Hi everyone,
I was curious to know if anyone has found a way to search for text inside files. I didn't think the SEARCH parser actually checked inside attachments, although maybe I'm wrong.
The best way I could think of was to use Visualize to process a collection then try to use the "post process" to search for strings, but on all my systems, post processing doesn't work.
Thanks!
John
Yes, you can use the /sdk msearch command to search sessions (only in v10.4) for a particular string or regex. If you pass the flag "ds" to the flags parameter, it will decode any sessions for protocols (SMB, HTTP, SMTP, POP, etc) it understands and then search the files that were transmitted thru the protocol.
Example
/sdk msearch where="service=80,139,25,110" limit=10000 flags=sp,ds,pre,post search="My search term"
The flags are:
sp - search packets
ds - decode sessions
pre - show text before hit
post - show text after hit
You can also use NwConsole's sdk content command to extract files and do the search yourself.