Querying PGSQLA record of all collected hashes is stored on the primary server pgsql db in the
storefiles table.
To see a specific record :
- On the primary server, run:
# psql -d cb -p 5002 -c "select * from storefiles where md5hash='\x<hash>';"
where <hash> is the lower-case value of the md5sum being queried.
example: md5hash='\x22ea17f020dc46f8bb4270cb31358acc ';"
The '\x' is generally required.
- Run:
# psql -d cb -p 5002 -c "select * from binary_status where md5hash='\x<hash>'
where <hash> is the lower-case value of the md5sum being queried.
example: md5hash='\x22ea17f020dc46f8bb4270cb31358acc ';"
The '\x' is generally required.
Querying YARATo determine if Yara has seen a specific hash before, query the SQL lite file from the primary server:
- Run:
# sqlite3 /var/cb/data/cb-yara-connector/feed_db/binary.db
- Run the query:
sqlite> select * from binarydetonationresult where md5='<hash>';
where <hash> is the lower-case value of the md5sum being queried.
example: md5='22ea17f020dc46f8bb4270cb31358acc ';"