New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Invalid URL under C2Server #478

Open

CrimsonGlory opened this issue Mar 22, 2021 · 1 comment

CrimsonGlory commented Mar 22, 2021

In the CAPE report, inside CAPE.configs, in a CobalStrike sample, I found the following value under "C2Server": 185.150.119.33,/pixel

There is a "," (comma) between the IP and the path which renders the URL invalid. Is this on purpose or is this a bug?

The sample hash is 1b9309cc3159a8dc44bcde02642e559b65d1065f

The text was updated successfully, but these errors were encountered:

Contributor

kevoreilly commented Mar 22, 2021

This comma is in the CS config data so not a bug - the parser just displays it as is. The original parser is from: https://github.com/Sentinel-One/CobaltStrikeParser/blob/master/parse_beacon_config.py

Unfortunately this is the wrong (dead) repo so I can't close this issue

CrimsonGlory mentioned this issue

Invalid URL under C2Server Sentinel-One/CobaltStrikeParser#6

Closed

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment