urlquery.net

[MysteryFCM]

Ah, cheers

May be an idea to make that a little clearer, yes.

[SysAdMini]

I would like to see a column "Host" in http request table. I don't like that I have to click on each request line to see the host.
You could make the "Reponse" column smaller, but add a host column.

[tyriel]

I would like to see a column "Host" in http request table. I don't like that I have to click on each request line to see the host.
You could make the "Reponse" column smaller, but add a host column.

I can add the "Host" row from the http request header to the default text before you expand it. Sounds ok?

[SysAdMini]

I would like to see a column "Host" in http request table. I don't like that I have to click on each request line to see the host.
You could make the "Reponse" column smaller, but add a host column.

I'll can add the "Host" row from the http request header to the default text before you expand it. Sounds ok?

Sounds good.

[SysAdMini]

Let's start with reporting about missing detections.

Incognito exploit kit
example

Code: [Select]

buyaion.cu.cc/showthread.php?t=82651514
New Blackhole kit version

Code: [Select]

dreth543rwfdegrhjt.cz.cc/t/b56696ed19ad9fdfd35260d0a21bf00f

[SysAdMini]

No detection for exploits of CrimePack

Code: [Select]

greatyoutubevideos.info/nolock/index.php
vb6protected.com/nolock/index.php

[tyriel]

No detection for exploits of CrimePack

Code: [Select]

greatyoutubevideos.info/nolock/index.php
vb6protected.com/nolock/index.php

I'll have a closer look at those URL, not sure if they contain CrimePack tho, as one seems to use some Java code and the other seems to be dead at time of visit.

I'll update the BlackHole and Incognito signatures tonight with new patterns.


Thanks for feedback MDL!

[tyriel]

Let's start with reporting about missing detections.

Incognito exploit kit
example

Code: [Select]

buyaion.cu.cc/showthread.php?t=82651514

Anyone know what version of incognito this is?

I remember the old format from v2.0 was:

Code: [Select]

/in.php?a=QQkFBwQHBAEABQQMEkcJBQcEBwYABQcHDA==