{ "llm": { "conf": 0.999012, "grade": "hostile", "model": "Qwen/Qwen3.8-27B", "before": { "lvl": 1, "prob": 0.9985253, "class": "hostile" }, "outcome": "hostile", "interpretation": "Obfuscated PHP webshell included" }, "ml": { "v": "7", "eng": "2.8.0", "lvl": 0, "conf": 100, "mods": [ { "cls": 2, "raw": 0.9985253, "rte": "az", "prob": 0.9985253 }, { "cls": 0, "raw": 0.97200316, "rte": "az/zip", "prob": 0.97200316 } ], "prob": 0.9985253, "files": [ { "id": 0, "lvl": 0, "conf": 100, "prob": 0.9985253214836121, "type": "zip" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.00001936157605086919, "type": "python" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.000018805265426635742, "type": "python" }, { "id": 6, "lvl": -1, "conf": 0, "prob": 0.000020613273591152392, "type": "python" }, { "id": 7, "lvl": -1, "conf": 0, "prob": 0.000021745761841884814, "type": "python" }, { "id": 8, "lvl": -1, "conf": 0, "prob": 0.00011330842971801758, "type": "python" }, { "id": 9, "lvl": -1, "conf": 0, "prob": 0.00011628866195678711, "type": "python" }, { "id": 10, "lvl": -1, "conf": 0, "prob": 0.000031640131055610254, "type": "python" }, { "id": 12, "lvl": -1, "conf": 0, "prob": 0.000025659799575805664, "type": "php" }, { "id": 14, "lvl": -1, "conf": 0, "prob": 0.000021864971131435595, "type": "python" }, { "id": 15, "lvl": -1, "conf": 0, "prob": 0.000019858280211337842, "type": "python" }, { "id": 16, "lvl": -1, "conf": 0, "prob": 0.00001609325408935547, "type": "html" }, { "id": 17, "lvl": -1, "conf": 0, "prob": 0.000021507343262783252, "type": "html" }, { "id": 19, "lvl": -1, "conf": 0, "prob": 0.000034670036257011816, "type": "python" }, { "id": 20, "lvl": -1, "conf": 0, "prob": 0.000021566947907558642, "type": "html" }, { "id": 21, "lvl": -1, "conf": 0, "prob": 0.000022977590560913086, "type": "html" }, { "id": 23, "lvl": -1, "conf": 0, "prob": 0.00003929932790924795, "type": "javascript" }, { "id": 24, "lvl": -1, "conf": 0, "prob": 0.00002146760562027339, "type": "package.json" }, { "id": 26, "lvl": -1, "conf": 0, "prob": 0.000029742717742919922, "type": "go" }, { "id": 28, "lvl": -1, "conf": 0, "prob": 0.000018368164091953076, "type": "go" }, { "id": 31, "lvl": -1, "conf": 0, "prob": 0.00003098447996308096, "type": "python" }, { "id": 32, "lvl": -1, "conf": 0, "prob": 0.00002031525036727544, "type": "html" }, { "id": 33, "lvl": -1, "conf": 0, "prob": 0.000023076931029208936, "type": "html" }, { "id": 34, "lvl": -1, "conf": 0, "prob": 0.000021457672119140625, "type": "html" }, { "id": 36, "lvl": -1, "conf": 0, "prob": 0.000021666288375854492, "type": "python" }, { "id": 37, "lvl": -1, "conf": 0, "prob": 0.000024239221602329053, "type": "python" }, { "id": 38, "lvl": -1, "conf": 0, "prob": 0.000021298727006069385, "type": "html" }, { "id": 39, "lvl": -1, "conf": 0, "prob": 0.000023076931029208936, "type": "html" }, { "id": 40, "lvl": -1, "conf": 0, "prob": 0.000021457672119140625, "type": "html" }, { "id": 42, "lvl": -1, "conf": 0, "prob": 0.000029146671295166016, "type": "php" }, { "id": 43, "lvl": -1, "conf": 0, "prob": 0.000023583570509799756, "type": "php" }, { "id": 44, "lvl": -1, "conf": 0, "prob": 0.000024616718292236328, "type": "php" }, { "id": 46, "lvl": -1, "conf": 0, "prob": 0.00002136826515197754, "type": "html" }, { "id": 47, "lvl": -1, "conf": 0, "prob": 0.00002234180828963872, "type": "html" }, { "id": 48, "lvl": -1, "conf": 0, "prob": 0.00002260009387100581, "type": "html" }, { "id": 49, "lvl": -1, "conf": 0, "prob": 0.000024159749955288135, "type": "javascript" }, { "id": 51, "lvl": -1, "conf": 0, "prob": 0.00003560383993317373, "type": "php" }, { "id": 52, "lvl": -1, "conf": 0, "prob": 0.0005451937322504818, "type": "php" }, { "id": 55, "lvl": -1, "conf": 0, "prob": 0.000023444494217983447, "type": "python" }, { "id": 57, "lvl": -1, "conf": 0, "prob": 0.00002390146255493164, "type": "python" }, { "id": 58, "lvl": -1, "conf": 0, "prob": 0.000022103389710537158, "type": "python" }, { "id": 59, "lvl": -1, "conf": 0, "prob": 0.00021979212760925293, "type": "python" }, { "id": 60, "lvl": -1, "conf": 0, "prob": 0.00001605351826583501, "type": "python" }, { "id": 61, "lvl": -1, "conf": 0, "prob": 0.000015676021575927734, "type": "python" }, { "id": 62, "lvl": -1, "conf": 0, "prob": 0.000016748905181884766, "type": "python" }, { "id": 63, "lvl": -1, "conf": 0, "prob": 0.000019729137420654297, "type": "python" }, { "id": 64, "lvl": -1, "conf": 0, "prob": 0.000013401110663835425, "type": "registry" }, { "id": 65, "lvl": -1, "conf": 0, "prob": 0.000013401110663835425, "type": "registry" } ], "version": "v18.18", "analyzed_at": "2026-09-08T04:25:50Z" }, "path": "github.com-wectf-2020-v0.0.0-20210205182610-7448c56d2f34.zip", "raw": { "files": [ { "id": 0, "ctx": [ { "b": "p!H([6Awys2MK\u00268000000000000000002v^003UCBzb/ae[n*pflZ#qBy)fYfFUsEB$+K5e?!\u003ejfFUvpgb7Nui5ixDfFbjug=O#5hE[NPgC*:qxk8E4xkRTdwO+phUoL[kZwy#ldYndJ2m}bTeBPZFx.MjfCEX?M+4fp}y+{6!?m!RJKcjh[GT:BUkIJDTD[!Bq", "ln": 0 } ], "mol": "K(Li₂)O₂(CXe)H₆(Cm₂₈CrDb₁₁Os₄Po₄U₃)Md₄(BkInPaPt)Th", "sha": "399a3f0ac68e2f3b7f6b0555757c18d85ff84c54a9a60dfee7d051ac7c105235", "path": "github.com-wectf-2020-v0.0.0-20210205182610-7448c56d2f34.zip", "risk": 200, "size": 70897, "type": "zip", "facts": { "metrics": { "file": { "size": 70897, "entropy": 7.75 }, "binary": { "peak_region_bytes": 59392, "peak_region_entropy": 7.83 }, "archive": { "file_count": 65, "member_count": 65, "script_count": 28, "zip_bomb_ratio": 5.87, "compressed_size": 54681, "directory_count": 0, "executable_count": 0, "extra_field_size": 0, "noise_file_count": 0, "compression.ratio": 0.34, "hidden_file_count": 1, "uncompressed_size": 163058, "crc_collision_count": 0, "entry_comment_count": 0, "max_filename_length": 94, "rtlo_filename_count": 0, "format.regular_count": 65, "nested_archive_count": 0, "path_traversal_count": 0, "symlink_escape_count": 0, "security.setgid_count": 0, "security.setuid_count": 0, "security.sticky_count": 0, "double_extension_count": 0, "duplicate_member_count": 0, "security.symlink_count": 0, "unicode_filename_count": 0, "homoglyph_filename_count": 0, "security.encrypted_count": 0, "misplaced_executable_count": 0, "timing.mtime_dominant_count": 65, "timing.sentinel_mtime_count": 65, "security.world_writable_count": 0, "timing.mtime_dominant_fraction": 1, "compression.method_counts.deflate": 65 }, "consistency": { "self_dependency": 0, "unused_runtime_deps": 0 } } }, "ident": { "name": { "value": "github.com-wectf", "source": "file.basename", "verified": false }, "trust": "unsigned", "version": { "value": "2020-v0.0.0-20210205182610-7448c56d2f34", "source": "file.basename", "verified": false } }, "traits": [ { "id": "micro-behaviors/data/serialize/object::unserialize", "atk": "T1059", "mbc": "E1059", "conf": 0.65, "crit": 3, "desc": "PHP object deserialization call", "from": [ { "file": 43 } ] }, { "id": "micro-behaviors/communications/http/cookies::setcookie-call", "conf": 0.5, "crit": 3, "desc": "Sets HTTP cookie via setcookie()", "from": [ { "file": 12 } ] }, { "id": "micro-behaviors/communications/http/url/cdn::jquery-cdn-asset", "atk": "T1071.001", "mbc": "C0002", "conf": 0.82, "crit": 3, "desc": "References a jQuery CDN asset URL", "from": [ { "file": 20 } ] }, { "id": "micro-behaviors/communications/socket/receive::socket-data-transfer", "atk": "T1071", "mbc": "C0001", "conf": 0.7, "crit": 3, "desc": "Socket data transfer operations", "from": [ { "file": 57 } ], "uses": [ 54, 70 ] }, { "id": "micro-behaviors/ui/window/manage/dom::browser-location-href-assign", "conf": 0.82, "crit": 3, "desc": "Navigates via location.href assignment", "from": [ { "file": 46 } ] }, { "id": "micro-behaviors/fs/read/file::file-open-content", "atk": "T1005", "mbc": "E1005", "conf": 0.86, "crit": 2, "desc": "Opens file in default read mode" }, { "id": "micro-behaviors/data/string/conversion::python-bytes-string-conversion", "conf": 0.86, "crit": 3, "desc": "Python bytes/string encoding conversion", "from": [ { "file": 55 } ] }, { "id": "micro-behaviors/process/create/shell/local::node-exec-require-destructure-binding", "conf": 0.94, "crit": 1, "desc": "Destructures Node exec from require", "from": [ { "file": 23 } ] }, { "id": "micro-behaviors/data/db/sql::sql-insert", "conf": 0.8, "crit": 3, "desc": "Contains an SQL INSERT statement", "from": [ { "file": 42 } ] }, { "id": "micro-behaviors/process/create/subprocess::import-subprocess", "atk": "T1059.006", "mbc": "E1059.006", "conf": 0.95, "crit": 3, "desc": "Imports Python's subprocess module", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/crypto/hash/digest::sha1-php", "mbc": "C0029", "conf": 0.7, "crit": 3, "desc": "SHA1 hash computation", "from": [ { "file": 42 } ] }, { "id": "micro-behaviors/data/serialize/envelope::command-assignment-key", "conf": 0.4, "crit": 1, "desc": "Command field or assignment key", "from": [ { "file": 23 } ] }, { "id": "micro-behaviors/os/env/access::php-getenv-call", "conf": 0.85, "crit": 3, "desc": "Calls PHP getenv", "from": [ { "file": 12 } ] }, { "id": "micro-behaviors/data/encode/base64::b64encode-call", "conf": 0.9, "crit": 3, "desc": "Encodes data with Python base64.b64encode()", "from": [ { "file": 55 } ] }, { "id": "micro-behaviors/communications/http/client/resource::external-script-element-load", "conf": 0.92, "crit": 3, "desc": "Loads external script element", "from": [ { "file": 20 } ] }, { "id": "micro-behaviors/communications/http/client/xmlhttp::js-request-object-open-call", "conf": 0.88, "crit": 3, "desc": "Calls open on a JavaScript request-like object", "from": [ { "file": 49 } ] }, { "id": "micro-behaviors/communications/http/post::xhr-post-open", "atk": "T1071.001", "mbc": "C0002", "conf": 0.94, "crit": 3, "desc": "Opens an XMLHttpRequest with HTTP POST", "from": [ { "file": 49 } ] }, { "id": "micro-behaviors/communications/http/url/path::browser-page-url-href-rhs-read", "conf": 0.9, "crit": 3, "desc": "Reads location.href into another binding" }, { "id": "micro-behaviors/process/create/shell/bridge::js-exec", "atk": "T1059.007", "mbc": "C0017", "conf": 0.95, "crit": 3, "desc": "Executes a command through Node.js child_process exec", "from": [ { "file": 23 } ], "uses": [ 35, 40 ] }, { "id": "micro-behaviors/communications/http/url/scheme::cleartext-http-url-code-literal", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Code embeds cleartext HTTP URL literal", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/communications/socket/connect::socket-module-import", "atk": "T1071", "mbc": "C0001", "conf": 0.6, "crit": 3, "desc": "Imports Python's socket module", "from": [ { "file": 57 } ] }, { "id": "micro-behaviors/process/interpreter/npm::npm-script-interpreter", "atk": "T1059", "mbc": "B0030", "conf": 0.85, "crit": 3, "desc": "Package script invokes a language interpreter" }, { "id": "well-known/lib/development/selenium::python-webdriver-import", "conf": 0.9, "crit": 3, "desc": "Imports the Selenium Python WebDriver package", "from": [ { "file": 63 } ] }, { "id": "micro-behaviors/fs/read/file::file-read-content", "atk": "T1005", "mbc": "E1005", "conf": 0.6, "crit": 2, "desc": "Reads file content (Python)", "from": [ { "file": 55 } ] }, { "id": "well-known/lib/network/golang-x-net::module-import", "conf": 0.99, "crit": 3, "desc": "golang.org/x/net import path", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/process/create/subprocess::subprocess-output-options", "atk": "T1059.006", "mbc": "C0017", "conf": 0.9, "crit": 3, "desc": "Python subprocess captures output streams" }, { "id": "micro-behaviors/data/db/sqlite::go-sqlite3-driver-import", "conf": 0.9, "crit": 3, "desc": "Go SQLite3 driver import", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/data/buffer::node-buffer-from-json-stringify", "conf": 0.94, "crit": 3, "desc": "Creates Node.js Buffer from JSON serialization", "from": [ { "file": 23 } ] }, { "id": "objectives/command-and-control/infrastructure/domain/tld::free-tld", "atk": "T1071", "conf": 0.8, "crit": 4, "desc": "Free/abused top-level domain", "from": [ { "off": 90, "file": 59, "line": 6 } ], "uses": [ 93 ] }, { "id": "micro-behaviors/data/string/split::php-str-split-call", "conf": 0.9, "crit": 3, "desc": "PHP str_split string operation", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/communications/http/headers::x-forwarded-for", "atk": "T1071.001", "mbc": "C0002", "conf": 0.7, "crit": 3, "desc": "X-Forwarded-For proxy header", "from": [ { "file": 58 } ] }, { "id": "metadata/lang/source::generated-code-do-not-edit-text", "conf": 0.85, "crit": 1, "desc": "Generated code do-not-edit warning", "from": [ { "file": 28 } ] }, { "id": "micro-behaviors/data/serialize/object::serialize-symbol", "conf": 0.7, "crit": 3, "desc": "References PHP serialize() or a serialize method", "from": [ { "file": 44 } ] }, { "id": "micro-behaviors/time/sleep/interval::python-sleep-1s-plus-arg", "conf": 0.75, "crit": 1, "desc": "Python sleep waits at least one second", "from": [ { "file": 63 } ] }, { "id": "micro-behaviors/communications/http/client/xmlhttp::js-xmlhttp-open", "conf": 0.8, "crit": 3, "desc": "Opens an XMLHttpRequest connection", "from": [ { "file": 49 } ] }, { "id": "micro-behaviors/process/create/shell/bridge::child-process-exec-destructure", "atk": "T1059", "mbc": "C0017", "conf": 0.9, "crit": 3, "desc": "Destructures exec from Node.js child_process", "from": [ { "file": 23 } ] }, { "id": "micro-behaviors/communications/grpc::grpc-go-new-server", "mbc": "C0002", "conf": 0.95, "crit": 3, "desc": "gRPC NewServer call", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/communications/http/url/cdn::multiple-frontend-cdn-assets", "atk": "T1071.001", "mbc": "C0002", "conf": 0.85, "crit": 3, "desc": "References multiple public frontend CDN assets", "from": [ { "file": 20 } ], "uses": [ 2, 105, 115 ] }, { "id": "micro-behaviors/communications/http/server/request::python-route-post-method", "conf": 0.9, "crit": 3, "desc": "Python route declares POST method", "from": [ { "file": 15 } ] }, { "id": "micro-behaviors/data/db/web-storage::dom-storage-setitem", "conf": 0.9, "crit": 3, "desc": "Writes browser storage with setItem", "from": [ { "file": 