Monthly Archives: March 2017

Script(s) to extract HTTP Host data from file

A while ago, created a new repository on GitHub for the scripts I wrote for DFIR. SinceĀ then, it only had the Computer Ping script in it. Today I added the first of the Extractor scripts.

The first extractor script, came about from a web based tool I used. It would run on a fileĀ uploaded to it, and then list a bunch of indicators, system artifacts, url calls outs, network communication, etc. However the tool didn’t have a good export mechanism at the time. So I would copy and paste everything to a text file, and then extract the url host details from the text files. Mainly so I could add the URL indicators to the web proxy.

Continue reading