@passmarked/malware
Version:
Rules that check if the page or linked pages on the same domain (or external) contain any unwanted software,malware or reported phishing attacks
243 lines (175 loc) • 6.33 kB
JavaScript
// modules
const assert = require('assert');
const _ = require('underscore');
const fs = require('fs');
const passmarked = require('passmarked');
// handle the settings
describe('phishtank', function() {
describe('links', function() {
// handle the error output
it('Should not report a internal link, if the link is on the same hostname', function(done) {
// handle the payload
var payload = passmarked.createPayload({
url: 'http://example.com/about',
cache: {
'passmarked:phishtank:9c17e047f58f9220a7008d4f18152fee4d111d14': JSON.stringify([{
"phish_id":"4350416",
"url":"http:\/\/example.com",
"phish_detail_url":"http:\/\/www.phishtank.com\/phish_detail.php?phish_id=example",
"submission_time":"2016-08-05T17:04:35+00:00",
"verified":"yes",
"verification_time":"2016-08-05T21:06:48+00:00",
"online":"yes",
"details":[
{
"ip_address":"65.60.44.234",
"cidr_block":"65.60.0.0\/18",
"announcing_network":"32475",
"rir":"arin",
"country":"US",
"detail_time":"2016-08-05T17:05:27+00:00"
}
],
"target":"Test"
}])
}
}, null, '<a href="http://example.com">bad link</a><a href="http://example2.com">good link</a>')
// run the rules
require('../lib/rules/links')(payload, function(err) {
// check for a error
if(err)
assert.fail('Was not expecting a error');
// get the rules
var rules = payload.getRules();
// check
var rule = _.find(rules, function(item) {
return item.key == 'link.internal.phishing';
});
// check if we found it
if(!rule)
assert.fail('Expected a error');
// done
done();
});
});
// handle the error output
it('Should report a internal link, if the link is on the same hostname', function(done) {
// handle the payload
var payload = passmarked.createPayload({
url: 'http://example.com/test',
cache: {
'passmarked:phishtank:9c17e047f58f9220a7008d4f18152fee4d111d14': JSON.stringify([{
"phish_id":"4350416",
"url":"http:\/\/example.com",
"phish_detail_url":"http:\/\/www.phishtank.com\/phish_detail.php?phish_id=example",
"submission_time":"2016-08-05T17:04:35+00:00",
"verified":"yes",
"verification_time":"2016-08-05T21:06:48+00:00",
"online":"yes",
"details":[
{
"ip_address":"65.60.44.234",
"cidr_block":"65.60.0.0\/18",
"announcing_network":"32475",
"rir":"arin",
"country":"US",
"detail_time":"2016-08-05T17:05:27+00:00"
}
],
"target":"Test"
}])
}
}, null, '<a href="http://example.com">bad link</a><a href="http://example2.com">good link</a>')
// run the rules
require('../lib/rules/links')(payload, function(err) {
// check for a error
if(err)
assert.fail('Was not expecting a error');
// get the rules
var rules = payload.getRules();
// check
var rule = _.find(rules, function(item) {
return item.key == 'link.internal.phishing';
});
// check if we found it
if(!rule)
assert.fail('Expected a error');
// done
done();
});
});
});
describe('page', function() {
// handle the error output
it('Should report back error if the current page is part of the cache of bad links', function(done) {
// handle the payload
var payload = passmarked.createPayload({
url: 'http://example.com',
cache: {
'passmarked:phishtank:9c17e047f58f9220a7008d4f18152fee4d111d14': JSON.stringify([{
"phish_id":"4350416",
"url":"http:\/\/example.com",
"phish_detail_url":"http:\/\/www.phishtank.com\/phish_detail.php?phish_id=example",
"submission_time":"2016-08-05T17:04:35+00:00",
"verified":"yes",
"verification_time":"2016-08-05T21:06:48+00:00",
"online":"yes",
"details":[
{
"ip_address":"65.60.44.234",
"cidr_block":"65.60.0.0\/18",
"announcing_network":"32475",
"rir":"arin",
"country":"US",
"detail_time":"2016-08-05T17:05:27+00:00"
}
],
"target":"Test"
}])
}
}, null, '')
// run the rules
require('../lib/rules/page')(payload, function(err) {
// check for a error
if(err)
assert.fail('Was not expecting a error');
// get the rules
var rules = payload.getRules();
// check
var rule = _.find(rules, function(item) {
return item.key == 'page.phishing';
});
// check if we found it
if(!rule)
assert.fail('Expected a error');
// done
done();
});
});
// handle the error output
it('Should not report error if the given page is not a phishing attack', function(done) {
// handle the payload
var payload = passmarked.createPayload({
url: 'http://example22222.com',
cache: {}
}, null, '')
// run the rules
require('../lib/rules/page')(payload, function(err) {
// check for a error
if(err)
assert.fail('Was not expecting a error');
// get the rules
var rules = payload.getRules();
// check
var rule = _.find(rules, function(item) {
return item.key == 'page.phishing';
});
// check if we found it
if(rule)
assert.fail('Was not expecting a error');
// done
done();
});
});
});
});