49 } ] }, { "id": "micro-behaviors/process/create/shell/bridge::js-exec-call", "conf": 1.0, "crit": 1, "desc": "Calls a function named exec", "from": [ { "file": 23 } ] }, { "id": "micro-behaviors/communications/proxy/tunnel::python-socket-bidirectional-copy", "atk": "T1090,T1572", "conf": 0.94, "crit": 3, "desc": "Python sockets receive and send stream data", "from": [ { "file": 57 } ], "uses": [ 70, 110 ] }, { "id": "micro-behaviors/communications/http/request/client::http-client", "conf": 0.7, "crit": 3, "desc": "Uses common HTTP client APIs", "from": [ { "off": 423, "file": 49, "line": 12 } ], "uses": [ 72 ] }, { "id": "micro-behaviors/data/db/web-storage::dom-storage-getitem", "conf": 0.9, "crit": 3, "desc": "Reads browser storage with getItem", "from": [ { "file": 49 } ] }, { "id": "micro-behaviors/communications/http/client/response-body::response-text", "conf": 0.7, "crit": 3, "desc": "Reads an XMLHttpRequest response body", "from": [ { "file": 49 } ] }, { "id": "micro-behaviors/process/create/shell/local::node-exec-command-variable-call", "conf": 0.9, "crit": 1, "desc": "Calls exec with a command-named variable", "from": [ { "file": 23 } ] }, { "id": "micro-behaviors/time/sleep/interval::python-sleep-call", "conf": 0.65, "crit": 2, "desc": "Pauses execution with a Python sleep call", "from": [ { "file": 63 } ] }, { "id": "micro-behaviors/communications/http/header/content-type::json-header", "conf": 0.9, "crit": 3, "desc": "References HTTP Content-Type application/json", "from": [ { "file": 12 } ] }, { "id": "micro-behaviors/data/control-flow/module-exec::module-level-side-effect-call", "conf": 0.82, "crit": 3, "desc": "Python module-level function call" }, { "id": "micro-behaviors/communications/socket/listen::listen-go", "atk": "T1071", "mbc": "C0001", "conf": 0.9, "crit": 3, "desc": "Go net.Listen call", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/process/create/subprocess::popen-ast", "atk": "T1059.006", "mbc": "C0017", "conf": 0.85, "crit": 3, "desc": "Launches a process with subprocess.Popen", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/data/serialize/json::json-stringify-identifier", "conf": 0.85, "crit": 3, "desc": "Serializes an identifier as JSON", "from": [ { "file": 23 } ] }, { "id": "micro-behaviors/communications/http/server/framework::python-framework-route-call", "atk": "T1071.001", "mbc": "C0002", "conf": 0.75, "crit": 3, "desc": "Python framework route call with URL literal" }, { "id": "micro-behaviors/communications/http/post::html-form-post-method", "atk": "T1071.001", "mbc": "C0002", "conf": 0.96, "crit": 3, "desc": "HTML form declares the POST method", "from": [ { "file": 16 } ] }, { "id": "micro-behaviors/communications/socket/receive::socket-recv-call", "atk": "T1071", "mbc": "C0001", "conf": 0.7, "crit": 3, "desc": "socket.recv() call", "from": [ { "file": 57 } ] }, { "id": "micro-behaviors/communications/http/client/resource::local-script-element-load", "conf": 0.92, "crit": 3, "desc": "Loads local script element", "from": [ { "file": 46 } ] }, { "id": "micro-behaviors/communications/socket/listen::python-named-socket-listen-method", "mbc": "C0001", "conf": 0.82, "crit": 3, "desc": "Python named socket listen call", "from": [ { "file": 57 } ] }, { "id": "micro-behaviors/communications/http/form::browser-credential-post", "conf": 0.94, "crit": 3, "desc": "Browser password POST", "from": [ { "file": 17 } ], "uses": [ 53, 74 ] }, { "id": "micro-behaviors/os/env/vars/access::python-os-getenv-call", "conf": 0.92, "crit": 3, "desc": "Python reads an environment variable", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/ui/window/manage/dom::innerhtml-inline-event-handler-write", "conf": 0.9, "crit": 3, "desc": "Writes markup with an inline event handler via innerHTML", "from": [ { "off": 2466, "file": 49, "line": 67 } ], "uses": [ 114, 138 ] }, { "id": "micro-behaviors/communications/http/post::formdata-class", "atk": "T1071.001", "mbc": "C0002", "conf": 0.75, "crit": 3, "desc": "Constructs browser FormData", "from": [ { "file": 49 } ] }, { "id": "micro-behaviors/ui/window/form-input::browser-credential-field-pair", "conf": 0.95, "crit": 3, "desc": "Browser form pairs username and password fields", "from": [ { "file": 17 }, { "file": 21 }, { "file": 33 }, { "file": 39 }, { "file": 47 } ], "uses": [ 77, 99 ] }, { "id": "third_party/SigBase/WEBSHELL/PHP/OBFUSC/Encoded/Mixed/Dec/And/Hex", "conf": 0.9, "crit": 5, "desc": "PHP webshell obfuscated by encoding of mixed hex and dec" }, { "id": "micro-behaviors/communications/http/message::host-header-line-token", "conf": 0.85, "crit": 1, "desc": "HTTP Host header name token", "from": [ { "file": 58 } ] }, { "id": "micro-behaviors/data/encode/base64::import-base64", "conf": 0.9, "crit": 3, "desc": "Imports Python's base64 module", "from": [ { "file": 55 } ] }, { "id": "metadata/lang/encoded/unicode-escape::dense-php-byte-escapes", "conf": 0.96, "crit": 3, "desc": "Dense PHP byte escapes", "from": [ { "file": 52 } ] }, { "id": "micro-behaviors/ui/window/form-input::browser-password-input-markup", "conf": 0.9, "crit": 1, "desc": "HTML markup names a password input field", "from": [ { "file": 17 } ] }, { "id": "micro-behaviors/crypto/hash/digest::md5-php", "mbc": "C0029", "conf": 0.7, "crit": 3, "desc": "MD5 hash computation", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/communications/url/reference::python-comment-url-reference", "conf": 0.9, "crit": 1, "desc": "Python comment contains a URL", "from": [ { "file": 9 } ] }, { "id": "metadata/package/scripts/develop::pkg-start-script-field", "conf": 0.6, "crit": 3, "desc": "\"start\": script in package.json" }, { "id": "micro-behaviors/communications/socket/send::python-sendall", "atk": "T1071", "mbc": "C0001", "conf": 0.7, "crit": 3, "desc": "Python socket sendall() call", "from": [ { "file": 57 } ] }, { "id": "micro-behaviors/communications/grpc::grpc-go-import", "mbc": "C0002", "conf": 0.95, "crit": 3, "desc": "Imports google.golang.org/grpc package", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/communications/http/request/client::xmlhttprequest-new", "atk": "T1071.001", "mbc": "C0002", "conf": 0.94, "crit": 3, "desc": "Invokes the XMLHttpRequest constructor", "from": [ { "file": 49 } ] }, { "id": "micro-behaviors/communications/http/request/body::http-post-with-body-argument", "conf": 0.82, "crit": 3, "desc": "HTTP POST supplies a body argument" }, { "id": "micro-behaviors/ui/window/form-input::browser-credential-field-reference", "conf": 0.94, "crit": 3, "desc": "Browser password field reference", "from": [ { "file": 17 }, { "file": 21 }, { "file": 33 }, { "file": 39 }, { "file": 47 } ], "uses": [ 87 ] }, { "id": "micro-behaviors/communications/http/response-code::wire-http-200-status", "atk": "T1190", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "HTTP response line returns status 200", "from": [ { "file": 58 } ] }, { "id": "micro-behaviors/communications/grpc::grpc-go-serve", "mbc": "C0002", "conf": 0.85, "crit": 1, "desc": "gRPC Server.Serve call", "from": [ { "file": 26 } ] }, { "id": "micro-behaviors/ui/window/form-input::browser-username-input-marker", "conf": 0.9, "crit": 1, "desc": "Browser markup or selector names username input", "from": [ { "file": 17 }, { "file": 21 }, { "file": 33 }, { "file": 39 } ], "uses": [ 112 ] }, { "id": "micro-behaviors/data/encode/base64::tostring-base64", "conf": 0.8, "crit": 3, "desc": "Base64 encoding via toString (JS)", "from": [ { "file": 23 } ] }, { "id": "micro-behaviors/communications/http/message::http-message-json-call", "conf": 0.9, "crit": 3, "desc": "Calls JSON method on HTTP-style object", "from": [ { "file": 23 } ] }, { "id": "micro-behaviors/ui/window/manage/dom::browser-document-write", "conf": 0.78, "crit": 3, "desc": "Writes HTML into document", "from": [ { "file": 49 } ] }, { "id": "micro-behaviors/communications/http/request/params::get-dup", "conf": 0.85, "crit": 3, "desc": "Reads PHP query parameters via $_GET", "from": [ { "file": 12 } ] }, { "id": "micro-behaviors/communications/socket/bind/function::python-named-socket-bind-method", "mbc": "C0001", "conf": 0.82, "crit": 3, "desc": "Python named socket bind call", "from": [ { "file": 57 } ] }, { "id": "micro-behaviors/communications/http/client/xmlhttp::js-xmlhttp-send", "conf": 0.85, "crit": 3, "desc": "Sends an XMLHttpRequest", "from": [ { "file": 49 } ] }, { "id": "micro-behaviors/communications/http/response::http-204-protocol-status", "conf": 0.9, "crit": 3, "desc": "HTTP 204 No Content status line", "from": [ { "file": 58 } ] }, { "id": "micro-behaviors/os/stdio::error-reporting-off", "conf": 0.95, "crit": 3, "desc": "Disables error reporting (error_reporting(0))", "from": [ { "file": 44 } ] }, { "id": "micro-behaviors/fs/read/file::file-get-contents", "mbc": "C0051", "conf": 0.75, "crit": 2, "desc": "File read via file_get_contents", "from": [ { "file": 51 } ] }, { "id": "micro-behaviors/ui/window/manage/dom::password-input-field", "conf": 0.82, "crit": 3, "desc": "HTML password input form field", "from": [ { "file": 17 } ] }, { "id": "micro-behaviors/data/serialize/envelope::result-assignment-key", "conf": 0.4, "crit": 1, "desc": "Result field or assignment key", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/communications/http/request/params::cookie", "conf": 0.8, "crit": 3, "desc": "Reads PHP cookie data via $_COOKIE", "from": [ { "file": 12 } ] }, { "id": "micro-behaviors/communications/http/server/framework::server-python", "atk": "T1071.001", "mbc": "C0002", "conf": 0.75, "crit": 3, "desc": "Python HTTP server", "from": [ { "off": 10, "file": 15, "line": 2 }, { "off": 38, "file": 19, "line": 4 }, { "off": 34, "file": 31, "line": 4 }, { "off": 12, "file": 37, "line": 2 } ], "uses": [ 107 ] }, { "id": "micro-behaviors/communications/socket/connect::socket-accept-call--rx-1", "atk": "T1071", "mbc": "C0001", "conf": 0.7, "crit": 1, "desc": "listen_socket.accept() call", "from": [ { "file": 57 } ] }, { "id": "micro-behaviors/process/create/shell/bridge::child-process-require", "atk": "T1059", "mbc": "C0017", "conf": 0.8, "crit": 3, "desc": "Imports the Node.js child_process module", "from": [ { "file": 23 } ], "uses": [ 121, 137 ] }, { "id": "objectives/command-and-control/infrastructure/domain/tld::tld-cf", "atk": "T1071", "conf": 0.8, "crit": 4, "desc": ".cf domain (free)", "from": [ { "file": 59 } ] }, { "id": "micro-behaviors/communications/http/request/params::php-secret-request-parameter", "conf": 0.82, "crit": 3, "desc": "Reads secret PHP request parameter", "from": [ { "file": 44 } ] }, { "id": "micro-behaviors/data/control-flow/loop::js-object-key-in-loop", "conf": 0.9, "crit": 3, "desc": "JavaScript iterates enumerable object keys", "from": [ { "file": 49 } ] }, { "id": "micro-behaviors/communications/http/request/params::request-param-assignment", "conf": 0.8, "crit": 3, "desc": "PHP request data assigned to variable", "from": [ { "file": 44 } ] }, { "id": "micro-behaviors/data/db/web-storage::dom-storage-setitem-call", "conf": 0.9, "crit": 3, "desc": "Calls localStorage or sessionStorage setItem", "from": [ { "file": 49 } ] }, { "id": "micro-behaviors/communications/http/message::user-agent-header-line-token", "conf": 0.85, "crit": 1, "desc": "HTTP User-Agent header name token", "from": [ { "file": 58 } ] }, { "id": "micro-behaviors/ui/window/form-input::browser-password-input-marker", "conf": 0.9, "crit": 1, "desc": "Browser markup names a password input field", "from": [ { "file": 17 }, { "file": 21 }, { "file": 33 }, { "file": 39 }, { "file": 47 } ], "uses": [ 66 ] }, { "id": "metadata/package/manifest/freeform::pkg-skeleton-small", "conf": 0.7, "crit": 3, "desc": "Tiny package.json manifest", "from": [ { "file": 24 } ] }, { "id": "micro-behaviors/data/serialize/json::php-json-encode", "conf": 0.86, "crit": 3, "desc": "PHP JSON serialization", "from": [ { "file": 12 } ] }, { "id": "micro-behaviors/os/env/vars/credentials::admin-password", "conf": 0.7, "crit": 3, "desc": "ADMIN_PASSWORD environment variable", "from": [ { "file": 14 } ] }, { "id": "micro-behaviors/communications/http/server/route::app-router-get-endpoint", "atk": "T1071.001", "mbc": "C0002", "conf": 0.78, "crit": 3, "desc": "App or router GET route definition", "from": [ { "file": 23 } ] }, { "id": "metadata/lang/source::generated-do-not-edit-text", "conf": 0.85, "crit": 1, "desc": "Generated source warning text", "from": [ { "file": 28 } ], "uses": [ 31 ] }, { "id": "micro-behaviors/communications/http/url/cdn::cdnjs-asset", "atk": "T1071.001", "mbc": "C0002", "conf": 0.82, "crit": 3, "desc": "References a cdnjs frontend asset URL", "from": [ { "file": 20 } ] }, { "id": "micro-behaviors/data/db/web-storage::browser-storage-persistence", "conf": 0.8, "crit": 3, "desc": "Persists data in browser storage", "from": [ { "off": 250, "file": 49, "line": 6 } ], "uses": [ 39, 43 ] }, { "id": "micro-behaviors/communications/http/server/framework::flask-framework", "atk": "T1071.001", "mbc": "C0002", "conf": 1.0, "crit": 3, "desc": "Flask web framework usage", "from": [ { "off": 1441, "file": 15, "line": 47 }, { "off": 5619, "file": 19, "line": 206 }, { "off": 3662, "file": 31, "line": 144 }, { "off": 1455, "file": 37, "line": 44 } ], "uses": [ 52, 108 ] }, { "id": "micro-behaviors/communications/http/server/framework::flask-import", "atk": "T1071.001", "mbc": "C0002", "conf": 0.7, "crit": 3, "desc": "Flask framework import", "from": [ { "file": 15 } ] }, { "id": "micro-behaviors/communications/http/server/framework::server-express", "atk": "T1071.001", "mbc": "C0002", "conf": 0.66, "crit": 3, "desc": "Express.js HTTP server", "from": [ { "file": 23 } ] }, { "id": "micro-behaviors/communications/socket/receive::socket-receive", "atk": "T1071", "mbc": "C0001", "conf": 0.85, "crit": 3, "desc": "Python receives data from a socket", "from": [ { "file": 57 } ], "uses": [ 54 ] }, { "id": "objectives/execution/exploit/chain::script-content-field", "atk": "T1189,T1059.007,T1505.003", "mbc": "E1059", "conf": 0.97, "crit": 4, "desc": "JSON content field contains script tag", "from": [ { "file": 8 } ] }, { "id": "micro-behaviors/ui/window/form-input::username-name-input-markup", "conf": 