Problem: When exporting or downloading content from the GUI in the digital forensics tool Velociraptor, underscores are appended to the beginning and end of filenames. Fi… (funda okungaphezulu)
Problem: When exporting or downloading content from the GUI in the digital forensics tool Velociraptor, underscores are appended to the beginning and end of filenames. File is otherwise downloaded correctly, but removal of underscores necessary if original filename is desired. One hypothesis is that perhaps for security reasons there were changes made in Firefox 127 for how character escaping is performed.
Tested Operating Systems: Ubuntu 24.04, Windows 11 22H2, Windows 11 24H2, macOS Sonoma (14.5)
Affected Firefox version(s): Confirmed 127.0, 127.0.1, 127.0.2
Tested Firefox versions which do not reproduce the behavior: 126.x, 125.x >
Testing Microsoft Edge, Chromium, Google Chrome on Windows, macOS, Linux: files download with correct name as expected.
Testing performed with clean installations on clean VMs with no add-ons enabled.
To reproduce:
Download the latest release of Velociraptor from Github (at the time of this writing, 0.72.3) for preferred platform / operating system.
Run Velociraptor using the gui switch, e.g. "$sudo velociraptor-v0.72.3-windows-amd64 gui" or "$ velociraptor-v0.72.3-windows-amd64.exe gui"
Navigate to Server Artifacts and click the "+" icon at the top
Search for Server.Utils.CreateMSI - select and press Launch
Select the newly-created flow, click "Uploaded Files" tab and click vfs_path to download the file
or, click the Notebook tab and click Download JSON or Download CSV buttons to download JSON or CSV respectively, underscores are appended to beginning and end of filenames.