dissect.cobaltstrike 1.2.1.dev6__tar.gz → 1.2.1.dev7__tar.gz
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- {dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/PKG-INFO +6 -2
- {dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/README.rst +5 -1
- {dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/dissect/cobaltstrike/_version.py +2 -2
- {dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/docs/installation.rst +13 -4
- {dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/docs/tutorials/decrypt_cobaltstrike_pcaps.rst +1 -1
- {dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/docs/tutorials/minimal_beacon_client.rst +1 -1
- {dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/.github/workflows/dissect-ci.yml +0 -0
- {dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/.gitignore +0 -0
- {dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/.lfs-assets-id +0 -0
- {dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/.pre-commit-config.yaml +0 -0
- {dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/.readthedocs.yml +0 -0
- {dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/LICENSE +0 -0
- {dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/codecov.yml +0 -0
- {dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/dissect/cobaltstrike/__init__.py +0 -0
- {dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/dissect/cobaltstrike/artifact.py +0 -0
- {dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/dissect/cobaltstrike/beacon.py +0 -0
- {dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/dissect/cobaltstrike/c2.py +0 -0
- {dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/dissect/cobaltstrike/c2profile.lark +0 -0
- {dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/dissect/cobaltstrike/c2profile.py +0 -0
- {dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/dissect/cobaltstrike/c_c2.py +0 -0
- {dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/dissect/cobaltstrike/client.py +0 -0
- {dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/dissect/cobaltstrike/pcap.py +0 -0
- {dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/dissect/cobaltstrike/pe.py +0 -0
- {dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/dissect/cobaltstrike/utils.py +0 -0
- {dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/dissect/cobaltstrike/version.py +0 -0
- {dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/dissect/cobaltstrike/xordecode.py +0 -0
- {dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/docs/Makefile +0 -0
- {dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/docs/c2profile-grammar.rst +0 -0
- {dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/docs/codespell-ignore-words.txt +0 -0
- {dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/docs/conf.py +0 -0
- {dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/docs/examples.rst +0 -0
- {dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/docs/images/beacon-client.png +0 -0
- {dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/docs/images/teamserver-echoclient.png +0 -0
- {dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/docs/images/teamserver_ls.png +0 -0
- {dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/docs/images/vt-cobaltstrike-43-zip.png +0 -0
- {dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/docs/index.rst +0 -0
- {dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/docs/license.rst +0 -0
- {dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/docs/scripts/checksum8-accesslogs.rst +0 -0
- {dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/docs/scripts/dump_beacon_keys.rst +0 -0
- {dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/docs/scripts/example_client.rst +0 -0
- {dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/docs/scripts/index.rst +0 -0
- {dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/docs/structures/c2_def.rst +0 -0
- {dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/docs/structures/cs_def.rst +0 -0
- {dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/docs/structures/index.rst +0 -0
- {dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/docs/structures/pe_def.rst +0 -0
- {dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/docs/tools/beacon-artifact.rst +0 -0
- {dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/docs/tools/beacon-client.rst +0 -0
- {dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/docs/tools/beacon-dump.rst +0 -0
- {dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/docs/tools/beacon-pcap.rst +0 -0
- {dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/docs/tools/beacon-xordecode.rst +0 -0
- {dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/docs/tools/c2profile-dump.rst +0 -0
- {dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/docs/tutorials/index.rst +0 -0
- {dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/pyproject.toml +0 -0
- {dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/scripts/checksum8-accesslogs.py +0 -0
- {dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/scripts/dump_beacon_keys.py +0 -0
- {dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/scripts/example_client.py +0 -0
- {dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/tests/conftest.py +0 -0
- {dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/tests/test_beacon.py +0 -0
- {dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/tests/test_c2.py +0 -0
- {dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/tests/test_c2profile.py +0 -0
- {dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/tests/test_client.py +0 -0
- {dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/tests/test_pe.py +0 -0
- {dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/tests/test_utils.py +0 -0
- {dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/tests/test_version.py +0 -0
- {dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/tests/test_xordecode.py +0 -0
- {dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/tox.ini +0 -0
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
Metadata-Version: 2.3
|
|
2
2
|
Name: dissect.cobaltstrike
|
|
3
|
-
Version: 1.2.1.