0.9, "crit": 1, "desc": "HTML input names username or email", "from": [ { "file": 17 } ] }, { "id": "micro-behaviors/communications/http/request/params::php-post-password-field", "conf": 0.9, "crit": 3, "desc": "Reads password field from PHP $_POST", "from": [ { "file": 44 } ] }, { "id": "micro-behaviors/ui/window/manage/html::html-active-handler-marker", "conf": 0.95, "crit": 3, "desc": "HTML contains an inline event handler", "from": [ { "file": 49 } ] }, { "id": "micro-behaviors/communications/http/url/cdn::unpkg-asset", "atk": "T1071.001", "mbc": "C0002", "conf": 0.82, "crit": 3, "desc": "References an unpkg frontend asset URL", "from": [ { "file": 32 } ] }, { "id": "micro-behaviors/communications/http/request/params::php-key-request-parameter", "conf": 0.82, "crit": 3, "desc": "Reads key PHP request parameter", "from": [ { "file": 44 } ] }, { "id": "micro-behaviors/process/create/shell/local::node-exec-command-variable", "atk": "T1059.007", "mbc": "C0017", "conf": 0.94, "crit": 3, "desc": "Node child_process exec receives a command-named variable", "from": [ { "file": 23 } ], "uses": [ 45, 130 ] }, { "id": "micro-behaviors/communications/http/request/params::post-dup", "conf": 0.85, "crit": 3, "desc": "Reads PHP form parameters via $_POST", "from": [ { "file": 44 } ] }, { "id": "micro-behaviors/data/db/web-storage::dom-storage-getitem-call", "conf": 0.9, "crit": 3, "desc": "Calls localStorage or sessionStorage getItem", "from": [ { "file": 49 } ] }, { "id": "micro-behaviors/communications/http/post::xhr-post-open-send", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Opens and sends an XMLHttpRequest POST", "from": [ { "file": 49 } ] }, { "id": "micro-behaviors/process/create/shell/bridge::child-process-destructure-require", "atk": "T1059", "mbc": "C0017", "conf": 0.85, "crit": 3, "desc": "Destructures APIs from Node.js child_process", "from": [ { "file": 23 } ] }, { "id": "micro-behaviors/communications/grpc::grpc-go-server", "mbc": "C0002", "conf": 0.95, "crit": 3, "desc": "Go process is a gRPC server", "from": [ { "off": 117, "file": 26, "line": 8 }, { "off": 181, "file": 28, "line": 10 } ], "uses": [ 36, 71, 76 ] }, { "id": "micro-behaviors/communications/http/message::host-user-agent-header-pair", "conf": 0.94, "crit": 3, "desc": "Co-located Host and User-Agent headers", "from": [ { "file": 58 } ], "uses": [ 63, 98 ] }, { "id": "micro-behaviors/communications/http/url/fragment::location-hash-read", "conf": 0.85, "crit": 3, "desc": "Reads the URL fragment from location.hash", "from": [ { "file": 48 } ] }, { "id": "micro-behaviors/os/stdio::error-suppress-prefix", "conf": 0.7, "crit": 3, "desc": "Suppresses errors with the PHP @ operator" }, { "id": "micro-behaviors/communications/http/response::server-response-send-end", "mbc": "C0002", "conf": 0.88, "crit": 3, "desc": "Calls server response send/end method", "from": [ { "file": 23 } ] }, { "id": "objectives/command-and-control/infrastructure/domain/tld::suspicious-tld", "atk": "T1071", "conf": 0.75, "crit": 3, "desc": "Suspicious top-level domain", "from": [ { "file": 59 } ], "uses": [ 28 ] }, { "id": "metadata/build/artifact::go-generated-source-header", "conf": 0.97, "crit": 3, "desc": "Go generated-code header comment", "from": [ { "file": 28 } ] }, { "id": "micro-behaviors/process/create/subprocess::process-execution", "atk": "T1059.006", "conf": 0.8, "crit": 3, "desc": "Python launches a child process", "from": [ { "file": 9 } ], "uses": [ 50 ] }, { "id": "micro-behaviors/process/create/shell/local::node-exec-child-process-binding", "conf": 0.94, "crit": 1, "desc": "Binds Node child_process exec", "from": [ { "file": 23 } ], "uses": [ 7 ] }, { "id": "micro-behaviors/communications/http/request/params::php-token-request-parameter", "conf": 0.86, "crit": 3, "desc": "Reads token PHP request parameter", "from": [ { "file": 12 } ] }, { "id": "micro-behaviors/communications/socket/connect::socket-accept-call", "atk": "T1071", "mbc": "C0001", "conf": 0.7, "crit": 3, "desc": "socket.accept() call", "from": [ { "file": 57 } ], "uses": [ 91 ] }, { "id": "micro-behaviors/communications/socket/connect::socket-socket-call", "atk": "T1071", "mbc": "C0001", "conf": 0.7, "crit": 3, "desc": "socket.socket() call", "from": [ { "file": 57 } ] }, { "id": "micro-behaviors/os/stdio::php-echo-statement", "conf": 0.95, "crit": 3, "desc": "Emits data with a PHP echo statement" }, { "id": "micro-behaviors/communications/http/lib/requests::imports-requests", "conf": 0.95, "crit": 3, "desc": "Imports the requests HTTP client for Python", "from": [ { "file": 4 } ] }, { "id": "micro-behaviors/data/db/sql::sql-select", "conf": 0.6, "crit": 3, "desc": "SQL SELECT syntax reference", "from": [ { "file": 42 } ] }, { "id": "metadata/import/builtin::require-child-process", "conf": 0.8, "crit": 3, "desc": "require() of the child_process module", "from": [ { "file": 23 } ] }, { "id": "micro-behaviors/ui/window/manage/dom::browser-innerhtml-assignment", "conf": 0.8, "crit": 3, "desc": "Writes HTML into the DOM with innerHTML" } ] }, { "ctx": [ { "b": "w].*baAz4kB.bSoB0bglAbP=sasWZ93s)ZWay]52z^NM%vrb\u003c\u003ec$)KuBsxlTarR^HA+frmy\u0026*^.azkncc$TVpBAzE.fe3*NA:\u003c5$e{?nIB98*-kw\u003e4zwnC*uCv-advpKy[z/dZVwNPQ?xKtB{zepyBe[n*qBy/ui3lQDlazCBgvJ){QBAhqqxfHJJjtg+$A=k\u0026dj%za!z/^aozxJ$hB9hqviTM#LarR^HarUYoBAIRwattt?b12^RzF%RtB7F^2v}V#jCv-cAw]zYjwmYQ@a{]CnarUYoB9hqvauZ\u0026WwPPtjb4#7uA5]T9v@Dx%A:ZOExM4%lEj)*5wO2y*wJ+lGcspg\u003eBzkVhj-+gyA:@=\u0026yiarha$kcVB8L}AdgdguarUxgaAz4mB.(e7b64moB.(dzu0x0*ar-(\u003cb0o{*A=k\u0026dk6HN2flqkQz/fhKDT{Y8z!r/]xmh)KAY$Wd3lQDlarR^HaAz4nB-IvxfF1s\u003cs8@j%xco!", "ln": 0, "col": 1, "line": 1 }, { "b": "vrcx%C{avOzF%Rtx(k5lwPJ0gBuf:KarR^HarR!EwPS6nzxHR:ar\u003cfYzF\u003cxmayYRnvrlGjlR*PDazCZovpTj?zxJ!mwmV}(arR^HA+funA=90OefDbX3jmbfrzC[XnL-8WauZ\u0026Kw]7)*uVP^!A:@=lay]52z^NM%vrb\u003c\u003et)Z]", "ln": 1464, "col": 59, "line": 28 } ], "depth": 1, "facts": { "imp": [ [ "", "get" ], [ "", "get.json" ], [ "", "get" ], [ "", "get" ], [ "", "get" ], [ "", "get.json" ], [ "", "get" ], [ "", "len" ], [ "", "get" ], [ "", "requests" ] ], "mbr": [ "get.content", "get.json", "result.result" ], "tgt": [ "get", "get.json", "len" ], "funcs": [ [ "demo_search", 25 ], [ "flag_search", 653 ] ], "metrics": { "ast": { "op.lor": 1, "max_depth": 12, "call_count": 9, "node_count": 394, "member_count": 3, "max_array_len": 2, "op_density.lor": 0, "member_depth_max": 2 }, "file": { "size": 1599, "entropy": 5.06 }, "text": { "lines": 34, "top_char": 101, "max_ws_run": 2, "digit_ratio": 0.06, "space_count": 246, "char_entropy": 5.06, "unique_chars": 73, "top_char_null": 0, "string_density": 0.76, "top_char_ratio": 0.08, "avg_line_length": 46.03, "max_line_length": 117, "empty_line_ratio": 0.21, "last_line_length": 38, "whitespace_ratio": 0.18, "identifier_density": 1.38, "line_length_stddev": 34.38, "normalized_string_count": 4.46, "repeated_char_sequences": 2, "normalized_unique_identifiers": 2.36 }, "binds": { "count": 8 }, "binary": { "peak_region_bytes": 1599, "peak_region_entropy": 5.15 }, "source": { "function_count": 2 }, "imports": { "count": 1, "third_party_count": 1, "third_party_ratio": 1 }, "strings": { "bytes": 858, "count": 26, "url_count": 6, "avg_length": 33, "max_length": 79, "avg_entropy": 3.88, "empty_count": 2, "entropy_stddev": 0.73 }, "functions": { "count": 2, "density": 5.88, "avg_params": 1, "code_ratio": 0.74, "max_params": 1, "length_stddev": 1.5, "avg_name_length": 11, "avg_length_lines": 12.5, "max_length_lines": 14, "min_length_lines": 11, "avg_param_name_length": 4 }, "identifiers": { "count": 47, "unique": 12, "avg_length": 6.58, "max_length": 11, "min_length": 3, "avg_entropy": 2.4, "reuse_ratio": 0.26, "length_stddev": 2.69, "all_lowercase_ratio": 0.92, "all_uppercase_ratio": 0.08 } } }, "id": 4, "mol": "H₂(Cm₂Os)", "path": "github.com-wectf-2020-v0.0.0-20210205182610-7448c56d2f34.zip!!github.com/wectf/2020@v0.0.0-20210205182610-7448c56d2f34/checkers/corbra.py", "pid": 0, "risk": 2, "sha": "2b32b9cbecee72e476ffd5752d55f85dbe897ac22db90b45f19a131484546488", "size": 1599, "traits": [ { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "spans": [ [ 212, 0 ] ] }, { "id": "micro-behaviors/data/serialize/envelope::result-assignment-key", "conf": 0.4, "crit": 1, "desc": "Result field or assignment key", "spans": [ [ 166, 0 ] ] }, { "id": "micro-behaviors/os/privilege/check::source-privileged-account-reference", "conf": 0.86, "crit": 3, "desc": "Source references a privileged account", "spans": [ [ 1528, 5 ] ] }, { "id": "micro-behaviors/communications/http/lib/requests::imports-requests", "conf": 0.95, "crit": 3, "desc": "Imports the requests HTTP client for Python", "spans": [ [ 0, 14 ] ] }, { "id": "micro-behaviors/communications/http/url/scheme::cleartext-http-url-code-literal", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Code embeds cleartext HTTP URL literal", "spans": [ [ 67, 14 ] ] } ], "type": "python" }, { "id": 5, "mol": "H(Cm₃)", "sha": "3cdca317a0fbc4a4dc13b8204273aa53f91169faa117a8c8af43ef26ff125687", "path": "github.com-wectf-2020-v0.0.0-20210205182610-7448c56d2f34.zip!!github.com/wectf/2020@v0.0.0-20210205182610-7448c56d2f34/checkers/customer.py", "risk": 1, "size": 1029, "type": "python", "depth": 1 }, { "id": 6, "mol": "H(Cm₃)", "sha": "a9df34a8daf50adf0820def387c0d6daa58f1bf2ac924a643f0867385ac1cefc", "path": "github.com-wectf-2020-v0.0.0-20210205182610-7448c56d2f34.zip!!github.com/wectf/2020@v0.0.0-20210205182610-7448c56d2f34/checkers/faster.py", "risk": 1, "size": 1192, "type": "python", "depth": 1 }, { "id": 7, "mol": "H(Cm₃)", "sha": "ece2ca999a088d070c0100a06407b286587a237251c86cef2847e14e56b79e43", "path": "github.com-wectf-2020-v0.0.0-20210205182610-7448c56d2f34.zip!!github.com/wectf/2020@v0.0.0-20210205182610-7448c56d2f34/checkers/na1.py", "risk": 1, "size": 826, "type": "python", "depth": 1 }, { "ctx": [ { "b": "w].*baAz4kB.bSoB0bglAbP=sasW.jze:AlBrCZFx(4?$x(d*cA=-BAwEn=Yvru0)uUK4(auZ\u0026/wIdFhze:i9wHF:oA+e\u0026CtP$?sz//Lzc[W2mdo[5Xa$i\u003cawmYu}v}YB-yBA\u003emB95\u0026(3lQDlaAFU*aAIanB7]Mgc[bGCarR^KaAz4a3lQDlaAz4mB.(dxjS[!#AbP/tc$TVpBAzE.fe4iKga)]!z/Z2GfcR}\u0026wmoN*j:NIUarR^HarR^JB-RbmzEEx[b03\u0026?BzkMje]\u003exrwn=r-BAh8kxdbhW3lQDlarR^Har\u003e=kB8#LzA+3vPar\u0026*+mSJGomr@rOB3\u003czBvN\u003c\u003czr3zU(arR!Pdk2aGzGGDcBp6ckarUxgayVJ@wO+\u003c{zdK\u0026izY\u0026$vAV/BCAaK5wwoz\u003c5AXg*AAaK5jB75V(az#atwGUA2A3lzFzF%Rtx(k5lwPJ0gBuf:KarR^HarR!EwPS6nzxHR:ar\u003co-x(4u\u003eaARJAy\u0026r%2zxYz{arR^HboQA9wft=dBy+!4arR!EwPJ0gBrAZ?B1RAIB95*xb4#7uA5]T9zECpMDUvtsBBt/JwmP4+z//LmefFFiByvsV3lQDlarR^Har\u003erlzGGDcBrS:*b0o{RA+PGmk4ensA=-Y:dlGn8v@=p5BuQ)13lQDlarR^Har(5KA+lHRaAGeBz/oA9wPGFpwPPsABz\u003e@azxZIparR^HEjl^Uz/fVdzGDjdarR!vw/$Lbph+k=aw1%Zar?}Cz/^aozxJ$hB9hqviTM#LarR^HarUYoBAIRwattt?b3e/6zF78jwPJ0gBrCHlayO!\u003eaz#atwG?D*arR^HboR8tB95KHB8}WharR!Az//L$x\u003eetHaz\u003eLev}Yj-", "ln": 0, "col": 1, "line": 1 }, { "b": "Bsn\u003c)jtg+=A+PGmj%za!z/^aozxJ$hB9hqviTM#LarR^HarUYoBAIRwattt?b12^RzF%RtBAh8dxjV9asw@cx3jm)#arR)KBy/Jnaz+$ez/{dearR^HB1RAIB95*xb4#7uA5]T9zECpMDUvtsBBt/Uz!B0hBrSdv3lQDlazCBgb6m:swO@Xmx(k5me[n*ryIvv3iTM#LarR^HarUYoBAIRwattt?b1#]/z/{dAw)]y\u0026wN($(3lQDlar@1JwPI@ovpTj?zvdHearUYoB9hqvauZ\u0026*e]U-IBsp-BxMOuniXJd7vkoDZxM4%lEj(=}ay[]5vlF@AarR^HarR^Hb6v%rA=br5wG\u003ceTb4k20x(kaC3lQDlarR^Har\u003e=kB8#LzA+3vPar\u003cH0bt?0azG6(phD.K.t{oQ#arR!Pdk2aGzGGDcBp5u$arR^KayO!$x(k59y**@-arR^HA+frmy\u0026*^.aAGeFwPPtjb4#7uA5]T9zECpMDUvtsBBt/Wz//Lzf^n50v@DmbwO#O%arR^Hx\u003ewF%cWfcGw\u0026RU7i5Uh2eI}60ga+srvM2!$wmEOJfF\u0026", "ln": 804, "col": 22, "line": 28 } ], "depth": 1, "facts": { "imp": [ [ "", "re.compile" ], [ "", "session" ], [ "", "s.post" ], [ "", "utils.randomString" ], [ "", "s.post" ], [ "", "s.cookies.get" ], [ "", "match_ids.findall" ], [ "", "str" ], [ "", "s.get" ], [ "", "s.post" ], [ "", "s.post" ], [ "", "s.get" ], [ "", "print" ], [ "", "check" ], [ "", "re" ], [ "", "requests" ], [ "", "utils" ] ], "mbr": [ "match_ids.findall", "re.compile", "s.cookies", "s.cookies.get", "s.get", "s.get.content", "s.post", "s.post.content", "utils.randomString" ], "tgt": [ "check", "match_ids.findall", "print", "re.compile", "s.cookies.get", "s.get", "s.post", "session", "str", "utils.randomString" ], "funcs": [ [ "check", 96 ] ], "metrics": { "ast": { "max_depth": 14, "call_count": 14, "node_count": 474, "member_count": 9, "max_array_len": 1, "member_depth_max": 3 }, "file": { "size": 1444, "entropy": 4.93 }, "text": { "lines": 51, "top_char": 116, "max_ws_run": 1, "digit_ratio": 0.05, "space_count": 282, "char_entropy": 4.93, "unique_chars": 79, "top_char_null": 0, "string_density": 0.61, "top_char_ratio": 0.07, "avg_line_length": 27.33, "max_line_length": 92, "empty_line_ratio": 0.18, "last_line_length": 27, "whitespace_ratio": 0.23, "identifier_density": 1.24, "line_length_stddev": 20.96, "normalized_string_count": 4.34, "suspicious_string_ratio": 0.06, "suspicious_identifier_ratio": 0.05, "normalized_unique_identifiers": 3.88 }, "binds": { "count": 9 }, "binary": { "peak_region_bytes": 420, "peak_region_entropy": 5.24 }, "source": { "function_count": 1 }, "imports": { "count": 3, "stdlib_count": 1, "stdlib_ratio": 0.33, "third_party_count": 2, "third_party_ratio": 0.67 }, "strings": { "bytes": 529, "count": 31, "url_count": 6, "avg_length": 17.06, "max_length": 67, "avg_entropy": 3.24, "empty_count": 1, "entropy_stddev": 0.68, "embedded_code_candidates": 2 }, "comments": { "chars": 56, "count": 6, "lines": 6, "to_code_ratio": 0.13 }, "functions": { "count": 1, "density": 1.96, "avg_params": 1, "code_ratio": 0.8, "max_params": 1, "avg_name_length": 5, "avg_length_lines": 41, "max_length_lines": 41, "min_length_lines": 41, "avg_param_name_length": 4 }, "identifiers": { "count": 63, "unique": 22, "avg_length": 5.91, "max_length": 12, "min_length": 1, "avg_entropy": 2.17, "reuse_ratio": 0.35, "length_stddev": 2.54, "sequential_names": 1, "single_char_count": 1, "single_char_ratio": 0.05, "all_lowercase_ratio": 0.91, "all_uppercase_ratio": 0.05, "double_underscore_count": 1, "underscore_prefix_count": 1 } } }, "id": 