mirror of
https://github.com/gchq/CyberChef.git
synced 2025-04-22 07:46:16 -04:00
Merge branch 'master' into feature-extract-files
This commit is contained in:
n1474335
commit
24a47445f6
56 changed files with 3121 additions and 986 deletions
|
|
@ -5,7 +5,7 @@
|
|||
*/
|
||||
|
||||
import Operation from "../Operation";
|
||||
import bsonjs from "bson";
|
||||
import bson from "bson";
|
||||
import OperationError from "../errors/OperationError";
|
||||
|
||||
/**
|
||||
|
|
@ -36,8 +36,6 @@ class BSONDeserialise extends Operation {
|
|||
run(input, args) {
|
||||
if (!input.byteLength) return "";
|
||||
|
||||
const bson = new bsonjs();
|
||||
|
||||
try {
|
||||
const data = bson.deserialize(new Buffer(input));
|
||||
return JSON.stringify(data, null, 2);
|
||||
|
|
|
|||
|
|
@ -5,7 +5,7 @@
|
|||
*/
|
||||
|
||||
import Operation from "../Operation";
|
||||
import bsonjs from "bson";
|
||||
import bson from "bson";
|
||||
import OperationError from "../errors/OperationError";
|
||||
|
||||
/**
|
||||
|
|
@ -36,8 +36,6 @@ class BSONSerialise extends Operation {
|
|||
run(input, args) {
|
||||
if (!input) return new ArrayBuffer();
|
||||
|
||||
const bson = new bsonjs();
|
||||
|
||||
try {
|
||||
const data = JSON.parse(input);
|
||||
return bson.serialize(data).buffer;
|
||||
|
|
|
|||
95
src/core/operations/ConvertCoordinateFormat.mjs
Normal file
95
src/core/operations/ConvertCoordinateFormat.mjs
Normal file
|
|
@ -0,0 +1,95 @@
|
|||
/**
|
||||
* @author j433866 [j433866@gmail.com]
|
||||
* @copyright Crown Copyright 2019
|
||||
* @license Apache-2.0
|
||||
*/
|
||||
|
||||
import Operation from "../Operation";
|
||||
import {FORMATS, convertCoordinates} from "../lib/ConvertCoordinates";
|
||||
|
||||
/**
|
||||
* Convert co-ordinate format operation
|
||||
*/
|
||||
class ConvertCoordinateFormat extends Operation {
|
||||
|
||||
/**
|
||||
* ConvertCoordinateFormat constructor
|
||||
*/
|
||||
constructor() {
|
||||
super();
|
||||
|
||||
this.name = "Convert co-ordinate format";
|
||||
this.module = "Hashing";
|
||||
this.description = "Converts geographical coordinates between different formats.<br><br>Supported formats:<ul><li>Degrees Minutes Seconds (DMS)</li><li>Degrees Decimal Minutes (DDM)</li><li>Decimal Degrees (DD)</li><li>Geohash</li><li>Military Grid Reference System (MGRS)</li><li>Ordnance Survey National Grid (OSNG)</li><li>Universal Transverse Mercator (UTM)</li></ul><br>The operation can try to detect the input co-ordinate format and delimiter automatically, but this may not always work correctly.";
|
||||
this.infoURL = "https://wikipedia.org/wiki/Geographic_coordinate_conversion";
|
||||
this.inputType = "string";
|
||||
this.outputType = "string";
|
||||
this.args = [
|
||||
{
|
||||
"name": "Input Format",
|
||||
"type": "option",
|
||||
"value": ["Auto"].concat(FORMATS)
|
||||
},
|
||||
{
|
||||
"name": "Input Delimiter",
|
||||
"type": "option",
|
||||
"value": [
|
||||
"Auto",
|
||||
"Direction Preceding",
|
||||
"Direction Following",
|
||||
"\\n",
|
||||
"Comma",
|
||||
"Semi-colon",
|
||||
"Colon"
|
||||
]
|
||||
},
|
||||
{
|
||||
"name": "Output Format",
|
||||
"type": "option",
|
||||
"value": FORMATS
|
||||
},
|
||||
{
|
||||
"name": "Output Delimiter",
|
||||
"type": "option",
|
||||
"value": [
|
||||
"Space",
|
||||
"\\n",
|
||||
"Comma",
|
||||
"Semi-colon",
|
||||
"Colon"
|
||||
]
|
||||
},
|
||||
{
|
||||
"name": "Include Compass Directions",
|
||||
"type": "option",
|
||||
"value": [
|
||||
"None",
|
||||
"Before",
|
||||
"After"
|
||||
]
|
||||
},
|
||||
{
|
||||
"name": "Precision",
|
||||
"type": "number",
|
||||
"value": 3
|
||||
}
|
||||
];
|
||||
}
|
||||
|
||||
/**
|
||||
* @param {string} input
|
||||
* @param {Object[]} args
|
||||
* @returns {string}
|
||||
*/
|
||||
