예제 #1
0
    def do_perform_test(self,
                        caplog,
                        sample,
                        expected,
                        events='',
                        useragent='win7ie90'):
        thug = ThugAPI()

        thug.set_useragent(useragent)
        thug.set_events(events)
        thug.disable_cert_logging()
        thug.set_features_logging()
        thug.log_init(sample)
        thug.run_local(sample)

        records = [r.message for r in caplog.records]

        matches = 0

        for e in expected:
            for record in records:
                if e in record:
                    matches += 1

        assert matches >= len(expected)
예제 #2
0
    def do_perform_test(self, caplog, url, expected, type_="local"):
        thug = ThugAPI()

        thug.set_useragent('win7ie90')
        thug.set_features_logging()
        thug.set_ssl_verify()
        thug.set_connect_timeout(1)
        thug.add_urlclassifier(
            os.path.join(self.signatures_path, "url_signature_13.yar"))
        thug.register_pyhook("DFT", "do_handle_params",
                             self.do_handle_params_hook)
        thug.register_pyhook("ThugLogging", "log_classifier",
                             self.log_classifier_hook)
        thug.log_init(url)

        m = getattr(thug, "run_{}".format(type_))
        m(url)

        records = [r.message for r in caplog.records]

        matches = 0

        for e in expected:
            for record in records:
                if e in record:
                    matches += 1

        assert matches >= len(expected)
예제 #3
0
    def do_perform_test(self, caplog, sample, adobe, expected):
        thug = ThugAPI()

        thug.set_useragent('win7ie90')
        thug.set_events('click,storage')
        thug.disable_cert_logging()
        thug.set_features_logging()

        if adobe in ('disable', ):
            thug.disable_acropdf()
        else:
            thug.set_acropdf_pdf(adobe)

        thug.log_init(sample)
        thug.run_local(sample)

        records = [r.message for r in caplog.records]

        matches = 0

        for e in expected:
            for record in records:
                if e in record:
                    matches += 1

        assert matches >= len(expected)
예제 #4
0
    def do_perform_test(self, caplog, sample, shockwave, expected):
        thug = ThugAPI()

        thug.set_useragent('win7ie90')
        thug.set_events('click,storage')
        thug.disable_cert_logging()
        thug.set_features_logging()
        
        if shockwave in ('disable', ):
            thug.disable_shockwave_flash()
        else:
            thug.set_shockwave_flash(shockwave)
        
        thug.log_init(sample)
        thug.run_local(sample)

        records = [r.message for r in caplog.records]

        matches = 0

        for e in expected:
            for record in records:
                if e in record:
                    matches += 1

        assert matches >= len(expected)
예제 #5
0
    def do_perform_test(self, caplog, sample, expected):
        thug = ThugAPI()

        thug.set_useragent('win7ie90')
        thug.set_events('click,storage')
        thug.set_extensive()
        thug.disable_cert_logging()
        thug.set_file_logging()
        thug.set_json_logging()
        thug.set_features_logging()
        thug.set_ssl_verify()
        thug.set_threshold(3)
        thug.log_init(sample)
        thug.run_local(sample)

        records = [r.message for r in caplog.records]

        matches = 0

        for e in expected:
            for record in records:
                if e in record:
                    matches += 1

        assert matches >= len(expected)
예제 #6
0
    def do_perform_remote_test(self, caplog, url, expected):
        thug = ThugAPI()

        thug.set_useragent('win7ie90')
        thug.set_image_processing()
        thug.set_threshold(2)
        thug.disable_cert_logging()
        thug.set_features_logging()
        thug.set_ssl_verify()
        thug.log_init(url)

        thug.add_htmlclassifier(
            os.path.join(self.signatures_path, "html_signature_12.yar"))
        thug.add_imageclassifier(
            os.path.join(self.signatures_path, "image_signature_14.yar"))
        thug.add_imageclassifier(
            os.path.join(self.signatures_path, "image_signature_15.yar"))

        thug.run_remote(url)

        records = [r.message for r in caplog.records]

        matches = 0

        for e in expected:
            for record in records:
                if e in record:
                    matches += 1

        assert matches >= len(expected)
예제 #7
0
    def do_perform_test(self, caplog, url, expected, type_="remote"):
        thug = ThugAPI()

        thug.set_useragent('win7ie90')
        thug.set_events('click,storage')
        thug.set_web_tracking()
        thug.enable_cert_logging()
        thug.set_features_logging()
        thug.set_log_verbose()
        thug.set_ssl_verify()
        thug.log_init(url)

        m = getattr(thug, "run_{}".format(type_))
        m(url)

        records = [r.message for r in caplog.records]

        matches = 0

        for e in expected:
            for record in records:
                if e in record:
                    matches += 1

        assert matches >= len(expected)
예제 #8
0
    def do_perform_test(self,
                        caplog,
                        sample,
                        expected,
                        useragent='osx10safari5'):
        thug = ThugAPI()

        thug.set_useragent(useragent)
        thug.set_events('click,storage')
        thug.set_connect_timeout(2)
        thug.disable_cert_logging()
        thug.set_features_logging()
        thug.set_ssl_verify()
        thug.log_init(sample)
        thug.run_local(sample)

        records = [r.message for r in caplog.records]

        matches = 0

        for e in expected:
            for record in records:
                if e in record:
                    matches += 1

        assert matches >= len(expected)
예제 #9
0
    def do_perform_test(self, caplog, sample, expected):
        thug = ThugAPI()

        thug.set_useragent('winxpie70')
        thug.set_threshold(2)
        thug.disable_cert_logging()
        thug.set_features_logging()
        thug.set_ssl_verify()
        thug.log_init(sample)

