Skip to content

Commit dc0dc27

Browse files
ajinabrahamajinabraham
authored
HOTFIX: Feature updates and Bug Fixes (#2197)
* OFAC, jquery bump, tox fix * AAR handle multiple application tags
1 parent b608ce4 commit dc0dc27

File tree

13 files changed

+273
-29
lines changed

13 files changed

+273
-29
lines changed

‎mobsf/MalwareAnalyzer/views/MalwareDomainCheck.py‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -78,6 +78,19 @@ def update_maltrail_db(self):
7878
def gelocation(self):
7979
"""Perform Geolocation."""
8080
try:
81+
ofac_list = {
82+
'cuba', 'iran', 'north korea',
83+
'russia', 'syria', 'balkans',
84+
'belarus', 'myanmar', 'congo',
85+
'ethiopia', 'hong kong', 'iraq',
86+
'lebanon', 'libya', 'sudan',
87+
'venezuela', 'yemen', 'zimbabwe',
88+
'crimea', 'donetsk', 'luhansk',
89+
'afghanistan', 'china', 'ivory coast',
90+
'cyprus', 'eritrea', 'haiti',
91+
'liberia', 'somalia', 'sri lanka',
92+
'vietnam', 'south sudan',
93+
}
8194
self.IP2Loc.open(self.iplocbin)
8295
for domain in self.domainlist:
8396
# Tag Good Domains
@@ -94,6 +107,16 @@ def gelocation(self):
94107
if ip:
95108
rec = self.IP2Loc.get_all(ip)
96109
self.result[domain]['geolocation'] = rec.__dict__
110+
country = rec.__dict__.get('country_long')
111+
region = rec.__dict__.get('region')
112+
city = rec.__dict__.get('city')
113+
self.result[domain]['ofac'] = False
114+
if country and country.lower() in ofac_list:
115+
self.result[domain]['ofac'] = True
116+
elif region and region.lower() in ofac_list:
117+
self.result[domain]['ofac'] = True
118+
elif city and city.lower() in ofac_list:
119+
self.result[domain]['ofac'] = True
97120
else:
98121
self.result[domain]['geolocation'] = None
99122
except Exception:

‎mobsf/MobSF/init.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010

1111
logger = logging.getLogger(__name__)
1212

13-
VERSION = '3.6.7'
13+
VERSION = '3.6.8'
1414
BANNER = """
1515
__ __ _ ____ _____ _____ __
1616
| \/ | ___ | |__/ ___|| ___|_ _|___ / / /_

‎mobsf/StaticAnalyzer/views/android/manifest_analysis.py‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -299,6 +299,8 @@ def manifest_analysis(mfxml, man_data_dic, src_type, app_dir):
299299
minsdk = man_data_dic.get('min_sdk')
300300
ret_list.append(('vulnerable_os_version', (minsdk,), ()))
301301
# APPLICATIONS
302+
# Handle multiple application tags in AAR
303+
backupDisabled = False
302304
for application in applications:
303305
# Esteve 23.07.2016 - begin - identify permission at the
304306
# application level
@@ -323,9 +325,10 @@ def manifest_analysis(mfxml, man_data_dic, src_type, app_dir):
323325
if application.getAttribute('android:allowBackup') == 'true':
324326
ret_list.append(('app_allowbackup', (), ()))
325327
elif application.getAttribute('android:allowBackup') == 'false':
326-
pass
328+
backupDisabled = True
327329
else:
328-
ret_list.append(('allowbackup_not_set', (), ()))
330+
if not backupDisabled:
331+
ret_list.append(('allowbackup_not_set', (), ()))
329332
if application.getAttribute('android:testOnly') == 'true':
330333
ret_list.append(('app_in_test_mode', (), ()))
331334
for node in application.childNodes:

‎mobsf/StaticAnalyzer/views/common/appsec.py‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -99,6 +99,21 @@ def common_fields(findings, data):
9999
'description': str(value['geolocation']),
100100
'section': 'domains',
101101
})
102+
if value.get('ofac') and value['ofac'] is True:
103+
country = ''
104+
if value['geolocation'].get('country_long'):
105+
country = value['geolocation'].get('country_long')
106+
elif value['geolocation'].get('region'):
107+
country = value['geolocation'].get('region')
108+
elif value['geolocation'].get('city'):
109+
country = value['geolocation'].get('city')
110+
findings['hotspot'].append({
111+
'title': ('App may communicate to a server '
112+
f'({domain}) in OFAC sanctioned country '
113+
f'({country})'),
114+
'description': str(value['geolocation']),
115+
'section': 'domains',
116+
})
102117
# Firebase
103118
for fb in data['firebase_urls']:
104119
if fb['open']:

