Recent changes to Home

WikiPage Home modified by Robert J. Hansen

Robert J. Hansen — Wed, 04 Jan 2012 17:01:20 -0000

--- v8 
+++ v9 
@@ -2,7 +2,7 @@
 
 nsrlquery consists of three utilities: nsrlsvr, nsrlparse and nsrllookup.
 
-nsrlsvr is a simple UNIX server that can be queried to see if a particular [SHA-1](http://en.wikipedia.org/wiki/SHA-1) hash is part of the [National Software Reference Library](http://www.nsrl.nist.gov/)'s [Reference Data Set](http://www.nsrl.nist.gov/Downloads.htm#isos) (NSRL RDS).  Assuming you've downloaded the full RDS, nrslsvr hosts the entire thing itself: it needs no external network connectivity to operate.
+nsrlsvr is a simple UNIX server that can be queried to see if a particular [SHA-1](http://en.wikipedia.org/wiki/SHA-1) or [MD5](http://en.wikipedia.org/wiki/MD5) hash is part of the [National Software Reference Library](http://www.nsrl.nist.gov/)'s [Reference Data Set](http://www.nsrl.nist.gov/Downloads.htm#isos) (NSRL RDS).  Once built, nrslsvr hosts the entire NSRL RDS itself: it needs no external network connectivity to operate, nor do you have to send your queries to an outside, untrusted source.
 
 nsrlparse transforms [md5deep or sha1deep](https://sourceforge.net/projects/md5deep) output (generated with the "-c" flag) into an nsrlsvr dataset.

WikiPage Home modified by Robert J. Hansen

Robert J. Hansen — Wed, 04 Jan 2012 16:59:50 -0000

--- v7 
+++ v8 
@@ -1,10 +1,12 @@
 Welcome to nsrlquery!
 
-nsrlquery consists of two utilities, nsrlsvr and nsrllookup.
-
+nsrlquery consists of three utilities: nsrlsvr, nsrlparse and nsrllookup.
+
 nsrlsvr is a simple UNIX server that can be queried to see if a particular [SHA-1](http://en.wikipedia.org/wiki/SHA-1) hash is part of the [National Software Reference Library](http://www.nsrl.nist.gov/)'s [Reference Data Set](http://www.nsrl.nist.gov/Downloads.htm#isos) (NSRL RDS).  Assuming you've downloaded the full RDS, nrslsvr hosts the entire thing itself: it needs no external network connectivity to operate.
 
-nsrllookup is a crossplatform Python script that queries a nsrlsvr.  Feed it a list of SHA-1 hashes and nsrlquery will split them into known-good hashes and unknown hashes.  The nsrllookup input format happens to be the same as the [sha1deep](https://sourceforge.net/projects/md5deep) data format, which means that simple pipes can be constructed to great effect.
+nsrlparse transforms [md5deep or sha1deep](https://sourceforge.net/projects/md5deep) output (generated with the "-c" flag) into an nsrlsvr dataset.
+
+nsrllookup is a crossplatform Python script that queries a nsrlsvr.  Feed it a list of hashes and nsrlquery will split them into known-good hashes and unknown hashes.  The nsrllookup input format happens to be the same as the [md5deep](https://sourceforge.net/projects/md5deep) data format, which means that simple pipes can be constructed to great effect.
 
 For instance, to query everything in /mount/suspect_hard_drive, you could just type **sha1deep -r /mount/suspect_hard_drive | nsrllookup** and quickly discover what on that hard drive was a known quantity and what was possibly more meriting of investigator attention.

WikiPage Home modified by Robert J. Hansen

Robert J. Hansen — Tue, 03 Jan 2012 19:41:54 -0000

--- v6 
+++ v7 
@@ -4,8 +4,8 @@
 
 nsrlsvr is a simple UNIX server that can be queried to see if a particular [SHA-1](http://en.wikipedia.org/wiki/SHA-1) hash is part of the [National Software Reference Library](http://www.nsrl.nist.gov/)'s [Reference Data Set](http://www.nsrl.nist.gov/Downloads.htm#isos) (NSRL RDS).  Assuming you've downloaded the full RDS, nrslsvr hosts the entire thing itself: it needs no external network connectivity to operate.
 
-nsrlquery is a crossplatform Python script that queries a nsrlsvr.  Feed it a list of SHA-1 hashes and nsrlquery will split them into known-good hashes and unknown hashes.  The nsrlquery input format happens to be the same as the [sha1deep](https://sourceforge.net/projects/md5deep) data format, which means that simple pipes can be constructed to great effect.
+nsrllookup is a crossplatform Python script that queries a nsrlsvr.  Feed it a list of SHA-1 hashes and nsrlquery will split them into known-good hashes and unknown hashes.  The nsrllookup input format happens to be the same as the [sha1deep](https://sourceforge.net/projects/md5deep) data format, which means that simple pipes can be constructed to great effect.
 