8, "mol": "O₄(XeCEuS)H₃(Cm₄Db₂Os₂)Md(Pa)", "path": "github.com-wectf-2020-v0.0.0-20210205182610-7448c56d2f34.zip!!github.com/wectf/2020@v0.0.0-20210205182610-7448c56d2f34/checkers/na2.py", "pid": 0, "risk": 47, "sha": "3f1d1ad16ab8237a15db3097b58ed546948e65ee4ea4edc6a6d851c7256e5221", "size": 1444, "traits": [ { "id": "metadata/package/testing/corpus::xss-category-label", "conf": 0.9, "crit": 3, "desc": "XSS attack category label", "spans": [ [ 868, 3 ] ] }, { "id": "micro-behaviors/communications/http/request/body::http-post-with-body-argument", "conf": 0.82, "crit": 3, "desc": "HTTP POST supplies a body argument", "spans": [ [ 154, 103 ], [ 428, 103 ], [ 1027, 103 ] ] }, { "id": "micro-behaviors/communications/http/request/client::py-post-generic", "conf": 0.8, "crit": 3, "desc": "Python post method call", "spans": [ [ 154, 6 ] ] }, { "id": "micro-behaviors/data/db/schema/relational::account-handle-field", "conf": 0.8, "crit": 3, "desc": "Account handle field name", "spans": [ [ 199, 10 ] ] }, { "id": "micro-behaviors/data/serialize/envelope::result-assignment-key", "conf": 0.4, "crit": 1, "desc": "Result field or assignment key", "spans": [ [ 355, 0 ] ] }, { "id": "micro-behaviors/data/serialize/schema-object::content-object-field", "conf": 0.8, "crit": 3, "desc": "JSON content object field", "spans": [ [ 481, 10 ] ] }, { "id": "micro-behaviors/data/serialize/schema-object::user-field-key", "conf": 0.9, "crit": 3, "desc": "JSON-like user identity field", "spans": [ [ 199, 11 ] ] }, { "id": "micro-behaviors/os/env/secret-name::python-environ-items-password-marker", "conf": 0.92, "crit": 3, "desc": "Password marker string literal", "spans": [ [ 242, 8 ] ] }, { "id": "micro-behaviors/os/privilege/check::source-privileged-account-reference", "conf": 0.86, "crit": 3, "desc": "Source references a privileged account", "spans": [ [ 1008, 5 ] ] }, { "id": "objectives/command-and-control/infrastructure/tracking::username-field", "conf": 0.7, "crit": 3, "desc": "Username tracking field", "spans": [ [ 199, 11 ] ] }, { "id": "objectives/exfiltration/oob/system-profile::python-user-path-profile-fields", "atk": "T1041", "mbc": "E1041", "conf": 0.88, "crit": 3, "desc": "Python user path profile fields", "spans": [ [ 199, 11 ] ] }, { "id": "objectives/supply-chain/recon-exfil/agent-skill::proxy-password-field", "atk": "T1195.002", "conf": 0.96, "crit": 3, "desc": "Password field marker for proxy use", "spans": [ [ 241, 11 ] ] }, { "id": "micro-behaviors/communications/http/lib/requests::imports-requests", "conf": 0.95, "crit": 3, "desc": "Imports the requests HTTP client for Python", "spans": [ [ 0, 14 ] ] }, { "id": "micro-behaviors/communications/http/url/scheme::cleartext-http-url-code-literal", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Code embeds cleartext HTTP URL literal", "spans": [ [ 163, 11 ] ] }, { "id": "objectives/execution/exploit/chain::script-content-field", "atk": "T1189,T1059.007,T1505.003", "mbc": "E1059", "conf": 0.97, "crit": 4, "desc": "JSON content field contains script tag", "spans": [ [ 481, 19 ] ] } ], "type": "python" }, { "ctx": [ { "b": "x(d*cA=-BBBZ/rgz!0v1A%-m^A=k!qA+flkwPI%mazCXiz/P}xdHG)bAbP=saA.^uy\u0026Y}$ze:AlBrCQn3jmbJwO95{xK$W?c$)KuBsxlTarR^HB09Q*B7GAlx(v(qdgdguarR)KA+e\u003e\u003carR^HB-5r+aA.^uy\u0026.jHvqYQ]zbUK%x(mMidgdguarUYoB9hqvauZ\u0026*e]U-IBsp-BxMOuniXJd7vkxJ.xM4%lEj]2Fx!HUYay[]5vlF@AarR^HarR^Hb4j#6x(v(kiV]R!wOkZ#By/Fped9HxarR^HarR\u003eJB7GxfvqPN1iV@M.ed9HxarR^HarR\u003eEvrlHlz/PwjiV]RbA7j\u003e/lQ=oexlcBHvpz-nzb.X^arR^HEjl^-B8L}AdgdguarUxgaAz4mB.(e7b64moB.(dzt{9\u003c5awM\u0026)wGU]iaz+Rbc#@)uB.(e7b64moB.(dzt}3)UatCMh3lQDlarR^HaAz4nB-IvxfF1s\u003cmQZ1EwN({9zY\u0026\u0026", "ln": 0, "col": 1, "line": 1 }, { "b": "3lQDlaA.:pA:J{byH}xajS[=RB9hqvtoX90B9hqvb3+J.arR^HboQA9wft=dBy+!4arR!EwPJ0gBrAZ?B1RAIB95*xb4#7uA5]T9zECsNDUvtsBBt/JAa{%HefFFiByvsV3lQDlarR^Har\u003el7BzkVhb03?\u003cvpS[QzF%Sda$K6zarR^HarR^JB-Rbmb03\u0026?B7Gx0Bz\u003e@azy=bqarR^HarR^Jv@DmbwO#PliV]R\u003eCZaDS3lQDlaBLW\u003ev@DmbwO#O%3lQDlaAz4mB.(dxjS[!#AbP/tc$TVpBAzE.fe4iKgCj2/z/Z2Gfjw*lfcR}\u0026wmoN*j:NIUarR^HarR^JvpKy[z/c:War\u003e@HwPzc}z//Mia$K6zarR^HarR^JB-Rbmb03\u0026?B7Gx0Bz\u003e@azy=bqarR!Pdk2vRz/c%L3jm)#arUxgaAz4mB.(e7b6d)pv}x.5b3=s1zE:(awO@]pwPJ0gBxY@fwPJ0gBrU0tau?}hf^6[xwft]7B9hqvtoX90B9hqvb3!zbu0wH.z/fVdzGE7dau.\u003egb6XuSCP]fQarR^HarR^HAa9*e3lQDlaz2wgwJx", "ln": 423, "col": 55, "line": 18 }, { "b": "arR^HaAz4nB-IvxfF1s\u003cmQZ1EwN({9zY\u0026LgwNPW(az#atwG?D*arR^HboQMxAboDbBp6ckarUPBBrAZ?B9g@hA=kD0B8@%gz/xo9c%E)mxMbdDar\u003eYigCiSWA3u?QB-7Fo3lQDlarR^HarR^HarR^HarR^HarR^HarR^HB97@hB-Y=/BZ/rgz!0v1B1QoXp^(]xarR^HarR^HarR^HarR^HarR^HarR^HarR!FByX%6AY[F^vSlvav}x.5e(L.qpGpvy3lQDlaAITnz/{dMaAITnwPz/ljS[V=Bs}6wzeBAkx\u003e7N[wHF#marR^HAb]VgBsqiLwn=QjdgdguarUYoB9hqvauZ\u0026*e]U-IBsp-BxMOuniXJd7vkxJ.xM4%lEj]2Fx!HUYay[]5vlF@AarR^HarR^Hb4j#6x(v(kiV]R?B7Gx0zF%SdB0rdxarR^HarR^Hb6v%rAW0K!B97@hB-YewarR^HEjl^Uz/fVdzGDi)arR^HA+frmy\u0026*^.aAGeOz/Z1Gw*g]gBz%n]fk+hOe{?nIB98*-vq]{la$K\u003cEvrt{vDKp(rarR^HarR\u003epv@#B6zx.a:b6v%rA:JZ5By/Iqed9HxarR^HarR\u003eJB7GwoiV@M^wPzd1z!\u0026{4ed9HxarQ", "ln": 885, "col": 4, "line": 36 }, { "b": "y\u0026*\u003ebdiH/qatL6FzE:\u003e{3lQDlarR^HarR^HaAz4mB.(e7b64moB.(dzu0x3?toWM}zGGDcBrU0kjV%]ijzwUBaAINkjTUF4aA8deA=M8sjTTVOwPz(vf!1Flb035NarR^HarR!CvrlF%arR^HwO=B0iTM#LarR^HarUYoBAIRwattt?b1u0Py?mc1Bz\u0026pkCYmFqx(\u003eKaarR^HBz\u003e@azxI7+A+frmy\u0026\u0026(9A+frmy\u0026*\u003ebtqoz/b6m:swO@X$3lQDlaAz4mB.(dxjS[!#AbP/tc$TVpBAzE.fe4iKgCj2/z/Z2Gfjw*lfcR}\u0026wmoN*j:NIUarR^HarR^JvpKy[z/c:War\u003eDfBye{7By=TE3lQDlarR^Har\u003e@HwPw$QaA.:pA:J{byH}xm3lQDlarR^Har\u003e]CyH}xciV@J.yH}w\u003carR^HEjl^-B8L}AdgdguarUxgaAz4mB.(e7b6d)pv}x.5b3=s1zE:(gwPJ0gBxY@fwPJ0gBrU0{b4CLeBy/uib3=rOjS\u003e}hx(dG9B8\u003e+NcWm0Yz/fcbA=k$YcT*?5A=-Y:djmq6iS", "ln": 1450, "col": 46, "line": 53 }, { "b": "3lQDlaz2wgwJyevarR^HarR!EwPS6nzxHR:ar\u003co-x(4u\u003eaARJAxjVfczF%Sda{[V1arR!EwPJ0gBrAZ?B1RAIB95*xb4#7uA5]T9zECsNDUvtsBBt/JAa{%HefFFiByvsV3lQDlarR^Har\u003el7BzkVhb03?\u003cxjVf(zF%Sda$K6zarR^HarR^JB-Rbmb03?\u003cf!$Keed9HxarR^HarR\u003eIz!\u0026{4b03\u0026*z!\u0026{43lQDlaBLW\u003eyiarhc[bGCarR!vw/#b9B9hqvtoXchv}f7\u003eB0s)jvqYP#A+frmy\u0026\u0026(9A+frmy\u0026*\u003ebtoWM}zGGDcBrU0kjV%]ijzwUBaAINkjTUF4aA8deA=M8sjTTVOwPz(vf!1Flb035NarR^", "ln": 1908, "col": 13, "line": 65 }, { "b": "arR^HwO=B0iTM#LarR^HarUYoBAIRwattt?b1u0Py?mc1Bz\u0026pmwPP5jz//Lkw]zYjvqZ13D2mFxB0p}#arR^HboQA9wft=dBy+!4arR^KaAhvnzGEpFe[n*ryIvv3e[X:qc)A+KyH}xcdjCPDarR^KaAz4mB.(dxjS[!#AbP/tc$TVpBAzE.fe4iKga)]!z/Z2Gfjwy4uV6!7wG\u0026VFwmoN*j:NIUarR^KarR^Har\u003erlzGGDcBrS:*b0o{RA+PGmk4ensA=-Y:dlGn8v@=p5BuQ)13lQDlar@0KarR^JCYN[qb03\u0026/e[n*ryIvv3e[X:qc)A+KyH}xcdgdguarR)KEjl^Uz/fVdzGDjdarR^KaAhvnzGEpEwPJ0gBsvLtarR^KazCBgvJ[M=By=N^l](Cmaz#atazCZoA+frmy\u0026?YBarR^HboO9KarUYoBAIRwattt?b3e/6zF78jwPJ0gBrCHlayO!\u003eaz#atwG?E7arR^K3lQDlar@0NaARgoBrC*HA%:3jarR)KzF%SduUK3[jS[PIByO#\u003ex\u003ehoqw[=c[vqG:dB98BJA+frmy\u0026?9Ptqfs\u0026arR^HboR2rB9hqvauZ\u0026*e[X:qc$TVpBAzE.fe4iKga)]!z/Z2Gfk+YIwInyFz//L$x\u003ehSodk2aGzGGDcBp6ckarR)KAb]VgBsq3BBy!/[wgm\u003cdarR^KazCBgvJ){Qv@=p5BuTbHwPz(vf!2jrB7ol8Acan/az#atazCZoA+frmy\u0026?YBarR^HboO9KarUYoBAIRwattt?b12^RzF%RtBAh8dxjV9asw@cx3lQDlar}joarR^Kar@1JwPI@oy\u0026r%8B-W%karR^KaAGeOz/Z1Gw*g]gBz%n]fk+hNe{?nIB98*-y\u0026r%8B-X/R3lQDlar}joarR^KazCBgb6m:swO@Xmx(k5me[n*ryIvv3iTM#LarR)KarR^HA+funA=90NefDcgz!B0hBrCg7x(4u\u003ea{]CnarR)oarR^HboOiNBy/JnayO!$x(jn2arR^KaAz4mB.(dxjS[!#AbP/tc$TVpBAzE.fe4iKga)]!z/Z2GfcR}\u0026wmoN*j:NIUarR^KarR^Har\u003e@HwPzV%zdK[Lar\u003el8ze0(ied9HxarR)KarR^Hb5*$iB9zLywfK5Sb1##3qaKA0AcVjSsT#aga{]CnarR)KEjl^Uz/fVdzGDjdarR^K3lQDlar@0NayO!$x(k59y**@-arR^HboR2rB9hp", "ln": 2212, "col": 1, "line": 76 } ], "depth": 1, "facts": { "imp": [ [ "", "session" ], [ "", "utils.randomString" ], [ "", "s.post.json" ], [ "", "s.post" ], [ "", "len" ], [ "", "s.post" ], [ "", "s.post.json" ], [ "", "s.post" ], [ "", "len" ], [ "", "subprocess.Popen" ], [ "", "out.communicate" ], [ "", "print" ], [ "", "s.post" ], [ "", "s.post.json" ], [ "", "s.post" ], [ "", "len" ], [ "", "s.post.json" ], [ "", "s.post" ], [ "", "s.post.json" ], [ "", "s.post" ], [ "", "print" ], [ "", "check" ], [ "", "re" ], [ "", "requests" ], [ "", "subprocess" ], [ "", "utils" ] ], "mbr": [ "out.communicate", "result.result", "result.result.content", "result.success", "s.post", "s.post.content", "s.post.json", "subprocess.PIPE", "subprocess.Popen", "subprocess.STDOUT", "utils.randomString" ], "tgt": [ "check", "len", "out.communicate", "print", "s.post", "s.post.json", "session", "subprocess.Popen", "utils.randomString" ], "funcs": [ [ "check", 67 ] ], "metrics": { "ast": { "op.lor": 1, "op.land": 6, "max_depth": 13, "call_count": 22, "node_count": 921, "member_count": 11, "max_array_len": 3, "op_density.lor": 0, "op_density.land": 0.01, "member_depth_max": 3 }, "file": { "size": 3471, "entropy": 4.68 }, "text": { "lines": 116, "top_char": 116, "max_ws_run": 5, "digit_ratio": 0.04, "space_count": 817, "char_entropy": 4.68, "unique_chars": 79, "top_char_null": 0, "string_density": 0.59, "top_char_ratio": 0.07, "avg_line_length": 28.92, "max_line_length": 101, "empty_line_ratio": 0.09, "last_line_length": 27, "whitespace_ratio": 0.27, "identifier_density": 0.87, "line_length_stddev": 22.1, "normalized_string_count": 6.31, "repeated_char_sequences": 3, "suspicious_comment_ratio": 0.03, "suspicious_identifier_ratio": 0.04, "normalized_unique_identifiers": 4.08 }, "binds": { "count": 13 }, "binary": { "peak_region_bytes": 399, "peak_region_entropy": 5.17 }, "source": { "function_count": 1 }, "imports": { "count": 4, "stdlib_count": 2, "stdlib_ratio": 0.5, "third_party_count": 2, "third_party_ratio": 0.5 }, "strings": { "bytes": 709, "count": 68, "url_count": 7, "avg_length": 10.43, "max_length": 34, "avg_entropy": 2.61, "empty_count": 1, "entropy_stddev": 0.8 }, "comments": { "chars": 925, "count": 36, "empty": 5, "lines": 31, "high_entropy": 1, "to_code_ratio": 0.36, "url_in_comments": 5 }, "functions": { "count": 1, "density": 0.86, "avg_params": 1, "code_ratio": 0.91, "max_params": 1, "over_100_lines": 1, "avg_name_length": 5, "avg_length_lines": 105, "max_length_lines": 105, "min_length_lines": 105, "avg_param_name_length": 4 }, "identifiers": { "count": 101, "unique": 28, "avg_length": 5.79, "max_length": 12, "min_length": 1, "avg_entropy": 2.1, "reuse_ratio": 0.28, "length_stddev": 2.74, "sequential_names": 1, "single_char_count": 1, "single_char_ratio": 0.04, "all_lowercase_ratio": 0.82, "all_uppercase_ratio": 0.11, "double_underscore_count": 1, "underscore_prefix_count": 1 } } }, "id": 9, "mol": "O₅(XeCEuPrS)H₄(Cm₅Db₃Os₂Po)Md(Pa)", "path": "github.com-wectf-2020-v0.0.0-20210205182610-7448c56d2f34.zip!!github.com/wectf/2020@v0.0.0-20210205182610-7448c56d2f34/checkers/na3.py", "pid": 0, "risk": 51, "sha": "4ae7eae3f3dcf99adbfe9adada26b0907b63feb28c23f68a8f8c86516ed64de8", "size": 3471, "traits": [ { "id": "metadata/lang/natural::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"", "spans": [ [ 782, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "spans": [ [ 2260, 0 ] ] }, { "id": "metadata/package/testing/corpus::xss-category-label", "conf": 0.9, "crit": 3, "desc": "XSS attack category label", "spans": [ [ 2848, 3 ] ] }, { "id": "micro-behaviors/communications/http/request/body::http-post-with-body-argument", "conf": 0.82, "crit": 3, "desc": "HTTP POST supplies a body argument", "spans": [ [ 155, 103 ], [ 487, 103 ], [ 641, 103 ], [ 1164, 103 ], [ 1664, 103 ], [ 1972, 103 ] ] }, { "id": "micro-behaviors/communications/http/request/client::py-post-generic", "conf": 0.8, "crit": 3, "desc": "Python post method call", "spans": [ [ 155, 6 ] ] }, { "id": "micro-behaviors/communications/url/reference::python-comment-url-reference", "conf": 0.9, "crit": 3, "desc": "Python comment contains a URL", "spans": [ [ 2327, 31 ], [ 2672, 30 ], [ 2879, 22 ] ] }, { "id": "micro-behaviors/data/db/schema/relational::account-handle-field", "conf": 0.8, "crit": 3, "desc": "Account handle field name", "spans": [ [ 234, 10 ] ] }, { "id": "micro-behaviors/data/format/json::json-command-field", "conf": 0.8, "crit": 3, "desc": "JSON command or task field key", "spans": [ [ 204, 9 ] ] }, { "id": "micro-behaviors/data/serialize/envelope::result-assignment-key", "conf": 0.4, "crit": 1, "desc": "Result field or assignment key", "spans": [ [ 2544, 0 ] ] }, { "id": "micro-behaviors/data/serialize/schema-object::command-field-key", "conf": 0.9, "crit": 1, "desc": "JSON-like object command field", "spans": [ [ 194, 0 ] ] }, { "id": "micro-behaviors/data/serialize/schema-object::content-object-field", "conf": 0.8, "crit": 3, "desc": "JSON content object field", "spans": [ [ 594, 10 ] ] }, { "id": "micro-behaviors/data/serialize/schema-object::result-field-key", "conf": 0.9, "crit": 1, "desc": "JSON-like object result field", "spans": [ [ 988, 0 ] ] }, { "id": "micro-behaviors/data/serialize/schema-object::user-field-key", "conf": 0.9, "crit": 3, "desc": "JSON-like user identity field", "spans": [ [ 234, 11 ] ] }, { "id": "micro-behaviors/os/env/secret-name::python-environ-items-password-marker", "conf": 0.92, "crit": 3, "desc": "Password marker string literal", "spans": [ [ 259, 8 ] ] }, { "id": "micro-behaviors/os/privilege/check::source-privileged-account-reference", "conf": 0.86, "crit": 3, "desc": "Source references a privileged account", "spans": [ [ 3013, 5 ] ] }, { "id": "micro-behaviors/process/create/subprocess::popen-ast", "atk": "T1059.006", "mbc": "C0017", "conf": 0.85, "crit": 3, "desc": "Launches a process with subprocess.Popen", "spans": [ [ 949, 16 ] ] }, { "id": "micro-behaviors/process/create/subprocess::python-subprocess-io-fields--stderr", "atk": "T1059.006", "conf": 0.84, "crit": 3, "desc": "Process output/status field names (stderr)", "spans": [ [ 1068, 6 ] ] }, { "id": "micro-behaviors/process/create/subprocess::python-subprocess-io-fields--stdout", "atk": "T1059.006", "conf": 0.84, "crit": 3, "desc": "Process output/status field names (stdout)", "spans": [ [ 1017, 6 ] ] }, { "id": "micro-behaviors/process/fd/stdio::py-stderr-stdout", "conf": 0.6, "crit": 3, "desc": "stderr=STDOUT pipe argument (Python)", "spans": [ [ 1068, 24 ] ] }, { "id": "objectives/command-and-control/infrastructure/tracking::username-field", "conf": 0.7, "crit": 3, "desc": "Username tracking field", "spans": [ [ 234, 11 ] ] }, { "id": "objectives/exfiltration/oob/system-profile::python-user-path-profile-fields", "atk": "T1041", "mbc": "E1041", "conf": 0.88, "crit": 3, "desc": "Python user path profile fields", "spans": [ [ 234, 11 ] ] }, { "id": "objectives/supply-chain/recon-exfil/agent-skill::proxy-password-field", "atk": "T1195.002", "conf": 0.96, "crit": 3, "desc": "Password field marker for proxy use", "spans": [ [ 258, 11 ] ] }, { "id": "micro-behaviors/communications/http/lib/requests::imports-requests", "conf": 0.95, "crit": 3, "desc": "Imports the requests HTTP client for Python", "spans": [ [ 19, 14 ] ] }, { "id": "micro-behaviors/communications/http/url/scheme::cleartext-http-url-code-literal", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Code embeds cleartext HTTP URL literal", "spans": [ [ 164, 11 ] ] }, { "id": "micro-behaviors/process/create/subprocess::import-subprocess", "atk": "T1059.006", "mbc": "E1059.006", "conf": 0.95, "crit": 3, "desc": "Imports Python's subprocess module", "spans": [ [ 7, 10 ] ] }, { "id": "micro-behaviors/process/create/subprocess::subprocess-output-options", "atk": "T1059.006", "mbc": "C0017", "conf": 0.9, "crit": 3, "desc": "Python subprocess captures output streams", "spans": [ [ 949, 103 ] ] }, { "id": "objectives/execution/exploit/chain::script-content-field", "atk": "T1189,T1059.007,T1505.003", "mbc": "E1059", "conf": 0.97, "crit": 4, "desc": "JSON content field contains script tag", "spans": [ [ 2397, 19 ] ] }, { "id": "objectives/privilege-escalation/exploit/keywords::img-onerror-handler", "atk": "T1059.007", "mbc": "E1090", "conf": 0.9, "crit": 3, "desc": "Image onerror event handler", "spans": [ [ 1514, 21 ] ] }, { "id": "micro-behaviors/process/create/subprocess::process-execution", "atk": "T1059.006", "conf": 0.8, "crit": 3, "desc": "Python launches a child process", "uses": [ 15 ], "spans": [ [ 949, 16 ] ] } ], "type": "python" }, { "id": 10, "mol": "H₂(Cm₂Po)", "sha": "3bfcd8551836ff67025e426630a6d5cb36e5307da514614271aeb5dc37690f90", "path": "github.com-wectf-2020-v0.0.0-20210205182610-7448c56d2f34.zip!!github.com/wectf/2020@v0.0.0-20210205182610-7448c56d2f34/checkers/url.py", "risk": 2, "size": 824, "type": "python", "depth": 1 }, { "id": 12, "mol": "H₃(Cm₂DbOs₂)", "sha": "3b82e6f5e4dc24259b41c756bdfd7ff8ebb3b566f09ddead1fd350e33c0c417d", "path": "github.com-wectf-2020-v0.0.0-20210205182610-7448c56d2f34.zip!!github.com/wectf/2020@v0.0.0-20210205182610-7448c56d2f34/corbra/index.php", "risk": 4, "size": 3275, "type": "php", "depth": 1 }, { "ctx": [ { "b": "x(d*cA=-Bmvru75x(dz*x(d*cA=-BDB.Lv[w].*baAg[6Cv+tdx(d*cA=-AN3tBu@z/P}xz/Vmgbo[ATbo[ATbo[ATbo[ATbo[ATbo[ATbo[ATbo[ATbo[ATbo[ATbo[A", "ln": 0, "col": 1, "line": 1 }, { "b": "bo[ATbo[ATbo[ATbo[ATbo)KuawM\u0026%xLzu%aAIjmB.\u003eOhvR3WaA=k\u0026dazCZoBzbxfazbt7wH[%xzFTOvxK#i}aARJAxk8K2aBd)FayMyix\u003e8mcA+cwiw/$=9CoyEuwPA6rxLzu%aA}:AyJyQy3l{=ubo[ATbo[ATbo[ATbo[ATbo[ATbo[ATbo[AT", "ln": 138, "col": 80, "line": 5 }, { "b": "bo[ATbo[ATbo[ATbo[ATbo[ATbo[ATbo[ATbo[ATbo[ATbo[ATbo[ATbo[ATbo[ATbo[ATbo)LavJW/Rq/MR/By^\u003cGBywS!B7D:zwmoN*e[wAndgcy?v@bN{B0aF7wPxg[z!9A}dlm!UarR!vwfs2Tl3mo/mRMBIwge(larR^HB-RbmzEEx[auZ\u0026mxKL{Jx\u003eq9\u003ed0oAwADL?Qrc0a)dgdguarR)KB-RbmuVZNjwGUF\u003ezxJz1ax}cxze0(savZfQxcpk?wP}ZaefEYaA=2l3axrF]A:o1{arR^KavfKPx(k56vqWibA=k/kBy=OqB7GwmBz\u0026pgazbB#xcqwiwP}ZaayPd#ay]ykCw7AbwP?T9aARpdC{4rtzGDjdarR^KavZfQxcpk?wP}Zaay!?$aA?EgCoz0vwGUP3vp{Z3vS(E7B-RwA3lQDlar@17z/PY6y-(-0wPw]6vqWh#zY\u0026}oBzbxax9]+7arU/FwPzd1D2NsqjS)a9vra?KwO+)9dgdguarUSiB8#LzA+3pQavx*JAZ\u003c+Oy?a}y3lQDlaARKqwO@RNavx*JAZ\u003c+Oy?a}y3jm)#arUfgvrlGjo\u003ewAPiTM#LarR^HarUi6BywS!B7DESay[{*3jo4evLheezF\u003c2}BzkVhuT[1(By/Ysc[bHlwO960zFsibvqGU7wHF#*3lQDlay[}lv@=c?By!*3vpB4:B0$l)B7Gw$dgdguarU=DC@=oParR^HarR!bB7GwAv@=c?By=\u003ccarR^HarR^HarR^HB-RbmzEEx[jTarBze0(ied9HxarR^HarR^HarU/FwPzd1D2NsTb0/:Rx(kaC3lQDlarR^HarR^HaAg+gB9zLywiB\u003cLe[X:qwO#Vtb0!Q\u003enLSR?k#QY-pF%O8dj+/GarR^HarR^HarR!Gz!\u0026{4j-tx]xjVf@zGWALk$1Bspg3*-q=u:[qBzYT3lQDlarR^HasNTuarR!rCW\u003er7Buf:KarR^HarR!CvrlF%3jpG+x([5$y?Xibc[bGg3s^)XB8@D\u0026p!rXParR^HkY.3QBzkl4wPRQ7wc%C4arS{WvLheezF\u003c2}BzkVhuT[1(By/Ysc[bGCarR!qwO95[B-.pBB-RbmzEEx[efF[uB8#LzA+3QweJ$p#BAfzHarR^HarR^HB-RbmuVfy*B09Q*rDz.(ay1", "ln": 294, "col": 40, "line": 7 }, { "b": "vru6e3lQDlarR^HarR^HarR^HarR^HaA.:pA=br5wJ+fSwPzV%zdLm9arR^HarR^HarR^HarR^HarR^HAa9*eCw?Ijj-B?JB9zLywgO6garR^HarR^HarR^HarR^HarR!Gz!\u0026{4j-\u003eQTwO%4aarR^HarR^HarR^HarR^HarR^HB-RbmuVZNjwJ.kjz/PY6y-(-0wPw$C3lQDlarR^HarR^HarR^HasNTuarR^HarR^HarR!rCW\u003er7BrBd)By/99x([R?AS", "ln": 1410, "col": 25, "line": 53 }, { "b": "wPS6nzxHbE3lQDlarR^HaAz4nB-IvxB-RbmuVfy*e{82EwO}?ZarR^HkY.3QBzkl4wPRQ7wc%C4arS{WvLheezF\u003c2}BzkVhuT[1(By/Ysc[bGCarR!qwO960B6\u0026u^ze0(oBz\u003e@azAn[YBAe/MeJ$p9vScg3efG1QAW:3RarR^HarR^HB-RbmuVfy*B09Q*rDz.(ay2l@arR^HarR^HarR^VB7Gf0v@%aFay2l@arR^HarR^HarR^VCw7MdwHHM1wPxzBz!\u0026{4au.\u003egBz\u003e@azyC]narR^HarR!vw/$]3zyxTGwPzc@vRP%kau.\u003egfGGK-arR^HarR^HarR!EwPS6nzxIzSy\u0026Y", "ln": 1792, "col": 14, "line": 65 } ], "depth": 1, "facts": { "imp": [ [ "", "SqliteDatabase" ], [ "", "AutoField" ], [ "", "CharField" ], [ "", "CharField" ], [ "", "CharField" ], [ "", "CharField" ], [ "", "db.connection_context" ], [ "", "db.create_tables" ], [ "", "User.create" ], [ "", "os.getenv" ], [ "", "os.getenv" ], [ "", "initialize" ], [ "", "db.connection_context" ], [ "", "User.select.where" ], [ "", "User.select" ], [ "", "len" ], [ "", "str" ], [ "", "uuid.uuid4" ], [ "", "User.create" ], [ "", "print" ], [ "", "db.connection_context" ], [ "", "User.select.where" ], [ "", "User.select" ], [ "", "len" ], [ "", "db.connection_context" ], [ "", "User.select.where" ], [ "", "User.select" ], [ "", "len" ], [ "", "db.connection_context" ], [ "", "API.is_admin" ], [ "", "User.update.where.execute" ], [ "", "User.update.where" ], [ "", "User.update" ], [ "", "datetime" ], [ "", "os" ], [ "", "peewee" ], [ "", "uuid" ] ], "mbr": [ "API.is_admin", "User.create", "User.select", "User.select.where", "User.token", "User.update", "User.update.where", "User.update.where.execute", "User.username", "db.connection_context", "db.create_tables", "os.getenv", "user_obj.password", "user_obj.token", "user_obj.user_type", "uuid.uuid4" ], "tgt": [ "API.is_admin", "AutoField", "CharField", "SqliteDatabase", "User.create", "User.select", "User.select.where", "User.update", "User.update.where", "User.update.where.execute", "db.connection_context", "db.create_tables", "initialize", "len", "os.getenv", "print", "str", "uuid.uuid4" ], "funcs": [ [ "initialize", 817 ], [ "auth", 1165 ], [ "is_admin", 1883 ], [ "is_flag_viewer", 2278 ], [ "promote_user_to_flag_viewer", 2691 ] ], "metrics": { "ast": { "max_depth": 15, "call_count": 33, "node_count": 762, "member_count": 16, "max_array_len": 2, "member_depth_max": 4 }, "file": { "size": 3036, "entropy": 4.4 }, "text": { "lines": 104, "top_char": 101, "max_ws_run": 1, "digit_ratio": 0, "space_count": 883, "char_entropy": 4.4, "unique_chars": 63, "top_char_null": 0, "string_density": 0.17, "top_char_ratio": 0.07, "ascii_art_lines": 2, "avg_line_length": 28.19, "max_line_length": 97, "empty_line_ratio": 0.12, "last_line_length": 23, "whitespace_ratio": 0.33, "identifier_density": 1.42, "line_length_stddev": 19.44, "normalized_string_count": 1.77, "repeated_char_sequences": 33, "suspicious_identifier_ratio": 0.02, "normalized_unique_identifiers": 6.57 }, "binds": { "count": 14 }, "binary": { "peak_region_bytes": 3036, "peak_region_entropy": 4.41 }, "source": { "class_count": 3, "function_count": 5 }, "imports": { "count": 4, "stdlib_count": 3, "stdlib_ratio": 0.75, "third_party_count": 1, "third_party_ratio": 0.25 }, "strings": { "bytes": 135, "count": 18, "avg_length": 7.5, "max_length": 18, "avg_entropy": 2.99, "empty_count": 5, "entropy_stddev": 0.48 }, "comments": { "chars": 472, "count": 7, "lines": 7, "to_code_ratio": 0.07 }, "functions": { "count": 8, "density": 4.81, "avg_params": 1.2, "code_ratio": 0.59, "max_params": 2, "length_stddev": 4.45, "avg_name_length": 12.6, "no_params_count": 1, "avg_length_lines": 12.2, "max_length_lines": 21, "min_length_lines": 9, "high_entropy_names": 1, "avg_param_name_length": 6.83 }, "identifiers": { "count": 148, "unique": 44, "avg_length": 7.52, "max_length": 27, "min_length": 1, "avg_entropy": 2.31, "reuse_ratio": 0.3, "length_stddev": 4.77, "has_digit_ratio": 0.02, "sequential_names": 1, "single_char_count": 1, "single_char_ratio": 0.02, "high_entropy_count": 1, "high_entropy_ratio": 0.02, "all_lowercase_ratio": 0.8, "all_uppercase_ratio": 0.02, "numeric_suffix_count": 1 } } }, "id": 14, "mol": "O(C)H₂(Db₃Os₃)", "path": "github.com-wectf-2020-v0.0.0-20210205182610-7448c56d2f34.zip!!github.com/wectf/2020@v0.0.0-20210205182610-7448c56d2f34/customer_service/api.py", "pid": 0, "risk": 6, "sha": "0ea5b2a2d9f31b44e5292c4ce9929215a0f243ae6a5c996e328438c9e9a27daf", "size": 3036, "traits": [ { "id": "metadata/file/string/credential::uppercase-password-identifier", "conf": 0.45, "crit": 3, "desc": "Uppercase identifier contains PASSWORD or PASS", "spans": [ [ 987, 14 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "spans": [ [ 620, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"", "spans": [ [ 567, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-7", "conf": 0.8, "crit": 1, "desc": "English function-word token \"this\"", "spans": [ [ 186, 0 ] ] }, { "id": "micro-behaviors/data/control-flow/error-handling::silent-exception-pass", "atk": "T1027", "mbc": "C0027", "conf": 0.85, "crit": 3, "desc": "exception suppression via try/except pass", "spans": [ [ 1061, 24 ] ] }, { "id": "micro-behaviors/os/env/secret-name::python-env-get-call", "conf": 0.8, "crit": 3, "desc": "Python reads an environment variable", "spans": [ [ 976, 9 ] ] }, { "id": "micro-behaviors/os/env/secret-name::python-environ-items-password-marker", "conf": 0.92, "crit": 3, "desc": "Password marker string literal", "spans": [ [ 992, 9 ] ] }, { "id": "micro-behaviors/os/privilege/check::source-privileged-account-reference", "conf": 0.86, "crit": 3, "desc": "Source references a privileged account", "spans": [ [ 488, 5 ], [ 916, 5 ], [ 1887, 8 ] ] }, { "id": "objectives/command-and-control/infrastructure/tracking::sqllitedb-init", "conf": 0.7, "crit": 3, "desc": "SqliteDatabase initialization", "spans": [ [ 358, 14 ] ] }, { "id": "objectives/credential-access/theft/keywords::password-upper", "conf": 0.45, "crit": 3, "desc": "PASSWORD credential label", "spans": [ [ 987, 14 ] ] }, { "id": "micro-behaviors/data/control-flow/module-exec::module-level-side-effect-call", "conf": 0.82, "crit": 3, "desc": "Python module-level function call", "spans": [ [ 1088, 12 ] ] }, { "id": "micro-behaviors/data/parse/vocabulary::password-key-value-pair", "conf": 0.8, "crit": 3, "desc": "password/passwd key with inline value", "spans": [ [ 704, 20 ], [ 967, 18 ], [ 1474, 17 ] ] }, { "id": "micro-behaviors/os/env/read::python-os-getenv-call", "conf": 0.92, "crit": 3, "desc": "Python reads an environment variable", "spans": [ [ 976, 9 ] ] }, { "id": "micro-behaviors/os/env/secret-name::admin-password", "conf": 0.7, "crit": 3, "desc": "ADMIN_PASSWORD environment variable", "spans": [ [ 987, 14 ] ] } ], "type": "python" }, { "id": 15, "mol": "H₂(Cm₂Os)", "sha": "d191a52d43a701a2ce0e1966946542f10b5a75c23da9cac69d1908794f592ff4", "path": "github.com-wectf-2020-v0.0.0-20210205182610-7448c56d2f34.zip!!github.com/wectf/2020@v0.0.0-20210205182610-7448c56d2f34/customer_service/app.py", "risk": 2, "size": 1759, "type": "python", "depth": 1 }, { "ctx": [ { "b": "jrW9*lSvh+miDn=zeqxyjzn?Ny-)L5zF89RwO@XQ3oS0kvpRLearR^Hjz!UKvix5[vrcB2BuH*Fr7nD0b0DtRarR^?Bzk\u0026kwJ\u0026F7B98tqwPw[(wPz%dv}v+QBzk\u0026kwJ*C-fka{9wiHt.vSb!5j]", "ln": 0, "col": 1, "line": 1 }, { "b": "DNf!Cy\u0026:egc4cayarR^HarR^?wncifk1Gm9wHzKwBzbkdw]7)*iV@=@azbB#xcqRJjtgkVC0llQarR!Nb{l=pwnbS#c4cayarR^?vSBTtarR^Hjz5ILz6im%BzkVhjT8K#A=k/kBy=TszdN*5z!80PAbP/tb0DtRarR^HarR^?xFI+FA=k/kBy=O6aA.:pAV/ExayMy8y**%0C4\u003eJiwPx)^xFI:UarR^HarR^HjzwXLB-X:zvqPNsb6v%rA:J{byH}xcaAhd9v}xs(y?d9$jTa#^yH}xaz!pblxK@reB7GwyaA}Hkv}W03x\u003equdx(k5nxK@q@z/oA9wG\u0026mrBA}XljTb8:woqGCatCM7b{C0a3lQDlarR^HauTvQAclmBBA}?pjTa@\u0026vR]?3a%p@GD2d4Pb5H+exk8lnBz(aVatLS\u0026CSN95", "ln": 362, "col": 5, "line": 14 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 838, "entropy": 4.85 }, "binary": { "peak_region_bytes": 838, "peak_region_entropy": 4.85 } } }, "id": 16, "mol": "H(Cm)", "path": "github.com-wectf-2020-v0.0.0-20210205182610-7448c56d2f34.zip!!github.com/wectf/2020@v0.0.0-20210205182610-7448c56d2f34/customer_service/templates/home.html", "pid": 0, "risk": 1, "sha": "068c71f0ed6c197a0a150940927b14e24b0cdebc5854ab4ef480b1130e27ea55", "size": 838, "traits": [ { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "spans": [ [ 394, 0 ] ] }, { "id": "micro-behaviors/communications/http/post::html-form-post-method", "atk": "T1071.001", "mbc": "C0002", "conf": 0.96, "crit": 3, "desc": "HTML form declares the POST method", "spans": [ [ 450, 36 ] ] } ], "type": "html" }, { "id": 17, "mol": "H₂(Cm₂U₂)", "sha": "9549b9c8425ee0e24f309cf7fb96c680c95c1c46e5c183fd95f902b0a00d72f8", "path": "github.com-wectf-2020-v0.0.0-20210205182610-7448c56d2f34.zip!!github.com/wectf/2020@v0.0.0-20210205182610-7448c56d2f34/customer_service/templates/login.html", "risk": 2, "size": 729, "type": "html", "depth": 1 }, { "id": 19, "mol": "H₃(Cm₂DbOs)", "sha": "f83101638cf8c3ac89f7c00d7ca425f5b3cd09f7f44f0124de06e8a6a43ae844", "path": "github.com-wectf-2020-v0.0.0-20210205182610-7448c56d2f34.zip!!github.com/wectf/2020@v0.0.0-20210205182610-7448c56d2f34/faster_shop/app.py", "risk": 3, "size": 6168, "type": "python", "depth": 1 }, { "ctx": [ { "b": "jrW9*lSvh+miDn=zeqxyjzn?Ny-)L5zF89RwO@XQ3oS0kvpRLearR^Hjz!UKvix5[vrcB2BuH*Fr7nD0b0DtRarR^?Bzk\u0026kwJ\u0026N(B97#lcVZzexM4\u0026Lfly]Iy?k^qarR^HjzX.HyANUey=@$-Bn", "ln": 0, "col": 1, "line": 1 }, { "b": "Bz9poz/o-sBAg/ev}oEfv@DiqvScgbB98ChA4:42gCgynv@(YAvScgbB98ChA4V0wzz2BuB0r^ParR^HjAC1Mx(FepB8\u003e+Nb4#7uAc15[fjO{hwId.qB.bPse[n*pfktGHwPA5FgCgEof!NJ-x(bFtx(kLrB0r!gflpSzx(FeT3lQDlauTZPA+PGmaAINkjTaMYBz#pZfe3*CzFBkBv@c7awm/T^A+c\u003ekz/4doyghuuy?Wv1fk$\u0026GAaK5xyi83.e?]gnh.Pq\u003cwg}[uAbYxee]true]2CKk0gGtv@=p5BuQ3OarR^?B7ol8Ac9jzA:}lRxMOunB2\u003e%cB97\u00262yJ9Z7xF9+jz/*5xA:-]%wnT2fz/4dpz/o-sBAg/efeLpqe?]1]B1Z#", "ln": 148, "col": 49, "line": 6 }, { "b": "aV}z\u003ef*k{!arR^?wncifv@bN{B3gZQy?mTeayP7$A=-)LA+Px0A^n\u0026)s-nB9xKM6}aBwCTvQT7YzEWl2EsikEBZ]idjtgkVC0llQarR^?xFR?wvrlK4AWL]Jq!Q8*aw^8%wozx[jtgw7j{\u0026zParS^.vpA!:k2VPywPw]9A+fr9aV}z]vpA!:j{\u0026zP", "ln": 628, "col": 37, "line": 14 }, { "b": "i=X!xj0D\u003cph83s0pEW!