private void ExportAsCsv()
{
StringBuilder sb = new StringBuilder();
DataTable dt = GetMergedDataTable();
IEnumerable <string> columnNames = dt.Columns.Cast <DataColumn>().
Select(column => column.ColumnName);
sb.AppendLine(string.Join(",", columnNames));
foreach (DataRow row in dt.Rows)
{
IEnumerable <string> fields = row.ItemArray.Select(field => field.ToString());
sb.AppendLine(string.Join(",", fields));
}
string csvPath = Path.Combine(ExportPath, ReportContainerName + ".csv");
File.WriteAllText(csvPath, sb.ToString());
Logger.Log(new OsirtActionsLog(Enums.Actions.Report, OsirtHelper.GetFileHash(csvPath), ReportContainerName));
PlaceReportInContainer(Path.Combine(ExportPath, ReportContainerName));
if (openReport)
{
Process.Start(csvPath);
}
}
private void CurrentBrowser_DownloadCompleted(object sender, EventArgs e)
{
DownloadEventArgs dl = (DownloadEventArgs)e;
Invoke((MethodInvoker) delegate
{
uiActionLoggedToolStripStatusLabel.Visible = false;
uiDownloadProgressBar.Visible = false;
MessageBox.Show("Download Completed", "Download Complete", MessageBoxButtons.OK, MessageBoxIcon.Asterisk);
});
string dlPath = dl.DownloadItems.FullPath;
string savePath = Path.Combine(Constants.ContainerLocation, Constants.Directories.GetSpecifiedCaseDirectory(Actions.Download), Path.GetFileName(dl.DownloadItems.FullPath));
if (File.Exists(savePath))
{
string extension = Path.GetExtension(savePath);
string name = Path.GetFileNameWithoutExtension(savePath) + "_" + (DateTime.Now.ToString("yyyy-MM-dd_hh_mm_ss") + extension);
savePath = Path.Combine(Constants.ContainerLocation, Constants.Directories.GetSpecifiedCaseDirectory(Actions.Download), name);
}
File.Copy(dlPath, savePath);
Logger.Log(new WebpageActionsLog(dl.DownloadItems.Url, Actions.Download, OsirtHelper.GetFileHash(dlPath), Path.GetFileName(savePath), ""));
}
private void uiSaveAsTextButton_Click(object sender, EventArgs e)
{
string savePath = Path.Combine(Constants.ContainerLocation, Constants.Directories.GetSpecifiedCaseDirectory(Enums.Actions.Exif), $"exif_data_{DateTime.Now.ToString("yyyy-MM-dd_hh_mm_ss")}.txt");
string text = string.Join("\r\n", properties);
File.WriteAllText(savePath, text);
Logger.Log(new WebpageActionsLog(url, Enums.Actions.Exif, OsirtHelper.GetFileHash(savePath), Path.GetFileName(savePath), "[Exif Saved]"));
MessageBox.Show("Exif data saved.", "Exif saved", MessageBoxButtons.OK, MessageBoxIcon.Information);
}
private void CreatePDF(object sender, WaitWindowEventArgs e)
{
//TODO: When audit log is exported and case notes are then exported (or vice-verca) as PDF, the application hangs...
string path = e.Arguments[0].ToString();
string html = CaseNotesToHtml.CreateHtml();
HtmLtoPdf.SaveHtmltoPdf(html, "", "Case Notes", path);
string hash = OsirtHelper.GetFileHash(path);
Logger.Log(new OsirtActionsLog(Enums.Actions.CaseNotes, hash, System.IO.Path.GetFileName(path)));
}
private void HashCase()
{
string hash = OsirtHelper.GetFileHash(Path.Combine(Constants.CasePath, Constants.CaseContainerName + Constants.ContainerExtension));
try
{
File.WriteAllText(Path.Combine(UserSettings.Load().HashExportLocation, Constants.ExportedHashFileName.Replace("%%dt%%", $"{DateTime.Now.ToString("yyyy-MM-dd_hh_mm_ss")}")), hash);
}
catch (Exception e)
{
File.WriteAllText(Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.DesktopDirectory), Constants.ExportedHashFileName.Replace("%%dt%%", $"{DateTime.Now.ToString("yyyy-MM-dd_hh_mm_ss")}")), hash);
}
}
private void SaveAsOther(object sender, WaitWindowEventArgs e)
{
//string fileName = e.Arguments[0].ToString();
ImageSaveOptions options = (ImageSaveOptions)e.Arguments[0];
string fileName = options.FileName;
string fileType = options.FileType;
MagickFormat format = options.ImageFormat;
pathToSave = "";
bool thrown = false;
try
{
using (MagickImage image = new MagickImage(filePath /*, settings*/))
