[Bro] Extracting Email Attachments

[Digital Ninja]

So apparently I was incorrect in thinking that local.bro was loading
automatically when running bro from the command line.  Including the
local.bro policy successfully extracted the attachments.

What it also told me was that these two lines:
redef SMTP::extract_file = T;
redef SMTP::calc_md5 = T;

Are not valid.  But poking around a little bit in entities.bro I found the
generate_md5 mime-types and redefined that in the local.bro file.

Thanks for the help all!





On Fri, Mar 22, 2013 at 3:59 PM, Digital Ninja <dn1nj4 at gmail.com> wrote:

> I tried both:
> redef SMTP::extract_file_types += /application\/.*/;
> and
> redef SMTP::extract_file_types += /.*/;
>
> But still end up with no attachments in /tmp, nor MD5s in the
> smtp_entities.log.
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.ICSI.Berkeley.EDU/pipermail/bro/attachments/20130322/f745c780/attachment.html