Changeset 205
- Timestamp:
- 03/07/07 10:49:41 (2 years ago)
- Files:
-
- honeyclient/branches/exp/jpuchalski-active_content (modified) (1 prop)
- honeyclient/branches/exp/jpuchalski-active_content/bin/StartAgent.pl (modified) (2 diffs, 1 prop)
- honeyclient/branches/exp/jpuchalski-active_content/bin/StartManager.pl (modified) (3 diffs, 1 prop)
- honeyclient/branches/exp/jpuchalski-active_content/bin/TestRegistry.pl (copied) (copied from honeyclient/trunk/bin/TestRegistry.pl)
- honeyclient/branches/exp/jpuchalski-active_content/etc/file_checklist.txt (copied) (copied from honeyclient/trunk/etc/file_checklist.txt)
- honeyclient/branches/exp/jpuchalski-active_content/etc/honeyclient.xml (modified) (7 diffs, 1 prop)
- honeyclient/branches/exp/jpuchalski-active_content/etc/honeyclient_log.conf (modified) (2 diffs, 1 prop)
- honeyclient/branches/exp/jpuchalski-active_content/etc/inline2test.conf (modified) (1 prop)
- honeyclient/branches/exp/jpuchalski-active_content/lib/HoneyClient/Agent.pm (modified) (10 diffs, 2 props)
- honeyclient/branches/exp/jpuchalski-active_content/lib/HoneyClient/Agent/Driver.pm (modified) (5 diffs, 2 props)
- honeyclient/branches/exp/jpuchalski-active_content/lib/HoneyClient/Agent/Driver/Browser.pm (modified) (77 diffs, 1 prop)
- honeyclient/branches/exp/jpuchalski-active_content/lib/HoneyClient/Agent/Driver/Browser/FF.pm (modified) (5 diffs, 1 prop)
- honeyclient/branches/exp/jpuchalski-active_content/lib/HoneyClient/Agent/Driver/Browser/IE.pm (modified) (3 diffs, 2 props)
- honeyclient/branches/exp/jpuchalski-active_content/lib/HoneyClient/Agent/Integrity (copied) (copied from honeyclient/trunk/lib/HoneyClient/Agent/Integrity)
- honeyclient/branches/exp/jpuchalski-active_content/lib/HoneyClient/Agent/Integrity.pm (modified) (26 diffs, 1 prop)
- honeyclient/branches/exp/jpuchalski-active_content/lib/HoneyClient/Manager.pm (modified) (11 diffs, 2 props)
- honeyclient/branches/exp/jpuchalski-active_content/lib/HoneyClient/Manager/FW.pm (modified) (62 diffs, 1 prop)
- honeyclient/branches/exp/jpuchalski-active_content/lib/HoneyClient/Manager/VM.pm (modified) (6 diffs, 1 prop)
- honeyclient/branches/exp/jpuchalski-active_content/lib/HoneyClient/Util/Config.pm (modified) (8 diffs, 1 prop)
- honeyclient/branches/exp/jpuchalski-active_content/lib/HoneyClient/Util/SOAP.pm (modified) (5 diffs, 1 prop)
- honeyclient/branches/exp/jpuchalski-active_content/t/honeyclient_agent.t (copied) (copied from honeyclient/trunk/t/honeyclient_agent.t)
- honeyclient/branches/exp/jpuchalski-active_content/t/honeyclient_agent_driver.t (modified) (1 diff)
- honeyclient/branches/exp/jpuchalski-active_content/t/honeyclient_agent_driver_browser.t (copied) (copied from honeyclient/trunk/t/honeyclient_agent_driver_browser.t)
- honeyclient/branches/exp/jpuchalski-active_content/t/honeyclient_agent_driver_browser_ie.t (copied) (copied from honeyclient/trunk/t/honeyclient_agent_driver_browser_ie.t)
- honeyclient/branches/exp/jpuchalski-active_content/t/honeyclient_agent_integrity.t (modified) (3 diffs)
- honeyclient/branches/exp/jpuchalski-active_content/t/honeyclient_agent_integrity_registry.t (copied) (copied from honeyclient/trunk/t/honeyclient_agent_integrity_registry.t)
- honeyclient/branches/exp/jpuchalski-active_content/t/honeyclient_agent_integrity_registry_parser.t (copied) (copied from honeyclient/trunk/t/honeyclient_agent_integrity_registry_parser.t)
- honeyclient/branches/exp/jpuchalski-active_content/t/honeyclient_manager.t (copied) (copied from honeyclient/trunk/t/honeyclient_manager.t)
- honeyclient/branches/exp/jpuchalski-active_content/t/honeyclient_manager_fw.t (copied) (copied from honeyclient/trunk/t/honeyclient_manager_fw.t)
- honeyclient/branches/exp/jpuchalski-active_content/t/honeyclient_manager_vm.t (modified) (2 diffs)
- honeyclient/branches/exp/jpuchalski-active_content/t/honeyclient_util_config.t (modified) (3 diffs)
- honeyclient/branches/exp/jpuchalski-active_content/t/honeyclient_util_soap.t (modified) (1 diff)
- honeyclient/branches/exp/jpuchalski-active_content/t/test_registry (copied) (copied from honeyclient/trunk/t/test_registry)
- honeyclient/branches/exp/jpuchalski-active_content/thirdparty/xpath-23934.patch (copied) (copied from honeyclient/trunk/thirdparty/xpath-23934.patch)
Legend:
- Unmodified
- Added
- Removed
- Modified
- Copied
- Moved
honeyclient/branches/exp/jpuchalski-active_content
- Property sc:bug-fix-release-branch set to 0.9