        thug.reset_customclassifiers()
        thug.add_customclassifier('url', self.catchall)
        thug.reset_customclassifiers()
        thug.add_customclassifier('html', self.catchall)
        thug.add_customclassifier('url', self.catchall)
        thug.add_customclassifier('js', self.catchall)
        thug.add_customclassifier('vbs', self.catchall)
        thug.add_customclassifier('sample', self.catchall)
        thug.add_customclassifier('cookie', self.catchall)
        thug.add_customclassifier('text', self.catchall)

        thug.add_htmlclassifier(
            os.path.join(self.signatures_path, "html_signature_1.yar"))
        thug.add_jsclassifier(
            os.path.join(self.signatures_path, "js_signature_2.yar"))
        thug.add_urlclassifier(
            os.path.join(self.signatures_path, "url_signature_3.yar"))
        thug.add_urlfilter(
            os.path.join(self.signatures_path, "url_filter_4.yar"))
        thug.add_textclassifier(
            os.path.join(self.signatures_path, "text_signature_5.yar"))
        thug.add_vbsclassifier(
            os.path.join(self.signatures_path, "vbs_signature_6.yar"))
        thug.add_urlclassifier(
            os.path.join(self.signatures_path, "url_signature_7.yar"))
        thug.add_urlclassifier(
            os.path.join(self.signatures_path, "url_signature_13.yar"))

        thug.run_local(sample)

        records = [r.message for r in caplog.records]

        matches = 0

        for e in expected:
            for record in records:
                if e in record:
                    matches += 1

        assert matches >= len(expected)
예제 #10
0
파일: test_events.py 프로젝트: buffer/thug
    def do_perform_test(self, caplog, sample, expected, events = '', useragent = 'win7ie90'):
        thug = ThugAPI()

        thug.set_useragent(useragent)
        thug.set_events(events)
        thug.disable_cert_logging()
        thug.set_features_logging()
        thug.log_init(sample)
        thug.run_local(sample)

        records = [r.message for r in caplog.records]

        matches = 0

        for e in expected:
            for record in records:
                if e in record:
                    matches += 1

        assert matches >= len(expected)
예제 #11
0
    def do_perform_test(self, caplog, sample, expected):
        thug = ThugAPI()

        thug.set_useragent('win7ie90')
        thug.set_events('click,storage')
        thug.set_features_logging()
        thug.set_connect_timeout(2)
        thug.log_init(sample)
        thug.run_local(sample)

        records = [r.message for r in caplog.records]

        matches = 0

        for e in expected:
            for record in records:
                if e in record:
                    matches += 1

        assert matches >= len(expected)
예제 #12
0
    def do_perform_test(self, caplog, url, expected, type_="remote"):
        thug = ThugAPI()

        thug.set_useragent('win7ie90')
        thug.set_features_logging()
        thug.log_init(url)

        m = getattr(thug, "run_{}".format(type_))
        m(url)

        records = [r.message for r in caplog.records]

        matches = 0

        for e in expected:
            for record in records:
                if e in record:
                    matches += 1

        assert matches >= len(expected)
예제 #13
0
    def do_perform_test(self, caplog, url, expected, type_ = "remote"):
        thug = ThugAPI()

        thug.set_useragent('win7ie90')
        thug.set_features_logging()
        thug.log_init(url)

        m = getattr(thug, "run_{}".format(type_))
        m(url)

        records = [r.message for r in caplog.records]

        matches = 0

        for e in expected:
            for record in records:
                if e in record:
                    matches += 1

        assert matches >= len(expected)
예제 #14
0
    def do_perform_test(self, caplog, sample, expected):
        thug = ThugAPI()

        thug.set_useragent('winxpie70')
        thug.set_events('click')
        thug.set_connect_timeout(2)
        thug.disable_cert_logging()
        thug.set_features_logging()
        thug.log_init(sample)
        thug.run_local(sample)

        records = [r.message for r in caplog.records]

        matches = 0

        for e in expected:
            for record in records:
                if e in record:
                    matches += 1

        assert matches >= len(expected)
예제 #15
0
    def do_perform_test(self, caplog, url, expected):
        thug = ThugAPI()

        thug.set_useragent('win7ie90')
        thug.set_vt_query()
        thug.set_vt_submit()
        thug.disable_cert_logging()
        thug.set_features_logging()
        thug.log_init(url)
        thug.run_remote(url)

        records = [r.message for r in caplog.records]

        matches = 0

        for e in expected:
            for record in records:
                if e in record:
                    matches += 1

        assert matches >= len(expected)
예제 #16
0
    def do_perform_test(self, caplog, url, expected, type_ = "local"):
        thug = ThugAPI()

        thug.set_useragent('win7ie90')
        thug.set_features_logging()
        thug.set_connect_timeout(1)
        thug.log_init(url)
        thug.register_pyhook("DFT", "do_handle_params", self.do_handle_params_hook)

        m = getattr(thug, "run_{}".format(type_))
        m(url)

        records = [r.message for r in caplog.records]

        matches = 0

        for e in expected:
            for record in records:
                if e in record:
                    matches += 1

        assert matches >= len(expected)
예제 #17
0
    def do_perform_test(self, caplog, sample):
        thug = ThugAPI()

        thug.log_init(sample)

        thug.set_useragent('win7ie90')
        thug.set_verbose()
        thug.set_json_logging()

        thug.reset_features_logging()
        assert thug.get_features_logging() is False

        thug.set_features_logging()
        assert thug.get_features_logging() is True

        thug.log_init(sample)
        thug.run_local(sample)
        thug.log_event()

        for r in caplog.records:
            try:
                features = json.dumps(r)
            except Exception:
                continue

            if not isinstance(features, dict):
                continue

            if "html_count" not in features:
                continue

            for url in self.expected:
                if not url.endswith(sample):
                    continue

                for key in features:
                    assert features[key] == self.expected[url][key]