{
image.Format = format;
//uncomment this to get annotation
//image.Annotate(Url + "\n" + DateAndTime, Gravity.Southwest);
pathToSave = Path.Combine(Constants.ContainerLocation, Constants.Directories.GetSpecifiedCaseDirectory(action), fileName + fileType);
image.Write(pathToSave);
e.Window.Message = $"Rehashing {fileType}";
Hash = OsirtHelper.GetFileHash(pathToSave);
successful = true;
}
}
catch (Exception ex) when(ex is MagickErrorException || ex is System.Runtime.InteropServices.SEHException || ex is ArgumentException || ex is System.Reflection.TargetInvocationException /*|| ex is System.AccessViolationException || ex is Exception*/)
{
thrown = true;
var message = $"Unable to save as {fileType}. Reverting to saving as PNG.";
Invoke((MethodInvoker)(() => uiFileExtensionComboBox.SelectedIndex = uiFileExtensionComboBox.Items.IndexOf(SaveableFileTypes.Png)));
e.Window.Message = message;
Task.Delay(2000).Wait(); //just so the user can see we're saving as PNG instead
SaveAsPng(fileName);
}
finally
{
//delete temp pdf file
if (thrown)
{
if (File.Exists(pathToSave))
{
File.Delete(pathToSave);
}
}
}
}
private void ExportAsXml()
{
ReportContainerName = Constants.ReportContainerName.Replace("%%dt%%", DateTime.Now.ToString("yyyy_MM_dd_HH_mm_ss"));
DataTable dt = GetMergedDataTable();
new ArtefactExporter(dt, ExportPath, ReportContainerName);
string xmlPath = Path.Combine(ExportPath, ReportContainerName, "report.xml");
dt.WriteXml(xmlPath);
Logger.Log(new OsirtActionsLog(Enums.Actions.Report, OsirtHelper.GetFileHash(xmlPath), ReportContainerName));
PlaceReportInContainer(Path.Combine(ExportPath, ReportContainerName));
}
private void Client_DownloadFileCompleted(object sender, AsyncCompletedEventArgs e)
{
Logger.Log(new WebpageActionsLog(url, action, OsirtHelper.GetFileHash(savePath), filename, @"[N/A]"));
files.Remove(files.First().Key);
if (files.Count > 0)
{
Download();
}
else //completed
{
uiCompleteLabel.Text = $"Download completed, you may now close this window.{Environment.NewLine} {count} image(s) were downloaded.{Environment.NewLine} {errorCount} image(s) could not be downloaded.";
uiCloseButton.Enabled = true;
}
}
private void uiSaveSourceToolStripButton_Click(object sender, EventArgs e)
{
string filename = Constants.PageSourceFileName.Replace("%%dt%%", DateTime.Now.ToString("yyyy-MM-dd_hh_mm_ss")).Replace("%%name%%", domainUrlAndTitle.Item1).Replace("%%action%%", action.ToString().Replace(".", "_"));
string path = Path.Combine(Constants.ContainerLocation, Constants.Directories.GetSpecifiedCaseDirectory(action), filename);
using (FileStream fileStream = new FileStream(path, FileMode.Create))
{
using (StreamWriter streamWriter = new StreamWriter(fileStream, Encoding.UTF8))
{
streamWriter.WriteLine(fctb.Text);
}
}
Logger.Log(new WebpageActionsLog(domainUrlAndTitle.Item2, action, OsirtHelper.GetFileHash(path), filename, $"[{action.ToString()} downloaded]"));
MessageBox.Show("Save successful", $"Saved - {action.ToString()}", MessageBoxButtons.OK, MessageBoxIcon.Information);
}
private void uiBrowseButton_Click(object sender, EventArgs e)
{
using (OpenFileDialog openFile = new OpenFileDialog())
{
DialogResult result = openFile.ShowDialog();
if (result != DialogResult.OK)
{
return;
}
uiAttachFileProgressPanel.Visible = false;
fileWithPath = openFile.FileName;
file = openFile.SafeFileName;
hash = OsirtHelper.GetFileHash(fileWithPath);
UpdateFileDetailsUi();
DisplayIcon();
}
}
private void Browser_SavePageSource(object sender, EventArgs e)
{
var args = ((SaveSourceEventArgs)e);
string filename = Constants.PageSourceFileName.Replace("%%dt%%", DateTime.Now.ToString("yyyy-MM-dd_hh_mm_ss")).Replace("%%name%%", args.Domain);
string path = Path.Combine(Constants.ContainerLocation, Constants.Directories.GetSpecifiedCaseDirectory(Enums.Actions.Source), filename);
