forked from fnmsd/awvs_script_decode
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy path11-Malware.script
More file actions
169 lines (165 loc) · 6.09 KB
/
Copy path11-Malware.script
File metadata and controls
169 lines (165 loc) · 6.09 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
#engine 3.3;
#include constants.inc;
#include helpers.inc;
#include string_helpers.inc;
#include json_helpers.inc;
#include debug_helpers.inc;
#noretest;
var urls2check = {};
var linksQuota = 25;
var debug = false;
var licKey = false;
// **************************************************************************************
function alert(details, db, url)
{
var fname = "Malware.xml";
var ri = new TReportItem();
ri.LoadFromFile(fname);
ri.details = details;
ri.affects = "Web Server";
ri.alertPath = "Scripts/" + fname;
if (db == "Google Safe Browsing database") {
ri.addReference("Google Safe Browsing Database for this URL", "https://safebrowsing.google.com/safebrowsing/diagnostic?&site=" + encodeURI(url));
}
AddReportItem(ri);
}
// **************************************************************************************
function checkListOfURlsViaSB(listOfURLs)
{
var lastJob = new THTTPJob();
lastJob.url = new TURL("https://sb.bxss.me/");
lastJob.verb = 'POST';
lastJob.secure = true;
lastJob.timeout = 10000;
lastJob.request.body = JSON.stringify({"urls": listOfURLs});
lastJob.request.addHeader('Content-type', 'application/x-www-form-urlencoded', true);
lastJob.request.addHeader('WVSSB', 'true', true);
lastJob.request.addHeader('WVSSBLK', licKey, true);
lastJob.execute();
if (!lastJob.wasError && lastJob.responseStatus == 200)
{
return lastJob.response.body;
}
return false;
}
// **************************************************************************************
function checkURLs(listOfURLs)
{
if (debug) trace("checking " + listOfURLs.length + " links ")
// mark them as checked
for (var i=0; i<listOfURLs.length; i++) {
var url = listOfURLs[i];
urls2check[url]['checked'] = true;
//trace(url);
}
// response
respText = checkListOfURlsViaSB(listOfURLs);
if (respText) {
// parse response
resp = JSON.parse(respText);
// could be parsed?
if (resp) {
for(var url in resp) {
if (resp[url] !== false) {
if (debug) trace(url + " => " + resp[url]);
urls2check[url]['malware'] = resp[url];
}
}
}
}
}
// **************************************************************************************
function SBIsAlive()
{
if (debug) trace("SBIsAlive?");
var listOfURLs = ["http://malware.testing.google.test/testing/malware/"];
// response
respText = checkListOfURlsViaSB(listOfURLs);
if (respText) {
// parse response
resp = JSON.parse(respText);
// could be parsed?
if (resp) {
for(var url in resp) {
if (resp[url] !== false) {
if (debug) trace("SBIsAlive? YES");
return true;
}
}
}
}
if (debug) trace("SBIsAlive? NO");
return false;
}
// **************************************************************************************
// main()
// **************************************************************************************
licKey = getGlobalValue('licensing.licKey');
// don't do anything unless we are activated and have a license key
if (licKey && licKey.length == 19) {
// make an associative array with all external URLs
var eurls = getExternalURLs();
var hosts = {}
for (var i=0; i<eurls.count; i++) {
var urlHost = eurls.item(i).url.host;
if (!(urlHost in hosts)) {
var urlStr = eurls.item(i).url.url;
urls2check[urlStr] = {};
urls2check[urlStr]['checked'] = false;
urls2check[urlStr]['malware'] = false;
urls2check[urlStr]['linkedFrom'] = [];
// fill in linked from information
for (var j=0; j<eurls.item(i).linkedFrom.count; j++) {
urls2check[urlStr]['linkedFrom'].push(eurls.item(i).linkedFrom.item(j).url);
}
hosts[urlHost]=1;
}
}
// check them
if (eurls.count && SBIsAlive())
{
var iterations = 0;
while (true) {
// prevent an infinite loop
if (iterations < 50000) iterations++; else break;
var cnt = 0;
var listOfURLs = [];
for(var url in urls2check) {
if(urls2check.hasOwnProperty(url)) {
if (!urls2check[url]['checked']) {
// not checked, add it to the list to check
if (cnt < linksQuota) {
listOfURLs.push(url);
cnt++;
} else break;
}
}
}
// no more links to check
if (cnt == 0) break;
else checkURLs(listOfURLs); // check them
}
// analyze results, look for the malware
for(var url in urls2check) {
if(urls2check.hasOwnProperty(url)) {
if(urls2check[url]['malware'] !== false) {
var db = "Unknown";
if (urls2check[url]['malware'] == "g") db = "Google Safe Browsing database";
else if (urls2check[url]['malware'] == "y") db = "Yandex Safe Browsing database";
if (debug) trace("malware: " + url + " => " + db)
var details = "The URL [dark][bold]" + url + "[/bold][/dark] is marked as malware in " + db + ".[break][break]";
details += "This malicious URL was referenced from the following pages of your website: [break][break]";
details += "[ul]";
for (var i=0; i<urls2check[url]['linkedFrom'].length; i++) {
details += "[li]" + urls2check[url]['linkedFrom'][i] + "[/li]";
}
details += "[/ul]";
if (db == "Yandex Safe Browsing database") {
details = details + "[break][break][bold]Yandex tested[/bold]";
}
alert(details, db, url);
}
}
}
}
}