search

krmaxwell / maltrieve

A tool to retrieve malware directly from the source for security researchers.
GNU General Public License v3.0
562 stars 184 forks source link

Custom user agent #59

Closed krmaxwell closed 9 years ago

krmaxwell commented 10 years ago

Specify a User-Agent string in maltrieve.cfg, otherwise we default to

Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0)

Suggestions for better default welcome.

sroberts commented 10 years ago

I mean... there's something to be said for having your own user-agent for Maltrieve. It would provide good information for malware providing sites.

krmaxwell commented 10 years ago

:troll:

sroberts commented 10 years ago

Not really trolling, I honestly thing it's a legitimate idea. Giving people the chance to change it without digging too far into is a good thing, but by default I think it's valuable insight being lost. Just my 2c.

krmaxwell commented 10 years ago

The thing is that the actual malware sites sometimes change their response based on the user-agent. (This is probably a good research topic on its own.)

I think it could make sense to specify maltrieve to the listing sites, though.

krmaxwell commented 10 years ago

FWIW you can always set your User-Agent in the config file to Maltrieve if you want, @sroberts

sroberts commented 10 years ago

:metal: