Shell based Norton Safeweb Query

Thanks to Webmaster Tips for the reminder about using lynx to pull the content of a web page without saving it to a file.

Using their method, we can quickly check the "Total Threat count" on Norton's Safe Web site for a domain using:

lynx -source "http://safeweb.norton.com/report/show?name=domain.com" | grep -i "Total threats found:" | awk -F '>' '{print $2}' | awk -F '<' '{print $1}'

Not all that pretty, but effective nonetheless. Looking to add 2-3 more command line based checks, including Google's Safe Browsing API.

Dump all IPs from pcap with tshark

Simple command to dump all IPs from a PCAP using tshark (custom fields are RED):

tshark -nr sample.pcap ip awk '{print $3 ; $ 5 }' sort -n -t . -k 1,1 -k 2,2 -k 3,3 -k 4,4 uniq > output_file

By section:
- Summarize all IP traffic in the PCAP without resolving names or ports
- Print the source and destination IPs on separate lines (the ;)
- Sort the results appropriately for IP addresses (thanks to networking.ringofsaturn.com)
- Remove duplicates
- Redirect the output to a file

Automated Malware Analysis - Lab or Live

The internal debate:

A. Lab only (with a minor exception for legit DNS lookups) with all traffic hitting mock services on a mock Internet

OR

B. Uber-throttled, hardened, and ham strung Internet connection to improve scope and accuracy of analysis

The obvious knock on B is that "You put others on the Internet at risk". Really? If the outbound ports are severely limited, connections throttled, and duration capped, isn't that risk wildly overstated? At that point, what is the difference between approach B and manually wget'ing links on a live system, only to move those files into the lab, rinse, and repeat?