honeyclient/branches/exp/jpuchalski-active_content/bin/StartAgent.pl
- Property svn:keywords set to Id "$file"
r13 r205 1 #!perl -w 1 #!perl -w -Ilib 2 3 # $Id$ 2 4 3 5 use strict; … … 35 37 print "Watchdog fault detected, recovering Agent daemon.\n"; 36 38 # XXX: Reenable this, eventually. 37 #Carp::carp __PACKAGE__ . "->_watchdogFaultHandler(): Error occurred during processing.\n" . $errMsg;39 #Carp::carp __PACKAGE__ . "->_watchdogFaultHandler(): Error occurred during processing.\n" . $errMsg; 38 40 39 41 honeyclient/branches/exp/jpuchalski-active_content/bin/StartManager.pl
- Property svn:keywords set to Id "$file"
r13 r205 1 #!/usr/bin/perl -w 1 #!perl -w -Ilib 2 3 # $Id$ 2 4 3 5 use strict; … … 20 22 my $agentState = HoneyClient::Manager->run( 21 23 driver => 'IE', # Change to 'IE' or 'FF' 22 master_vm_config => '/vm/Agent.Master- 2/winXPPro.cfg',24 master_vm_config => '/vm/Agent.Master-7/winXPPro.cfg', 23 25 agent_state => encode_base64(nfreeze({ 24 26 IE => { # Change to 'IE' or 'FF' … … 26 28 # Enable this line, if you want to only go to the 27 29 # first 5 links for each domain. 28 #max_relative_links_to_visit => 5,30 max_relative_links_to_visit => 5, 29 31 }, 30 32 })), honeyclient/branches/exp/jpuchalski-active_content/etc/honeyclient.xml
- Property svn:keywords set to Id "$file"
r13 r205 9 9 For information about the syntax of this file format, please type 10 10 "perldoc XML::Simple". 11 12 CVS: $Id$ 11 13 12 14 ####################################################################### … … 45 47 <HoneyClient> 46 48 <!-- Global Options --> 47 <timeout description="Default timeout used for all communications between each module (in seconds)." default="600"> 48 600 49 <!-- Note: This timeout should be long enough so that the Agent watchdog code will properly let the integrity checking code finish, before detecting a faulty timeout in processing. --> 50 <timeout description="Default timeout used for all communications between each module (in seconds)." default="900"> 51 1800 49 52 </timeout> 50 53 <log_config description="The global Log4perl configuration file, used throughout all modules. This setting should not need to be changed." default="etc/honeyclient_log.conf"> … … 66 69 <!-- TODO: Update this. --> 67 70 <timeout description="How long the Driver waits during a drive operation, before timing out (in seconds)." default="60"> 68 571 10 69 72 </timeout> 70 73 <Browser> 71 <!-- HoneyClient::Agent::Driver::IE Options -->72 <!-- TODO: Update this. -->73 <ignore_links_timed_out description="If this parameter is 1, then the browser will never attempt to revisit any links that caused the browser to initially time out." default="0">74 <!-- HoneyClient::Agent::Driver::IE Options --> 75 <!-- TODO: Update this. --> 76 <ignore_links_timed_out description="If this parameter is 1, then the browser will never attempt to revisit any links that caused the browser to initially time out." default="0"> 74 77 1 75 78 </ignore_links_timed_out> 76 <!-- TODO: Update this. -->77 <process_name description="The name of the Internet Explorer application process, as it appears in the Task Manager." default="iexplore.exe">79 <!-- TODO: Update this. --> 80 <process_name description="The name of the Internet Explorer application process, as it appears in the Task Manager." default="iexplore.exe"> 78 81 iexplore.exe 79 82 </process_name> 80 <max_relative_links_to_visit description="An integer, representing the maximum number of relative links that the browser should visit, before moving onto another website. If negative, then the browser will exhaust all possible relative links found, before moving on. This functionality is best effort; it's possible for the browser to visit new links on previously visited websites." default="-1">83 <max_relative_links_to_visit description="An integer, representing the maximum number of relative links that the browser should visit, before moving onto another website. If negative, then the browser will exhaust all possible relative links found, before moving on. This functionality is best effort; it's possible for the browser to visit new links on previously visited websites." default="-1"> 81 84 -1 82 85 </max_relative_links_to_visit> 83 <IE> 84 <!-- HoneyClient::Agent::Driver::IE Options --> 85 <!