diff --git a/sample_recipe.md b/sample_recipe.md new file mode 100644 index 00000000..f0583bdd --- /dev/null +++ b/sample_recipe.md @@ -0,0 +1,16 @@ +# Ready-To-Go Sample Recipe + +## tcpdump (no ASCII) Daily Use + +1. tcpdump (no ASCII) convert to plaintext (e.g. 0x0000: 0020 0A0D) +2. URL decode loop (e.g. %3d to =) +3. From HTML Entity (e.g. & to &) +4. From 0x[Hex] (e.g. 0x33 to !) +5. From Char(Hex) (e.g. char(33) to !) + + [{"op":"From nTcpdump","args":[]}, + {"op":"URL Decode","args":[]}, + {"op":"Conditional Jump","args":["\\%([0-9a-fA-F]{2,})","-1","45"]}, + {"op":"From HTML Entity","args":[]}, + {"op":"From 0x[Hex]","args":[]}, + {"op":"From Char(Hex)","args":[]}] \ No newline at end of file