[Bro] Quick smtp-url-extraction question

[James Lay]

On 2014-08-07 11:26, Seth Hall wrote:
> On Aug 7, 2014, at 12:26 PM, James Lay <jlay at slave-tothe-box.net> 
> wrote:
>
>> sudo bro -C -r ../captures/email.pcapng
>> 
>> /usr/local/bro/share/bro/policy/frameworks/intel/seen/smtp-url-extraction.bro
>
> Ah!  Perhaps a poorly named script.  That's only extracting the URLs
> and feeding them into the intel framework.
>
> Would you like a script that extracts and logs them?  I ran one of
> those in production before, it was useful to be able to see what 
> links
> were flying around for sure.
>
> I'm thinking for fields we could have...
>
> 	ts
> 	uid
> 	fuid
> 	trans_depth
> 	link
>
> That should provide enough information to link back to the connection
> it happened over and which "file" (or body content since they're
> effectively the same in smtp) it was seen within.
>
>   .Seth
>
> --
> Seth Hall
> International Computer Science Institute
> (Bro) because everyone has a network
> http://www.bro.org/

I would absolutely love a script that would log urls....we all know 
that quoted-printable and bas364 shenanigans may get missed, but every 
little bit helps..thanks a bunch Seth.

James