Timeline for How do I safely inspect a potentially malicious website?
Current License: CC BY-SA 3.0
10 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jan 12, 2022 at 19:47 | comment | added | Rick | Great post. I'd love to see some sort of complete setup for a VM sandbox. Though there are probably pre-built images these days... | |
| Jun 14, 2016 at 17:25 | vote | accept | Mirsad | ||
| Apr 27, 2016 at 14:42 | comment | added | Alexander O'Mara | I understand, but this feature of curl is also quite useful for scanning for such malicious behavior. You could quickly check if malicious code is specifically severed to MS IE and no other browser. | |
| Apr 27, 2016 at 14:40 | comment | added | munkeyoto | @AlexanderO'Mara you're missing the gist of my comment. I am aware that user agents can be changed in curl, wget, etc. The point is to illustrate that malware authors can enable sending SPECIFIC types of pages based upon who/what is viewing the site | |
| Apr 27, 2016 at 14:37 | comment | added | Alexander O'Mara | Curl headers like the user agent can also be set via command line. | |
| Apr 26, 2016 at 23:18 | comment | added | cat | As @mirsad said, your URL-rewriting tricks are interesting but no match for my UA spoofery. | |
| Apr 26, 2016 at 21:49 | comment | added | Mirsad |
After all, you made a good point about user agents, but there is a solution for that, so by tweaking .curlrc the door can become open for analyizing. user-agent = "Mozilla/4.0 (Mozilla/4.0; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 3.0.04506.30)" and sometimes also tweaking referer can be useful, referer = "http://www.google.com/search?hl=en&q=web&aq=f&oq=&aqi=g1"
|
|
| Apr 26, 2016 at 20:14 | comment | added | Bacon Brad | I +1'd for the mention of rerouting using mod_rewrite and using a virtualized sandbox. But I agree with the OP's mention of how VirusTotal is not right for their purposes. Although it returns a lot of useful information it is not always guaranteed to be detected nor does it return a detailed analysis. As a test I once obfuscated my own code that exploited a then known browser exploit and VT never picked it up. Such would be a job for a virtualized sandbox like you mentioned. | |
| Apr 26, 2016 at 17:35 | comment | added | Mirsad | I want to do it manually, from VT I don't see some details that I' am interesting for it. Also I'm not sure how VT is handling obfuscated javascript and other hiding methods. False positives are another problem in this story. | |
| Apr 26, 2016 at 17:12 | history | answered | munkeyoto | CC BY-SA 3.0 |