-- TODO: Update this. --> 86 <ignore_links_timed_out description="If this parameter is 1, then the browser will never attempt to revisit any links that caused the browser to initially time out." default="0"> 86 <goodwords description="A comma-separated list of good words which will increase the score of links within a webpage." default=""> 87 news,new,big,latest,main,update,sell,free,buy 88 </goodwords> 89 <badwords description="A comma-separated list of bad words which will decrease the score of links within a webpage." default=""> 90 archive,privacy,legal,disclaim,about,contact,copyright,jobs,careers 91 </badwords> 92 <IE> 93 <!-- HoneyClient::Agent::Driver::IE Options --> 94 <!-- TODO: Update this. --> 95 <ignore_links_timed_out description="If this parameter is 1, then the browser will never attempt to revisit any links that caused the browser to initially time out." default="0"> 87 96 1 88 97 </ignore_links_timed_out> 89 <!-- TODO: Update this. -->90 <process_name description="The name of the Internet Explorer application process, as it appears in the Task Manager." default="iexplore.exe">98 <!-- TODO: Update this. --> 99 <process_name description="The name of the Internet Explorer application process, as it appears in the Task Manager." default="iexplore.exe"> 91 100 iexplore.exe 92 101 </process_name> 93 <max_relative_links_to_visit description="An integer, representing the maximum number of relative links that the browser should visit, before moving onto another website. If negative, then the browser will exhaust all possible relative links found, before moving on. This functionality is best effort; it's possible for the browser to visit new links on previously visited websites." default="-1">102 <max_relative_links_to_visit description="An integer, representing the maximum number of relative links that the browser should visit, before moving onto another website. If negative, then the browser will exhaust all possible relative links found, before moving on. This functionality is best effort; it's possible for the browser to visit new links on previously visited websites." default="-1"> 94 103 -1 95 104 </max_relative_links_to_visit> 96 </IE>105 </IE> 97 106 <FF> 98 <max_relative_links_to_visit description="An integer, representing the maximum number of relative links that the browser should visit, before moving onto another website. If negative, then the browser will exhaust all possible relative links found, before moving on. This functionality is best effort; it's possible for the browser to visit new links on previously visited websites." default="-1">107 <max_relative_links_to_visit description="An integer, representing the maximum number of relative links that the browser should visit, before moving onto another website. If negative, then the browser will exhaust all possible relative links found, before moving on. This functionality is best effort; it's possible for the browser to visit new links on previously visited websites." default="-1"> 99 108 5 100 109 </max_relative_links_to_visit> 101 <!-- http://gatekeeper-w.mitre.org:80 -->102 <http_proxy description="Set to your HTTP Proxy if you have one, otherwise set to 'none'">110 <!-- http://gatekeeper-w.mitre.org:80 --> 111 <http_proxy description="Set to your HTTP Proxy if you have one, otherwise set to 'none'"> 103 112 none 104 113 </http_proxy> 105 <ff_exec description="path to the firefox executable (default install path is C:\Program Files\Mozilla Firefox\firefox.exe)">114 <ff_exec description="path to the firefox executable (default install path is C:\Program Files\Mozilla Firefox\firefox.exe)"> 106 115 C:\Program Files\Mozilla Firefox\firefox.exe 107 116 </ff_exec> 108 </FF>117 </FF> 109 118 </Browser> 110 119 <EmailClient> … … 112 121 </Driver> 113 122 <perform_integrity_checks description="An integer, representing whether the Agent should perform any integrity checks. 1 enables, 0 disables." default="1"> 114 0123 1 115 124 </perform_integrity_checks> 116 125 <!-- HoneyClient::Agent::Integrity Options --> … … 118 127 <!-- Files which are read in only. --> 119 128 <!-- TODO: Update this. --> 120 <file_checklist description="The file containing the list of files and directories to check during filesystem checking." >121 none129 <file_checklist description="The file containing the list of files and directories to check during filesystem checking." default="none"> 130 etc/file_checklist.txt 122 131 </file_checklist> 123 132 <!