[Bro] Renaming carved files

Michał Purzyński michalpurzynski1 at gmail.com
Thu Mar 3 14:28:13 PST 2016


> I'd be curious to see how many files don't match their declared mime types, I bet a lot.  I thought about writing a script to do this once, but then stopped myself because at the very least, there are lots of favicon files that are jpegs and gifs, but the remote server even declares in the header that it's actually an icon file (since servers typically just base on the file extension).  I would still be interested to see what people's experiences are if anyone ever takes it on though (i.e., does it catch anything worth following).
> 

That's exactly the kind of script I've just written. Will send an update how it behaves in a week or so. It's going to be deployed in several busy offices.


> Thanks,
>  .Seth
> 
> --
> Seth Hall
> International Computer Science Institute
> (Bro) because everyone has a network
> http://www.bro.org/
> 
> 
> _______________________________________________
> Bro mailing list
> bro at bro-ids.org
> http://mailman.ICSI.Berkeley.EDU/mailman/listinfo/bro



More information about the Bro mailing list