dfir

Hello Zeek's community!

Zeek (master and 4.1) corrupts extracted PE executable from an HTTP response if the request has a non-expected Content-Type. Here is a proof-of-concept PCAP with two HTTP responses returning the same file but with different Content-Types. The first one with the right Content-Type "application/x-msdownload" and another one with "message/rfc822".

Zeek extracts the f

https://github.com/google/timesketch/blob/fce0f54e20d9385b264f2401079dbeb5ad773a38/timesketch/frontend/src/components/Common/UploadForm.vue#L124

Uploading a foobar.txt file that has CSV content would still get uploaded and errored out on the backend side, even if the Client JS should error out already.

Request Method: POST
Status Code: 500 

I was wondering the benefit of using Modular File Management vs Single Config File Management? Why do you consider it easier to use multiple files and then compile? Trying to figure out what the best case is for my use case. Thanks. #