{string}}
{% endfor %}
+ 
{% for string in file.floss.stack_strings %}{{string}}
{% endfor %}
@@ -32,7 +32,7 @@
Stack Strings
Tight Strings
- 
{% for string in file.floss.tight_strings %}{{string}}
{% endfor %}
+ 
{% for string in file.floss.tight_strings %}{{string}}
{% endfor %}
@@ -43,7 +43,7 @@
Tight Strings
Static Strings
- 
{% for string in file.floss.static_strings %}{{string}}
{% endfor %}
+ 
{% for string in file.floss.static_strings %}{{string}}
{% endfor %}
diff --git a/web/templates/analysis/generic/_java.html b/web/templates/analysis/generic/_java.html index a5dd91f3f8e..e23a7d8c355 100644 --- a/web/templates/analysis/generic/_java.html +++ b/web/templates/analysis/generic/_java.html @@ -7,7 +7,7 @@
Java D {% if file.java and file.java.decompiled %}
- 
{{file.java.decompiled}}
+ 
{{file.java.decompiled}}
{% else %} diff --git a/web/templates/analysis/generic/_office.html b/web/templates/analysis/generic/_office.html index e914afbe30d..0b99b388d0d 100644 --- a/web/templates/analysis/generic/_office.html +++ b/web/templates/analysis/generic/_office.html @@ -123,7 +123,7 @@

- 
{{code}}
+ 
{{code}}
diff --git a/web/templates/analysis/generic/_pdf.html b/web/templates/analysis/generic/_pdf.html index cecf97dc2fa..52d7ab1fd84 100644 --- a/web/templates/analysis/generic/_pdf.html +++ b/web/templates/analysis/generic/_pdf.html @@ -132,7 +132,7 @@

Size: {{obj.Size}} bytes

Offset: {{obj.Offset}}

- 
{{obj.Data|linebreaksbr}}
+ 
{{obj.Data|linebreaksbr}}
diff --git a/web/templates/analysis/generic/_xlmmacro.html b/web/templates/analysis/generic/_xlmmacro.html index 0127e2b4144..96914e013a5 100644 --- a/web/templates/analysis/generic/_xlmmacro.html +++ b/web/templates/analysis/generic/_xlmmacro.html @@ -6,7 +6,7 @@

