I’ve noticed when a zlib compressed chunk of data is followed by other data, search-for-compression.py will not always be able to detect the compressed chunk. This is caused by the fact that the other data generates a decompression error, and the complete chunk is disregarded.

I’ve added a new option to try to solve this: -S

Option -S takes a value, a positive number. It’s the size of the decompression buffer. By default, its value is 0.

When you try -S 100 for example, search-for-compression.py will try to decompress up to 100 bytes. If that succeeds, then we assume that we found compressed data, and search-for-compression.py will try to decompress the remainder of the data until either a decompression error occurs, or there is no more data. But when an error occurs, search-for-compression.py will revert to the last decompression without error, and report that.

search-for-compression.py is still in my beta repository.

More info on this update: “zipdump.py: Metadata Encoding“.

base64dump_V0_0_31.zip (http)
MD5: E54FFB4F618E47FAA724C9F16CF21E7A
SHA256: 9475E4184790583265106CBA0FBD04546A7BF4B1B67A569F2B96D432E6F16E2D

This new version adds option –stats. For more details, take a look at SANS Internet Storm Center diary entry “Evil MSI Background: BASE64 Statistical Analysis“.

base64dump_V0_0_30.zip (http)
MD5: E54FFB4F618E47FAA724C9F16CF21E7A
SHA256: 9475E4184790583265106CBA0FBD04546A7BF4B1B67A569F2B96D432E6F16E2D

AI-driven development is not something organizations can or should block. But it must be governed.

The post Everybody Is Vibe Coding But Nobody Told the Security Team appeared first on SecurityWeek.

This is a small bug fix for search-for-compression.py, and I’m also taking it out of the beta repository and putting it into the DidierStevensSuite repository.

search-for-compression_V0_0_7.zip (http)
MD5: DD113FF41851A562D271804E4558EA08
SHA256: 6E663316F774BA5B373704E7FE41B8266F5D1ADC618327F9F2C4C4C830A1B3DE

This is a fix for escape sequences that trigger warnings in the latest Python versions.

cut-bytes_V0_0_18.zip (http)
MD5: C5FE455A5371C6675EDF16200D7C5657
SHA256: A4F2A2CFE3614F32F9127F1BAA898260B7C3DF6DEA9544513A375519DE7A5595

Fixing newlines in some plugins.

oledump_V0_0_85.zip (http)
MD5: D972CE411B395EF77DBCE9A63059E8C1
SHA256: 721C095F3126745A42720316A0B3AC1BCCB9DCDBBA9FF59F5FE1F70F8BA3A1AB

This is a fix for option –yarastrings.

oledump_V0_0_84.zip (http)
MD5: 24EA0DEAA6FCB2FA234F33DD179BBAAF
SHA256: C966607C864AAE1D956279B4C3087D37BD003072ED39143512979E771BA5462A

This is a fix for option –yarastrings.

pdf-parser_V0_7_14.zip (http)
MD5: EB3808ACE5497B428138594AFDC5205F
SHA256: 6A60223D52B75F8AFF8C8CF19A58699A20829AC758C251B405B08EC734EF6A4A

This update adds option forcedecompress when using options -f and -s.

More info: Analyzing “Zombie Zip” Files (CVE-2026-0866).

zipdump_v0_0_35.zip (http)
MD5: F4A48AE14C1B258D688BF61D9ACF5E54
SHA256: 8DF7B3EBA282A0391AD619AD33A5F77CD25CC0FDA760E116934DD953714A27C5

This is a fix for option –yarastrings.

zipdump_v0_0_34.zip (http)
MD5: F2BB1DF9A4E1BA323D85C3F8F71B5E69
SHA256: 2455A026DB2BE1678AD8F1AAC2D148D40A7AB7412CCE180C3E9E1FC4B39B9378

This is a fix for option –yarastrings.

pecheck-v0_7_20.zip (http)
MD5: DB34684DA9A5DEC0E94746328318FFE1
SHA256: F6B702206E4DAE3971778263F4B234F7E77BA91A3A1F59419D12CA312316CA96

This is a fix for option –yarastrings in search-for-compression.py.

This is a fix for option –yarastrings.

emldump_V0_0_16.zip (http)
MD5: FF80F7768800EB5AB3A77FEF3E162285
SHA256: 87A33A9345C927B56377CBEC04811826930866C181885A6793F70C53A3418426

This is a fix for option –yarastrings.

base64dump_V0_0_29.zip (http)
MD5: CA3FD00D6AD8B6C0CD091526E3D45D72
SHA256: 2B203BF336D4D7971E4277CE9438D271E9F002E75A2386B97BA61C543D712964

This is a fix for option –yarastrings.

rtfdump_V0_0_15.zip (http)
MD5: C70F327DDC11B549A399B2F85B2B9607
SHA256: 9EFDEB5978372BD93065BCDAB6486DAECA4CB7E2EDA15DD5BD4C98AF69FB19A7

This update adds option -C (–combinations). When this option is used together with -j (–jsonoutput), 2 extra versions of each stream are added. One with option -H enabled, and one with option -H and -S enabled.

rtfdump_V0_0_14.zip (http)
MD5: D9BBA8F83E04D4FD25268E7A2BB4653E
SHA256: DB852CEDA1AE368FF32C1D12951A02BD7A4E36C74632D0D1F790C700FB298689

This update adds pseudo-field sha256 which can be used to calculate the sha256 hash of the content (compressed or decompressed):
-E sha256:data
-E sha256:data:decompress
-E sha256:decompress
-E sha256:extra

zipdump_v0_0_33.zip (http)
MD5: ABF2AC037D2CB7E26664D28B109E9293
SHA256: A80E956072E9C4E3051992EA3E551444585854747EFE2A997A232E6F5B94E8E4

This is a bug fix version.

hash_V0_0_14.zip (http)
MD5: 66A205915A280CC474541053739B8EDD
SHA256: C459B75F132BB4AA394D8EA27A79F409C446AAA67536946673EC824EA9219F9F

This is a small fix for an escape sequence warning.

pecheck-v0_7_19.zip (http)
MD5: A53F4648119CC9A44FB684EAC2C84C08
SHA256: 67637A257967807800AF04D45E0B8DA8F32D38AA772C3596DAE7E0CD4ECFCE52