run(input, args) {
|
||||
if (input.replace(/[\s+]/g, "") !== "") {
|
||||
const [inFormat, inDelim, outFormat, outDelim, incDirection, precision] = args;
|
||||
const result = convertCoordinates(input, inFormat, inDelim, outFormat, outDelim, incDirection, precision);
|
||||
return result;
|
||||
} else {
|
||||
return input;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
export default ConvertCoordinateFormat;
|
||||
125
src/core/operations/DNSOverHTTPS.mjs
Normal file
125
src/core/operations/DNSOverHTTPS.mjs
Normal file
|
|
@ -0,0 +1,125 @@
|
|||
/**
|
||||
* @author h345983745
|
||||
* @copyright Crown Copyright 2019
|
||||
* @license Apache-2.0
|
||||
*/
|
||||
import Operation from "../Operation";
|
||||
import OperationError from "../errors/OperationError";
|
||||
|
||||
/**
|
||||
* DNS over HTTPS operation
|
||||
*/
|
||||
class DNSOverHTTPS extends Operation {
|
||||
|
||||
/**
|
||||
* DNSOverHTTPS constructor
|
||||
*/
|
||||
constructor() {
|
||||
super();
|
||||
|
||||
this.name = "DNS over HTTPS";
|
||||
this.module = "Default";
|
||||
this.description = [
|
||||
"Takes a single domain name and performs a DNS lookup using DNS over HTTPS.",
|
||||
"<br><br>",
|
||||
"By default, <a href='https://developers.cloudflare.com/1.1.1.1/dns-over-https/'>Cloudflare</a> and <a href='https://developers.google.com/speed/public-dns/docs/dns-over-https'>Google</a> DNS over HTTPS services are supported.",
|
||||
"<br><br>",
|
||||
"Can be used with any service that supports the GET parameters <code>name</code> and <code>type</code>."
|
||||
].join("\n");
|
||||
this.infoURL = "https://wikipedia.org/wiki/DNS_over_HTTPS";
|
||||
this.inputType = "string";
|
||||
this.outputType = "JSON";
|
||||
this.manualBake = true;
|
||||
this.args = [
|
||||
{
|
||||
name: "Resolver",
|
||||
type: "editableOption",
|
||||
value: [
|
||||
{
|
||||
name: "Google",
|
||||
value: "https://dns.google.com/resolve"
|
||||
},
|
||||
{
|
||||
name: "Cloudflare",
|
||||
value: "https://cloudflare-dns.com/dns-query"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
name: "Request Type",
|
||||
type: "option",
|
||||
value: [
|
||||
"A",
|
||||
"AAAA",
|
||||
"TXT",
|
||||
"MX",
|
||||
"DNSKEY",
|
||||
"NS"
|
||||
]
|
||||
},
|
||||
{
|
||||
name: "Answer Data Only",
|
||||
type: "boolean",
|
||||
value: false
|
||||
},
|
||||
{
|
||||
name: "Validate DNSSEC",
|
||||
type: "boolean",
|
||||
value: true
|
||||
}
|
||||
];
|
||||
}
|
||||
|
||||
/**
|
||||
* @param {string} input
|
||||
* @param {Object[]} args
|
||||
* @returns {JSON}
|
||||
*/
|
||||
run(input, args) {
|
||||
const [resolver, requestType, justAnswer, DNSSEC] = args;
|
||||
let url = URL;
|
||||
try {
|
||||
url = new URL(resolver);
|
||||
} catch (error) {
|
||||
throw new OperationError(error.toString() +
|
||||
"\n\nThis error could be caused by one of the following:\n" +
|
||||
" - An invalid Resolver URL\n");
|
||||
}
|
||||
const params = {name: input, type: requestType, cd: DNSSEC};
|
||||
|
||||
url.search = new URLSearchParams(params);
|
||||
|
||||
return fetch(url, {headers: {"accept": "application/dns-json"}}).then(response => {
|
||||
return response.json();
|
||||
}).then(data => {
|
||||
if (justAnswer) {
|
||||
return extractData(data.Answer);
|
||||
}
|
||||
return data;
|
||||
}).catch(e => {
|
||||
throw new OperationError(`Error making request to ${url}\n${e.toString()}`);
|
||||
});
|
||||
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Construct an array of just data from a DNS Answer section
|
||||
*
|
||||
* @private
|
||||
* @param {JSON} data
|
||||
* @returns {JSON}
|
||||
*/
|
||||
function extractData(data) {
|
||||
if (typeof(data) == "undefined"){
|
||||
return [];
|
||||
} else {
|
||||
const dataValues = [];
|
||||
data.forEach(element => {
|
||||
