BackBox and Xplico
We are started a collaboration with BackBox team. The first result of this collaboration is a new deb package which can be installed directly from Launchpad.
To install Xplico on Ubuntu the steps to follow are:
- at the end of the file /etc/apt/sources.list add the lines:
deb http://ppa.launchpad.net/backbox/two/ubuntu natty main
deb-src http://ppa.launchpad.net/backbox/two/ubuntu natty main - in your terminal, enter:
sudo apt-key adv –keyserver keyserver.ubuntu.com –recv-keys 78A7ABE1
sudo apt-get update - install Xplico :
sudo apt-get install xplico
Enjoy!
Web Demo
We are completing the tests on 0.7.0 version. In this release the main features are:
- Gmail Webmail (HTTP)
- Yahoo! Mobile Mail (Andorid)
- AOL WebMail (last version)
- Language localization
The “WebMail sniffer” component (manipulator and python scripts) were improved.
All this features and others can be examined and tested with the Web Demo of Xplico.
Any help on Language translation and bug report or suggestions are greatly appreciated.
In the Web Demo all data can be remove by you, in anyway all data (but not the users accounts) are removed every day at 00:00 UTC. More info about Web Demo can be found here.
ISSA Journal: toolsmith
Russ McRee wrote an article about Xplico for ISSA Journal.
The PDF file can be downloaded here.
The next week will be released the Xplico’s new version, with support for 64bit.
Xplico 0.6.2: l7-patterns
This version introduces l7-patterns classifier for all flows not decoded, also there is the improvement of the real time acquisition, new features for the XI (Xplico Interface) and many bugs fixes.
ChangeLog:
- l7-patterns for all flows/protocols not decoded by xplico
- Xplico Interface (XI) improved
- python3 porting of many scripts
- realtime capture module improved
- facebook chat realtime view
- UTC/localtime bug fixes
- l2tp dissector bug fixes
- cli and lite dispatchers bug fixes
- telnet dissector bug fixes
- trigcap bug fixes
- new script named session_mng.pyc to facilitate the creation of new case and/or new session from command line
We thank naif for his support and his availability.
The decoding performance are:
- from command line: 5.9 MB/s
- from Xplico Interface (XI) with SQLite DB (=> lite dispatcher): 1.76 MB/s
- from Xplico Interface with MySQL DB (=> ximysql dispatcher): 4.09 MB/s
measured on an Aspire 5633WLMi (Intel Core 2 Duo processor T5500 with 1GB RAM an HD IDE controller) with the pcap http://domex.nps.edu/corp/scenarios/2009-m57/net/day11-18.dmp.zip (851 MB).
As always: Enjoy !
Xplico 0.6.1: MSN and Paltalk
In this version new dissectors, new features and obviously many bugfix:
- Paltalk chat dissector
- MSN dissector (beta basic version)
- XI Cookie hijacking
- XI pagination for Images and Web
- XI XSS fixed
- XI bugfix
We thank:
- Tim Hentenaa for his Paltalk reverse engineering
- Steve-William KISSI to have found various XSS
- Daniele Franchetto for MSN dissector
- Michele Dallachiesa for cookietools
You can found Xplico 0.6.1 in DEFT Linux 6 and you can download VirtualBox.org image, source code and Ubuntu 10.10 package here.
Enjoy 😉
Xplico 0.6.0 for Fedora 11-14 by CERT
Larry Rogers has built and tested Xplico version 0.6.0 for the CERT.
The rpm package is available for Fedora 11-14 from CERT Forensics Appliance repository.
More info and for all comments please see here.
Thank to Larry Rogers.
Xplico 0.5.7: VoIP tapping and phone numbers
This release introduces improvements in the SIP and RTP dissectors.
In this version was also added the RTCP dissector, with this dissector Xplico is able to obtain the phone numbers of the caller and called party (obviously only if present in the RTCP packets).
DEFT 5.1 Live distribution contains this version.
You can download source code and Ubuntu 10.04 package here.
Enjoy ;).
Xplico version 0.5.6: VoIP (SIP & RTP)
In this version there are new and important features:
- HTTP reconstruction file. ie: files downloaded with tools like DownThemAll
- undecodec UDP and TCP “stream” with textual content
- RTP dissector
- SIP dissector
- SDP dissector
- Improved XI
- many bugfix
This version of the SIP and RTP dissectors is not optimal. The (media) contents currently decoded have the following characteristics (limitations) :
- only audio
- audio codec: G711ulaw, G711alaw, G722, G729, G723 and G726
- only static RTP payload type
We have to thank:
- Michele Dallachiesa, for his wonderful tool rtpbreak and for his papers on VoIP protocols
- UCSniff Team for their tool VideoSnarf
- Carlos Gacimartín, for his help and for Virtualbox Image
- Massimiliano Dal Cero for his help with flash application
- all forum users for their debug
You can download VirtualBox.org image, source code and Ubuntu 9.10 package here.
Enjoy ;).
Xplico version 0.5.5: WebMail
In this version:
- migrating to SQLite3
- telnet dissector
- webmail dissector
- webmail manipulator: Yahoo!, AOL, Hotmail (all without attachments)
- Improved LLC dissector
- Improved XI
- script to check new release (only in source code)
Hotmail (Live) depends on the language. Currently the languages supported are Italian and English.
Any feedback are welcome: forum.
You can download VirtualBox image, source code and Ubuntu 9.10 package here.
