{"id":3435,"date":"2015-12-20T16:44:32","date_gmt":"2015-12-20T16:44:32","guid":{"rendered":"http:\/\/www.hexacorn.com\/blog\/?p=3435"},"modified":"2015-12-20T17:09:08","modified_gmt":"2015-12-20T17:09:08","slug":"santas-bag-full-of-user-agents","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2015\/12\/20\/santas-bag-full-of-user-agents\/","title":{"rendered":"Santa&#8217;s bag full of User Agents"},"content":{"rendered":"<p>Santa dropped some <a href=\"https:\/\/www.hexacorn.com\/examples\/2015-12-21_useragents.txt\">user agents<\/a> on the DFIR\/RCE community today.<\/p>\n<p>It is similar to other lists shared before:<\/p>\n<ul>\n<li><a href=\"https:\/\/www.hexacorn.com\/blog\/2014\/12\/23\/santas-bag-full-of-mutants\/\">https:\/\/www.hexacorn.com\/blog\/2014\/12\/23\/santas-bag-full-of-mutants\/<\/a><\/li>\n<li><a href=\"https:\/\/www.hexacorn.com\/blog\/2015\/04\/05\/the-easter-bunny-comes-with-a-bag-full-of-events\/\">https:\/\/www.hexacorn.com\/blog\/2015\/04\/05\/the-easter-bunny-comes-with-a-bag-full-of-events\/<\/a><\/li>\n<li><a href=\"https:\/\/www.hexacorn.com\/blog\/2015\/02\/19\/year-of-sheep-starts-with-a-bag-full-of-atoms\/\">https:\/\/www.hexacorn.com\/blog\/2015\/02\/19\/year-of-sheep-starts-with-a-bag-full-of-atoms\/<\/a><\/li>\n<\/ul>\n<p>The list includes over 6K user agents used by samples I sandboxed. There is no guarantee all of them are malicious, so be aware that adding them blindly to some block lists will cause a lot of issues.<\/p>\n<p>If you find any mistakes, please let me know. As mentioned above, this list SHOULD NOT be taken at its face value as there are a lot of ways for it to get contaminated.<\/p>\n<p>Note: the list contains variables (I hope they are self-explanatory \ud83d\ude42 ):<\/p>\n<ul>\n<li>&lt;COMPUTER NAME&gt;<\/li>\n<li>&lt;IP&gt;<\/li>\n<li>&lt;MAC&gt;<\/li>\n<li>&lt;SAMPLE NAME&gt;<\/li>\n<li>&lt;USER NAME&gt;<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Santa dropped some user agents on the DFIR\/RCE community today. It is similar to other lists shared before: https:\/\/www.hexacorn.com\/blog\/2014\/12\/23\/santas-bag-full-of-mutants\/ https:\/\/www.hexacorn.com\/blog\/2015\/04\/05\/the-easter-bunny-comes-with-a-bag-full-of-events\/ https:\/\/www.hexacorn.com\/blog\/2015\/02\/19\/year-of-sheep-starts-with-a-bag-full-of-atoms\/ The list includes over 6K user agents used by samples I sandboxed. There is no guarantee all of them &hellip; <a href=\"https:\/\/www.hexacorn.com\/blog\/2015\/12\/20\/santas-bag-full-of-user-agents\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[28,39,15,19,46,33],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/3435"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=3435"}],"version-history":[{"count":3,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/3435\/revisions"}],"predecessor-version":[{"id":3440,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/3435\/revisions\/3440"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=3435"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=3435"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=3435"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}