‎mobsf/static/adminlte/plugins/jquery.min.js‎

Lines changed: 2 additions & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎mobsf/templates/dynamic_analysis/android/dynamic_report.html‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -584,6 +584,35 @@ <h5 class="card-title"></h5>
584584
<div class="table-responsive">
585585
<div id="chartdiv"></div>
586586
</div>
587+
588+
<div class="table-responsive">
589+
{% if domains %}
590+
<p></br>This app may communicate with the following OFAC sanctioned list of countries.</p>
591+
<table id="table_ofac" class="table table-bordered table-hover table-striped">
592+
<thead>
593+
<tr>
594+
<th>DOMAIN</th>
595+
<th>COUNTRY/REGION</th>
596+
</tr>
597+
</thead>
598+
<tbody>
599+
{% for domain, details in domains.items %}
600+
{% if details|key:"ofac" == True %}
601+
<tr><td>{{domain}}</td>
602+
<td>
603+
<strong>IP: </strong>{{details|key:"geolocation"|key:"ip"}} <br/>
604+
<strong>Country: </strong>{{details|key:"geolocation"|key:"country_long"}} <br/>
605+
<strong>Region: </strong>{{details|key:"geolocation"|key:"region"}} <br/>
606+
<strong>City: </strong>{{details|key:"geolocation"|key:"city"}} <br/>
607+
</td>
608+
</tr>
609+
{% endif %}
610+
{% endfor %}
611+
</tbody>
612+
</table>
613+
{% endif %}
614+
</div>
615+
587616
</div>
588617
</div><!-- /.card -->
589618
</div>

‎mobsf/templates/pdf/android_report.html‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -734,6 +734,31 @@ <h2><i class="fab fa-quora"></i> QUARK </h2>
734734
{% endif %}
735735
-->
736736
{% if domains %}
737+
<h2><i class="fa fa-exclamation"></i> OFAC SANCTIONED COUNTRIES</h2>
738+
<p>This app may communicate with the following OFAC sanctioned list of countries.</p>
739+
<table id="table_ofac" class="table table-bordered table-hover table-striped">
740+
<thead>
741+
<tr>
742+
<th>DOMAIN</th>
743+
<th>COUNTRY/REGION</th>
744+
</tr>
745+
</thead>
746+
<tbody>
747+
{% for domain, details in domains.items %}
748+
{% if details|key:"ofac" == True %}
749+
<tr><td>{{domain}}</td>
750+
<td>
751+
<strong>IP: </strong>{{details|key:"geolocation"|key:"ip"}} <br/>
752+
<strong>Country: </strong>{{details|key:"geolocation"|key:"country_long"}} <br/>
753+
<strong>Region: </strong>{{details|key:"geolocation"|key:"region"}} <br/>
754+
<strong>City: </strong>{{details|key:"geolocation"|key:"city"}} <br/>
755+
</td>
756+
</tr>
757+
{% endif %}
758+
{% endfor %}
759+
</tbody>
760+
</table>
761+
737762
<h2><i class="fab fa-searchengin"></i> DOMAIN MALWARE CHECK</h2>
738763
<table class="basic">
739764
<thead>

‎mobsf/templates/pdf/ios_report.html‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -586,6 +586,32 @@ <h5>CVSS V2:</h5>
586586

587587
{% endif %}
588588
{% if domains %}
589+
590+
<h2><i class="fa fa-exclamation"></i> OFAC SANCTIONED COUNTRIES</h2>
591+
<p>This app may communicate with the following OFAC sanctioned list of countries.</p>
592+
<table id="table_ofac" class="table table-bordered table-hover table-striped">
593+
<thead>
594+
<tr>
595+
<th>DOMAIN</th>
596+
<th>COUNTRY/REGION</th>
597+
</tr>
598+
</thead>
599+
<tbody>
600+
{% for domain, details in domains.items %}
601+
{% if details|key:"ofac" == True %}
602+
<tr><td>{{domain}}</td>
603+
<td>
604+
<strong>IP: </strong>{{details|key:"geolocation"|key:"ip"}} <br/>
605+
<strong>Country: </strong>{{details|key:"geolocation"|key:"country_long"}} <br/>
606+
<strong>Region: </strong>{{details|key:"geolocation"|key:"region"}} <br/>
607+
<strong>City: </strong>{{details|key:"geolocation"|key:"city"}} <br/>
608+
</td>
609+
</tr>
610+
{% endif %}
611+
{% endfor %}
612+
</tbody>
613+
</table>
614+
589615
<h2><i class="fab fa-searchengin"></i> DOMAIN MALWARE CHECK</h2>
590616
<table class="basic">
591617
<thead>

