Project

General

Profile

Actions

Feature #6922

open

Have a way to manually request decompression/inflate if headers are not present

Added by Jason Taylor 2 months ago. Updated 2 months ago.

Status:
New
Priority:
Normal
Assignee:
Target version:
Effort:
Difficulty:
Label:

Description

This is a follow up from a discord discussion here:
https://discord.com/channels/864648830553292840/906009559276081182/1225415703675539556

The sample I was looking at (03f80949b6a0d5148c4e0d0557175131) gzip's the json data that is put into the request body prior to sending the data. The requisite http headers are not set to have libhtp decompress the body. It would be nice to be able to have a keyword or transform to uncompress/inflate the data for content matching.

The pcap from one of the virustotal sandbox run is attached.


Files

Actions

Also available in: Atom PDF