dataValues.push(element.data);
|
||||
});
|
||||
return dataValues;
|
||||
}
|
||||
}
|
||||
|
||||
export default DNSOverHTTPS;
|
||||
|
|
@ -43,7 +43,7 @@ class Divide extends Operation {
|
|||
*/
|
||||
run(input, args) {
|
||||
const val = div(createNumArray(input, args[0]));
|
||||
return val instanceof BigNumber ? val : new BigNumber(NaN);
|
||||
return BigNumber.isBigNumber(val) ? val : new BigNumber(NaN);
|
||||
}
|
||||
|
||||
}
|
||||
|
|
|
|||
39
src/core/operations/FromCaseInsensitiveRegex.mjs
Normal file
39
src/core/operations/FromCaseInsensitiveRegex.mjs
Normal file
|
|
@ -0,0 +1,39 @@
|
|||
/**
|
||||
* @author masq [github.cyberchef@masq.cc]
|
||||
* @copyright Crown Copyright 2018
|
||||
* @license Apache-2.0
|
||||
*/
|
||||
|
||||
import Operation from "../Operation";
|
||||
|
||||
/**
|
||||
* From Case Insensitive Regex operation
|
||||
*/
|
||||
class FromCaseInsensitiveRegex extends Operation {
|
||||
|
||||
/**
|
||||
* FromCaseInsensitiveRegex constructor
|
||||
*/
|
||||
constructor() {
|
||||
super();
|
||||
|
||||
this.name = "From Case Insensitive Regex";
|
||||
this.module = "Default";
|
||||
this.description = "Converts a case-insensitive regex string to a case sensitive regex string (no guarantee on it being the proper original casing) in case the i flag wasn't available at the time but now is, or you need it to be case-sensitive again.<br><br>e.g. <code>[mM][oO][zZ][iI][lL][lL][aA]/[0-9].[0-9] .*</code> becomes <code>Mozilla/[0-9].[0-9] .*</code>";
|
||||
this.infoURL = "https://wikipedia.org/wiki/Regular_expression";
|
||||
this.inputType = "string";
|
||||
this.outputType = "string";
|
||||
this.args = [];
|
||||
}
|
||||
|
||||
/**
|
||||
* @param {string} input
|
||||
* @param {Object[]} args
|
||||
* @returns {string}
|
||||
*/
|
||||
run(input, args) {
|
||||
return input.replace(/\[[a-z]{2}\]/ig, m => m[1].toUpperCase() === m[2].toUpperCase() ? m[1] : m);
|
||||
}
|
||||
}
|
||||
|
||||
export default FromCaseInsensitiveRegex;
|
||||
|
|
@ -1,44 +0,0 @@
|
|||
/**
|
||||
* @author gchq77703 []
|
||||
* @copyright Crown Copyright 2018
|
||||
* @license Apache-2.0
|
||||
*/
|
||||
|
||||
import Operation from "../Operation";
|
||||
import geohash from "ngeohash";
|
||||
|
||||
/**
|
||||
* From Geohash operation
|
||||
*/
|
||||
class FromGeohash extends Operation {
|
||||
|
||||
/**
|
||||
* FromGeohash constructor
|
||||
*/
|
||||
constructor() {
|
||||
super();
|
||||
|
||||
this.name = "From Geohash";
|
||||
this.module = "Crypto";
|
||||
this.description = "Converts Geohash strings into Lat/Long coordinates. For example, <code>ww8p1r4t8</code> becomes <code>37.8324,112.5584</code>.";
|
||||
this.infoURL = "https://wikipedia.org/wiki/Geohash";
|
||||
this.inputType = "string";
|
||||
this.outputType = "string";
|
||||
this.args = [];
|
||||
}
|
||||
|
||||
/**
|
||||
* @param {string} input
|
||||
* @param {Object[]} args
|
||||
* @returns {string}
|
||||
*/
|
||||
run(input, args) {
|
||||
return input.split("\n").map(line => {
|
||||
const coords = geohash.decode(line);
|
||||
return [coords.latitude, coords.longitude].join(",");
|
||||
}).join("\n");
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
export default FromGeohash;
|
||||
70
src/core/operations/GenerateLoremIpsum.mjs
Normal file
70
src/core/operations/GenerateLoremIpsum.mjs
Normal file
|
|
@ -0,0 +1,70 @@
|
|||
/**
|
||||
* @author klaxon [klaxon@veyr.com]
|
||||
* @copyright Crown Copyright 2018
|
||||
* @license Apache-2.0
|
||||
*/
|
||||
|
||||
import Operation from "../Operation";
|
||||
import OperationError from "../errors/OperationError";
|
||||
import { GenerateParagraphs, GenerateSentences, GenerateWords, GenerateBytes } from "../lib/LoremIpsum";
|
||||
|
||||
/**
|
||||
* Generate Lorem Ipsum operation
