Welcome to the Mail DataBase although it has expanded slightly now. Here is a list of all the things it does at the moment
- The email parser will read the headers extracting the main fields
- Links, Img tags and Iframes sources extracted and listed
- Any attatchments are extracted, Hashed stored and scanned with Yara, optionally you can include options to scan with Clam AV and submit to Virus Total
- All the information extracted above is stored in to a SQLite Database as a Task.
- All files are stored for further analysis
- Options to submit file attatchments to Sandboxs, Cuckoo or FireEyes, MAS
###Http PCAP files
- Extract all the streams
- Parse the HTTP Headers
- Extract all the HTTP Objects and files
- Replicate the Server Path structure
- Write the Header data to the SQLite Database as a Task
- Micro management system allows you to track Tasks in the Database
- Add Comments to Tasks
- Set tasks as Reviewed, Events or Unchecked
- Generate, Weekly, Montly, Yearly reports on all Submitted tasks
- Trend analysis on all artefacts in the database
- Python 2.7
- Mako
- Bottle
- Yara
- BeautifulSoup (Included)
- Cuckoo
- SSDEEP
- python requests required for Cuckoo API
- See the INSTALL file for installation details
- Ubuntu 12.04
- Windows 7 x64
- Implement Cuckoo API
- Finish the VT Function
- Timer for the IMAP / POP Feeds
- More reports / trends.