Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Added "timeFrame" parameter #144

Open
wants to merge 3 commits into
base: master
Choose a base branch
from

Conversation

BlueFootedBird
Copy link

Added a parameter to support only returning files within a specific range of time. Works with either "--timeFrame" or "-g". Can be helpful for OPSEC in terms of reducing the output Snaffler returns by constraining files that were last modified in a certain date. The format for the command in YYYY-MM-DD,YYYY-MM-DD. For simplicity, it is assumed that the time starts at midnight rather than prompting the operator/user to also include a specific hour, minute, and second. Therefore, the smallest range would be a window of 24 hours. Was not able to incorporate this as a classifier rule, but it is very simple and efficient given it's just a simple comparison.

There are two commits - the first one holds the changes to include the "timeFrame" parameter. The second commit is to keep the target .NET version the same. Tested it on .NET v4.8 and verified it also works with .NET 4.5.1.

This parameter addresses Issue 94. An image of Snaffler running with the new parameter can be seen below.
image

@l0ss
Copy link
Contributor

l0ss commented Aug 7, 2024

Most of this looks good, but it looks like you've also stripped out the timestamps from every line of output. Is that related to the feature in a way I'm not following, or is it just an unrelated change that snuck in?

@BlueFootedBird
Copy link
Author

BlueFootedBird commented Aug 7, 2024

That was an unrelated change - I've gone ahead and fixed that. The timestamps are back in, and the commit only includes the necessary changes for the timeframe feature

@Sh3r4
Copy link
Contributor

Sh3r4 commented Sep 20, 2024

I suspect this would have fairly large performance impact on the UI thread, which can get jammed up if we're not careful as there is only one.

I would suggest refactoring this so that the parsing of the datetime is done when the CLI input is evaluated and then checking before it is ever sent to the UI thread.

ProcessMessage() needs to be for display only.

@Sh3r4
Copy link
Contributor

Sh3r4 commented Sep 20, 2024

An additional point here: This PR only changes what is displayed not what is collected. Changes to that deeper code need to be made to reduce the noise (check out the link mentioned in Issue 94 for where it will need to be implemented: https://github.com/SnaffCon/Snaffler/blob/master/SnaffCore/Classifiers/FileClassifier.cs )

If you're gonna have a crack at implementing it, please go ahead, but if not this PR should be closed.

@l0ss
Copy link
Contributor

l0ss commented Sep 21, 2024

Probably the best way would be to implement a new type of rule that discards based on that timestamp. Discard rules get assessed before all others, and we already have the last modified timestamp as part of the FileInfo, so that approach would make using this feature actually improve performance rather than hurt it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants