<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Dynamic Analysis — API Reference

## CAPE Sandbox

### API Submission

```bash
# Submit sample
curl -F "file=@sample.exe" http://cape:8000/apiv2/tasks/create/file/

# Submit URL
curl -F "url=http://malicious.com" http://cape:8000/apiv2/tasks/create/url/

# Get report
curl http://cape:8000/apiv2/tasks/get/report/1/
```

### Configuration Options
| Option | Description |
|--------|-------------|
| `timeout` | Execution timeout (seconds) |
| `enforce_timeout` | Force full timeout |
| `machine` | Specific VM to use |
| `package` | Analysis package (exe, dll, doc, ps1) |
| `options` | Comma-separated options |

## FakeNet-NG

```bash
# Start with default config
sudo fakenet-ng

# Custom config
sudo fakenet-ng --config custom.cfg

# Key listeners
# - DNS: responds to all queries
# - HTTP/HTTPS: captures requests, serves responses
# - SMTP: captures email sends
# - FTP: captures file transfers
```

## Procmon (Sysinternals)

```bash
# Start logging
Procmon.exe /Quiet /Minimized /BackingFile log.pml

# Filter by process
Procmon.exe /Quiet /Filter "ProcessName is sample.exe"

# Convert to CSV
Procmon.exe /OpenLog log.pml /SaveAs log.csv

# Key operation types:
# RegSetValue, RegCreateKey     — Registry persistence
# CreateFile, WriteFile          — File drops
# Process Create                 — Child processes
# TCP Connect, UDP Send          — Network activity
```

## CAPA

```bash
capa sample.exe              # Standard analysis
capa sample.exe -j           # JSON output
capa sample.exe -v           # Verbose with rule matches
capa sample.exe -vv          # Very verbose
capa sample.exe -r rules/    # Custom rules directory
```

### Capability Namespaces
| Namespace | Examples |
|-----------|---------|
| `communication` | HTTP client, DNS, socket |
| `persistence` | registry, service, task |
| `defense-evasion` | process injection, anti-debug |
| `collection` | keylogger, screen capture |
| `execution` | shellcode, process creation |

## tshark (Network Analysis)

```bash
# DNS queries
tshark -r capture.pcap -Y "dns.qry.name" -T fields -e dns.qry.name

# HTTP requests
tshark -r capture.pcap -Y "http.request" -T fields -e http.host -e http.request.uri

# Unique destination IPs
tshark -r capture.pcap -T fields -e ip.dst | sort -u

# SSL/TLS server names
tshark -r capture.pcap -Y "tls.handshake.extensions_server_name" -T fields -e tls.handshake.extensions_server_name
```

## INetSim

```bash
# Start all services
sudo inetsim

# Key services: DNS, HTTP, HTTPS, SMTP, FTP, IRC
# Config: /etc/inetsim/inetsim.conf
# Logs: /var/log/inetsim/
```