-- TODO: Update this. --> 124 <file_exclude description="The file containing the list of files or directories to exclude if found in subdirectories during filesystem checking." >125 /tmp/file_exclude.txt133 <file_exclude description="The file containing the list of files or directories to exclude if found in subdirectories during filesystem checking." default="none"> 134 ../../../etc/file_exclude.txt 126 135 </file_exclude> 127 <!-- TODO: Update this. -->128 <reg_list_to_check description="The file containing the list of registry keys to check.">129 /tmp/reg_list_to_check.txt130 </reg_list_to_check>131 136 <!-- Files which are written out only. --> 132 137 <!-- TODO: Update this. --> … … 140 145 <!-- Files to read and write. --> 141 146 <!-- TODO: Update this. --> 142 <clean_reg description="Stores baseline for the registry. Always appended with a number.">143 clean.reg144 </clean_reg>145 <!-- TODO: Update this. -->146 <current_reg description="Stores the current state of the register to check against the clean state.">147 current.reg148 </current_reg>149 <!-- TODO: Update this. -->150 <diffs description="The file for the diff command to redirect its output to. Always appended with a number.">151 differences.out152 </diffs>153 <!-- TODO: Update this. -->154 147 <test_dir description="If you're testing integrity checks, this is the directory that you can specify to minimize testing time. Only the files in this directory will be part of the integrity check."> 155 148 ../t/testintegrity 156 149 </test_dir> 150 <Registry> 151 <!-- HoneyClient::Agent::Integrity::Registry::Test Options --> 152 <Test> 153 <!-- 154 Note: you should *never* need to change *any* values 155 within this section of the configuration. All contents 156 are *only* used for unit testing. 157 --> 158 <before_registry_file description="The relative path to a (before) sample registry dump, that's used during unit testing." default="t/test_registry/before.reg"> 159 t/test_registry/before.reg 160 </before_registry_file> 161 <after_registry_file description="The relative path to an (after) sample registry dump, that's used during unit testing." default="t/test_registry/after.reg"> 162 t/test_registry/after.reg 163 </after_registry_file> 164 </Test> 165 <Parser> 166 <!-- HoneyClient::Agent::Integrity::Registry::Parser::Test Options --> 167 <Test> 168 <!-- 169 Note: you should *never* need to change *any* values 170 within this section of the configuration. All contents 171 are *only* used for unit testing. 172 --> 173 <registry_file description="The relative path to a sample registry dump, that's used during unit testing." default="t/test_registry/dump.reg"> 174 t/test_registry/dump.reg 175 </registry_file> 176 </Test> 177 </Parser> 178 </Registry> 157 179 </Integrity> 158 180 </Agent> 159 181 <Manager> 182 <!-- TODO: Update this. --> 183 <manager_state description="Upon termination, the Manager will attempt to save a complete copy of its state into this file, if specified." default=""> 184 Manager.dump 185 </manager_state> 160 186 <!-- TODO: Update this. --> 161 187 <address description="The IP or hostname that all Manager modules should use, when accepting SOAP requests." default="localhost"> … … 314 340 are *only* used for unit testing. 315 341 --> 316 <!-- TODO: Update this. -->317 342 <test_vm_config description="The relative path to the (empty) test VM, that's used during unit testing." default="t/testVM/winXPPro.vmx"> 318 343 t/testVM/winXPPro.vmx honeyclient/branches/exp/jpuchalski-active_content/etc/honeyclient_log.conf
- Property svn:keywords set to Id "$file"
r13 r205 7 7 # modules. 8 8 # 9 # CVS: $Id : honeylog.conf 1099 2006-06-29 22:38:16Z jdurick$9 # CVS: $Id$ 10 10 # 11 11 # @author jdurick, kindlund … … 60 60 61 61 log4perl.rootLogger=INFO, Screen 62 #log4perl.logger.HoneyClient.Agent.Integrity.Registry=DEBUG, Screen 63 # Suppress Parser Debugging Messages 64 #log4perl.logger.HoneyClient.Agent.Integrity.Registry.Parser=INFO, Screen 62 65 log4perl.appender.Screen=Log::Log4perl::Appender::Screen 63 66 # If you want colorized logging to the screen, enable this line, instead. 64 67 #log4perl.appender.Screen=Log::Log4perl::Appender::ScreenColoredLevels 65 68 log4perl.appender.Screen.stderr=0 66 log4perl.appender.Screen.Threshold= INFO69 log4perl.appender.Screen.Threshold=DEBUG 67 70 log4perl.appender.Screen.layout=Log::Log4perl::Layout::PatternLayout 68 71 log4perl.appender.Screen.layout.ConversionPattern=%d{yyyy-MM-dd HH:mm:ss} %5p [%M] (%F:%L) - %m%n honeyclient/branches/exp/jpuchalski-active_content/etc/inline2test.conf