-For instance, to query everything in /mount/suspect_hard_drive, you could just type **sha1deep -r /mount/suspect_hard_drive | nsrlquery** and quickly discover what on that hard drive was a known quantity and what was possibly more meriting of investigator attention.
+For instance, to query everything in /mount/suspect_hard_drive, you could just type **sha1deep -r /mount/suspect_hard_drive | nsrllookup** and quickly discover what on that hard drive was a known quantity and what was possibly more meriting of investigator attention.
 
 [[download_button]]

WikiPage Home modified by Robert J. Hansen

Robert J. Hansen — Fri, 30 Dec 2011 21:55:59 -0000

--- v5 
+++ v6 
@@ -1,13 +1,11 @@
-[[download_button]]
-
-
-
 Welcome to nsrlquery!
 
 nsrlquery consists of two utilities, nsrlsvr and nsrllookup.
 
 nsrlsvr is a simple UNIX server that can be queried to see if a particular [SHA-1](http://en.wikipedia.org/wiki/SHA-1) hash is part of the [National Software Reference Library](http://www.nsrl.nist.gov/)'s [Reference Data Set](http://www.nsrl.nist.gov/Downloads.htm#isos) (NSRL RDS).  Assuming you've downloaded the full RDS, nrslsvr hosts the entire thing itself: it needs no external network connectivity to operate.
 
 nsrlquery is a crossplatform Python script that queries a nsrlsvr.  Feed it a list of SHA-1 hashes and nsrlquery will split them into known-good hashes and unknown hashes.  The nsrlquery input format happens to be the same as the [sha1deep](https://sourceforge.net/projects/md5deep) data format, which means that simple pipes can be constructed to great effect.
 
 For instance, to query everything in /mount/suspect_hard_drive, you could just type **sha1deep -r /mount/suspect_hard_drive | nsrlquery** and quickly discover what on that hard drive was a known quantity and what was possibly more meriting of investigator attention.
+
+[[download_button]]

WikiPage Home modified by Robert J. Hansen

Robert J. Hansen — Fri, 30 Dec 2011 21:55:36 -0000

--- v4 
+++ v5 
@@ -1,6 +1,7 @@
 [[download_button]]
 
 
+
 Welcome to nsrlquery!
 
 nsrlquery consists of two utilities, nsrlsvr and nsrllookup.

WikiPage Home modified by Robert J. Hansen

Robert J. Hansen — Fri, 30 Dec 2011 21:55:19 -0000

--- v3 
+++ v4 
@@ -1,5 +1,6 @@
 [[download_button]]
 
+
 Welcome to nsrlquery!
 
 nsrlquery consists of two utilities, nsrlsvr and nsrllookup.

WikiPage Home modified by Robert J. Hansen

Robert J. Hansen — Fri, 30 Dec 2011 21:55:08 -0000

--- v2 
+++ v3 
@@ -1,4 +1,5 @@
 [[download_button]]
+
 Welcome to nsrlquery!
 
 nsrlquery consists of two utilities, nsrlsvr and nsrllookup.

WikiPage Home modified by Robert J. Hansen

Robert J. Hansen — Thu, 29 Dec 2011 18:04:18 -0000

--- v1 
+++ v2 
@@ -1,8 +1,10 @@
-Welcome to your wiki!
-
-This is the default page, edit it as you see fit. To add a new page simply reference it within brackets, e.g.: [SamplePage].
-
-The wiki uses [Markdown](/p/nsrlquery/wiki/markdown_syntax/) syntax.
-
-[[project_admins]]
 [[download_button]]
+Welcome to nsrlquery!
+
+nsrlquery consists of two utilities, nsrlsvr and nsrllookup.
+
+nsrlsvr is a simple UNIX server that can be queried to see if a particular [SHA-1](http://en.wikipedia.org/wiki/SHA-1) hash is part of the [National Software Reference Library](http://www.nsrl.nist.gov/)'s [Reference Data Set](http://www.nsrl.nist.gov/Downloads.htm#isos) (NSRL RDS).  Assuming you've downloaded the full RDS, nrslsvr hosts the entire thing itself: it needs no external network connectivity to operate.
+
+nsrlquery is a crossplatform Python script that queries a nsrlsvr.  Feed it a list of SHA-1 hashes and nsrlquery will split them into known-good hashes and unknown hashes.  The nsrlquery input format happens to be the same as the [sha1deep](https://sourceforge.net/projects/md5deep) data format, which means that simple pipes can be constructed to great effect.
+
+For instance, to query everything in /mount/suspect_hard_drive, you could just type **sha1deep -r /mount/suspect_hard_drive | nsrlquery** and quickly discover what on that hard drive was a known quantity and what was possibly more meriting of investigator attention.

WikiPage Home modified by Robert J. Hansen

Robert J. Hansen — Wed, 28 Dec 2011 19:56:42 -0000

Welcome to your wiki! This is the default page, edit it as you see fit. To add a new page simply reference it within brackets, e.g.: [SamplePage]. The wiki uses [Markdown](/p/nsrlquery/wiki/markdown_syntax/) syntax. [[project_admins]] [[download_button]]