%dlGn1vpA!:k0gGuwiHtyarR^HarR^HarR^?ByWMxarR^HarR^HarR^HarR^Hjz5ILz6im%BzkVhjT8K*B:kR{a%p-lBzbP6jTa\u0026-B95P\u00263lQDlarR^HarR^HarR^HarR^HauTvQAclmBBA}?pjTa@\u0026vR]?3a%pxivrlGMb4tUiayYCgePt-AzddEgayYCgePU+MaA?gfB.9YWluNL$atk[=arR^HarR^HarR^HarR^Hjtgq+A=0#EarR^HarR^HarR^Hjtc", "ln": 1275, "col": 72, "line": 33 }, { "b": "fG.1gwiHtyarR^HarR^HarR^?ByWM\u003cfG.1gwiHtyarR^HarR^HarR^?ByWMxarR^HarR^HarR^HarR^Hjz5ILz6im%BzkVhjT8K*B:kR}a%p-lBzbP6jTa\u0026-B95P\u00263lQDlarR^HarR^HarR^HarR^HauTvQAclmBBA}?pjTa@\u0026vR]?3a%pxivrlGMb4tUiayYCgePt-AzddEgayYCgePU+MaA?gfB.9YWluNL$atk[=arR^HarR^HarR^HarR^Hjtgq+A=0#EarR^HarR^HarR^Hjtc", "ln": 1625, "col": 19, "line": 44 }, { "b": "fG.1gwiHtyarR^HarR^HarR^?ByWM\u003cf*4ahwiHtyarR^HarR^HarR^?ByWMxarR^HarR^HarR^HarR^Hjz5ILz6im%BzkVhjT8K*B:kR@a%p-lBzbP6jTa\u0026-B95P\u00263lQDlarR^HarR^HarR^HarR^HauTvQAclmBBA}?pjTa@\u0026vR]?3a%pxivrlGMb4tUiayYCgePt-AzddEgayYCgePU+MaA?gfB.9YWluNL$atk[=arR^HarR^HarR^HarR^Hjtgq+A=0#EarR^HarR^HarR^Hjtc", "ln": 1991, "col": 21, "line": 55 }, { "b": "BAfLLarR^HarR^Hjtg!\u0026wNPak3lQDlarR^HauT:Pz!abS3lQDlarR^HaBtySw]zYjx=}bcaAhEzv}Yp(wNxm(xcnHG3lQDlarR^HarR^HauT:^j{\u0026zParR^HarR^HarR^HarS^*xDRwaz/xnJb64QCb0Hv2azADxwfuqGjtg!\u0026j{\u0026zParR^HarR^", "ln": 2624, "col": 11, "line": 75 }, { "b": "ByWNZDMW2PC3!=*By=OyElof8wiHtyarR^HarR^HarR^HarR^?ByWMxarR^HarR^HarR^HarR^HarR^Hjz5ILz6im%BzkVhjT8L2wO=foDWu(He[[\u0026sEsipZzdN*5z!80PAbP/tb0DtRarR^HarR^HarR^HarR^HarR^HarR^?x(m)jBrCWJAaIfRB9g@ex(\u003eKwv@bN{B3gZRBz-jgBz-WHA+Px0A^n^pBz-WKz6y9CvqH6$jT9*oy?$prffPZ=arR^HarR^HarR^HarR^HarR^?fj]cyz9wpHarR^H", "ln": 2868, "col": 18, "line": 83 }, { "b": "az\u003eLcxk8lnBz(aVatCM7AcKCKarR^HarR^HzddVvCwgPfxGvm}fFED\u003ci%)8MarV7tjtg+$D2d4Q3oP$PBzU?T3i", "ln": 3231, "col": 8, "line": 98 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 3300, "entropy": 4.38 }, "binary": { "peak_region_bytes": 1024, "peak_region_entropy": 4.87 } } }, "id": 20, "mol": "H₂(Cm₂Po)", "path": "github.com-wectf-2020-v0.0.0-20210205182610-7448c56d2f34.zip!!github.com/wectf/2020@v0.0.0-20210205182610-7448c56d2f34/faster_shop/templates/home.html", "pid": 0, "risk": 2, "sha": "19e9da981ddfa90cc827b8b4bd28c72d7c2b4f3fc8a19c624ee1f6fe1cb6d9be", "size": 3300, "traits": [ { "id": "metadata/lang/natural::lang-english--atom-4", "conf": 0.8, "crit": 1, "desc": "English function-word token \"have\"", "spans": [ [ 676, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "spans": [ [ 2672, 0 ] ] }, { "id": "micro-behaviors/communications/http/post::html-form-post-method", "atk": "T1071.001", "mbc": "C0002", "conf": 0.96, "crit": 3, "desc": "HTML form declares the POST method", "spans": [ [ 1339, 34 ], [ 1689, 34 ], [ 2055, 34 ], [ 2932, 44 ] ] }, { "id": "micro-behaviors/process/create/load/script::external-script-element-load", "conf": 0.92, "crit": 3, "desc": "Loads external script element", "spans": [ [ 212, 21 ] ] }, { "id": "micro-behaviors/communications/http/url/cdn::cdnjs-asset", "atk": "T1071.001", "mbc": "C0002", "conf": 0.82, "crit": 3, "desc": "References a cdnjs frontend asset URL", "spans": [ [ 302, 29 ] ] }, { "id": "micro-behaviors/communications/http/url/cdn::jquery-cdn-asset", "atk": "T1071.001", "mbc": "C0002", "conf": 0.82, "crit": 3, "desc": "References a jQuery CDN asset URL", "spans": [ [ 225, 31 ] ] }, { "id": "micro-behaviors/communications/http/url/cdn::multiple-frontend-cdn-assets", "atk": "T1071.001", "mbc": "C0002", "conf": 0.85, "crit": 3, "desc": "References multiple public frontend CDN assets", "uses": [ 4, 5 ], "spans": [ [ 225, 31 ], [ 302, 29 ] ] } ], "type": "html" }, { "id": 21, "mol": "H₂(Cm₄U₂)", "sha": "475ac81bd2aafcfe34bcdf63f7fde1bab7856a6d8021dd6bd847bfc81d57ddc3", "path": "github.com-wectf-2020-v0.0.0-20210205182610-7448c56d2f34.zip!!github.com/wectf/2020@v0.0.0-20210205182610-7448c56d2f34/faster_shop/templates/login.html", "risk": 2, "size": 1261, "type": "html", "depth": 1 }, { "ctx": [ { "b": "v@DmaBrCdtAb]JhB09Q*A+flkx(W=kcUmKwA+frkcN?a:v@DmaBrC]MwQ4=@aBLv}aAz4kB.L(cc)Aemx(4r!Ab](bwPI]pdlv(Dz/fSrayPkdauZ\u0026UCYmXmB8@-Ui%]znA4U^mBsnH\u0026cOcw*A+fkwaAz4mdiH=qaAz4me]$Pwwge*bwO+\u003c{zdK\u0026izY?XNvpr7TcN*Ga3jpPXBrCZFx(4\u0026kjS]7UarR^HC4CYdw{E:9z!\u0026{4iV]?[B7Gx0Bz\u003e@azyE.jDMWuuBAIRwar.[JB7Gx0Bz\u003e@azxKuU3lQDlay]IhA9)3\u0026y*Q)*uVf\u003e1iV]?1jWainx\u003ewFon(FIXe]#bPx(mM$w{C!nvKS{CwO#d5xDPFYf!+pnfEXbPvJW/RDWN2+efDP0az#9uC6dRsazttbwH[%sB-RTEBz\u0026pvA+fA9zGE1ivJYO#ygQ)%azbUjz6iq0x(mMaBz(7uy*?u%wEoL5arSr\u003caAz47x(^S{z/Z1YayD]Rf!Lgkf\u003c(KtarR^Hfe1C*wN]H@uVP!2iV}*JwN]H@eN@Qhat4mHbZTVQx(4\u0026yA+e=}B6\u0026Q0B98*MB7GCou[qTcao", "ln": 0, "col": 1, "line": 1 }, { "b": "ay[}=B-RbmuVZj4wO$=@jS]91j0lgfay/C6vru66BzbkdB-RbmcVZzKAa9l/azCBgzF%RtwQ4{gBrCpnay[}7z^)D)v@@52arR!qvQ0$@wPzd1z!\u0026{4u0z8QD0IKQaA?gfB.9SSfe1C?wPP5pxK@rfvqH6$aARJABzbkdtxL0#A:J{byH}x?e)Aa5D0H+1arR!EwPGFsB8L}ADMW3zuVQv1v}x.5iV@J+B.8XzdggFLi%(s6AbWBxwPPsFfk1\u003crcOcw*A+fkwaAz4mdiH=qaBsCrarR!pz/fSraBwlLwPzd1z!\u0026{4efF.tD3{!#aAz4ke]=2BA^o.NarR^Hx\u003ewFoa:4)vy\u0026.jLwPzG%D0+ViyH}w", "ln": 822, "col": 25, "line": 20 }, { "b": "wO#3bb2}x7rA8H+qB$4Xl)s6watkw\u003czF%Rtvix5#A=L-3BrCNCwPA56arR^Hy?mYhA+frmy\u0026*^.ay[}=B-RbmuVZj4wO$^n3lQDlazCBgc#@)uB.(dGaAz4mB.(dxjS[=RB9hqvtwE!}t@@xoarR!EwPGFsB8L}ADMWuuB9hqviV@DOB9hqvau.\u003eJaA.NjwObT]wN(]Far\u003eYCy?$priV@DOB9hqvefFUFuVQv1v}x.5iV@DOB9hqvar-)haA.NjwObT]wN({idggFLi%(rFfcCsHz/[8-l}6{Immfvummnpwwn=ukBrCZEwGUYeaT50LaT4h3AbWBGB-Y2VfjFv1yJTOzefDuYwPomzA+fqvau.[hDKp(rarUGiBrCa6uVQsfwNPA#jS)7lw[CQ{e[Pcxz751PpFJJ-BAh8kxk7$6c$D^odlwU9fcCjOwP?T5BrBEGmiJ0XarR!pz/fSray/n0auZ\u0026\u0026BzkMje]\u003eJlx(^T5wPP4BayF.?as8qAvQBg#A+eV@e{82gBAh8kxdbcpvrl0rg::-2u][YrarR!rCX7wkv@k:casH/wAX7MGuTCl8jW70n3lQDlarR^HazCBgc$NBtdiJUxBAIRwaAz4me]2DCzyx\u0026Ox(^T5BZ[])B8%w+w)]H%wGVyIi%)8MarR^HarUYoB1RiGz/c$IazC[7B9g#5wPI]NaARTDwGVyIi%)8MarV7Yi%{x+i%(s6AbWBCx(!xczyvj[fF+m5c[co4j%juNzGx-jwId!qxddd^ByxiiwN)zCe){aSi%\u003e", "ln": 1139, "col": 54, "line": 27 } ], "depth": 1, "facts": { "imp": [ [ "", "require" ], [ "", "require" ], [ "", "express" ], [ "", "app.get" ], [ "", "res.send" ], [ "", "JSON.stringify" ], [ "", "app.get" ], [ "", "utils.drop_all_if_oom" ], [ "", "utils.verify_token" ], [ "", "res.send" ], [ "", "res.json" ], [ "", "app.get" ], [ "", "utils.verify_token" ], [ "", "res.send" ], [ "", "res.json" ], [ "", "app.put" ], [ "", "Buffer.from" ], [ "", "JSON.stringify" ], [ "", "db_stream.toString" ], [ "", "exec" ], [ "", "res.json" ], [ "", "res.json" ], [ "", "app.listen" ], [ "", "console.log" ], [ "", "child_process" ], [ "", "express" ] ], "mbr": [ "Buffer.from", "JSON.stringify", "JSON.stringify.length", "app.get", "app.listen", "app.put", "console.log", "db_stream.toString", "req.query", "res.json", "res.send", "utils.drop_all_if_oom", "utils.redis_set", "utils.verify_token" ], "tgt": [ "Buffer.from", "JSON.stringify", "app.get", "app.listen", "app.put", "console.log", "db_stream.toString", "exec", "express", "require", "res.json", "res.send", "utils.drop_all_if_oom", "utils.verify_token" ], "funcs": [ [ "anonymous", 115 ], [ "anonymous", 194 ], [ "anonymous", 254 ], [ "anonymous", 556 ], [ "anonymous", 1029 ], [ "anonymous", 1417 ], [ "anonymous", 1588 ], [ "anonymous", 1731 ] ], "metrics": { "ast": { "op.eq": 1, "op.gt": 1, "op.ne": 1, "op.add": 1, "op.lor": 1, "op.lnot": 6, "max_depth": 17, "call_count": 24, "node_count": 617, "member_count": 14, "op_density.eq": 0, "op_density.gt": 0, "op_density.ne": 0, "op_density.add": 0, "op_density.lor": 0, "op_density.lnot": 0.01, "max_concat_chain": 2, "member_depth_max": 3 }, "file": { "size": 1765, "entropy": 5.02 }, "text": { "lines": 43, "top_char": 101, "max_ws_run": 1, "digit_ratio": 0.01, "space_count": 285, "char_entropy": 5.02, "unique_chars": 73, "top_char_null": 0, "string_density": 0.28, "top_char_ratio": 0.09, "avg_line_length": 40.05, "max_line_length": 140, "empty_line_ratio": 0.14, "last_line_length": 50, "whitespace_ratio": 0.19, "identifier_density": 2.4, "line_length_stddev": 33.54, "normalized_string_count": 1.83, "normalized_unique_identifiers": 6.45 }, "binds": { "count": 9 }, "binary": { "peak_region_bytes": 1765, "peak_region_entropy": 4.99 }, "imports": { "count": 2, "stdlib_count": 1, "stdlib_ratio": 0.5, "third_party_count": 1, "third_party_ratio": 0.5 }, "strings": { "bytes": 125, "count": 12, "avg_length": 10.42, "max_length": 34, "path_count": 3, "avg_entropy": 2.62, "entropy_stddev": 1.13 }, "comments": { "chars": 407, "count": 11, "lines": 11, "to_code_ratio": 0.34 }, "functions": { "nested": 1, "density": 18.6, "anonymous": 8, "avg_params": 1.5, "code_ratio": 0.72, "max_params": 3, "one_liners": 4, "length_stddev": 3.1, "no_params_count": 2, "avg_length_lines": 3.88, "max_length_lines": 8, "min_length_lines": 1, "avg_nesting_depth": 0.13, "max_nesting_depth": 1, "single_char_params": 1, "avg_param_name_length": 3.33 }, "identifiers": { "count": 103, "unique": 35, "avg_length": 5.54, "max_length": 15, "min_length": 1, "avg_entropy": 2.03, "reuse_ratio": 0.34, "length_stddev": 3.1, "single_char_count": 1, "single_char_ratio": 0.03, "all_lowercase_ratio": 0.91, "all_uppercase_ratio": 0.09, "underscore_prefix_count": 2 } } }, "id": 23, "mol": "H₄(Cm₄Db₅OsPo₂)Md₂(InPa)", "path": "github.com-wectf-2020-v0.0.0-20210205182610-7448c56d2f34.zip!!github.com/wectf/2020@v0.0.0-20210205182610-7448c56d2f34/kvaas/main.js", "pid": 0, "risk": 10, "sha": "fc80a95774f9ec144767a551af96b98114e6d5f45bad0cfeaee9a08fc151f870", "size": 1765, "traits": [ { "id": "metadata/import/builtin::require-child-process", "conf": 0.8, "crit": 3, "desc": "require() of the child_process module", "spans": [ [ 53, 7 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "spans": [ [ 854, 0 ] ] }, { "id": "metadata/package/testing/corpus::rce-category-label", "conf": 0.9, "crit": 3, "desc": "RCE attack category label", "spans": [ [ 1497, 3 ] ] }, { "id": "micro-behaviors/communications/ftp/client::put-call", "atk": "T1071.002", "mbc": "C0004", "conf": 0.4, "crit": 3, "desc": ".put() method call", "spans": [ [ 1401, 5 ] ] }, { "id": "micro-behaviors/communications/http/response::server-response-send-end", "mbc": "C0002", "conf": 0.88, "crit": 3, "desc": "Calls server response send/end method", "spans": [ [ 129, 8 ] ] }, { "id": "micro-behaviors/data/buffer::node-buffer-from-json-stringify", "conf": 0.94, "crit": 3, "desc": "Creates Node.js Buffer from JSON serialization", "spans": [ [ 1453, 27 ] ] }, { "id": "micro-behaviors/data/control-flow/module-exec::module-scope-zero-arg-call", "conf": 0.86, "crit": 3, "desc": "Module scope assigns zero-argument call", "spans": [ [ 79, 21 ] ] }, { "id": "micro-behaviors/data/serialize/envelope::command-assignment-key", "conf": 0.4, "crit": 1, "desc": "Command field or assignment key", "spans": [ [ 1512, 0 ] ] }, { "id": "micro-behaviors/data/serialize/envelope::result-assignment-key", "conf": 0.4, "crit": 1, "desc": "Result field or assignment key", "spans": [ [ 1269, 0 ] ] }, { "id": "micro-behaviors/data/serialize/json::json-stringify-identifier", "conf": 0.85, "crit": 3, "desc": "Serializes an identifier as JSON", "spans": [ [ 264, 14 ] ] }, { "id": "micro-behaviors/data/serialize/schema-object::result-field-key", "conf": 0.9, "crit": 1, "desc": "JSON-like object result field", "spans": [ [ 1267, 0 ] ] }, { "id": "micro-behaviors/data/string/conversion::tostring-call", "conf": 0.94, "crit": 3, "desc": "Calls JavaScript toString conversion method", "spans": [ [ 1542, 18 ] ] }, { "id": "micro-behaviors/data/string/conversion::tostring-token", "conf": 1.0, "crit": 3, "desc": "References the toString conversion method", "spans": [ [ 1552, 8 ] ] }, { "id": "micro-behaviors/os/security/directory-service::directory-entry-property-put-call", "conf": 0.94, "crit": 3, "desc": "DirectoryEntry property write API call", "spans": [ [ 1401, 5 ] ] }, { "id": "micro-behaviors/process/create/shell/bridge::child-process-exec-destructure", "atk": "T1059", "mbc": "C0017", "conf": 0.9, "crit": 3, "desc": "Destructures exec from Node.js child_process", "spans": [ [ 42, 33 ] ] }, { "id": "micro-behaviors/process/create/shell/bridge::child-process-keyword-literal", "atk": "T1059", "conf": 0.9, "crit": 3, "desc": "child_process module name literal", "spans": [ [ 62, 13 ] ] }, { "id": "micro-behaviors/process/create/shell/bridge::js-exec-call", "conf": 1.0, "crit": 1, "desc": "Calls a function named exec", "spans": [ [ 1578, 0 ] ] }, { "id": "micro-behaviors/process/create/shell/local::node-exec-command-variable-call", "conf": 0.9, "crit": 3, "desc": "Calls exec with a command-named variable", "spans": [ [ 1577, 9 ] ] }, { "id": "micro-behaviors/process/create/shell/local::node-exec-require-destructure-binding", "conf": 0.94, "crit": 3, "desc": "Destructures Node exec from require", "spans": [ [ 42, 33 ] ] }, { "id": "micro-behaviors/communications/http/message::http-message-json-call", "conf": 0.9, "crit": 3, "desc": "Calls JSON method on HTTP-style object", "spans": [ [ 977, 8 ] ] }, { "id": "micro-behaviors/communications/http/server/framework::server-express", "atk": "T1071.001", "mbc": "C0002", "conf": 0.66, "crit": 3, "desc": "Express.js HTTP server", "spans": [ [ 91, 7 ] ] }, { "id": "micro-behaviors/communications/http/server/route::app-router-get-endpoint", "atk": "T1071.001", "mbc": "C0002", "conf": 0.78, "crit": 3, "desc": "App or router GET route definition", "spans": [ [ 102, 9 ] ] }, { "id": "micro-behaviors/data/encode/base64::tostring-base64", "conf": 0.8, "crit": 3, "desc": "Base64 encoding via