- 
{% for line in file.office.XLMMacroDeobfuscator.Code %}{{line}}
{% endfor %}
+ 
{% for line in file.office.XLMMacroDeobfuscator.Code %}{{line}}
{% endfor %}
diff --git a/web/templates/analysis/network/_cif.html b/web/templates/analysis/network/_cif.html index 00e8f6f18c5..878e7889caf 100644 --- a/web/templates/analysis/network/_cif.html +++ b/web/templates/analysis/network/_cif.html @@ -30,10 +30,6 @@
CIF {% endfor %} - {% else %} -
-
No CIF Results
-
{% endif %} diff --git a/web/templates/analysis/network/_dns.html b/web/templates/analysis/network/_dns.html index 0a6b0521b68..76dc0c431b6 100644 --- a/web/templates/analysis/network/_dns.html +++ b/web/templates/analysis/network/_dns.html @@ -80,10 +80,6 @@
DNS Reque {% endfor %} - {% else %} -
-
No domains contacted.
-
{% endif %} diff --git a/web/templates/analysis/network/_hosts.html b/web/templates/analysis/network/_hosts.html index 4326aca1a53..1ea14a9f759 100644 --- a/web/templates/analysis/network/_hosts.html +++ b/web/templates/analysis/network/_hosts.html @@ -68,10 +68,6 @@
Hosts - {% else %} -
-
No hosts contacted.
-
{% endif %} diff --git a/web/templates/analysis/network/_http.html b/web/templates/analysis/network/_http.html index af715355e64..898662ca1fd 100644 --- a/web/templates/analysis/network/_http.html +++ b/web/templates/analysis/network/_http.html @@ -22,6 +22,8 @@
HTTP Re {% else %} Request: {% endif %} + Hexdump + {% for value in http.request|network_rn %}
  • {{value}}
    • {% endfor %} @@ -34,6 +36,8 @@
    HTTP Re {% else %} Response: {% endif %} + Hexdump + {% for value in http.response|network_rn %}
  • {{value}}
    • {% endfor %} @@ -73,23 +77,46 @@
    HTTP Re {% for request in network.http %} {{request.uri}} {% if request.source == "behavior" %}behavior{% endif %} - 
    {{request.data}}
    - {% if settings.NETWORK_PROC_MAP %} - - {% if request.process_name %} - {{ request.process_name }}{% if request.process_id %} ({{ request.process_id }}){% endif %} - {% else %} - - - {% endif %} - - {% endif %} + + Hexdump + 
    {{request.data}}
    + {% if settings.NETWORK_PROC_MAP %} + + {% if request.process_name %} + {{ request.process_name }}{% if request.process_id %} ({{ request.process_id }}){% endif %} + {% else %} + - + {% endif %} + + {% endif %} + {% endfor %} -{% else %} -
    -
    No HTTP(s) requests performed.
    -
    {% endif %} + + diff --git a/web/templates/analysis/network/_icmp.html b/web/templates/analysis/network/_icmp.html index 526cf7db7af..7994da71286 100644 --- a/web/templates/analysis/network/_icmp.html +++ b/web/templates/analysis/network/_icmp.html @@ -31,9 +31,5 @@
    ICMP Tra {% endfor %} -{% else %} -
    -
    No ICMP traffic performed.
    -
    {% endif %} diff --git a/web/templates/analysis/network/_irc.html b/web/templates/analysis/network/_irc.html index e6d2961f209..395c24899a3 100644 --- a/web/templates/analysis/network/_irc.html +++ b/web/templates/analysis/network/_irc.html @@ -29,9 +29,5 @@
    IRC Tr {% endfor %} -{% else %} -
    -
    No IRC requests performed.
    -
    {% endif %} diff --git a/web/templates/analysis/network/_smtp.html b/web/templates/analysis/network/_smtp.html index a0971a15ee4..582b2f26760 100644 --- a/web/templates/analysis/network/_smtp.html +++ b/web/templates/analysis/network/_smtp.html @@ -81,9 +81,5 @@
    SMTP T {% endfor %} -{% else %} -
    -
    No SMTP traffic performed.
    -
    {% endif %} diff --git a/web/templates/analysis/network/_suricata_alerts.html b/web/templates/analysis/network/_suricata_alerts.html index d1cf77ab04c..3cf3dd8453d 100644 --- a/web/templates/analysis/network/_suricata_alerts.html +++ b/web/templates/analysis/network/_suricata_alerts.html @@ -82,10 +82,6 @@
    -
    No Suricata Alerts
    - {% endif %} diff --git a/web/templates/analysis/network/_suricata_files.html b/web/templates/analysis/network/_suricata_files.html index 425160afbdb..4fc8f93ba75 100644 --- a/web/templates/analysis/network/_suricata_files.html +++ b/web/templates/analysis/network/_suricata_files.html @@ -134,6 +134,4 @@ {% endfor %} -{% else %} -
    Sorry! No Suricata Extracted files.
    {% endif %} diff --git a/web/templates/analysis/network/_suricata_http.html b/web/templates/analysis/network/_suricata_http.html index a90a4d91f1e..a8563998e79 100644 --- a/web/templates/analysis/network/_suricata_http.html +++ b/web/templates/analysis/network/_suricata_http.html @@ -95,10 +95,6 @@
    Suricata {% endfor %} - {% else %} -
    -
    No Suricata HTTP
    -
    {% endif %} diff --git a/web/templates/analysis/network/_suricata_tls.html b/web/templates/analysis/network/_suricata_tls.html index dbd0d2bf1f9..484a68a2414 100644 --- a/web/templates/analysis/network/_suricata_tls.html +++ b/web/templates/analysis/network/_suricata_tls.html @@ -71,10 +71,6 @@
    Suricata T {% endfor %} - {% else %} -
    -
    No Suricata TLS
    -
    {% endif %} diff --git a/web/templates/analysis/network/_tcp.html b/web/templates/analysis/network/_tcp.html index 54f03cf8832..356270bcc9a 100644 --- a/web/templates/analysis/network/_tcp.html +++ b/web/templates/analysis/network/_tcp.html @@ -1,14 +1,9 @@ -
    -
    -
    -
    TCP Connections
    -
    {% if network.tcp %} -
    +

