mandiant / flare-fakenet-ng

FakeNet-NG - Next Generation Dynamic Network Analysis Tool
Apache License 2.0
1.73k stars 357 forks source link

Race condition writing HTTP posts to text files #174

Open strictlymike opened 4 months ago

strictlymike commented 4 months ago

Timestamps do not provide adequately unique filenames for logging HTTP POSTS that occur in rapid succession.

The HTTP Listener logs full HTTP POST bodies to their own text files, one file per POST request.

In the circumstance where two HTTP POST requests are serviced within the same second and corresponding to the same timestamp, the HTTP listener has been observed writing two distinct requests to the same file (because the timestamp portion of the filename is the same).

This has been observed when demonstrating basic dynamic analysis on a DLL file that is used by FLARE during malware analysis course instruction.