toString (JS)", "spans": [ [ 1551, 18 ] ] }, { "id": "micro-behaviors/process/create/shell/bridge::child-process-destructure-require", "atk": "T1059", "mbc": "C0017", "conf": 0.85, "crit": 3, "desc": "Destructures APIs from Node.js child_process", "spans": [ [ 42, 33 ] ] }, { "id": "micro-behaviors/process/create/shell/bridge::js-exec", "atk": "T1059.007", "mbc": "C0017", "conf": 0.95, "crit": 3, "desc": "Executes a command through Node.js child_process exec", "uses": [ 14, 16 ], "spans": [ [ 42, 33 ], [ 1578, 4 ] ] }, { "id": "micro-behaviors/process/create/shell/local::node-exec-child-process-binding", "conf": 0.94, "crit": 1, "desc": "Binds Node child_process exec", "uses": [ 18 ], "spans": [ [ 42, 0 ] ] }, { "id": "micro-behaviors/process/create/shell/local::node-exec-command-variable", "atk": "T1059.007", "mbc": "C0017", "conf": 0.94, "crit": 3, "desc": "Node child_process exec receives a command-named variable", "uses": [ 17, 25 ], "spans": [ [ 42, 33 ], [ 1577, 9 ] ] }, { "id": "micro-behaviors/process/create/shell/bridge::child-process-require", "atk": "T1059", "mbc": "C0017", "conf": 0.8, "crit": 3, "desc": "Imports the Node.js child_process module", "uses": [ 0, 23 ], "spans": [ [ 42, 33 ], [ 53, 7 ] ] } ], "type": "javascript" }, { "id": 24, "mol": "H(Po)Md(Pa₂)", "sha": "83811d5863aa52f8c9e67ddf8d022c4d63343476e5639f76f9503f059b55fe30", "path": "github.com-wectf-2020-v0.0.0-20210205182610-7448c56d2f34.zip!!github.com/wectf/2020@v0.0.0-20210205182610-7448c56d2f34/kvaas/package.json", "risk": 3, "size": 162, "type": "package.json", "depth": 1 }, { "id": 26, "mol": "K(Li)H₂(Cm₂Db)", "sha": "6fb89c5ff7245fa8542c178e0fc524b575f70371736320f8301cda112a119616", "path": "github.com-wectf-2020-v0.0.0-20210205182610-7448c56d2f34.zip!!github.com/wectf/2020@v0.0.0-20210205182610-7448c56d2f34/light_sequel/cmd/main.go", "risk": 4, "size": 2788, "type": "go", "depth": 1 }, { "id": 28, "mol": "H(Cm)Md(Bk)", "sha": "899ae270556ea454f8e29247e5e4387361b14ffb44ba200beb29b62ee3834e83", "path": "github.com-wectf-2020-v0.0.0-20210205182610-7448c56d2f34.zip!!github.com/wectf/2020@v0.0.0-20210205182610-7448c56d2f34/light_sequel/proto/main.pb.go", "risk": 3, "size": 13776, "type": "go", "depth": 1 }, { "id": 31, "mol": "H₃(Cm₂DbOs)", "sha": "75803d93bd3d5c65daecaf13b44dcaaa8a7008fb6a1744aa6f2e64a7102adc22", "path": "github.com-wectf-2020-v0.0.0-20210205182610-7448c56d2f34.zip!!github.com/wectf/2020@v0.0.0-20210205182610-7448c56d2f34/note_app/app.py", "risk": 3, "size": 4223, "type": "python", "depth": 1 }, { "id": 32, "mol": "H(Cm₃)", "sha": "4700e3656bf8e3ddc53a736c41b2498ae11e5c6fc890391488e19b7e05990a8c", "path": "github.com-wectf-2020-v0.0.0-20210205182610-7448c56d2f34.zip!!github.com/wectf/2020@v0.0.0-20210205182610-7448c56d2f34/note_app/templates/home.html", "risk": 1, "size": 1884, "type": "html", "depth": 1 }, { "id": 33, "mol": "H₂(Cm₄U₂)", "sha": "36ae61867d421d8016359f19605df7f22a88a3b2a581beb8c45fc0d9f23a73e2", "path": "github.com-wectf-2020-v0.0.0-20210205182610-7448c56d2f34.zip!!github.com/wectf/2020@v0.0.0-20210205182610-7448c56d2f34/note_app/templates/login.html", "risk": 2, "size": 1903, "type": "html", "depth": 1 }, { "id": 34, "mol": "H(Cm₂)", "sha": "a6838cb12fac9b7a6c5acc6fe569f953e42d22de2cc9c0fde6ae8eec7ce7aca5", "path": "github.com-wectf-2020-v0.0.0-20210205182610-7448c56d2f34.zip!!github.com/wectf/2020@v0.0.0-20210205182610-7448c56d2f34/note_app/templates/note.html", "risk": 1, "size": 1054, "type": "html", "depth": 1 }, { "id": 36, "mol": "H₂(DbOs)", "sha": "6cd2383d2d84d9dcc94382b3deeb1454863f7c3694cc124d7baa33309db3003e", "path": "github.com-wectf-2020-v0.0.0-20210205182610-7448c56d2f34.zip!!github.com/wectf/2020@v0.0.0-20210205182610-7448c56d2f34/note_app_2/api.py", "risk": 2, "size": 3489, "type": "python", "depth": 1 }, { "id": 37, "mol": "H(Cm₂)", "sha": "80dbc39e396f7a7603c061e88e35a29f8e19d9bf37861f72ed98c4be5a2ad463", "path": "github.com-wectf-2020-v0.0.0-20210205182610-7448c56d2f34.zip!!github.com/wectf/2020@v0.0.0-20210205182610-7448c56d2f34/note_app_2/app.py", "risk": 1, "size": 2211, "type": "python", "depth": 1 }, { "id": 38, "mol": "H(Cm₃)", "sha": "ae704bd8e8f3929a1bfb33b566912ca907c5934b9d45eced32df329b7a869d18", "path": "github.com-wectf-2020-v0.0.0-20210205182610-7448c56d2f34.zip!!github.com/wectf/2020@v0.0.0-20210205182610-7448c56d2f34/note_app_2/templates/home.html", "risk": 1, "size": 2237, "type": "html", "depth": 1 }, { "id": 39, "mol": "H₂(Cm₄U₂)", "sha": "a88152fc0b430bf8285d6b1ea2d549c23c04bebf6d795c6275a4ed9276f1e790", "path": "github.com-wectf-2020-v0.0.0-20210205182610-7448c56d2f34.zip!!github.com/wectf/2020@v0.0.0-20210205182610-7448c56d2f34/note_app_2/templates/login.html", "risk": 2, "size": 1939, "type": "html", "depth": 1 }, { "id": 40, "mol": "H(Cm₂)", "sha": "d0c1e79a4c170633125fe80815830f92736d4bde48230b64b00240e94274787e", "path": "github.com-wectf-2020-v0.0.0-20210205182610-7448c56d2f34.zip!!github.com/wectf/2020@v0.0.0-20210205182610-7448c56d2f34/note_app_2/templates/note.html", "risk": 1, "size": 1065, "type": "html", "depth": 1 }, { "id": 42, "mol": "H₂(CrDb)", "sha": "687d2c4331cee50a132c0ea20b8cd5b2354d62136153080725d764ebb866719d", "path": "github.com-wectf-2020-v0.0.0-20210205182610-7448c56d2f34.zip!!github.com/wectf/2020@v0.0.0-20210205182610-7448c56d2f34/note_app_3/api/Helpers.inc", "risk": 2, "size": 11194, "type": "php", "depth": 1 }, { "id": 43, "mol": "H₂(Db₂Os₂)", "sha": "c28d277edf2a03c5918d049236d5effc1965477058621457e90c9f12195ad0d6", "path": "github.com-wectf-2020-v0.0.0-20210205182610-7448c56d2f34.zip!!github.com/wectf/2020@v0.0.0-20210205182610-7448c56d2f34/note_app_3/api/Utils.inc", "risk": 3, "size": 660, "type": "php", "depth": 1 }, { "id": 44, "mol": "H₃(CmDbOs)", "sha": "f1b1cea45edb248f7666eecd00c248b16ce0f3a3aea993b6ac4b7f582548a34b", "path": "github.com-wectf-2020-v0.0.0-20210205182610-7448c56d2f34.zip!!github.com/wectf/2020@v0.0.0-20210205182610-7448c56d2f34/note_app_3/api/index.php", "risk": 3, "size": 1336, "type": "php", "depth": 1 }, { "id": 46, "mol": "H₂(Cm₂U)", "sha": "4f30746aecf8c1a6907b8e11191b556cd19a16186715c36565bdfe0fb3041198", "path": "github.com-wectf-2020-v0.0.0-20210205182610-7448c56d2f34.zip!!github.com/wectf/2020@v0.0.0-20210205182610-7448c56d2f34/note_app_3/home.html", "risk": 2, "size": 3130, "type": "html", "depth": 1 }, { "ctx": [ { "b": "jrW9*lSvh+miDn=zeqxyjzn?Ny-)L5zF89RwO@XQ3oS0kvpRLearR^Hjz!UKvix5[vrcB2BuH*Fr7nD0b0DtRarR^?Bzk\u0026kwJ\u0026\u003ecBy=NXAbV{Qe?/yvBzk\u0026kwJ*CzarR^?y?W^53lQDlarR^HarR^HaAz4fjTa@?D2d5kxK$:%a{]CnarR^HarR^HarUurwOa7HxMOunB2\u003e%cv}oE(B1Q%sz/]P5y*?u}e[n*pfjwQ7CRr(EvSKhzwO\u003e\u003c[BzkkpB.JG:e\u0026kgnflpYwvqZg3v\u003eIRjzz2BuB0p@larR^HarR^HarR!GD2NsTb6myvBt4cBB0p@larR^Wj{\u0026zParS^/v@=p5Bp6ckarR^HarR^HarU-Cv)82HBAzFyiXJc@z!9Aiyh[xcA^ooEz/4dxADL\u0026kC}y*8f!Lgkze0(uyi7NaarR^HarR^HarR^Hx(n37xl4ZdC%9u)xKJUNhz5Pyr=h5Gx*Cc+r8knCDr0ELBXCzFi6{qsq!!/]t608mm@p*\u0026oM\u0026g2i6wC)arR^HarR^HarR^Hv@=HeB8M8kxk8lDb4kwczH38qB-O-\u003cjtg+=A+PGmj{\u0026zParS^/v@=p5BrCTBv)82HBAzFyiXJc@wnVd6e[nZoB.292vrb{iv@Diqvqoj}fkLuiB1.PCzdds7x\u003e5-qx!Ij]g+HHoB7Gh%zGGP5e]true]2CKk0gGtv@=p5BuQ3OarR^?B7ol8Ac9jzA:}lRflqkzBzkkrzddc@e]2CKk0gGtv@=p5BuQ3OarR^?B98XzwGV8uAaIfRBy/YsfjP6Ab0DtRarR^HarR!oz!aboDKp(rarR^HarR^HarSmWwNYB?Bs?9yzGEEKzeTumxLzu%iV}\u003cGBzkf1x\u003c(6]wigbvarR^HarR^HarR^UzeT.Lw]zNeePU=E", "ln": 0, "col": 1, "line": 1 }, { "b": "Bzbk]wg?}mxkIi$BrC]qarR^HarR^HarR^Hze0(txK$)\u003cxMMoThzu?7CSMlParR^HarR^HarR!CvpS[.zF80Mf\u003eChAfLb8.3lQDlarR^HaBKO7arR^HarR^He]t3rBzbj", "ln": 766, "col": 13, "line": 23 }, { "b": "arR^HEf{r7arR^HarR^VB7F\u003c1zE^f@C}K5Ox(n3bzF7OswO#Ske{82we[]Asz6jfjarR^HarR^HarR^Hwnca7y*?PIaz#anwJHkwarR^HarR!P3jm)#arR^HarS{^wN]H-aA8dlC{4frA+e*1ayPd#asI8nCRabNwoqGCau7#dAcJ/ODKp(rarR^HarR^HarSpTwN/T@wmoI7e]U-yzGGPgxd!4jzGN6Ox(){6aBsCrarR^HarR^HarR^HarR!qx(!lfvr\u003c)RzF%A7", "ln": 1672, "col": 5, "line": 66 }, { "b": "wPz)7wftL%vpS}\u0026b0F+uBy=NXAbV{Qe?/yvxFzWTarR^HarR^HarR^HjzlGlra]?=zeTGqaAIa7B-I4ovqYP#vpTK\u0026zEWl*az#atwGU@mvR/+1xLzu%ayPkdy?Wx/BzkVhe\u003c7!2gcM3/arR^HarR^HarR^?wncifv@bN{B3gZ\u0026x=}8ixjSi8A+Pv", "ln": 3173, "col": 30, "line": 114 }, { "b": "ay!?$azkziwGVnpB-FQmz/6D4zH0vCB-p]jAbP@iA=SvBzY\u0026OeaARphzFa2kBzb98aARpdC)UVparR^HarR^HarR^HarR^HarR^HarUMkC4CXpBzbPnxj#xfAbP/sx\u003c$)\u0026e*9\u00260BrCZEay]51x\u003eIa3aBd)FAV!\u003emB98tqwPz\u0026mvqYP.arR^HarR^H", "ln": 3742, "col": 27, "line": 127 }, { "b": "arR^HarR^HjA9E\u003earR^HarR^HarR^HarR^HarR^HarR^Hmr\u0026]{vixSgvpJ\u003c\u003ew]zYjvix5*y?$kozY\u0026E#BzkVhazC.mx\u003eg=$Bzbkdw]zQfwPw]nxKM09v@DHawc%C4arR^HarR^HarR^HarR^HarR^HarUuey\u0026yIqwI4FhxjkB:aA.:pA=S\u0026uarR^", "ln": 6055, "col": 13, "line": 176 }, { "b": "j{\u0026zParR^HarS^Sx)7Rey*?yajTb2.az2Olz/M$qwPI{3xjSnfx\u003efvJy\u0026r%2zEl%}A=k$xaAITIy?k:Nwnca7y*?PIaz#anwG\u003cqBarR^HarR^HarR^Hjy\u0026eHay/j@B8%F*xK$Q.wPw$U3lQDlarR^HarR^HarR^Haxi2=A+cwqwPzu8B8L]baz2Olz/P[wCwhejaBd)FAV/BCvR]?2B7]Mg3lQDlarR^HarR^HauRq/x)8VEarR^HarR^HarR^HjAUD.v@bN{B3gZ-x(!wuj{\u0026zParR^HarR^HarR^HarS^.x=}b2jTaYXxk8l\u003cwPz*fA:JJ#w]w\u003eSjtgI+j{\u0026zParR^HarR^HarS^1B.\u003ckGarR^HarR^HjtgkVC0llQarR^HarR^?w]zZbay/j@B8%F*B.I$mvrc0(azbLjz6zdJarR^HarR^HarR^Hjy\u0026eHay/j@B8%F*B.I$tBn", "ln": 6438, "col": 25, "line": 190 }, { "b": "arR^HarR^HarR^HarS^XzG6-uazCvHb5zggx(mo%vrlHlz/PwjaAhd9v}xs(y?d9$jT9ZhB8#LzA+3vpBA}?pjTa\u0026NB8#LzA+3vpffPZ=arR^HarR^HarR^HarR^HarR^?fjX^uj{\u0026zParR^HarR^HarR^HarS^1wnciJ3lQDlarR^HarR^HauRq/x)8VEarR^HarR^Hjtgq+A=0#EarR^HjtgkVC0llQarR^?wncifv@bN{B3gZQv@#B6zGv0=3lQC", "ln": 7250, "col": 11, "line": 210 }, { "b": "v@=p5BuQ3OarR!vw/@Hrz!0i(q/(}#vp%d7xjVfRBy/qqb58a9vrDW9a$jS$jV%]if^n4NarR^HarR^HCwg@9z*9*Iz!0i$x(v(wxMvV@auZ?\u003efkbovwIdUrzepy6jtg+=A+PGmj{\u003cz9xMO9cj]", "ln": 10039, "col": 3, "line": 293 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 10156, "entropy": 4.01 }, "binary": { "peak_region_bytes": 2048, "peak_region_entropy": 4.68 } } }, "id": 47, "mol": "O(Ca₂)H₃(CmPoU₃)", "path": "github.com-wectf-2020-v0.0.0-20210205182610-7448c56d2f34.zip!!github.com/wectf/2020@v0.0.0-20210205182610-7448c56d2f34/note_app_3/index.html", "pid": 0, "risk": 4, "sha": "0a7270b9ad80c42740ec2ab48ce4d517ef94b06f61dad2e2e311cfa185320f0e", "size": 10156, "traits": [ { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "spans": [ [ 3221, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"", "spans": [ [ 1789, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-3", "conf": 0.8, "crit": 1, "desc": "English function-word token \"that\"", "spans": [ [ 3790, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "spans": [ [ 6103, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-6", "conf": 0.8, "crit": 1, "desc": "English function-word token \"with\"", "spans": [ [ 6590, 0 ] ] }, { "id": "micro-behaviors/process/create/load/script::external-script-element-load", "conf": 0.92, "crit": 3, "desc": "Loads external script element", "spans": [ [ 270, 33 ], [ 466, 21 ] ] }, { "id": "micro-behaviors/process/create/load/script::local-script-element-load", "conf": 0.92, "crit": 3, "desc": "Loads local script element", "spans": [ [ 567, 29 ] ] }, { "id": "micro-behaviors/ui/window/password-field::browser-password-input-markup", "conf": 0.9, "crit": 3, "desc": "HTML markup names a password input field", "spans": [ [ 7314, 15 ] ] }, { "id": "micro-behaviors/ui/window/password-field::password-input-field", "conf": 0.82, "crit": 3, "desc": "HTML password input form field", "spans": [ [ 7314, 15 ] ] }, { "id": "micro-behaviors/ui/window/style::css-display-none", "conf": 0.9, "crit": 3, "desc": "CSS display none declaration", "spans": [ [ 1736, 13 ] ] }, { "id": "objectives/credential-access/phishing/credential::three-ds-password-field", "atk": "T1566.002", "mbc": "B0030", "conf": 0.88, "crit": 3, "desc": "3DS password input field", "spans": [ [ 7314, 15 ] ] }, { "id": "objectives/credential-access/phishing/mfa-relay::hidden-list-container", "atk": "T1566.002", "mbc": "B0030", "conf": 0.9, "crit": 3, "desc": "Hidden list markup outside common navigation", "spans": [ [ 6502, 177 ] ] }, { "id": "micro-behaviors/communications/http/url/cdn::cdnjs-asset", "atk": "T1071.001", "mbc": "C0002", "conf": 0.82, "crit": 3, "desc": "References a cdnjs frontend asset URL", "spans": [ [ 156, 29 ] ] }, { "id": "micro-behaviors/communications/http/url/cdn::jquery-cdn-asset", "atk": "T1071.001", "mbc": "C0002", "conf": 0.82, "crit": 3, "desc": "References a jQuery CDN asset URL", "spans": [ [ 295, 31 ] ] }, { "id": "micro-behaviors/ui/window/navigation::browser-location-href-assign", "conf": 0.82, "crit": 3, "desc": "Navigates via location.href assignment", "spans": [ [ 10103, 23 ] ] }, { "id": "micro-behaviors/ui/window/password-field::browser-credential-field-reference", "conf": 0.94, "crit": 3, "desc": "Browser password field reference", "uses": [ 8 ], "spans": [ [ 7314, 15 ] ] }, { "id": "micro-behaviors/ui/window/password-field::browser-password-input-marker", "conf": 0.9, "crit": 1, "desc": "Browser markup names a password input field", "uses": [ 7 ], "spans": [ [ 7314, 0 ] ] }, { "id": "micro-behaviors/communications/http/url/cdn::multiple-frontend-cdn-assets", "atk": "T1071.001", "mbc": "C0002", "conf": 0.85, "crit": 3, "desc": "References multiple public frontend CDN assets", "uses": [ 12, 13 ], "spans": [ [ 156, 29 ], [ 295, 31 ] ] } ], "type": "html" }, { "ctx": [ { "b": "jrW9*lSvh+miDn=zeqxyjzn?Ny-)L5zF89RwO@XQ3oS0kvpRLearR^Hjz!UKvix5[vrcB2BuH*Fr7nD0b0DtRarR^?Bzk\u0026kwJ\u0026\u003ecBy=NXAbV{Qe?/yvBzk\u0026kwJ*CzarR^?y?W^53lQDlarR^HarR^HaAz4fjTa@?D2d5kxK$:%a{]CnarR^HarR^HarUurwOa7HxMOunB2\u003e%cv}oE(B1Q%sz/]P5y*?u}e[n*pfjwQ7CRr(EvSKhzwO\u003e\u003c[BzkkpB.JG:e\u0026kgnflpYwvqZg3v\u003eIRjzz2BuB0p@larR^HarR^HarR!GD2NsTb6myvBt4cBB0p@larR^Wj{\u0026zParS^/v@=p5Bp6ckarR^HarR^HarU-Cv)82HBAzFyiXJc@z!9Aiyh[xcA^ooEz/4dxADL\u0026kC}y*8f!Lgkze0(uyi7NaarR^HarR^HarR^Hx(n37xl4ZdC%9u)xKJUNhz5Pyr=h5Gx*Cc+r8knCDr0ELBXCzFi6{qsq!!