    TCP

    - +
    @@ -41,13 +36,7 @@
    T
    - - {% else %} -
    -
    No TCP connections recorded.
    -
    {% endif %} - {% if network.pcap_sha256 %}
    @@ -32,11 +33,7 @@ {% if network.tcp %} -
  • - - TCP ({{ network.tcp|length }}) - -
    • +
  • TCP ({{ network.tcp|length }})
    • {% endif %} {% if network.udp %}
  • diff --git a/web/templates/analysis/overview/_info.html b/web/templates/analysis/overview/_info.html index 969ae5cfd75..f7b4f26c54c 100644 --- a/web/templates/analysis/overview/_info.html +++ b/web/templates/analysis/overview/_info.html @@ -168,7 +168,7 @@
    Analysis Errors/Warnings:
    Options
    - 
    {% for key, val in analysis.info.options.items %}{{ key }}={{ val }}
    {% endfor %}
    + 
    {% for key, val in analysis.info.options.items %}{{ key }}={{ val }}
    {% endfor %}
    {% endif %} diff --git a/web/templates/analysis/overview/_statistics.html b/web/templates/analysis/overview/_statistics.html index 15bf0a1b245..82181e526b8 100644 --- a/web/templates/analysis/overview/_statistics.html +++ b/web/templates/analysis/overview/_statistics.html @@ -3,14 +3,23 @@
    -
    - {% if analysis.info.category != "pcap" and analysis.info.category != "static" %} + {% if analysis.info.category != "pcap" and analysis.info.category != "static" %} {% if config.usage %}
    {% include "analysis/overview/_usage.html" %} @@ -18,19 +27,20 @@
    {% endif %} {% endif %} - -
    +
    {% if analysis.statistics.processing %} -
    -
    -
    - Processing {{ stats_total.processing }}s +
    +
    +
    + Processing + {{ stats_total.processing }}s
    -
      +
        {% for stat in analysis.statistics.processing|dictsortreversed:"time" %} {% if stat.time %}
      • - {{stat.time}}s {{stat.name}} + {{ stat.time }}s + {{ stat.name }}
        • {% endif %} {% endfor %} @@ -38,18 +48,19 @@
    {% endif %} - {% if analysis.statistics.signatures %} -
    -
    -
    - Signatures {{ stats_total.signatures }}s +
    +
    +
    + Signatures + {{ stats_total.signatures }}s
    -
      +
        {% for stat in analysis.statistics.signatures|dictsortreversed:"time" %} {% if stat.time %}
      • - {{stat.time}}s {{stat.name}} + {{ stat.time }}s + {{ stat.name }}
        • {% endif %} {% endfor %} @@ -57,18 +68,19 @@
    {% endif %} - {% if analysis.statistics.reporting %} -
    -
    -
    - Reporting {{ stats_total.reporting }}s +
    +
    +
    + Reporting + {{ stats_total.reporting }}s
    -
      +
        {% for stat in analysis.statistics.reporting|dictsortreversed:"time" %} {% if stat.time %}
      • - {{stat.time}}s {{stat.name}} + {{ stat.time }}s + {{ stat.name }}
        • {% endif %} {% endfor %} diff --git a/web/templates/analysis/overview/_summary.html b/web/templates/analysis/overview/_summary.html index c8511a3f960..317961430a1 100644 --- a/web/templates/analysis/overview/_summary.html +++ b/web/templates/analysis/overview/_summary.html @@ -7,8 +7,8 @@
        Summa
        -
    • Source Source Port