Detonate URL - Cuckoo

Detonating URL with Cuckoo

Cuckoo Sandbox · 9 tasks · 3 inputs · 22 outputs

Details

IDDetonate URL - Cuckoo
From Version5.0.0
Tasks9

README

Detonates a URL with Cuckoo.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

  • GenericPolling

Integrations

This playbook does not use any integrations.

Scripts

  • Sleep

Commands

  • cuckoo-view-task
  • cuckoo-get-task-report
  • cuckoo-create-task-from-url

Playbook Inputs

Name Description Default Value Source Required
URL The URL to detonate. Data URL Optional
interval How often to poll for results. 1 - Optional
timeout How long to wait before giving up waiting for results. 10 - Optional

Playbook Outputs

Path Description Type
Cuckoo.Task.Category The category of the task. unknown
Cuckoo.Task.Machine The machine of the task. unknown
Cuckoo.Task.Errors The errors of the task. unknown
Cuckoo.Task.Traget The traget of the task. unknown
Cuckoo.Task.Package The package of the task. unknown
Cuckoo.Task.SampleID The sample ID of the task. unknown
Cuckoo.Task.Guest The task guest. unknown
Cuckoo.Task.Custom The custom values of task. unknown
Cuckoo.Task.Owner The task owner. unknown
Cuckoo.Task.Priority The priority of task. unknown
Cuckoo.Task.Platform The platform of task. unknown
Cuckoo.Task.Options The task options. unknown
Cuckoo.Task.Status The task status. unknown
Cuckoo.Task.EnforceTimeout Whether the timeout of task is enforced. unknown
Cuckoo.Task.Timeout The task timeout. unknown
Cuckoo.Task.Memory The task memory. unknown
Cuckoo.Task.Tags The task tags. unknown
Cuckoo.Task.ID The ID of the task. unknown
Cuckoo.Task.AddedOn The date on which the task was added. unknown
Cuckoo.Task.CompletedOn The date on which the task was completed. unknown
Cuckoo.Task.Score The reported score of the the task. unknown
Cuckoo.Task.Monitor The monitor of the reported task. unknown

Playbook Image

Detonate_URL_Cuckoo

Inputs

  • URL — URL to detonate
  • interval — How often to poll for results
  • timeout — How long to wait before giving up waiting for results

Outputs

  • Cuckoo.Task.Category — Category of task
  • Cuckoo.Task.Machine — Machine of task
  • Cuckoo.Task.Errors — Errors of task
  • Cuckoo.Task.Traget — Traget of task
  • Cuckoo.Task.Package — Package of task
  • Cuckoo.Task.SampleID — Sample ID of task
  • Cuckoo.Task.Guest — Task guest
  • Cuckoo.Task.Custom — Custom values of task
  • Cuckoo.Task.Owner — Task owner
  • Cuckoo.Task.Priority — Priority of task
  • Cuckoo.Task.Platform — Platform of task
  • Cuckoo.Task.Options — Task options
  • Cuckoo.Task.Status — Task status
  • Cuckoo.Task.EnforceTimeout — Is timeout of task enforced
  • Cuckoo.Task.Timeout — Task timeout
  • Cuckoo.Task.Memory — Task memory
  • Cuckoo.Task.Tags — Task tags
  • Cuckoo.Task.ID — ID of task
  • Cuckoo.Task.AddedOn — Date on which the task was added
  • Cuckoo.Task.CompletedOn — Date on which the task was completed
  • Cuckoo.Task.Score — Reported score of the the task
  • Cuckoo.Task.Monitor — Monitor of the reported task

Commands used

cuckoo-create-task-from-url cuckoo-get-task-report cuckoo-view-task

Flowchart

yes yes Start Start Is there any active Cuckoo instance? Is there any active Cucko... Is there a URL? Is there a URL? Send URL to Cuckoo - cuckoo-create-task-from-url Send URL to Cuckoo cuckoo-create-task-from-url GenericPolling - GenericPolling GenericPolling GenericPolling Done Done Get task report - cuckoo-get-task-report Get task report cuckoo-get-task-report Sleep (let the sandbox create the task) - Sleep Sleep (let the sandbox cr... Sleep View task - cuckoo-view-task View task cuckoo-view-task

Source

playbook-Detonate_URL_-_Cuckoo.yml
Download History Raw 
id: Detonate URL - Cuckoo
version: -1
name: Detonate URL - Cuckoo
description: Detonating URL with Cuckoo
fromversion: "5.0.0"
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: ac486e14-1500-41db-8579-c2acb8b805ef
    type: start
    task:
      id: ac486e14-1500-41db-8579-c2acb8b805ef
      version: -1
      name: ""
      description: starting test
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 50
        }
      }
    note: false
  "1":
    id: "1"
    taskid: 470c6166-f089-4486-80c1-2e0ab0d650eb
    type: condition
    task:
      description: Check for active instance
      id: 470c6166-f089-4486-80c1-2e0ab0d650eb
      version: -1
      name: Is there any active Cuckoo instance?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "6"
      "yes":
      - "2"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              complex:
                root: modules
                filters:
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.brand
                      iscontext: true
                    right:
                      value:
                        simple: Cuckoo Sandbox
                - - operator: isEqualString
                    left:
                      value:
                        simple: modules.state
                      iscontext: true
                    right:
                      value:
                        simple: active
                accessor: brand
            iscontext: true
    view: |-
      {
        "position": {
          "x": 50,
          "y": 195
        }
      }
    note: false
  "2":
    id: "2"
    taskid: 1e9c332f-bfcc-4323-899c-c29476110b53
    type: condition
    task:
      description: Check for URL
      id: 1e9c332f-bfcc-4323-899c-c29476110b53
      version: -1
      name: Is there a URL?
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "6"
      "yes":
      - "3"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isExists
          left:
            value:
              simple: inputs.URL
            iscontext: true
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 370
        }
      }
    note: false
  "3":
    id: "3"
    taskid: 1ee9c8d9-b62b-4e27-858f-ae9735ddb857
    type: regular
    task:
      description: create task from url
      id: 1ee9c8d9-b62b-4e27-858f-ae9735ddb857
      version: -1
      name: Send URL to Cuckoo
      script: '|||cuckoo-create-task-from-url'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      url:
        simple: ${inputs.URL}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 275,
          "y": 545
        }
      }
    note: false
  "4":
    id: "4"
    taskid: 9ad01520-9f27-44be-8a20-2caa2ce4b1c4
    type: playbook
    task:
      id: 9ad01520-9f27-44be-8a20-2caa2ce4b1c4
      version: -1
      name: GenericPolling
      description: |-
        Use as a sub-playbook to block execution of the master playbook until a remote action is complete.
        This playbook implements polling by continually running the command in Step #2 until the operation completes.
        The remote action should have the following structure:

