pyWhat – identify anything
What is this?
Imagine this: You come across some mysterious text 
0x52908400098527886E0F7030069857D2E4169EE7 or dQw4w9WgXcQ and you wonder what it is. What do you do?
Well, with what all you have to do is ask what "0x52908400098527886E0F7030069857D2E4169EE7" and what will tell you!
what‘s job is to identify what something is. Whether it be a file or text! Or even the hex of a file! What about text within files? We have that too! what is recursive, it will identify everything in text and more!
Use Cases
Use Cases Wannacry
Wannacry
You come across a new piece of malware called WantToCry. You think back to Wannacry and remember it was stopped because a researcher found a kill-switch in the code.
When a domain, hardcoded into Wannacry, was registered the virus would stop.
You use What to identify all the domains in the malware, and use a domain registrar API to register all the domains.
Faster Analysis of Pcap files
Faster Analysis of Pcap files
Say you have a .pcap file from a network attack. What can identify this and quickly find you:
- All URLs
- Emails
- Phone numbers
- Credit card numbers
- Cryptocurrency addresses
- Social Security Numbers
- and much more.
With what, you can identify the important things in the pcap in seconds, not minutes.
Anything
AnythingAnytime you have a file and you want to find structured data in it that’s useful, What is for you.
Or if you come across some piece of text and you don’t know what it is, What will tell you.
File Opening You can pass in a file path by what 'this/is/a/file/path'. What is smart enough to figure out it’s a file!
What about a whole directory? What can handle that too! It will recursively search for files and output everything you need!
Filtration You can filter output by using what --rarity 0.2:0.8 --include_tags tag1,tag2 TEXT. Use what --help to get more information.
Sorting You can sort the output by using what -k rarity --reverse TEXT. Use what --help to get more information.
Exporting You can export to json using what --json and results can be sent directly to a file using what --json > file.json.
Boundaryless mode What has a special mode to match identifiable information within strings. By default, it is enabled in CLI but disabled in API. Use what --help or refer to API Documentation for more information.
API
APIPyWhat has an API! Click here https://github.com/bee-san/pyWhat/wiki/API to read about it.
Contributing
Contributingwhat not only thrives on contributors, but can’t exist without them! If you want to add a new regex to check for things, you can read our documentation here
We ask contributors to join the Discord for quicker discussions, but it’s not needed:
Original repository: https://github.com/bee-san/pyWhat
The post pyWhat – identify anything appeared first on Hakin9 – IT Security Magazine.