|
||||
*/
|
||||
class GenerateLoremIpsum extends Operation {
|
||||
|
||||
/**
|
||||
* GenerateLoremIpsum constructor
|
||||
*/
|
||||
constructor() {
|
||||
super();
|
||||
|
||||
this.name = "Generate Lorem Ipsum";
|
||||
this.module = "Default";
|
||||
this.description = "Generate varying length lorem ipsum placeholder text.";
|
||||
this.infoURL = "https://wikipedia.org/wiki/Lorem_ipsum";
|
||||
this.inputType = "string";
|
||||
this.outputType = "string";
|
||||
this.args = [
|
||||
{
|
||||
"name": "Length",
|
||||
"type": "number",
|
||||
"value": "3"
|
||||
},
|
||||
{
|
||||
"name": "Length in",
|
||||
"type": "option",
|
||||
"value": ["Paragraphs", "Sentences", "Words", "Bytes"]
|
||||
}
|
||||
|
||||
];
|
||||
}
|
||||
|
||||
/**
|
||||
* @param {string} input
|
||||
* @param {Object[]} args
|
||||
* @returns {string}
|
||||
*/
|
||||
run(input, args) {
|
||||
const [length, lengthType] = args;
|
||||
if (length < 1){
|
||||
throw new OperationError("Length must be greater than 0");
|
||||
}
|
||||
switch (lengthType) {
|
||||
case "Paragraphs":
|
||||
return GenerateParagraphs(length);
|
||||
case "Sentences":
|
||||
return GenerateSentences(length);
|
||||
case "Words":
|
||||
return GenerateWords(length);
|
||||
case "Bytes":
|
||||
return GenerateBytes(length);
|
||||
default:
|
||||
throw new OperationError("Invalid length type");
|
||||
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
export default GenerateLoremIpsum;
|
||||
|
|
@ -43,7 +43,7 @@ class Mean extends Operation {
|
|||
*/
|
||||
run(input, args) {
|
||||
const val = mean(createNumArray(input, args[0]));
|
||||
return val instanceof BigNumber ? val : new BigNumber(NaN);
|
||||
return BigNumber.isBigNumber(val) ? val : new BigNumber(NaN);
|
||||
}
|
||||
|
||||
}
|
||||
|
|
|
|||
|
|
@ -43,7 +43,7 @@ class Median extends Operation {
|
|||
*/
|
||||
run(input, args) {
|
||||
const val = median(createNumArray(input, args[0]));
|
||||
return val instanceof BigNumber ? val : new BigNumber(NaN);
|
||||
return BigNumber.isBigNumber(val) ? val : new BigNumber(NaN);
|
||||
}
|
||||
|
||||
}
|
||||
|
|
|
|||
|
|
@ -44,7 +44,7 @@ class Multiply extends Operation {
|
|||
*/
|
||||
run(input, args) {
|
||||
const val = multi(createNumArray(input, args[0]));
|
||||
return val instanceof BigNumber ? val : new BigNumber(NaN);
|
||||
return BigNumber.isBigNumber(val) ? val : new BigNumber(NaN);
|
||||
}
|
||||
|
||||
}
|
||||
|
|
|
|||
|
|
@ -181,8 +181,8 @@ class ParseX509Certificate extends Operation {
|
|||
Serial number: ${new r.BigInteger(sn, 16).toString()} (0x${sn})
|
||||
Algorithm ID: ${cert.getSignatureAlgorithmField()}
|
||||
Validity
|
||||
Not Before: ${nbDate} (dd-mm-yy hh:mm:ss) (${cert.getNotBefore()})
|
||||
Not After: ${naDate} (dd-mm-yy hh:mm:ss) (${cert.getNotAfter()})
|
||||
Not Before: ${nbDate} (dd-mm-yyyy hh:mm:ss) (${cert.getNotBefore()})
|
||||
Not After: ${naDate} (dd-mm-yyyy hh:mm:ss) (${cert.getNotAfter()})
|
||||
Issuer
|
||||
${issuerStr}
|
||||
Subject
|
||||
|
|
@ -206,12 +206,15 @@ ${extensions}`;
|
|||
* @returns {string}
|
||||
*/
|
||||
function formatDate (dateStr) {
|
||||
return dateStr[4] + dateStr[5] + "/" +
|
||||
dateStr[2] + dateStr[3] + "/" +
|
||||
dateStr[0] + dateStr[1] + " " +
|
||||
dateStr[6] + dateStr[7] + ":" +
|
||||
if (dateStr.length === 13) { // UTC Time
|
||||
dateStr = (dateStr[0] < "5" ? "20" : "19") + dateStr;
|
||||
}
|
||||
return dateStr[6] + dateStr[7] + "/" +
|
||||
dateStr[4] + dateStr[5] + "/" +
|
||||
dateStr[0] + dateStr[1] + dateStr[2] + dateStr[3] + " " +
|
||||
dateStr[8] + dateStr[9] + ":" +
|
||||
dateStr[10] + dateStr[11];
|
||||
dateStr[10] + dateStr[11] + ":" +
|
||||
dateStr[12] + dateStr[13];
|
||||
}
|
||||
|
||||
export default ParseX509Certificate;
|
||||
|
|
|
|||
|
|