- Property svn:keywords set to Id "$file"
honeyclient/branches/exp/jpuchalski-active_content/lib/HoneyClient/Agent.pm
- Property svn:executable deleted
- Property svn:keywords set to Id "$file"
r13 r205 5 5 # Description: Central library used for agent-based operations. 6 6 # 7 # CVS: $Id : Agent.pm 1049 2006-06-28 16:37:41Z flindiakos$7 # CVS: $Id$ 8 8 # 9 9 # @author knwang, ttruong, kindlund … … 38 38 =head1 VERSION 39 39 40 $Rev: 1626 $ 40 0.94 41 41 42 42 =head1 SYNOPSIS … … 79 79 80 80 # Set our package version. 81 $VERSION = 0.9 ;81 $VERSION = 0.94; 82 82 83 83 @ISA = qw(Exporter); … … 210 210 # TODO: Update unit tests to include 'dclone' 211 211 use Storable qw(nfreeze thaw dclone); 212 $Storable::Deparse = 1; 213 $Storable::Eval = 1; 212 214 213 215 # Include Base64 Libraries … … 236 238 our $PERFORM_INTEGRITY_CHECKS : shared = 237 239 getVar(name => "perform_integrity_checks"); 240 241 # A globally shared, serialized hashtable, containing the 242 # initialized integrity state of the VM -- ready to be checked 243 # against, at any time. 244 our $integrityState : shared = undef; 238 245 239 246 # A globally shared, serialized hashtable, containing data per … … 359 366 $driverUpdateQueues{$driverName} = new Thread::Queue; 360 367 } 368 369 # Perform initial integrity baseline check. 370 #my $integrity = undef; 371 #if ($PERFORM_INTEGRITY_CHECKS) { 372 # print "Initializing Integrity Check...\n"; 373 # # TODO: Initialize Integrity Checks 374 # $integrity = HoneyClient::Agent::Integrity->new(); 375 # $integrity->initAll(); 376 #} 377 #$integrityState = $integrity->serialize(); 361 378 362 379 # Release data lock. … … 688 705 eval { 689 706 690 my $integrity = undef;691 if ($PERFORM_INTEGRITY_CHECKS) {692 print "Initializing Filesystem Integrity Check...\n";693 # TODO: Initialize Integrity Checks694 $integrity = HoneyClient::Agent::Integrity->new();695 $integrity->initAll();696 }697 698 707 ################################### 699 708 ### Driver Initialization Phase ### 700 709 ################################### 710 711 # Initially set local integrity object to undef. 712 my $integrity = undef; 701 713 702 714 # Initially set all driver objects to undef. … … 705 717 # Acquire lock on stored driver state. 706 718 $data = _lock(); 719 720 if ($PERFORM_INTEGRITY_CHECKS) { 721 # XXX: WARNING - The $integrityState object data is NOT thread-safe 722 # (since it relies on external data stored on the file system). 723 # As such, do NOT try to call integrity checks on multiple, simultaneous 724 # asynchronous threaded drivers. 725 #$integrity = thaw($integrityState); 726 # Perform initial integrity baseline check. 727 print "Initializing Integrity Check...\n"; 728 # TODO: Initialize Integrity Checks 729 $integrity = HoneyClient::Agent::Integrity->new(); 730 $integrity->initAll(); 731 732 # TODO: Delete this. 733 #$Data::Dumper::Indent = 1; 734 #$Data::Dumper::Terse = 1; 735 #print "Integrity: " . Dumper($integrity) . "\n"; 736 } 707 737 708 738 # Now, initialize each driver object. … … 805 835 # For now, we update a scalar called 'is_compromised' within 806 836 # the $data->{$driverName}->{'status'} sub-hashtable. 807 print "Performing Filesystem Integrity Check...\n";837 print "Performing Integrity Checks...\n"; 808 838 if ($integrity->checkAll()) { 809 839 print "Integrity Check: FAILED\n"; … … 1099 1129 =head1 SEE ALSO 1100 1130 1101 XXX: Fill this in. 1102 1103 XXX: If you have a mailing list, mention it here. 1104 1105 XXX: If you have a web site set up for your module, mention it here. 1131 L<http://www.honeyclient.org/trac> 1106 1132 1107 1133 =head1 REPORTING BUGS 1108 1134 1109 XXX: Mention website/mailing list to use, when reporting bugs. 1135 L<http://www.honeyclient.org/trac/newticket> 1110 1136 1111 1137 =head1 ACKNOWLEDGEMENTS honeyclient/branches/exp/jpuchalski-active_content/lib/HoneyClient/Agent/Driver.pm
- Property svn:executable deleted
- Property svn:keywords set to Id "$file"
