Comments for Fireshark blog http://www.fireshark.org/blog linking the malicious web Sat, 29 May 2010 15:54:55 +0000 hourly 1 http://wordpress.org/?v=3.3.2 Comment on Fireshark 1.0 Pre-release! by Eli Kirk http://www.fireshark.org/blog/?p=4&cpage=1#comment-15 Eli Kirk Sat, 29 May 2010 15:54:55 +0000 http://www.fireshark.org/blog/?p=4#comment-15 Heh I am actually the only comment to this great post. Heh I am actually the only comment to this great post.

]]> Comment on Plans for new version (Fireshark 1.1) by hank http://www.fireshark.org/blog/?p=8&cpage=1#comment-13 hank Thu, 27 May 2010 16:08:10 +0000 http://www.fireshark.org/blog/?p=8#comment-13 Hi Stephan, Thanks for the reply. about the META data "REFRESH" tag, that is exactly what I said. I think I illustrate the problem badly. What I want to said is it will not be log correctly when I put the another link after redirection link. for example, URL A will redirect user to URLB, When I write the data.txt file like this: ULRA URLC It will only log URL A and URL C without URL B However, I I write the file like ; URLC URLA, Then I will log all the URLs, including URL A B, and C About different kind of redirectors, I am interested in three kind of redirection methods, 1) HTTP status, 2)Meta Data "REFRESH" tag, and 3) JavaScript redirection. 1) HTTP status: It is already shown in the raw log file as you said. 2) Meta data: I find it will be logged as another "urlloadded" , 3) JavaScript: the basic one might look like this window.location = http://redirect.html There are other more complicated ways to do redirection in JavaScript. I just want to group them in the same group. Thanks. Hi Stephan,
Thanks for the reply.
about the META data “REFRESH” tag, that is exactly what I said.
I think I illustrate the problem badly.
What I want to said is it will not be log correctly when I put the another link after redirection link.
for example, URL A will redirect user to URLB,
When I write the data.txt file like this:
ULRA
URLC
It will only log URL A and URL C without URL B
However, I I write the file like ;
URLC
URLA,
Then I will log all the URLs, including URL A B, and C

About different kind of redirectors, I am interested in three kind of redirection methods, 1) HTTP status, 2)Meta Data “REFRESH” tag, and 3) JavaScript redirection.
1) HTTP status: It is already shown in the raw log file as you said.
2) Meta data: I find it will be logged as another “urlloadded” ,
3) JavaScript: the basic one might look like this

window.location = http://redirect.html

There are other more complicated ways to do redirection in JavaScript. I just want to group them in the same group.

Thanks.

]]> Comment on Plans for new version (Fireshark 1.1) by Stephan Chenette http://www.fireshark.org/blog/?p=8&cpage=1#comment-10 Stephan Chenette Wed, 26 May 2010 06:53:44 +0000 http://www.fireshark.org/blog/?p=8#comment-10 Hi Hank, Fireshark should follow meta refresh tags correctly. you specifically mean something in this form right? <META HTTP-EQUIV="Refresh" CONTENT="3;URL=http://www.some.org/some.html"> All Fireshark is doing is logging while Firefox does all the hard work, but the question then becomes if it logging it in a way that the redirect is linked correctly. I'll test it out and make sure. As for your second question, you can see 302s by looking at the connection type event and looking for status, you should see a 302 if you look at the raw log (reportlog.yml). The other option is to run the post-processing scripts and look at the graphviz graph and the incoming edges are actually the server status codes, so that should be a large indicator. This will only work if it's a 302 redirect though. Anything else might just look like a connection type in the logs. list out the possibly redirectors you might be interested in and I'll try to help figure out how the log will show you it's a redirector, if it's not possible I'll make sure to include it in version two, which was supposed to be due out end of June, but has been delayed due to priorities. Hi Hank,

Fireshark should follow meta refresh tags correctly.
you specifically mean something in this form right?