@ -228,40 +228,29 @@ function regexList (input, regex, displayTotal, matches, captureGroups) {
|
|||
function regexHighlight (input, regex, displayTotal) {
|
||||
let output = "",
|
||||
title = "",
|
||||
m,
|
||||
hl = 1,
|
||||
i = 0,
|
||||
total = 0;
|
||||
|
||||
while ((m = regex.exec(input))) {
|
||||
// Moves pointer when an empty string is matched (prevents infinite loop)
|
||||
if (m.index === regex.lastIndex) {
|
||||
regex.lastIndex++;
|
||||
}
|
||||
output = input.replace(regex, (match, ...args) => {
|
||||
args.pop(); // Throw away full string
|
||||
const offset = args.pop(),
|
||||
groups = args;
|
||||
|
||||
// Add up to match
|
||||
output += Utils.escapeHtml(input.slice(i, m.index));
|
||||
|
||||
title = `Offset: ${m.index}\n`;
|
||||
if (m.length > 1) {
|
||||
title = `Offset: ${offset}\n`;
|
||||
if (groups.length) {
|
||||
title += "Groups:\n";
|
||||
for (let n = 1; n < m.length; ++n) {
|
||||
title += `\t${n}: ${m[n]}\n`;
|
||||
for (let i = 0; i < groups.length; i++) {
|
||||
title += `\t${i+1}: ${Utils.escapeHtml(groups[i] || "")}\n`;
|
||||
}
|
||||
}
|
||||
|
||||
// Add match with highlighting
|
||||
output += "<span class='hl"+hl+"' title='"+title+"'>" + Utils.escapeHtml(m[0]) + "</span>";
|
||||
|
||||
// Switch highlight
|
||||
hl = hl === 1 ? 2 : 1;
|
||||
|
||||
i = regex.lastIndex;
|
||||
total++;
|
||||
}
|
||||
|
||||
// Add all after final match
|
||||
output += Utils.escapeHtml(input.slice(i, input.length));
|
||||
return `<span class='hl${hl}' title='${title}'>${Utils.escapeHtml(match)}</span>`;
|
||||
});
|
||||
|
||||
if (displayTotal)
|
||||
output = "Total found: " + total + "\n\n" + output;
|
||||
|
|
|
|||
|
|
@ -44,7 +44,7 @@ class StandardDeviation extends Operation {
|
|||
*/
|
||||
run(input, args) {
|
||||
const val = stdDev(createNumArray(input, args[0]));
|
||||
return val instanceof BigNumber ? val : new BigNumber(NaN);
|
||||
return BigNumber.isBigNumber(val) ? val : new BigNumber(NaN);
|
||||
|
||||
}
|
||||
|
||||
|
|
|
|||
153
src/core/operations/Subsection.mjs
Normal file
153
src/core/operations/Subsection.mjs
Normal file
|
|
@ -0,0 +1,153 @@
|
|||
/**
|
||||
* @author j433866 [j433866@gmail.com]
|
||||
* @copyright Crown Copyright 2019
|
||||
* @license Apache-2.0
|
||||
*/
|
||||
|
||||
import XRegExp from "xregexp";
|
||||
import Operation from "../Operation";
|
||||
import Recipe from "../Recipe";
|
||||
import Dish from "../Dish";
|
||||
|
||||
/**
|
||||
* Subsection operation
|
||||
*/
|
||||
class Subsection extends Operation {
|
||||
|
||||
/**
|
||||
* Subsection constructor
|
||||
*/
|
||||
constructor() {
|
||||
super();
|
||||
|
||||
this.name = "Subsection";
|
||||
this.flowControl = true;
|
||||
this.module = "Regex";
|
||||
this.description = "Select a part of the input data using a regular expression (regex), and run all subsequent operations on each match separately.<br><br>You can use up to one capture group, where the recipe will only be run on the data in the capture group. If there's more than one capture group, only the first one will be operated on.";
|
||||
this.infoURL = "";
|
||||
this.inputType = "string";
|
||||
this.outputType = "string";
|
||||
this.args = [
|
||||
{
|
||||
"name": "Section (regex)",
|
||||
"type": "string",
|
||||
"value": ""
|
||||
},
|
||||
{
|
||||
"name": "Case sensitive matching",
|
||||
"type": "boolean",
|
||||
"value": true
|
||||
},
|
||||
{
|
||||
"name": "Global matching",
|
||||
"type": "boolean",
|
||||
"value": true
|
||||
},
|
||||
{
|
||||
"name": "Ignore errors",
|
||||
"type": "boolean",
|
||||
"value": false
|
||||
}
|
||||
];
|
||||
}
|
||||
|
||||
/**
|
||||
* @param {Object} state - The current state of the recipe.
|
||||
* @param {number} state.progress - The current position in the recipe.
