@passmarked/malware/lib/drivers/phistank.js

Rules that check if the page or linked pages on the same domain (or external) contain any unwanted software,malware or reported phishing attacks

/**
* Required modules
**/
const crypto      = require('crypto');
const async       = require('async');
const url         = require('url');
const request     = require('request');
const S           = require('string');
const _           = require('underscore');
const Constants   = require('../constants');

/**
* Object to expose
**/
var PhisTank = {};

/**
* Generates a hash that we can use to check against our local cache
**/
PhisTank.getHash = function(payload, link, fn) {

  // remove the query and hash params
  var uri = url.parse( (link || '').toLowerCase() );

  // remove the hash
  uri.hash = '';
  uri.search = '';

  // create the hash object
  sha = crypto.createHash('sha1');
  sha.update( url.format(uri) );
  var hash = sha.digest('hex');

  // done
  fn(null, hash);

};

/**
* Does the actual check
**/
PhisTank.check = function(payload, link, fn) {

  // parse the url
  var uri = url.parse(link);

  // get the hash
  PhisTank.getHash(payload, link, function(err, hash) {

    // handle a error if any
    if(err) {

      // output error
      payload.error('Something went wrong while generating the hash for PhisTank from link ' + link, err);

      // finish
      return fn(err);

    }

    // the key to use for caching
    var cachingKey = [

      'passmarked',
      'phishtank',
      hash

    ].join(':');

    // check the cache
    payload.get(cachingKey, function(err, cachedResults) {

      // handle any errors
      if(err) {

        // output to stderr
        payload.error('Problem checking cache for Phistank results', err);

        // even if the cache is not working still continue
        // return fn(err);

      }

      // was it cached ?
      if(!cachedResults) return fn(null, []);

      // the value
      var detections = [];

      // split the results
      var results = null;

      // try to parse the results
      try {

        // parse it
        results = JSON.parse(cachedResults);

      } catch(err) {

        // failed to parse
        payload.error('Failed to parse the response from Cache for Phistank', err);

        // finish
        return fn(null, []);

      }

      // go through the results one by one
      async.each(results || [], function(result, cb) {

        // the type we will go searching for
        var type = Constants.DETECTIONS.PHISHING;

        // must be a known type
        if(!type) return cb(null);

        // add it
        detections.push({
          
          source:       Constants.PHISTANK_SOURCE, // API name
          provider:     Constants.PHISTANK_COMPANY, // Company Name
          preview:      result.phish_detail_url, // Preview url to view why online
          website:      Constants.PHISTANK_WEBSITE,
          result:       results,
          type:         Constants.DETECTIONS.PHISHING,
          url:          link

        });

        // done
        cb(null);

      }, function(err) {

        // handle the output
        if(err) {

          // output as error
          payload.error('Something went wrong while parsing the results from SAFE BROWSING: ' + results, err);

        }

        // finish with the error if given
        fn(err, detections);

      });

    });

  });


};

/**
* Expose the given object
**/
module.exports = exports = PhisTank;