|
|
3
|
+
Version: 1.2.1.dev7
|
|
4
4
|
Summary: a Python library for dissecting Cobalt Strike related data
|
|
5
5
|
Project-URL: Homepage, https://github.com/fox-it/dissect.cobaltstrike
|
|
6
6
|
Project-URL: Documentation, https://dissect-cobaltstrike.readthedocs.io/
|
|
@@ -93,7 +93,11 @@ The library is available on `PyPI <https://pypi.org/project/dissect.cobaltstrike
|
|
|
93
93
|
|
|
94
94
|
Or install using the ``full`` extra to automatically install dependencies for C2 and PCAP support::
|
|
95
95
|
|
|
96
|
-
$ pip install dissect.cobaltstrike[full]
|
|
96
|
+
$ pip install 'dissect.cobaltstrike[full]'
|
|
97
|
+
|
|
98
|
+
If you want to install the latest pre-release version, use the ``--pre`` flag::
|
|
99
|
+
|
|
100
|
+
$ pip install --pre dissect.cobaltstrike
|
|
97
101
|
|
|
98
102
|
**dissect.cobaltstrike** requires Python 3.9 or later.
|
|
99
103
|
|
|
@@ -21,7 +21,11 @@ The library is available on `PyPI <https://pypi.org/project/dissect.cobaltstrike
|
|
|
21
21
|
|
|
22
22
|
Or install using the ``full`` extra to automatically install dependencies for C2 and PCAP support::
|
|
23
23
|
|
|
24
|
-
$ pip install dissect.cobaltstrike[full]
|
|
24
|
+
$ pip install 'dissect.cobaltstrike[full]'
|
|
25
|
+
|
|
26
|
+
If you want to install the latest pre-release version, use the ``--pre`` flag::
|
|
27
|
+
|
|
28
|
+
$ pip install --pre dissect.cobaltstrike
|
|
25
29
|
|
|
26
30
|
**dissect.cobaltstrike** requires Python 3.9 or later.
|
|
27
31
|
|
{dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/dissect/cobaltstrike/_version.py
RENAMED
|
@@ -12,5 +12,5 @@ __version__: str
|
|
|
12
12
|
__version_tuple__: VERSION_TUPLE
|
|
13
13
|
version_tuple: VERSION_TUPLE
|
|
14
14
|
|
|
15
|
-
__version__ = version = '1.2.1.
|
|
16
|
-
__version_tuple__ = version_tuple = (1, 2, 1, '
|
|
15
|
+
__version__ = version = '1.2.1.dev7'
|
|
16
|
+
__version_tuple__ = version_tuple = (1, 2, 1, 'dev7')
|
|
@@ -19,14 +19,23 @@ The following pip `extras` flavours are provided as well:
|
|
|
19
19
|
|
|
20
20
|
.. code-block:: bash
|
|
21
21
|
|
|
22
|
-
$ pip install dissect.cobaltstrike[c2]
|
|
23
|
-
$ pip install dissect.cobaltstrike[pcap]
|
|
24
|
-
$ pip install dissect.cobaltstrike[full]
|
|
22
|
+
$ pip install 'dissect.cobaltstrike[c2]'
|
|
23
|
+
$ pip install 'dissect.cobaltstrike[pcap]'
|
|
24
|
+
$ pip install 'dissect.cobaltstrike[full]'
|
|
25
25
|
|
|
26
26
|
* ``[c2]`` for if you want to communicate with Cobalt Strike Team Servers, eg: :doc:`tools/beacon-client`.
|
|
27
27
|
* ``[pcap]`` for if you want to parse and decrypt PCAPS containing Beacon traffic, eg: :doc:`tools/beacon-pcap`.
|
|
28
28
|
* ``[full]`` provides the above but also installs ``rich`` for prettier console logging.
|
|
29
29
|
|
|
30
|
+
Install the latest pre-release version
|
|
31
|
+
--------------------------------------
|
|
32
|
+
|
|
33
|
+
Every change to the main branch is packaged and uploaded to PyPi as a pre-release version, to install the latest pre-release version use the ``--pre`` flag:
|
|
34
|
+
|
|
35
|
+
.. code-block:: bash
|
|
36
|
+
|
|
37
|
+
$ pip install --pre dissect.cobaltstrike
|
|
38
|
+
|
|
30
39
|
Installing from source
|
|
31
40
|
----------------------
|
|
32
41
|
|
|
@@ -36,7 +45,7 @@ If you want to install ``dissect.cobaltstrike`` from source, you can use the fol
|
|
|
36
45
|
|
|
37
46
|
$ git clone https://github.com/fox-it/dissect.cobaltstrike.git
|
|
38
47
|
$ cd dissect.cobaltstrike
|
|
39
|
-
$ pip install --editable .[full]
|
|
48
|
+
$ pip install --editable '.[full]'
|
|
40
49
|
|
|
41
50
|
Using a virtual environment is recommended. Using the ``--editable`` flag ensures that any changes you make to the source code directly affects the installed package.