        1. Initiate the operation.
        2. Poll to check if the operation completed.
        3. (optional) Get the results of the operation.
      playbookName: GenericPolling
      type: playbook
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      Ids:
        simple: ${Cuckoo.Task.ID}
      Interval:
        simple: ${inputs.interval}
      PollingCommandArgName:
        simple: id
      PollingCommandName:
        simple: cuckoo-view-task
      Timeout:
        simple: ${inputs.timeout}
      dt:
        simple: Cuckoo.Task(val.CompletedOn == null).ID
    separatecontext: true
    loop:
      iscommand: false
      exitCondition: ""
      wait: 1
    view: |-
      {
        "position": {
          "x": 275,
          "y": 1070
        }
      }
    note: false
  "6":
    id: "6"
    taskid: bee9857d-c4a9-4e9f-8939-822514c68078
    type: title
    task:
      description: "-"
      id: bee9857d-c4a9-4e9f-8939-822514c68078
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1245
        }
      }
    note: false
  "7":
    id: "7"
    taskid: 244fc667-b769-4232-809c-424cf5d174f0
    type: regular
    task:
      description: get task report
      id: 244fc667-b769-4232-809c-424cf5d174f0
      version: -1
      name: Get task report
      script: '|||cuckoo-get-task-report'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      id:
        simple: ${Cuckoo.Task.ID}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 275,
          "y": 1245
        }
      }
    note: false
  "8":
    id: "8"
    taskid: f9d3406d-4b34-44e7-88eb-b2523f8e0897
    type: regular
    task:
      description: sleep
      id: f9d3406d-4b34-44e7-88eb-b2523f8e0897
      version: -1
      name: Sleep (let the sandbox create the task)
      scriptName: Sleep
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      seconds:
        simple: "5"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 275,
          "y": 720
        }
      }
    note: false
  "9":
    id: "9"
    taskid: 666d7185-d292-42cf-8d42-882e5f80c0d8
    type: regular
    task:
      description: view task
      id: 666d7185-d292-42cf-8d42-882e5f80c0d8
      version: -1
      name: View task
      script: '|||cuckoo-view-task'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "4"
    scriptarguments:
      id:
        simple: ${Cuckoo.Task.ID}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 275,
          "y": 895
        }
      }
    note: false
view: |-
  {
    "linkLabelsPosition": {},
    "paper": {
      "dimensions": {
        "height": 1435,
        "width": 605,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: URL
  value:
    complex:
      root: URL
      accessor: Data
  required: false
  description: URL to detonate
- key: interval
  value:
    simple: "1"
  required: false
  description: How often to poll for results
- key: timeout
  value:
    simple: "10"
  required: false
  description: How long to wait before giving up waiting for results
outputs:
- contextPath: Cuckoo.Task.Category
  description: Category of task
- contextPath: Cuckoo.Task.Machine
  description: Machine of task
- contextPath: Cuckoo.Task.Errors
  description: Errors of task
- contextPath: Cuckoo.Task.Traget
  description: Traget of task
- contextPath: Cuckoo.Task.Package
  description: Package of task
- contextPath: Cuckoo.Task.SampleID
  description: Sample ID of task
- contextPath: Cuckoo.Task.Guest
  description: Task guest
- contextPath: Cuckoo.Task.Custom
  description: Custom values of task
- contextPath: Cuckoo.Task.Owner
  description: Task owner
- contextPath: Cuckoo.Task.Priority
  description: Priority of task
- contextPath: Cuckoo.Task.Platform
  description: Platform of task
- contextPath: Cuckoo.Task.Options
  description: Task options
- contextPath: Cuckoo.Task.Status
  description: Task status
- contextPath: Cuckoo.Task.EnforceTimeout
  description: Is timeout of task enforced
- contextPath: Cuckoo.Task.Timeout
  description: Task timeout
- contextPath: Cuckoo.Task.Memory
  description: Task memory
- contextPath: Cuckoo.Task.Tags
  description: Task tags
- contextPath: Cuckoo.Task.ID
  description: ID of task
- contextPath: Cuckoo.Task.AddedOn
  description: Date on which the task was added
- contextPath: Cuckoo.Task.CompletedOn
  description: Date on which the task was completed
- contextPath: Cuckoo.Task.Score
  description: Reported score of the the task
- contextPath: Cuckoo.Task.Monitor
  description: Monitor of the reported task
tests:
- CuckooTest