Tutorial

Searching

Hash search

Enter any MD5, SHA1, SHA256 hash and select the database you'd like to search in.

CERT, PE, and APK/JAR search

There are two primary modes for search - searching by attribute and free text search. We recommend the latter only for advanced users and if you know exactly what you are looking for. On the right side, you can find a drop-down menu of certificate attributes. By pressing the 'add' button next to the drop-down menu, you can add the selected attribute to the search parameters. After pressing the 'add' button, you can set the attribute using the provided fields. The fields are either accept a date, a selected drop-down menu entry, an exact or partial match. For example the 'Valid-To' attribute has a date selector field. The 'timeout' setting at the bottom of this panel is useful if you are trying to run queries which will return a very large amount of items.

The free-text search allows you to specify attributes in a raw, text format. Please consult the 'help' button next to the text entry field for further information.

Public key search

This search function is useful if you already know the hash of the public key you're searching for.

Upload

You can upload any number of certificates, PE or JAR/APK files into ROSCO. If you would like to be notified when the upload & analysis of the uploaded files have finished, fill out the 'Notification email' field.

Alerts

Using String Alerts, you can set ROSCO to warn you in case it detects a specified string in any of the fields that you are able to search in. The Signed alerts feature is mainly for those wishing to monitor the usage of their signing keys - simply upload your public key into the system, and it will automatically alert you whenever it detects the uploaded key in any of the newly-uploaded files. Using this alert can quickly alert you to any unauthorized of your private keys.

Notifications can be sent through e-mail, or through an RSS feed. Simply set the e-mail address in the alert and tick 'Notify' if you wish to have an e-mail sent to that address whenever a new file contains your public key or the specified string. You can set any number of alerts to be included in your personalized RSS feed - simply apply the RSS feed link to any RSS reader, and it will show you alerts in near real-time. You can specifically include and ignore alerts by ticking and unticking the RSS checkbox.

The 'Matched' field of the alerts shows you how many uploaded items match for your search in ROSCO's database - you can click on the number to list all files that your alert filter applies to.

Profile

By clicking on your username, you can access your own profile, where you can change your password and/or the associated e-mail address.