Ben Reardon
Ben Reardon
One thought is to look at splitting the payload from the right to left. eg if we split on the last '/' in /Exploit and take the second to last...
Another thought is to use a split on a regex that caters for working exploits and the potentially not working edge case, something like: local tmp = split_string(s, /\/\/|\:\/[0-9]{0,3}\.[0-9]{0,3}\.[0-9]{0,3}\.[0-9]{0,3}/); Again,...
I went through a triage exercise yesterday and can confirm that if we had these fields in log4j.log, it would make triage and hunting easier, missing them slowed me down.