<META HTTP-EQUIV=”Refresh” CONTENT=”3;URL=http://www.some.org/some.html”>

All Fireshark is doing is logging while Firefox does all the hard work, but the question then becomes if it logging it in a way that the redirect is linked correctly. I’ll test it out and make sure.

As for your second question, you can see 302s by looking at the connection type event and looking for status, you should see a 302 if you look at the raw log (reportlog.yml). The other option is to run the post-processing scripts and look at the graphviz graph and the incoming edges are actually the server status codes, so that should be a large indicator. This will only work if it’s a 302 redirect though. Anything else might just look like a connection type in the logs.

list out the possibly redirectors you might be interested in and I’ll try to help figure out how the log will show you it’s a redirector, if it’s not possible I’ll make sure to include it in version two, which was supposed to be due out end of June, but has been delayed due to priorities.

]]> Comment on Plans for new version (Fireshark 1.1) by hank http://www.fireshark.org/blog/?p=8&cpage=1#comment-9 hank Tue, 25 May 2010 18:13:01 +0000 http://www.fireshark.org/blog/?p=8#comment-9 Hi, I just found that fireshark will not follow mate data refresh tag correctly if I put another linke after that one. For example I wrote the data.txt file like this: http://example_mate_redirect.html http://exaplme2.html The other question is : From the reportlog.yml file, Is there any way I can tell what kind of redirection methods the URLs use (if they do). For example some URL may use 302 redirect, and someone may use JavaScripts, I would like to which method they use. Thanks for response in advance Hi,
I just found that fireshark will not follow mate data refresh tag correctly if I put another linke after that one. For example I wrote the data.txt file like this:
http://example_mate_redirect.html
http://exaplme2.html

The other question is :
From the reportlog.yml file, Is there any way I can tell what kind of redirection methods the URLs use (if they do).
For example some URL may use 302 redirect, and someone may use JavaScripts, I would like to which method they use.

Thanks for response in advance

]]> Comment on About by hank http://www.fireshark.org/blog/?page_id=2&cpage=1#comment-8 hank Tue, 25 May 2010 18:06:52 +0000 http://www.fireshark.org/blog/?page_id=2#comment-8 Hi, I found that fireshark will not follow the meta refresh redirect correctly when I put another link after redirect one. like this: http://example_meta_redirect.html http://example2.html and the other question is , is there anyway that I can tell what kind of redirection method the URL use from reportlog.yml ? For example someone may use Javascript, http status code or Meta data reflash flag. Thanks for your response first. Hi,
I found that fireshark will not follow the meta refresh redirect correctly when I put another link after redirect one.
like this:
http://example_meta_redirect.html
http://example2.html

and the other question is , is there anyway that I can tell what kind of redirection method the URL use from reportlog.yml ?
For example someone may use Javascript, http status code or Meta data reflash flag.

Thanks for your response first.

]]> Comment on Plans for new version (Fireshark 1.1) by Stephan Chenette http://www.fireshark.org/blog/?p=8&cpage=1#comment-3 Stephan Chenette Sun, 25 Apr 2010 17:10:52 +0000 http://www.fireshark.org/blog/?p=8#comment-3 Documentation is def. lacking right now as I explained in my previous post, but check out the download link, you'll find a "quick" explanation of how to run it. When I release 1.1 there will be full documentation. thanks for the patience. Documentation is def. lacking right now as I explained in my previous post, but check out the download link, you’ll find a “quick” explanation of how to run it. When I release 1.1 there will be full documentation. thanks for the patience.

]]> Comment on Plans for new version (Fireshark 1.1) by urrgh http://www.fireshark.org/blog/?p=8&cpage=1#comment-2 urrgh Sun, 25 Apr 2010 02:54:23 +0000 http://www.fireshark.org/blog/?p=8#comment-2 i like the idea, but would anyone tell me how to run it? see no button for doing anything... i like the idea, but would anyone tell me how to run it? see no button for doing anything…

]]>