Skip to content

WhoYouCalling v1.5 🗺️

Choose a tag to compare

View all tags
@H4NM H4NM released this 18 Feb 20:56
· 11 commits to main since this release
v1.5
1c64327
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

This release includes some minor changes and one medium and one minor bug fix, but above all it includes CallMapper - a Python and JavaScript solution for that enables an interactive network graph of all the processes and their respective network activity from a WhoYouCalling session. CallMapper also allows for conducting automatic API lookups for all of the endpoints identified - except ofcourse of single-label domains, private or localhost IPs. Currently, i've only integrated VirusTotal and AbuseIPDB as available APIs, in which you need to supply API-keys for them. I also came to the realization that a solution that integrates API lookups is the most applicable if you as end users are able to add your own REST APIs for enriching data as you see fit - especially since there are tons of different IP and domain lookup APIs.... Therefore, CallMapper includes functionality to streamline the process of adding custom REST APIs. See CallMapper README.md for more instructions on how to do so. I've also extended the GitHub actions to better catch potential bugs that may be introduced. Now they execute all three WYC modes (Execute, Listen and Illuminate). If you appreciate this MIT-project and want to buy me a coffee, i've added my link ☕ #WhoYouCallingET :suspect:

Changelog

✨Features:

  • Add interactive network graph visualization of data and possibility of automatically performing API lookups to get reputation
  • Add Hostname to the summary output

📄Changes:

  • Change main folder name for when listening to a specific PID where it now takes the process name rather than the executable as it sometimes was problematic due to protected processes
  • Rename ProcessID to PID in for ChildProcessInfo for consistency
  • Expanded GitHub actions to execute WYC with the three main modes
  • Set default value of CommandLine to null rather than empty string for monitored processes for consitency
  • Adressed build warnings
  • Update README.md
  • Update LICENSE

🛠️ Fixes:

  • Fix logic for indexing short lived processes that are started where WYC would state that that they couldn't be succcessfully be mapped.
  • Fix logic for when executing a binary to correctly retrieve its process name.
  • Fix bug where it was not possible to execute an application unprivileged, see #11. The extended GitHub actions is meant to catch this as early as possible
  • Fix issue with Listen mode where the retrieved process name of the PID wasn't successfully added as a monitored process
Get-FileHash -path .\*1.5*.zip -algo sha256

Algorithm       Hash                                                                   Path
---------       ----                                                                   ----
SHA256          1CC76FAC345C46773C640F3DB6E58E660CB800D60CE069C8C6715C52563CDB64       CallMapper-1.5.zip
SHA256          FEB8729C28A4A4D9D3B2D30E6FE2DFD75CDB73622A7C3E11635C29B505D5D0ED       WhoYouCalling-1.5-x64-selfcontained.zip
SHA256          4C9D0779712A41213B8B59C40CE2878F7C0698988A8E38D1C8B5B8FF657E871A       WhoYouCalling-1.5-x86-selfcontained.zip
Assets 5
Loading