‎mobsf/templates/static_analysis/android_binary_analysis.html‎

Lines changed: 35 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1669,12 +1669,42 @@ <h5 class="description-header">{{ code_analysis.summary.suppressed }}</h5>
16691669
<div class="table-responsive">
16701670
<div id="chartdiv"></div>
16711671
</div>
1672-
</div>
1673-
</div><!-- /.card -->
1674-
</div>
1675-
<!-- end row -->
1676-
</div>
1672+
1673+
1674+
<div class="table-responsive">
1675+
{% if domains %}
1676+
<p></br>This app may communicate with the following OFAC sanctioned list of countries.</p>
1677+
<table id="table_ofac" class="table table-bordered table-hover table-striped">
1678+
<thead>
1679+
<tr>
1680+
<th>DOMAIN</th>
1681+
<th>COUNTRY/REGION</th>
1682+
</tr>
1683+
</thead>
1684+
<tbody>
1685+
{% for domain, details in domains.items %}
1686+
{% if details|key:"ofac" == True %}
1687+
<tr><td>{{domain}}</td>
1688+
<td>
1689+
<strong>IP: </strong>{{details|key:"geolocation"|key:"ip"}} <br/>
1690+
<strong>Country: </strong>{{details|key:"geolocation"|key:"country_long"}} <br/>
1691+
<strong>Region: </strong>{{details|key:"geolocation"|key:"region"}} <br/>
1692+
<strong>City: </strong>{{details|key:"geolocation"|key:"city"}} <br/>
1693+
</td>
1694+
</tr>
1695+
{% endif %}
1696+
{% endfor %}
1697+
</tbody>
1698+
</table>
1699+
{% endif %}
16771700
</div>
1701+
1702+
</div>
1703+
</div><!-- /.card -->
1704+
</div>
1705+
<!-- end row -->
1706+
</div>
1707+
</div>
16781708
</section>
16791709
<!-- ===========================end server locations ================================== -->
16801710
<a id="malware_check" class="anchor"></a>

‎mobsf/templates/static_analysis/android_source_analysis.html‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1184,6 +1184,35 @@ <h5 class="description-header">{{ code_analysis.summary.suppressed }}</h5>
11841184
<div class="table-responsive">
11851185
<div id="chartdiv"></div>
11861186
</div>
1187+
1188+
<div class="table-responsive">
1189+
{% if domains %}
1190+
<p></br>This app may communicate with the following OFAC sanctioned list of countries.</p>
1191+
<table id="table_ofac" class="table table-bordered table-hover table-striped">
1192+
<thead>
1193+
<tr>
1194+
<th>DOMAIN</th>
1195+
<th>COUNTRY/REGION</th>
1196+
</tr>
1197+
</thead>
1198+
<tbody>
1199+
{% for domain, details in domains.items %}
1200+
{% if details|key:"ofac" == True %}
1201+
<tr><td>{{domain}}</td>
1202+
<td>
1203+
<strong>IP: </strong>{{details|key:"geolocation"|key:"ip"}} <br/>
1204+
<strong>Country: </strong>{{details|key:"geolocation"|key:"country_long"}} <br/>
1205+
<strong>Region: </strong>{{details|key:"geolocation"|key:"region"}} <br/>
1206+
<strong>City: </strong>{{details|key:"geolocation"|key:"city"}} <br/>
1207+
</td>
1208+
</tr>
1209+
{% endif %}
1210+
{% endfor %}
1211+
</tbody>
1212+
</table>
1213+
{% endif %}
1214+
</div>
1215+
11871216
</div>
11881217
</div><!-- /.card -->
11891218
</div>

0 commit comments

Comments
 (0)