using (FileStream fileStream = new FileStream(path, FileMode.Create))
{
using (StreamWriter streamWriter = new StreamWriter(fileStream, Encoding.UTF8))
{
streamWriter.WriteLine(args.Source);
}
}
Logger.Log(new WebpageActionsLog(uiTabbedBrowserControl.CurrentTab.Browser.URL, Enums.Actions.Source, OsirtHelper.GetFileHash(path), filename, "[Page source downloaded]"));
MessageBox.Show("Page source saved successfully", "Saved", MessageBoxButtons.OK, MessageBoxIcon.Information);
}
private async void printPageAsPDFToolStripMenuItem_Click(object sender, EventArgs e)
{
SaveFileDialog savefile = new SaveFileDialog
{
FileName = "example.pdf",
Filter = "PDF files (*.pdf)|*.pdf"
};
if (savefile.ShowDialog() != DialogResult.OK)
{
return;
}
bool printed = await uiTabbedBrowserControl.CurrentTab.Browser.PrintToPdfAsync(savefile.FileName, new PdfPrintSettings
{
BackgroundsEnabled = true,
Landscape = false,
MarginType = CefPdfPrintMarginType.Default,
});
if (printed)
{
string savePath = Path.Combine(Constants.ContainerLocation, Constants.Directories.GetSpecifiedCaseDirectory(Actions.Download), Path.GetFileName(savefile.FileName));
if (File.Exists(savePath))
{
string extension = Path.GetExtension(savePath);
string name = Path.GetFileNameWithoutExtension(savePath) + "_" + (DateTime.Now.ToString("yyyy-MM-dd_hh_mm_ss") + extension);
savePath = Path.Combine(Constants.ContainerLocation, Constants.Directories.GetSpecifiedCaseDirectory(Actions.Download), name);
}
File.Copy(savefile.FileName, savePath);
Logger.Log(new WebpageActionsLog(uiTabbedBrowserControl.CurrentTab.Browser.URL, Actions.Download, OsirtHelper.GetFileHash(savefile.FileName), Path.GetFileName(savePath), ""));
}
else
{
MessageBox.Show("Unable to save page as PDF", "Error Saving as PDF", MessageBoxButtons.OK, MessageBoxIcon.Error);
}
}
/// <summary>
/// Handle DownloadCompleted event.
/// </summary>
void DownloadCompleted(object sender, HttpDownloadCompletedEventArgs e)
{
Invoke(new UIDownloadCompletedHanlder(DownloadCompletedHanlder), e);
Logger.Log(new WebpageActionsLog(tbURL.Text, Actions.Download, OsirtHelper.GetFileHash(DownloadPath), Path.GetFileName(tbURL.Text), ""));
}
private void SavePage(object sender, WaitWindowEventArgs e)
{
string output = "";
List <RequestWrapper> resources = uiTabbedBrowserControl.CurrentTab.Browser.ResourcesSet().OrderBy(q => q.Identifier).ToList();
List <HeaderWrapper> headers = uiTabbedBrowserControl.CurrentTab.Browser.ResponseHeaders().OrderBy(q => q.Identifer).ToList();
List <HeaderWrapper> requestHeaders = uiTabbedBrowserControl.CurrentTab.Browser.RequestHeaders().OrderBy(q => q.Identifer).ToList();
string saveFolder = new Uri(uiTabbedBrowserControl.CurrentTab.Browser.URL).Host.Replace(".", "_") + DateTime.Now.ToString("yyyy-MM-dd-HH-mm-ss-fff");
string savePath = Path.Combine(GSettings.Load().SaveDirectory, saveFolder);
string logSavePath = Path.Combine(savePath, "_complete_log");
Directory.CreateDirectory(savePath);
Directory.CreateDirectory(logSavePath);
output += "=================================================================================\r\n";
output += "Capture started: " + DateTime.Now.ToString("yyyy-MM-dd-HH:mm:ss.fff") + "\r\n";
output += "URL: " + uiTabbedBrowserControl.CurrentTab.Browser.URL + "\r\n";
output += "IP(s): " + OsirtHelper.GetIpFromUrl(uiTabbedBrowserControl.CurrentTab.Browser.URL).Replace("\r\n", " ") + "\r\n";
output += "Screenshot Hash: " + OsirtHelper.GetFileHash(Constants.TempImgFile) + "\r\n";
output += "=================================================================================\r\n";
ulong count = 0;
foreach (var resource in resources)
{
Directory.CreateDirectory($@"{savePath}\{resource.ResourceType}");
string filename = resource.ResourceType == ResourceType.MainFrame ? "mainframe.html" : OsirtHelper.GetSafeFilename(resource.RequestUrl, resource.MimeType);