|
||||
* @param {Dish} state.dish - The Dish being operated on
|
||||
* @param {Operation[]} state.opList - The list of operations in the recipe
|
||||
* @returns {Object} - The updated state of the recipe
|
||||
*/
|
||||
async run(state) {
|
||||
const opList = state.opList,
|
||||
inputType = opList[state.progress].inputType,
|
||||
outputType = opList[state.progress].outputType,
|
||||
input = await state.dish.get(inputType),
|
||||
ings = opList[state.progress].ingValues,
|
||||
[section, caseSensitive, global, ignoreErrors] = ings,
|
||||
subOpList = [];
|
||||
|
||||
if (input && section !== "") {
|
||||
// Create subOpList for each tranche to operate on
|
||||
// all remaining operations unless we encounter a Merge
|
||||
for (let i = state.progress + 1; i < opList.length; i++) {
|
||||
if (opList[i].name === "Merge" && !opList[i].disabled) {
|
||||
break;
|
||||
} else {
|
||||
subOpList.push(opList[i]);
|
||||
}
|
||||
}
|
||||
|
||||
let flags = "",
|
||||
inOffset = 0,
|
||||
output = "",
|
||||
m,
|
||||
progress = 0;
|
||||
|
||||
if (!caseSensitive) flags += "i";
|
||||
if (global) flags += "g";
|
||||
|
||||
const regex = new XRegExp(section, flags),
|
||||
recipe = new Recipe();
|
||||
|
||||
recipe.addOperations(subOpList);
|
||||
state.forkOffset += state.progress + 1;
|
||||
|
||||
// Take a deep(ish) copy of the ingredient values
|
||||
const ingValues = subOpList.map(op => JSON.parse(JSON.stringify(op.ingValues)));
|
||||
let matched = false;
|
||||
|
||||
// Run recipe over each match
|
||||
while ((m = regex.exec(input))) {
|
||||
matched = true;
|
||||
// Add up to match
|
||||
let matchStr = m[0];
|
||||
|
||||
if (m.length === 1) { // No capture groups
|
||||
output += input.slice(inOffset, m.index);
|
||||
inOffset = m.index + m[0].length;
|
||||
} else if (m.length >= 2) {
|
||||
matchStr = m[1];
|
||||
|
||||
// Need to add some of the matched string that isn't in the capture group
|
||||
output += input.slice(inOffset, m.index + m[0].indexOf(m[1]));
|
||||
// Set i to be after the end of the first capture group
|
||||
inOffset = m.index + m[0].indexOf(m[1]) + m[1].length;
|
||||
}
|
||||
|
||||
// Baseline ing values for each tranche so that registers are reset
|
||||
subOpList.forEach((op, i) => {
|
||||
op.ingValues = JSON.parse(JSON.stringify(ingValues[i]));
|
||||
});
|
||||
|
||||
const dish = new Dish();
|
||||
dish.set(matchStr, inputType);
|
||||
|
||||
try {
|
||||
progress = await recipe.execute(dish, 0, state);
|
||||
} catch (err) {
|
||||
if (!ignoreErrors) {
|
||||
throw err;
|
||||
}
|
||||
progress = err.progress + 1;
|
||||
}
|
||||
output += await dish.get(outputType);
|
||||
if (!regex.global) break;
|
||||
}
|
||||
|
||||
// If no matches were found, advance progress to after a Merge op
|
||||
// Otherwise, the operations below Subsection will be run on all the input data
|
||||
if (!matched) {
|
||||
state.progress += subOpList.length + 1;
|
||||
}
|
||||
|
||||
output += input.slice(inOffset);
|
||||
state.progress += progress;
|
||||
state.dish.set(output, outputType);
|
||||
}
|
||||
return state;
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
export default Subsection;
|
||||
|
|
@ -44,7 +44,7 @@ class Subtract extends Operation {
|
|||
*/
|
||||
run(input, args) {
|
||||
const val = sub(createNumArray(input, args[0]));
|
||||
return val instanceof BigNumber ? val : new BigNumber(NaN);
|
||||
return BigNumber.isBigNumber(val) ? val : new BigNumber(NaN);
|
||||
}
|
||||
|
||||
}
|
||||
|
|
|
|||
|
|
@ -44,7 +44,7 @@ class Sum extends Operation {
|
|||
*/
|
||||
run(input, args) {
|
||||
const val = sum(createNumArray(input, args[0]));
|
||||
return val instanceof BigNumber ? val : new BigNumber(NaN);
|
||||
return BigNumber.isBigNumber(val) ? val : new BigNumber(NaN);
|
||||
}
|
||||
|
||||
}
|
||||
|
|
|
|||
|
|
@ -20,7 +20,7 @@ class ToBase64 extends Operation {
|
|||
|
||||
this.name = "To Base64";
|
||||
this.module = "Default";
|
||||
this.description = "Base64 is a notation for encoding arbitrary byte data using a restricted set of symbols that can be conveniently used by humans and processed by computers.<br><br>This operation decodes data from an ASCII Base64 string back into its raw format.<br><br>e.g. <code>aGVsbG8=</code> becomes <code>hello</code>";
