Hi everyone! This is a short one. I’m going to show you today how I use certain kinds of filters when pivoting on artifacts found on my latest research for can of worms. This is going to be a live demonstration of the different kinds of filters you can use when presenting information on DriftNet and how do they empower you? There’s mainly two different kinds of filters for you to use. One of them is Add to Query which is effectively adjusting your overall query as you go and the second one is a simple Add filter which does not change your query but changes the data that’s presented to you for a current tab These are also adjustable and they can go for positive and negative additions I’ll show you how that works in a sec So as you can see in the page here, I’ve used my query from the latest research from Ken of Worms. This one is the leaf certificate issuer data, that was found on all of the certificates presented in that mesh network Ken of Worms. We’ll go now to Internet wide scans click on Visible services and you can see that there are eight ninety nine current within the last days visible services presenting this information. Do note that this does not mean unique IPs, this means unique services In fact, if you go to the summary page, can see here there are four fifty unique values or IPs but each IP can present more than one service with this information. In fact, this is something we reported on that each one of those IPs actually had anywhere between two or three different services using that data. So let’s say that I can see now the results here and let’s say that I want to filter for a specific service among those. To be more exact, I want to go for the Squid Cache proxy HTTP service that is very uniquely part of that network. It’s being used in almost all of the nodes that we’ve detected. So how do we do that? When I click on one of them, can see here the information about the service itself. You can see the issue and subject data. And if you go down a bit, you can see the server banner presented as Skuid. And if you go even down lower than that, you can see the product tag is Skuid Cache Skuid. Or even lower than that, Skuid HTTP proxy. Let’s say that I’ve checked all three and I want to use this one. The SQUID HTTP proxy. Let’s say that this is the most useful. How do I use this? If I click on it, you will see this, drop down being opened and there are multiple things I can do here. I can edit to the query. I can exclude it from the query or I can apply it as a filter These are effectively the three main ways that I can use this one If I apply it as a filter the page reloads and now you can see four seventeen Basically more than half of the results that we’ve seen here have been cut off. And now we can see only the ones that present this signature. And you can see the tag here being added. And now I can only see the results that accommodate this search. But notice that it did not change my query. This means that if I go for summary here, I still get to see the full four fifty results. Nothing changed. Come back here, the filter is removed and you can’t see it anymore because you’ve reloaded the page and we again see all the eight ninety nine. So why does that help me? This helps you filter through information, especially when you have a long list of artifacts. This helps you filter through without changing the overarching query. You don’t necessarily want to do it every time. But what if I do? What if I figured out that this specific service is the only one that’s of interest to I want to be able to filter only for that I want to actually see only services and IPs that present this one. So the way to do it is go for the same click here, the Squid HTTP proxy. Now I’m going to click on add query. As you can see my query now changed. It is now the issuer information that was before and product tag and map found squid HTTP proxy. Same results as before with the filter, but what you can see now is that the query itself changed. That means if I go over summary, you only see four seventeen IPs. We lost thirty three IPs that basically do not present this service So what does it actually mean for us? It means that if you want to be able to alter your query as you go, this is the way to do it But if you want to stick to an original query and you only want to filter through information within a given set, you can use the filter and that prevents you from changing and constantly altering your query so that you don’t necessarily miss out on the information that is crucial to you. Now, let’s remove this one again and I want to show you the alternative for what if I want to do the opposite. Let’s say I decided that the squid ones are not interesting. One click on this and I could go for exclude from the query Notice it’s excluding it from the query, meaning this is going to alter my query necessarily Clicking on this now adds it, but it adds it as a negative. We can see that it accidentally we didn’t change the URL at the top of the page and so it reloaded this part, but easily removing it. And you can see now that the query looks like this: the initial data and not presenting this one One click here and you can see four eighty two services that do not show the Squid HTTP proxy. Now these ones would probably be mostly the SOX ports. We’ve seen those in research. And this really helps me if I want to focus and zero down on a specific service or a specific artifact. Another way to do this or a third, fourth maybe kind of way to do this. If you want to look at something, but you don’t necessarily want to use the original filters, you just want to see something new. So for example, I’ve seen Squid service and I want to be able to just understand what is this? Like how many services like this appear on the wider internet not relating to specifically MiSight? One click here on the new search summary and if you click it with your center clicker on your mouse you will get a new tab opening. As it does you will see that it created a query only with this specific filter. No more are we limited by the leaf data from previous search. Now this is going to present all of the services and in the summary page you will see all the IPs and the rest of the information but if we go specifically for visible services it will show you all of the services within the last ten days that have presented this product tag Squid HTTP. Let it load here for a minute. It’s doing that, this is basically the different ways you can filter information on DriftNet as you go. This prevents you from losing your original query if you want or altering it if you feel like it’s not as specific. And so you can actually use this to adjust and get to the results that you actually want to see. Actually, Using the filter is actually a nice way to test potential changes to your query. Let’s say for example I want to add subject information, not just the issuer but also the subject information. If I apply it as a filter, I will see now how many have changed Effectively none! And so I can safely say that if I edit to the query Same results! All of these certificates are exactly the same between the issuer data and their subject data And that’s it! That’s a quick note from me on how to use different kind of filters when you’re hunting for artifacts across the internet using DriftNet. Good luck to you hunters out there and keep on hunting.