r13 r205 6 6 # HoneyClient VM. 7 7 # 8 # CVS: $Id : Driver.pm 1412 2006-10-18 20:33:18Z kindlund$8 # CVS: $Id$ 9 9 # 10 10 # @author knwang, ttruong, kindlund … … 38 38 =head1 VERSION 39 39 40 This documentation refers to HoneyClient::Agent::Driver version 1.0.40 This documentation refers to HoneyClient::Agent::Driver version 0.94. 41 41 42 42 =head1 SYNOPSIS … … 120 120 121 121 # Set our package version. 122 $VERSION = 0.9 ;122 $VERSION = 0.94; 123 123 124 124 @ISA = qw(Exporter); … … 160 160 # Make sure Log::Log4perl loads 161 161 BEGIN { use_ok('Log::Log4perl', qw(:nowarn)) 162 or diag("Can't load Log::Log4perl package. Check to make sure the package library is correctly li nsted within the path.");162 or diag("Can't load Log::Log4perl package. Check to make sure the package library is correctly listed within the path."); 163 163 164 164 # Suppress all logging messages, since we need clean output for unit testing. … … 697 697 L<perltoot/"Autoloaded Data Methods"> 698 698 699 XXX: If you have a mailing list, mention it here. 700 701 XXX: If you have a web site set up for your module, mention it here. 699 L<http://www.honeyclient.org/trac> 702 700 703 701 =head1 REPORTING BUGS 704 702 705 XXX: Mention website/mailing list to use, when reporting bugs. 703 L<http://www.honeyclient.org/trac/newticket> 706 704 707 705 =head1 AUTHORS honeyclient/branches/exp/jpuchalski-active_content/lib/HoneyClient/Agent/Driver/Browser.pm
- Property svn:keywords set to Id "$file"
r13 r205 7 7 # HoneyClient VM. 8 8 # 9 # CVS: $Id : Browser.pm 1423 2006-11-6 14:21:47Z stephenson$9 # CVS: $Id$ 10 10 # 11 11 # @author knwang, kindlund, stephenson … … 17 17 # as published by the Free Software Foundation, using version 2 18 18 # of the License. 19 # 19 # 20 20 # This program is distributed in the hope that it will be useful, 21 21 # but WITHOUT ANY WARRANTY; without even the implied warranty of 22 22 # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 23 23 # GNU General Public License for more details. 24 # 24 # 25 25 # You should have received a copy of the GNU General Public License 26 26 # along with this program; if not, write to the Free Software … … 40 40 =head1 VERSION 41 41 42 This documentation refers to HoneyClient::Agent::Driver::Browser version 1.0.42 This documentation refers to HoneyClient::Agent::Driver::Browser version 0.94. 43 43 44 44 =head1 SYNOPSIS … … 55 55 'http://www.google.com' => 1, 56 56 'http://www.cnn.com' => 1, 57 }, 57 }, 58 58 ); 59 59 … … 76 76 print "Status:\n"; 77 77 print Dumper($browser->status()); 78 78 79 79 } 80 80 … … 84 84 $browser->{links_to_visit}->{'http://www.mitre.org'} = 1; 85 85 86 # Now, drive IEfor one iteration.86 # Now, drive the browser for one iteration. 87 87 $browser->drive(); 88 88 … … 90 90 91 91 This library allows the Agent module to drive an instance of any broswer, 92 running inside the HoneyClient VM. The purpose 93 of this module is to programmatically navigate the browser to different 94 websites, in order to become purposefully infected with new malware. 95 The module implements the logic necessary to decide the order in which 96 the 97 98 This module is object-oriented in design, retaining all state information 92 running inside the HoneyClient VM. The purpose of this module is to 93 programmatically navigate the browser to different websites, in order to 94 become purposefully infected with new malware. 95 96 This module is object-oriented in design, retaining all state information 99 97 within itself for easy access. A specific browser class must inherit from 100 98 Browser. … … 116 114 external links in a random fashion. B<However>, this cannot be 117 115 guaranteed, as additional links from the same server may be found 118 later, after processing the contents of an external link. 116 later, after processing the contents of an external link. 119 117 120 118 As the browser driver navigates the browser to each link, it … … 122 120 visited (see L<links_visited>); when invalid links were found 123 121 (see L<links_ignored>); and when the browser attempted to visit 124 a link but the operation timed out (see L<links_timed_out>). 122 a link but the operation timed out (see L<links_timed_out>). 125 123 By maintaining this internal history, the driver will B<never> 126 124 navigate the browser to the same link twice. … … 157 155 158 156 # Set our package version. 159 $VERSION = 0.9 ;157 $VERSION = 0.94; 160 158 161 159 # Define inherited modules. … … 175 173 # Do not simply export all your public functions/methods/constants. 176 174 177 # This allows declaration use HoneyClient::Agent::Driver:: IE':all';175 # This allows declaration use HoneyClient::Agent::Driver::Browser ':all'; 178 176 # If you do not need this, moving things directly into @EXPORT or @EXPORT_OK 179 177 # will save memory. … … 194 192 #if ($Config{osname} !~ /^MSWin32$/) { 195 193 # Carp::croak "Error: " . __PACKAGE__ . " will only run on Win32 platforms!