|
||||
this.description = "Base64 is a notation for encoding arbitrary byte data using a restricted set of symbols that can be conveniently used by humans and processed by computers.<br><br>This operation encodes raw data into an ASCII Base64 string.<br><br>e.g. <code>hello</code> becomes <code>aGVsbG8=</code>";
|
||||
this.infoURL = "https://wikipedia.org/wiki/Base64";
|
||||
this.inputType = "ArrayBuffer";
|
||||
this.outputType = "string";
|
||||
|
|
|
|||
39
src/core/operations/ToCaseInsensitiveRegex.mjs
Normal file
39
src/core/operations/ToCaseInsensitiveRegex.mjs
Normal file
|
|
@ -0,0 +1,39 @@
|
|||
/**
|
||||
* @author masq [github.cyberchef@masq.cc]
|
||||
* @copyright Crown Copyright 2018
|
||||
* @license Apache-2.0
|
||||
*/
|
||||
|
||||
import Operation from "../Operation";
|
||||
|
||||
/**
|
||||
* To Case Insensitive Regex operation
|
||||
*/
|
||||
class ToCaseInsensitiveRegex extends Operation {
|
||||
|
||||
/**
|
||||
* ToCaseInsensitiveRegex constructor
|
||||
*/
|
||||
constructor() {
|
||||
super();
|
||||
|
||||
this.name = "To Case Insensitive Regex";
|
||||
this.module = "Default";
|
||||
this.description = "Converts a case-sensitive regex string into a case-insensitive regex string in case the i flag is unavailable to you.<br><br>e.g. <code>Mozilla/[0-9].[0-9] .*</code> becomes <code>[mM][oO][zZ][iI][lL][lL][aA]/[0-9].[0-9] .*</code>";
|
||||
this.infoURL = "https://wikipedia.org/wiki/Regular_expression";
|
||||
this.inputType = "string";
|
||||
this.outputType = "string";
|
||||
this.args = [];
|
||||
}
|
||||
|
||||
/**
|
||||
* @param {string} input
|
||||
* @param {Object[]} args
|
||||
* @returns {string}
|
||||
*/
|
||||
run(input, args) {
|
||||
return input.replace(/[a-z]/ig, m => `[${m.toLowerCase()}${m.toUpperCase()}]`);
|
||||
}
|
||||
}
|
||||
|
||||
export default ToCaseInsensitiveRegex;
|
||||
|
|
@ -1,53 +0,0 @@
|
|||
/**
|
||||
* @author gchq77703 []
|
||||
* @copyright Crown Copyright 2018
|
||||
* @license Apache-2.0
|
||||
*/
|
||||
|
||||
import Operation from "../Operation";
|
||||
import geohash from "ngeohash";
|
||||
|
||||
/**
|
||||
* To Geohash operation
|
||||
*/
|
||||
class ToGeohash extends Operation {
|
||||
|
||||
/**
|
||||
* ToGeohash constructor
|
||||
*/
|
||||
constructor() {
|
||||
super();
|
||||
|
||||
this.name = "To Geohash";
|
||||
this.module = "Crypto";
|
||||
this.description = "Converts Lat/Long coordinates into a Geohash string. For example, <code>37.8324,112.5584</code> becomes <code>ww8p1r4t8</code>.";
|
||||
this.infoURL = "https://wikipedia.org/wiki/Geohash";
|
||||
this.inputType = "string";
|
||||
this.outputType = "string";
|
||||
this.args = [
|
||||
{
|
||||
name: "Precision",
|
||||
type: "number",
|
||||
value: 9
|
||||
}
|
||||
];
|
||||
}
|
||||
|
||||
/**
|
||||
* @param {string} input
|
||||
* @param {Object[]} args
|
||||
* @returns {string}
|
||||
*/
|
||||
run(input, args) {
|
||||
const [precision] = args;
|
||||
|
||||
return input.split("\n").map(line => {
|
||||
line = line.replace(/ /g, "");
|
||||
if (line === "") return "";
|
||||
return geohash.encode(...line.split(",").map(num => parseFloat(num)), precision);
|
||||
}).join("\n");
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
export default ToGeohash;
|
||||
|
|
@ -38,7 +38,9 @@ class ToMessagePack extends Operation {
|
|||
if (ENVIRONMENT_IS_WORKER()) {
|
||||
return notepack.encode(input);
|
||||
} else {
|
||||
return notepack.encode(input).buffer;
|
||||
const res = notepack.encode(input);
|
||||
// Safely convert from Node Buffer to ArrayBuffer using the correct view of the data
|
||||
return (new Uint8Array(res)).buffer;
|
||||
}
|
||||
} catch (err) {
|
||||
throw new OperationError(`Could not encode JSON to MessagePack: ${err}`);
|
||||
|
|
|
|||
|
|
@ -57,7 +57,7 @@ class ToTable extends Operation {
|
|||
const [cellDelims, rowDelims, firstRowHeader, format] = args;
|
||||
|
||||
// Process the input into a nested array of elements.
