[Bug] Attachments (txt) are not parsed

[ClaudioWayne]

[Bug] Attachments (txt) are not parsed

[ClaudioWayne]

It seems to be that plaintext is ignored other file types are working. so i guess A is solved.
Thx

[emalderson]

Hello, thanks for having taken the time to thoroughly explain the problems you have faced.

A) - Attachments are not parsed

As you have already found out, the problem is only with the plaintext files. This is because I have never encountered an email with a plaintext file as an attachment, so this behavior has never been tested. However, I have already identified the problem and it is solvable by adding a couple lines of code to consider the Content-Disposition MIME header, so I will fix this bug in the next commit.

B) - html-tags for hyperlinks gets recolonized as part of the URL

This seems to be a problem of the the library that I use to parse the IoCs (which is ioc-finder). I don't know if this problem is known by the maintainer or if it has been solved in any new commit, so I'll probably test the latest release of the library with some URLs and I hope I'll be able to reproduce this behavior. For this, I would be grateful if you could send me the email you have used so that I can test with the same URLs, since I've never faced this problem before. Maybe I can try to add some workaround and parse the already parsed observables to remove those characters related to HTML tags.

C) - mini report from the URL-Haus Analyzer is not shown in observables

That's quite odd. I am not able to reproduce this problem. Anyway this is a TheHive/Cortex problem since the analyzer is correctly started by ThePhish and the mini-reports are handled by TheHive.

[ClaudioWayne]

Hi thx for reply. How should i send you the mail?

[emalderson]

As an attachment to [email protected]

[ClaudioWayne]

done

[emalderson]

I haven't received anything

[ClaudioWayne]

Maybe Spam?!
Send you the mail attached as zip again.

[emalderson]

Ok, I have received the email. It seems that the URL is recognised twice (from the href attribute of the anchor element and from the content of that element) and only one of them contains the >< characters. I'll try to solve this problem, but in the meantime this should not invalidate the result of the analysis, since the link that contains the tag elements won't be recognized as malicious by any analyzer, while the correct one would, so the email would be marked as malicious anyway.

[emalderson]

Bug fixed with the latest commit.