|
|
42
51
|
|
|
@@ -26,7 +26,7 @@ First we ensure that we have ``dissect.cobaltstrike`` installed with PCAP suppor
|
|
|
26
26
|
|
|
27
27
|
.. code-block:: bash
|
|
28
28
|
|
|
29
|
-
$ pip install dissect.cobaltstrike[pcap]
|
|
29
|
+
$ pip install 'dissect.cobaltstrike[pcap]'
|
|
30
30
|
|
|
31
31
|
This also installs the ``pyshark`` Python package but it still requires the ``tshark`` binary from Wireshark_ to work.
|
|
32
32
|
Ensure that you have Wireshark_ installed or install the ``tshark`` binary, for example on Ubuntu or Debian systems you can install it with:
|
|
@@ -26,7 +26,7 @@ First we install ``dissect.cobaltstrike`` with the ``[c2]`` extra, as we are goi
|
|
|
26
26
|
|
|
27
27
|
.. code-block:: bash
|
|
28
28
|
|
|
29
|
-
$ pip install dissect.cobaltstrike[c2]
|
|
29
|
+
$ pip install 'dissect.cobaltstrike[c2]'
|
|
30
30
|
|
|
31
31
|
This installs the necessary dependencies such as `PyCryptodome` and `httpx`.
|
|
32
32
|
|
{dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/.github/workflows/dissect-ci.yml
RENAMED
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
{dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/dissect/cobaltstrike/__init__.py
RENAMED
|
File without changes
|
{dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/dissect/cobaltstrike/artifact.py
RENAMED
|
File without changes
|
{dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/dissect/cobaltstrike/beacon.py
RENAMED
|
File without changes
|
{dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/dissect/cobaltstrike/c2.py
RENAMED
|
File without changes
|
|
File without changes
|
|
File without changes
|
{dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/dissect/cobaltstrike/c_c2.py
RENAMED
|
File without changes
|
{dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/dissect/cobaltstrike/client.py
RENAMED
|
File without changes
|
{dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/dissect/cobaltstrike/pcap.py
RENAMED
|
File without changes
|
{dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/dissect/cobaltstrike/pe.py
RENAMED
|
File without changes
|
{dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/dissect/cobaltstrike/utils.py
RENAMED
|
File without changes
|
{dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/dissect/cobaltstrike/version.py
RENAMED
|
File without changes
|
|
File without changes
|
|
File without changes
|
{dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/docs/c2profile-grammar.rst
RENAMED
|
File without changes
|
{dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/docs/codespell-ignore-words.txt
RENAMED
|
File without changes
|
|
File without changes
|
|
File without changes
|
{dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/docs/images/beacon-client.png
RENAMED
|
File without changes
|
|
File without changes
|
{dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/docs/images/teamserver_ls.png
RENAMED
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
{dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/docs/scripts/example_client.rst
RENAMED
|
File without changes
|
|
File without changes
|
{dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/docs/structures/c2_def.rst
RENAMED
|
File without changes
|
{dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/docs/structures/cs_def.rst
RENAMED
|
File without changes
|
{dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/docs/structures/index.rst
RENAMED
|
File without changes
|
{dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/docs/structures/pe_def.rst
RENAMED
|
File without changes
|
{dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/docs/tools/beacon-artifact.rst
RENAMED
|
File without changes
|
{dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/docs/tools/beacon-client.rst
RENAMED
|
File without changes
|
{dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/docs/tools/beacon-dump.rst
RENAMED
|
File without changes
|
{dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/docs/tools/beacon-pcap.rst
RENAMED
|
File without changes
|
{dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/docs/tools/beacon-xordecode.rst
RENAMED
|
File without changes
|
{dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/docs/tools/c2profile-dump.rst
RENAMED
|
File without changes
|
{dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/docs/tutorials/index.rst
RENAMED
|
File without changes
|
|
File without changes
|
{dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/scripts/checksum8-accesslogs.py
RENAMED
|
File without changes
|
{dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/scripts/dump_beacon_keys.py
RENAMED
|
File without changes
|
{dissect_cobaltstrike-1.2.1.dev6 → dissect_cobaltstrike-1.2.1.dev7}/scripts/example_client.py
RENAMED
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|