|
||||
const tableData = Utils.parseCSV(input, cellDelims.split(""), rowDelims.split(""));
|
||||
const tableData = Utils.parseCSV(Utils.escapeHtml(input), cellDelims.split(""), rowDelims.split(""));
|
||||
|
||||
if (!tableData.length) return "";
|
||||
|
||||
|
|
|
|||
122
src/core/operations/YARARules.mjs
Normal file
122
src/core/operations/YARARules.mjs
Normal file
|
|
@ -0,0 +1,122 @@
|
|||
/**
|
||||
* @author Matt C [matt@artemisbot.uk]
|
||||
* @copyright Crown Copyright 2019
|
||||
* @license Apache-2.0
|
||||
*/
|
||||
|
||||
import Operation from "../Operation";
|
||||
import OperationError from "../errors/OperationError";
|
||||
import Yara from "libyara-wasm";
|
||||
|
||||
/**
|
||||
* YARA Rules operation
|
||||
*/
|
||||
class YARARules extends Operation {
|
||||
|
||||
/**
|
||||
* YARARules constructor
|
||||
*/
|
||||
constructor() {
|
||||
super();
|
||||
|
||||
this.name = "YARA Rules";
|
||||
this.module = "Yara";
|
||||
this.description = "YARA is a tool developed at VirusTotal, primarily aimed at helping malware researchers to identify and classify malware samples. It matches based on rules specified by the user containing textual or binary patterns and a boolean expression. For help on writing rules, see the <a href='https://yara.readthedocs.io/en/latest/writingrules.html'>YARA documentation.</a>";
|
||||
this.infoURL = "https://wikipedia.org/wiki/YARA";
|
||||
this.inputType = "ArrayBuffer";
|
||||
this.outputType = "string";
|
||||
this.args = [
|
||||
{
|
||||
name: "Rules",
|
||||
type: "text",
|
||||
value: "",
|
||||
rows: 5
|
||||
},
|
||||
{
|
||||
name: "Show strings",
|
||||
type: "boolean",
|
||||
value: false
|
||||
},
|
||||
{
|
||||
name: "Show string lengths",
|
||||
type: "boolean",
|
||||
value: false
|
||||
},
|
||||
{
|
||||
name: "Show metadata",
|
||||
type: "boolean",
|
||||
value: false
|
||||
},
|
||||
{
|
||||
name: "Show counts",
|
||||
type: "boolean",
|
||||
value: true
|
||||
}
|
||||
];
|
||||
}
|
||||
|
||||
/**
|
||||
* @param {string} input
|
||||
* @param {Object[]} args
|
||||
* @returns {string}
|
||||
*/
|
||||
run(input, args) {
|
||||
if (ENVIRONMENT_IS_WORKER())
|
||||
self.sendStatusMessage("Instantiating YARA...");
|
||||
const [rules, showStrings, showLengths, showMeta, showCounts] = args;
|
||||
return new Promise((resolve, reject) => {
|
||||
Yara().then(yara => {
|
||||
if (ENVIRONMENT_IS_WORKER()) self.sendStatusMessage("Converting data for YARA.");
|
||||
let matchString = "";
|
||||
|
||||
const inpArr = new Uint8Array(input); // Turns out embind knows that JS uint8array <==> C++ std::string
|
||||
|
||||
if (ENVIRONMENT_IS_WORKER()) self.sendStatusMessage("Running YARA matching.");
|
||||
|
||||
const resp = yara.run(inpArr, rules);
|
||||
|
||||
if (ENVIRONMENT_IS_WORKER()) self.sendStatusMessage("Processing data.");
|
||||
|
||||
if (resp.compileErrors.size() > 0) {
|
||||
for (let i = 0; i < resp.compileErrors.size(); i++) {
|
||||
const compileError = resp.compileErrors.get(i);
|
||||
if (!compileError.warning) {
|
||||
reject(new OperationError(`Error on line ${compileError.lineNumber}: ${compileError.message}`));
|
||||
} else {
|
||||
matchString += `Warning on line ${compileError.lineNumber}: ${compileError.message}`;
|
||||
}
|
||||
}
|
||||
}
|
||||
const matchedRules = resp.matchedRules;
|
||||
for (let i = 0; i < matchedRules.size(); i++) {
|
||||
const rule = matchedRules.get(i);
|
||||
const matches = rule.resolvedMatches;
|
||||
let meta = "";
|
||||
if (showMeta && rule.metadata.size() > 0) {
|
||||
meta += " [";
|
||||
for (let j = 0; j < rule.metadata.size(); j++) {
|
||||
meta += `${rule.metadata.get(j).identifier}: ${rule.metadata.get(j).data}, `;
|
||||
}
|
||||
meta = meta.slice(0, -2) + "]";
|
||||
}
|
||||
const countString = showCounts ? `${matches.size()} time${matches.size() > 1 ? "s" : ""}` : "";
|
||||
if (matches.size() === 0 || !(showStrings || showLengths)) {
|
||||
matchString += `Input matches rule "${rule.ruleName}"${meta}${countString.length > 0 ? ` ${countString}`: ""}.\n`;
|
||||
} else {
|
||||
matchString += `Rule "${rule.ruleName}"${meta} matches (${countString}):\n`;
|
||||
for (let j = 0; j < matches.size(); j++) {
|
||||
const match = matches.get(j);
|
||||
if (showStrings || showLengths) {
|
||||
matchString += `Pos ${match.location}, ${showLengths ? `length ${match.matchLength}, ` : ""}identifier ${match.stringIdentifier}${showStrings ? `, data: "${match.data}"` : ""}\n`;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
resolve(matchString);
|
||||
});
|
||||
});
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
export default YARARules;
|
||||
Loading…
Add table
Add a link
Reference in a new issue