Submit sample via email #568
Conversation
- Utility functions to extract attachments from MIME and RFC 2822-based message. - New API endpoint in api.py. The API accepts raw email text in either request body or form data (compatible with mailgun)
…, using the backend code from Edwin Chu cuckoosandbox/cuckoo#568
|
I like the integration with emails, but what happens when you have an email with multiple attachments? |
|
@jbremer Currently, multiple samples in an email will be submitted for analysis individually. Also, if the email contains attachments in RFC 2822-like format (e.g. a copy of email source code), it will parse the attachment and submit any attachment inside the attachment. It allows people to submit samples that they received via email using "Forward as Attachment" function in their email client. The raw email source (headers, email body, etc) is not used at this moment, but it could be saved for further analysis as well. |
|
I like this PR. |
This commit adds support and a unittest for [1]. The advantage being that we don't need special support for emails in the Cuckoo API or the Cuckoo Web Interface, but rather can use the to-be standard submission interface. [1]: cuckoosandbox/cuckoo#568
|
Little bit late to the party, but this functionality has now been included in https://github.com/jbremer/sflock, and will be incorporated in the Cuckoo API and Cuckoo Web Interface in a commit nearby. |
message.
request body or form data (compatible with mailgun)