\n"; 196 #} 194 #} 197 195 198 196 $SIG{PIPE} = 'IGNORE'; # Do not exit on broken pipes. … … 213 211 214 212 # Use Storable Library 213 # TODO: Need unit testing. 215 214 use Storable qw(dclone); 216 215 … … 223 222 # TODO: Need unit testing. 224 223 use HoneyClient::Util::SOAP qw(getClientHandle); 225 224 226 225 # TODO: Need unit testing. 227 226 use LWP::UserAgent; … … 240 239 =head1 DEFAULT PARAMETER LIST 241 240 242 When a n IEB<$object> is instantiated using the B<new()> function,241 When a Browser B<$object> is instantiated using the B<new()> function, 243 242 the following parameters are supplied default values. Each value 244 243 can be overridden by specifying the new (key => value) pair into the 245 244 B<new()> function, as arguments. 246 245 247 Furthermore, as each parameter is initialized, each can be individually 246 Furthermore, as each parameter is initialized, each can be individually 248 247 retrieved and set at any time, using the following syntax: 249 248 … … 287 286 resource (i.e., "javascript:doNetDetect()"). 288 287 289 Specifically, each 'key' corresponds to an absolute URL and the 288 Specifically, each 'key' corresponds to an absolute URL and the 290 289 'value' is a string representing the date and time of when the link 291 290 was visited. … … 302 301 This parameter is a hashtable of fully qualified URLs, such that each 303 302 URL shares a common B<hostname>. This is an internal hashtable used 304 by the IE driver that should be initially empty. As the IE driver305 extracts and removes new URLs off the B<links_to_visit> hashtable,303 by the Browser driver that should be initially empty. As the Browser 304 driver extracts and removes new URLs off the B<links_to_visit> hashtable, 306 305 driving the browser to each URL, any B<relative> links found are 307 306 added into this hashtable; any B<external> links found are added 308 307 back into the B<links_to_visit> hashtable. 309 308 310 When driving to the next link, this hashtable is exhausted prior 309 When driving to the next link, this hashtable is exhausted prior 311 310 to the main B<links_to_visit> hashtable. This allows a 312 311 browser to navigate to all links hosted on the same server, prior … … 325 324 It is updated dynamically, any time $object->getNextLink() is called. 326 325 327 When the browser is ready to drive to the next link, B<next_link_to_visit> 326 When the browser is ready to drive to the next link, B<next_link_to_visit> 328 327 is checked first. If that value is B<undef>, then the B<relative_links_to_visit> 329 328 hashtable is checked next. If that hashtable is empty, then finally the … … 341 340 timing out. 342 341 343 Specifically, each 'key' corresponds to an absolute URL and the 342 Specifically, each 'key' corresponds to an absolute URL and the 344 343 'value' is a string representing the date and time of when access to 345 the resource was attempted. 344 the resource was attempted. 346 345 347 346 B<Note>: See internal documentation of _getTimestamp() for the … … 364 363 =over 4 365 364 366 A string containing the process name of the Internet Explorer 367 browser application, as it appears in the Task Manager. This is 368 usually called "iexplore.exe". 365 A string containing the process name of the browser application, 366 as it appears in the Task Manager. 369 367 370 368 =back … … 385 383 =cut 386 384 387 my %PARAMS = ( 385 my %PARAMS = ( 388 386 389 387 # This is a hashtable of fully qualified URLs … … 396 394 # 'key' is the absolute URL and the 'value' is a string 397 395 # representing the date and time of when the link was visited. 398 # 396 # 399 397 # Note: See _getTimestamp() for the corresponding date/time 400 398 # format. … … 411 409 # The 'key' is the absolute URL and the 'value' is a string 412 410 # representing the date and time of when the link was visited. 413 # 411 # 414 412 # Note: See _getTimestamp() for the corresponding date/time 415 413 # format. … … 418 416 # This is a hashtable of fully qualified URLs 419 417 # that all share a common *hostname*. This hashtable should be 420 # initially empty. As the driver extracts and removes new URLs 421 # off the 'links_to_visit' hashtable, driving the browser to each URL, 418 # initially empty. As the driver extracts and removes new URLs 419 # off the 'links_to_visit' hashtable, driving the browser to each URL, 422 420 # any *relative* links found are added into this hashtable; any 423 421 # *external* links found are added back into the 'links_to_visit' 424 422 # hashtable. 