e.Window.Message = "Saving: " + filename + "...Please Wait";
if (File.Exists($@"{savePath}\{resource.ResourceType}\{filename}"))
{
filename = $"{++count}_{filename}";
}
File.WriteAllBytes($@"{savePath}\{resource.ResourceType}\{filename}", resource.Data);
output += "=================================================================================\r\n";
output += "Request ID: " + resource.Identifier + "\r\n";
output += "Request URL: " + resource.RequestUrl + "\r\n";
output += "Request URL IP(s): " + OsirtHelper.GetIpFromUrl(resource.RequestUrl).Replace("\r\n", " ") + "\r\n";
output += "Resource Type: " + resource.ResourceType + "\r\n";
output += "Mime Type: " + resource.MimeType + "\r\n";
output += "File Saved Location: " + $@"{savePath}\{resource.ResourceType}\{filename}" + "\r\n";
output += $"Hash [{UserSettings.Load().Hash.ToUpper()}]: " + OsirtHelper.GetFileHash(resource.Data) + "\r\n";
output += "Save completed at: " + DateTime.Now.ToString("yyyy-MM-dd-HH:mm:ss.fffffff") + "\r\n";
output += "=================================================================================\r\n";
e.Result = savePath;
}
output += "=================================================================================\r\n";
output += "Capture finished: " + DateTime.Now.ToString("yyyy-MM-dd-HH:mm:ss.fff") + "\r\n";
output += "=================================================================================\r\n";
File.AppendAllText($@"{logSavePath}\_capture.txt", output);
File.Copy(Constants.TempImgFile, $@"{logSavePath}\_website.png");
if (GSettings.Load().SaveHttpHeaders)
{
string headerOutput = "";
foreach (var k in headers)
{
headerOutput += "====================================================\r\n";
headerOutput += "Request ID: " + k.Identifer + "\r\n";
foreach (KeyValuePair <string, string> kv in k.Headers)
{
headerOutput += $"{kv.Key} : {kv.Value}" + "\r\n";
}
headerOutput += "====================================================\r\n";
}
File.AppendAllText($@"{logSavePath}\_headers.txt", headerOutput);
//string reqheaderOutput = "";
//foreach (var k in requestHeaders)
//{
// reqheaderOutput += "====================================================\r\n";
// reqheaderOutput += "Request ID: " + k.Identifer + "\r\n";
// foreach (KeyValuePair<string, string> kv in k.Headers)
// {
// reqheaderOutput += $"{kv.Key} : {kv.Value}" + "\r\n";
// }
// reqheaderOutput += "====================================================\r\n";
//}
//File.AppendAllText($@"{logSavePath}\_request_headers.txt", reqheaderOutput);
}
CopyPageSaveToCase(savePath, e);
}
private void BackgroundWorker_DoWork(object sender, DoWorkEventArgs e)
{
//We haven't extracted the case container, so we don't know the user setting.
//We'll use SHA512 as the default for hashing and verifying containers.
e.Result = OsirtHelper.GetFileHash(file.FullName, /*UserSettings.Load().Hash*/ "SHA512");
}
private void CopyPageSaveToCase(string folder, WaitWindowEventArgs e)
{
using (ZipFile zip = new ZipFile())
{
zip.AddDirectory(folder);
zip.Save(folder + ".zip");
e.Window.Message = "Zipping...Please Wait";
}
string copyTo = Path.Combine(Constants.ContainerLocation, Constants.Directories.GetSpecifiedCaseDirectory(Enums.Actions.Download), Path.GetFileNameWithoutExtension(folder) + ".zip");
File.Copy(folder + ".zip", copyTo);
e.Window.Message = "Logging...Please Wait";
Logger.Log(new WebpageActionsLog(uiTabbedBrowserControl.CurrentTab.Browser.URL, Enums.Actions.Download, OsirtHelper.GetFileHash(copyTo), Path.GetFileNameWithoutExtension(folder) + ".zip", "Webpage downloaded"));
Thread.Sleep(2000);
File.Delete(folder + ".zip");
ImageDiskCache.RemoveItemsInCache();
}
private void BackgroundWorker_DoWork(object sender, DoWorkEventArgs e)
{
Task.Delay(1000).Wait(); //just so user can "see" the image hashing
e.Result = OsirtHelper.GetFileHash(filePath);
}