425 423 # 426 # When navigating to the next link, this hashtable is exhausted prior 424 # When navigating to the next link, this hashtable is exhausted prior 427 425 # to the main 'links_to_visit' hashtable. This allows a 428 426 # browser to navigate to all links hosted on the same server, prior 429 427 # to contacting a different server. 430 # 428 # 431 429 # Specifically, the 'key' is the absolute URL and the 'value' 432 430 # is always 1. … … 448 446 # The 'key' is the absolute URL and the 'value' is a string 449 447 # representing the date and time of when the link was visited. 450 # 448 # 451 449 # Note: See _getTimestamp() for the corresponding date/time 452 450 # format. … … 458 456 ignore_links_timed_out => getVar(name => "ignore_links_timed_out"), 459 457 460 # A string containing the process name of the Internet Explorer 461 # browser application, as it appears in the Task Manager. This is 462 # usually called "iexplore.exe". 458 # A string containing the process name of the browser application, 459 # as it appears in the Task Manager. 463 460 process_name => getVar(name => "process_name"), 464 461 … … 477 474 # websites. 478 475 max_relative_links_to_visit => getVar(name => "max_relative_links_to_visit"), 479 476 477 # Comma-separated string containing the good words and bad words for link scoring purposes 478 goodwords => getVar(name => "goodwords", namespace => "HoneyClient::Agent::Driver::Browser"), 479 badwords => getVar(name => "badwords", namespace => "HoneyClient::Agent::Driver::Browser"), 480 480 481 ); 481 482 … … 491 492 # 492 493 # When getting the next link, 'next_link_to_visit' is checked first. 493 # If that value is undef, then the 'relative_links_to_visit' hashtable 494 # is checked next. If that hashtable is empty, then finally the 494 # If that value is undef, then the 'relative_links_to_visit' hashtable 495 # is checked next. If that hashtable is empty, then finally the 495 496 # 'links_to_visit' hashtable is checked. 496 497 # 497 # Inputs: HoneyClient::Agent::Driver:: IEobject498 # Inputs: HoneyClient::Agent::Driver::Browser object 498 499 # Outputs: link, or undef if all applicable scalars/hashtables are empty 499 500 sub _getNextLink { … … 501 502 # Get the object state. 502 503 my $self = shift; 503 504 # Set the link to find as undef, initially. 504 505 # Set the link to find as undef, initially. 505 506 # We use undef to signify that our URL *_links_to_visit hashtables 506 507 # are empty. If we were to use the empty string instead, as our … … 540 541 } 541 542 542 # Return the next link found. 543 # Return the next link found. 543 544 return $link; 544 545 } … … 556 557 $dt->hms(':') . "." . 557 558 $dt->nanosecond(); 558 } 559 } 559 560 560 561 # Helper function designed to "pop" a key off a given hashtable. 561 562 # When given a hashtable reference, this function will extract a valid key 562 # from the hashtable and delete the (key, value) pair from the 563 # hashtable. 564 # 565 # Note: There is no guaranteed order about how this function picks 566 # keys from the hashtable. 563 # from the hashtable and delete the (key, value) pair from the 564 # hashtable. The link with the highest score is returned. 565 # 566 # 567 567 # 568 568 # Inputs: hashref … … 573 573 my $hash = shift; 574 574 575 # Get a new key.576 my @ keys = keys(%{$hash});577 my $ key = pop(@keys);578 575 # Get the highest score. 576 my @array = sort {$$hash{$b} <=> $$hash{$a}} keys %{$hash}; 577 my $topkey = $array[0]; 578 579 579 # Delete the key from the hashtable. 580 if (defined($ key)) {581 delete $hash->{$ key};580 if (defined($topkey)) { 581 delete $hash->{$topkey}; 582 582 } 583 583 584 584 # Return the key found. 585 return $key; 586 } 587 588 # This is the abstract function which actually fetches the web content using 589 # a specific browser implementation. Must be implemented by each browser class. 590 591 sub getContent { 592 593 } 594 595 # Helper function which parses the HTTP::Response from LWP::UserAgent 596 # and returns an array of the links contained in the response 597 # 598 # Inputs: HTTP::Response object 599 # Outputs: Array containing all href links within the response 600 601 sub _getAllLinks { 602 603 my $response = shift; 604 my $hostname = shift; 605 my @links = (); 606 my $thislink; 607 608 &nb