/]t608mm@p*\u0026oM\u0026g2i6wC)arR^HarR^HarR^Hv@=HeB8M8kxk8lDb4kwczH38qB-O-\u003cjtg+=A+PGmj{\u0026zParS^/v@=p5BrCTBv)82HBAzFyiXJc@wnVd6e[nZoB.292vrb{iv@Diqvqoj}fkLuiB1.PCzdds7x\u003e5-qx!Ij]g+HHoB7Gh%zGGP5e]true]2CKk0gGtv@=p5BuQ3OarR^?B7ol8Ac9jzA:}lRflqkzBzkkrzddc@e]2CKk0gGtv@=p5BuQ3OarR^?B98XzwJ*CzarR^HarR!CaBsCrarR^HarR^HarR!sz/fUGB7]@iiV{dfgC-PVi%)8MarR^HarR^HarUfjy\u0026stPar@^5hAIl*arR^HarR^HarR!Jz/PwuvSD3*yDrOEA+eV{eN-Eii%)8M", "ln": 0, "col": 1, "line": 1 }, { "b": "jyGvCA+e\u0026Ca$)RFzdLtkBzU?rk0f@OvpK7nfjv3KarR^HjAC1Mx(FeT3lQDlarR^HazCBgd0Gxywn=VAy\u0026r/(BzkVhe[!WmxFavGvSMTic]0d[jV$}JcV-ZdwNxp)wmWbqDKp(rarR^HarR^HarU-lw[tsXv}Y^edgdguarR^HarV7tarR^Hjtg+=A+PGmj{\u0026zParS^Wf*nuJBy=N^l](CMy**^:y-)C5jTa=ZBy!/[wfKhAarR^HarR^HjzXCnwD", "ln": 928, "col": 5, "line": 34 }, { "b": "B8%F*B.I$qy***+xM4Y$wPw]fx(mGaaAITIy?k:NCwgPfxGvm[fFED\u003cb0Et\u003evSMGIjtgIVvR6vt3lQDlauRq[vpA!:k0gGif*k{!arR^?A6uNgBzbPkiV{L3vpA!:azy", "ln": 1138, "col": 19, "line": 41 }, { "b": "ar\u0026J:asnATCwg@9z*9*Iz!0i$x(v(wxKL%}e]#eAB98BJf!1j*jV%]nB75V(uU%Z(wHw]larR^HarR^HCwg@9z*9*Iz!0i$x(v(wxMvV@auZ?{fkbovwIdUrzepNY3lQDlay]z2B.$YcBs}iqBvy1SzdNQblu#dkc)A.Cvrb{^B-Ipxdk2^Ly\u0026%qijS[@.zE^Wfe]kDovruj4zz2QywOa1harR^Hfe1C?xM52OaA}mdBrApXB7F\u003c1zE:(izY\u0026[9yH[SfB-I4oB-RbmB0bKnwGU]lAV!\u003egz!{LqyH}r[Bz(4tB7ol4wO}?$arR!FwPQ)=zdNTdBsnK^jW9H\u0026Bye{7By=\u003eAx(mE1Cp)YIv{%E[z/dgvvrl8", "ln": 2339, "col": 46, "line": 78 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 2671, "entropy": 4.76 }, "binary": { "peak_region_bytes": 2671, "peak_region_entropy": 4.79 } } }, "id": 48, "mol": "H₃(Cm₃PoU)Md", "path": "github.com-wectf-2020-v0.0.0-20210205182610-7448c56d2f34.zip!!github.com/wectf/2020@v0.0.0-20210205182610-7448c56d2f34/note_app_3/note.html", "pid": 0, "risk": 4, "sha": "1b40dd88d83dc9630548c29c2567f098e109e4933098956762a00dce342f36d3", "size": 2671, "traits": [ { "id": "metadata/file/extension/identity::script-content-extension-mismatch", "conf": 0.9, "crit": 3, "desc": "Script content mismatches extension" }, { "id": "micro-behaviors/communications/http/url/navigation::browser-page-url-href-rhs-read", "conf": 0.9, "crit": 3, "desc": "Reads location.href into another binding", "spans": [ [ 2482, 24 ] ] }, { "id": "micro-behaviors/communications/http/url/fragment::location-hash-read", "conf": 0.85, "crit": 3, "desc": "Reads the URL fragment from location.hash", "spans": [ [ 992, 13 ] ] }, { "id": "micro-behaviors/process/create/load/script::external-script-element-load", "conf": 0.92, "crit": 3, "desc": "Loads external script element", "spans": [ [ 270, 33 ], [ 466, 21 ] ] }, { "id": "micro-behaviors/process/create/load/script::local-script-element-load", "conf": 0.92, "crit": 3, "desc": "Loads local script element", "spans": [ [ 567, 29 ] ] }, { "id": "micro-behaviors/communications/http/url/cdn::cdnjs-asset", "atk": "T1071.001", "mbc": "C0002", "conf": 0.82, "crit": 3, "desc": "References a cdnjs frontend asset URL", "spans": [ [ 156, 29 ] ] }, { "id": "micro-behaviors/communications/http/url/cdn::jquery-cdn-asset", "atk": "T1071.001", "mbc": "C0002", "conf": 0.82, "crit": 3, "desc": "References a jQuery CDN asset URL", "spans": [ [ 295, 31 ] ] }, { "id": "micro-behaviors/ui/window/navigation::browser-location-href-assign", "conf": 0.82, "crit": 3, "desc": "Navigates via location.href assignment", "spans": [ [ 2403, 23 ] ] }, { "id": "micro-behaviors/communications/http/url/cdn::multiple-frontend-cdn-assets", "atk": "T1071.001", "mbc": "C0002", "conf": 0.85, "crit": 3, "desc": "References multiple public frontend CDN assets", "uses": [ 5, 6 ], "spans": [ [ 156, 29 ], [ 295, 31 ] ] } ], "type": "html" }, { "id": 49, "mol": "H₃(Cm₄Db₂U₂)", "sha": "feae076389a8b1e0a379a9b74a13ba0962f8b74bccd36733ecd0a539a17ef482", "path": "github.com-wectf-2020-v0.0.0-20210205182610-7448c56d2f34.zip!!github.com/wectf/2020@v0.0.0-20210205182610-7448c56d2f34/note_app_3/static/main.js", "risk": 4, "size": 4594, "type": "javascript", "depth": 1 }, { "id": 51, "mol": "H₃(CrDbOs)", "sha": "fea0c7d14c80f9ace02c8be3c862cec0c6fb7eb7daaf5652adb5e7be277db172", "path": "github.com-wectf-2020-v0.0.0-20210205182610-7448c56d2f34.zip!!github.com/wectf/2020@v0.0.0-20210205182610-7448c56d2f34/re/unobfuscated.php", "risk": 3, "size": 2264, "type": "php", "depth": 1 }, { "ctx": [ { "b": "ju)^#A0*k@Bz\u0026o%fMRL.j0nYTrwNDjazkRmzY\u003c0@qE:-eazkRmzY?R]zaNwZazrV5nOZvfwN/y(ar\u003e6nhAa(=hFchGh8!+{g=eC]fKe\u0026Xvo!4nw)v5Egf/5Vf^nX4xk.)gaxqAJl}YP:mmRt)qAt}rAb4gNiV@6NBz\u0026pFBV0\u00263j0nP1B-Hkraz24@zY\u0026:!g=4(PdlwU+z//[uCtzZpp=/!oizjx+iV@0zxM21qtZeertZeestROb[tR[ctf/y\u003c[CS4J^f/g:)g+-fVhA1!{h8FM.hzFC\u003eg=FV:gbf$mazkRmzY\u003cjmrwNDkaBcTrA8nOrw{503BzkVhaBk?zwL%{4nO}g1yBHxMazkRmzY\u00261/yew?gaAfhGo\u0026B7}A+funA=90BmNos=zY?hajS(1wzb0]zj0nfOBz\u0026pizcnL-j0mA)xMWxqas6N1xIgc7jS\u003e}Nf/pT\u0026CSdD:CSdD:CSdrYf/y*)h.[R}h^wj0tZed.tZeeptZedZtRO8\u003ctRO8]tZe2ntRO5\u003etRO8{tRO8[tZe2oDN8=Li95H%b0c]Wz//[uk%!{\u003elouq?vqnRSiV]XKh8[SaauZ?\u003etZe7=tRN#\u0026tZe8mtZe4YtZe4Vb0c]Wz//[uqB$LAs34J\u003clsjv(iV]Xqk%Y^mauZ\u0026*BAg-ewPhD]v}v5jtRN#TefDq/efFLsy?l%^wPRo?z/fVdzGG}FbUA8\u003coew1Cj0nfOBz\u0026pvhdPAWj0n3IsUJxcaBLwBz//[uBAqp}p=/!ulUyQiiV@cGasFxYbW\u003e.av\u0026#{TjS(H5E0^4Zvrc17tqozajV$}Jb3V#.tS1xzCS4J^CS4A:f/p^)f/yZfdjDx^azkRmzY\u0026}pybp8@aBLv", "ln": 0, "col": 1, "line": 1 }, { "b": "A8nRsBAqp}p=Y.hB-7Yhx(v(ip!M4HAWSh8zb0]zdiJ%Wxk.)gawWe]gdjhDpJ*zbl](D5z/Pz$v}V#kB98CfB8U@fBsnzazb0]zdiJ5uas6Y:vNi0%jW6#loJKk}gBTC[azkRmzY\u003cmrCVO6gaA}KAs6vTcbURo1B2a}4az\u003eTDc)RF/iDD#9j0nfOBz\u0026p9l{@+Lj0mY{l[@*BazCBgc)p0yb3YvGi9ZX:fKcH\u0026tZe4.tZe4VtSjuwh.!MZgC\u0026uYgC-n]fKe\u0026Ugf/5Whc-3}tSarwhz[-:hA1/0fKe\u0026UhE5f}tZed:tZe4YtRO5)tZe4VtRO5[tSaovCR.u+hz!V-gDeM-gCJcVgCA5(f\u003cDQ(a$K\u0026XtZe4-tRO5\u003ctZe4-tZe4-tSaAzf/g:)CS4D+f/g^[f/g:)CR.fYf/gQ\u0026hzXO@g*CnYiB1o}gH8*@tRO5(tRO5(tSjuwhzOJZhzFDYhz!V-gC\u0026uYhA1/+gC\u0026t\u003eg=wO%gf=Z(tZed-tZe4XtZe4YtZed.a$K\u0026XtSjuwf/gZ(h.!L(g=5w{gH8*(tZe4-tRO5\u003etZedZtSaJCf/g^[hzXO)g=5w{g*Cn-f\u003cDQ)tZe4WtZe4:tZe4WtSauxCS4oYhz[.$f\u003cF@ViB3!+gf=Z)tRO5(tZe4VtZed.tRO5)tZedYtRO5\u0026a$K\u0026XtRO5\u003ctSarwCR.fYCS4oYhAa(=hzOI@fKe\u0026UfKcH[tZe4+tRO5(tSjxxf/gW\u003eCR.3Uhz[.$hc+wZiB3!+hc-3@tZed.tSjxxCR.9WCR.l.CR.o-CR.fYf/gW\u003ef/g:)CR.l.CR.3Uhzww]gH8*[a$K\u0026XtZe4+tZe4WtZed:tRO5\u003ctZe4ZtZed+tRO5[tZed:tRO5)tZe4.tZedYtRO5)tSauxCS4D+CS4A:CS4u.hzXP.hzFDYhz!V-gDeM-gCJb?g=5xYgDeL%h^wm1tZe4ZtZe4XtZe4VtSaDAhAa(1fKe\u0026Xhx\u003cW{b3W2+tRO5\u003ctSaJChAa(0g*z:(hc+w:hE7F+hE4%[hc-3@tZedYtSaxyhz!V-gx", "ln": 847, "col": 842, "line": 2 } ], "depth": 1, "facts": { "imp": [ [ "", "iK43N" ], [ "", "str_replace" ], [ "", "file_get_contents" ], [ "", "z3Uer" ], [ "", "pkxLr" ], [ "", "explode" ], [ "", "str_split" ], [ "", "md5" ] ], "tgt": [ "explode", "file_get_contents", "iK43N", "md5", "pkxLr", "str_replace", "str_split", "z3Uer" ], "funcs": [ [ "z3UeR", 256 ], [ "PKxlr", 858 ], [ "Ik43N", 4916 ] ], "metrics": { "ast": { "op.eq": 2, "op.ne": 2, "op.lor": 1, "op.land": 1, "op.lnot": 2, "max_depth": 14, "op.concat": 2, "call_count": 8, "node_count": 1803, "max_array_len": 30, "op_density.eq": 0, "op_density.ne": 0, "op_density.lor": 0, "op_density.land": 0, "op_density.lnot": 0, "op_density.concat": 0 }, "file": { "size": 5323, "entropy": 4.36 }, "text": { "lines": 2, "top_char": 92, "max_ws_run": 1, "digit_ratio": 0.67, "space_count": 210, "char_entropy": 4.36, "unique_chars": 86, "top_char_null": 0, "escape_density": 20.72, "lines_over_200": 1, "lines_over_500": 1, "string_density": 0.5, "top_char_ratio": 0.21, "avg_line_length": 2660.5, "lines_over_1000": 1, "max_line_length": 5316, "hex_escape_count": 524, "last_line_length": 5316, "long_token_count": 32, "whitespace_ratio": 0.04, "identifier_density": 62, "line_length_stddev": 2655.5, "octal_escape_count": 579, "normalized_string_count": 0.71, "normalized_unique_identifiers": 65 }, "binds": { "count": 5 }, "binary": { "peak_region_bytes": 1024, "peak_region_entropy": 5.66 }, "source": { "function_count": 3 }, "strings": { "count": 1, "empty_count": 1 }, "functions": { "count": 3, "density": 150, "avg_params": 0.67, "code_ratio": 1.5, "max_params": 1, "one_liners": 3, "avg_name_length": 5, "no_params_count": 1, "avg_length_lines": 1, "max_length_lines": 1, "min_length_lines": 1, "avg_param_name_length": 6 }, "identifiers": { "count": 124, "unique": 65, "avg_length": 5.38, "max_length": 17, "min_length": 3, "avg_entropy": 2.31, "reuse_ratio": 0.52, "length_stddev": 1.79, "has_digit_ratio": 0.49, "all_lowercase_ratio": 0.11, "numeric_suffix_count": 10 } } }, "id": 52, "mol": "O(As₂)H₄(CmCrDb₂Os)Md(Pt)Th", "path": "github.com-wectf-2020-v0.0.0-20210205182610-7448c56d2f34.zip!!github.com/wectf/2020@v0.0.0-20210205182610-7448c56d2f34/re/x.php", "pid": 0, "risk": 114, "sha": "6432dd8a731b8006951dba758a20bae32689c876b2b2c990696d156decc64cb0", "size": 5323, "traits": [ { "id": "metadata/lang/encoded/unicode-escape::dense-php-byte-escapes", "conf": 0.96, "crit": 3, "desc": "Dense PHP byte escapes" }, { "id": "micro-behaviors/communications/http/client/file-read::php-file-get-variable-source", "conf": 0.88, "crit": 3, "desc": "PHP reads content from a variable source", "spans": [ [ 538, 17 ] ] }, { "id": "micro-behaviors/crypto/hash/digest::md5-php", "mbc": "C0029", "conf": 0.7, "crit": 3, "desc": "MD5 hash computation", "spans": [ [ 980, 3 ] ] }, { "id": "micro-behaviors/data/string/replace::php-str-replace-call", "conf": 0.9, "crit": 3, "desc": "PHP replaces matched string content", "spans": [ [ 515, 11 ] ] }, { "id": "micro-behaviors/data/string/split::php-str-split-call", "conf": 0.9, "crit": 3, "desc": "PHP str_split string operation", "spans": [ [ 911, 9 ] ] }, { "id": "micro-behaviors/os/stdio::php-echo-statement", "conf": 0.95, "crit": 3, "desc": "Emits data with a PHP echo statement", "spans": [ [ 56, 43 ], [ 145, 13 ], [ 178, 58 ] ] }, { "id": "objectives/anti-static/obfuscation/code-metrics/strings::few-strings", "atk": "T1027", "mbc": "B0032", "conf": 0.4, "crit": 3, "desc": "Very few string literals" }, { "id": "metadata/file/function::high-function-density", "conf": 0.85, "crit": 2, "desc": "High function density" }, { "id": "metadata/file/padding::low-whitespace", "conf": 0.7, "crit": 2, "desc": "Very low whitespace ratio (minified/compressed)" }, { "id": "objectives/anti-static/obfuscation/code-metrics/identifiers::php-single-long-line", "atk": "T1027", "mbc": "B0032", "conf": 0.9, "crit": 3, "desc": "PHP source contains very long line", "spans": [ [ 6, 5316 ] ] }, { "id": "objectives/anti-static/obfuscation/code-metrics/structure::last-line-over-1000", "atk": "T1027", "mbc": "B0032", "conf": 0.9, "crit": 3, "desc": "Last line is over 1000 chars" }, { "id": "objectives/anti-static/obfuscation/code-metrics/structure::single-long-line-outlier", "atk": "T1027", "mbc": "B0032", "conf": 0.9, "crit": 3, "desc": "Exactly one line exceeds 1000 chars" }, { "id": "third_party/SigBase/WEBSHELL/PHP/OBFUSC/Encoded/Mixed/Dec/And/Hex", "conf": 0.9, "crit": 5, "desc": "PHP webshell obfuscated by encoding of mixed hex and dec", "spans": [ [ 0, 2 ], [ 61, 29 ], [ 183, 44 ], [ 354, 43 ], [ 1019, 46 ], [ 1138, 41 ], [ 1262, 34 ], [ 1382, 38 ] ] } ], "type": "php" }, { "id": 55, "mol": "H(Db₂)", "sha": "f949d7affd698a2cdbdaf2ed6bd8ceb4926000de882f2fbb4655cabb04ef8adb", "path": "github.com-wectf-2020-v0.0.0-20210205182610-7448c56d2f34.zip!!github.com/wectf/2020@v0.0.0-20210205182610-7448c56d2f34/url_longener/controllers.py", "risk": 2, "size": 1805, "type": "python", "depth": 1 }, { "id": 57, "mol": "H₂(Cm₆Db)", "sha": "3213d34a3c42b34bbe3e454580ee5ef4006ba51664119d287aaa62b5eaae20a1", "path": "github.com-wectf-2020-v0.0.0-20210205182610-7448c56d2f34.zip!!github.com/wectf/2020@v0.0.0-20210205182610-7448c56d2f34/url_longener/server.py", "risk": 3, "size": 1642, "type": "python", "depth": 1 }, { "ctx": [ { "b": "w].*bay/tay?m9#x(v)gazCXiz/P}xwmYvYB.(egx\u003e8k(x(d*cA=-BCx(dz*x(d*cA=-BsCxsgaze:AlBrCZGx\u003edM+ze:AlBrCHy3uG^0C4CY3B7F\u003c4wPRo{wQbyYaAITBd0oVDwg\u00261Ex\u003ef4GdjDw\u0026aAITBd0oVDwg\u00261Ex\u003ef4GdjDw\u0026aAITBd0oVDwg\u00261Ex\u003ef4GdjDw\u0026aAITBd0oVDwg\u00261Ex\u003ef4GdjCPFa%Ew8wN/U0vruBdaARp9BrC7bvqYZ?B0bHmADL\u0026lBrCKhD2dzcwftP7ay]g@Buf+Q3lQDlar\u003e=kA:-*ab03\u0026Sx\u003e8lcz!pb8wPP5nwPq\u003c7B95Kzvrb^[B08(xe[V^VDNB4=iX=49w]zYjff:XAf!0CLarR^JvrDW9z/PMrvruj4zx.a:B98BBfcCyUwPzd1z!\u0026{43lQDlatbo03lQDlar\u003eokwo/vWaz#atazCXiy?mD{zGGD2aBdKu3vJm\u0026zE:(evrcB2ay/t2wH[%qwNPaXA=S=Ov@DmbwO#PjA+funA=bD0ayYQsw{503aARJAA::emxMOunaAz4mAbPSnwEoR9a{}\u003c(w/$@0yH{\u003c[wPI*ezGxwqw{503dlm", "ln": 0, "col": 1, "line": 1 }, { "b": "AbYxec#@)sefFCsx\u003eqg7uTWFQAW:3RarR^HarR^HA+frmy\u0026*^.aswJzarR^HarR^HAa9^dwNxE?ADL\u0026lBrAZ?Aa9^dwNxE?Avt\u003csAv-kxy?WD#ByeD!wo6aaarR^HarR^H", "ln": 490, "col": 12, "line": 18 }, { "b": "A^oXMarR^HarR^HarR^Hx\u003ewGbvrcB2uVGZ$B.bSotoXfcyH}xct{8o[aswJVz/M$tvrcB2uVGZ$B.bSotoXfcyH}xct{8o[asyk*pFKz!r8ldQpa57farR^HarR^HarR^HarR^HAa9^dwNxE?ADL\u0026lBxY@hz!\u0026{4b3=rOaAITBd0oVDwg\u00261Ex\u003ef4GdjCPDarR^HarR^HarR!pz!9Agazts{wmY!5efFCvzGGDcBrAZ?w{503", "ln": 689, "col": 10, "line": 24 }, { "b": "3lQDlarR^HarR^HaAz4mB.(dxd)k15tYK7!cM\u003c]Zv@DmbwO#O%arR^HarR^HwQ4Y@Ac9i\u003eCW\u003er7BzkVhayPslwJyevarR^HarR^HarR!CA+PAkc$K?marR^HarR^HarR^HA+frmy\u0026*^IjS[@?x()][v@C)?c]AXjdgdguarR^HarR^HarUYoB9hqvas/O$CxdztwNxaZ", "ln": 1098, "col": 44, "line": 30 }, { "b": "v@Dp3x\u003equdjS[=RAA^D{Av$%ywmZ0lb13o!yIvuva$jS+atC].3lQDlarR^HazbLjazz%jzxJCcz!\u003c5#B2\u003cTJarR^HarR^HarR!vw/@puA+]90z/fi0zE)\u0026}vrDW9a%pPqazA\u003ezarR^HarR^HarR^HarR^HA+funA=91mCxtDFwN/T?wHImBB8U@fBsns@a$i", "ln": 1384, "col": 9, "line": 43 }, { "b": "wN/:(Bye/{C}p7Dy?EWbx([39B3i.Pnk?o3hyz=VtpjJhyH}xht).X%arR^HarUYoBAIRwar\u00260parR^HwQ4Y@Ac9i\u003eCW\u003er7BzkVhayPslwJyevarR^HarR!CA+PAkc$K?mao", "ln": 1551, "col": 60, "line": 46 }, { "b": "ogqP13jprPw/$.$ByeZ1B95*JwPodW3lQDlaARTHiTM#LarR^HarUYoBAIRwaAz4ktxjp{e[]ilwQ2QEnn\u0026M\u003eiWc0}d\u003ccML3lQDlaz2!cwPh-lmr\u0026rNAcb/jzxJweaz0OvarR^HarR^HAb]VgBspYH3lQDlarR^HaAz4nB-Ivxa%Ev3wmYu}xjVf(w[=pbByff0c#@)sdlm!UarR!GA^oXMarR^HarR^HboQ]xy\u003cvdBvqxA%Bzbkdw[=pbBrCTov@#B6zxJ\u003efaA.91arR^HarR^HA+funA=91uwPp{{wPotpzE^s6c)zVjwPxv*xjU$5iWc0}d\u003ccML3lQDlaz2!cwPh-lmr\u0026rNAcb/jzxJweaz0OvarR^HarR^HAb]VgBspYH3lQDlarR^HaAz4nB-Ivxa%Ev3boQVwBz#pZfe4A=Byx0dAcb/hwIdFhz7/WlfkboFeN@jbeOM!PvSV3)zy]%zwI4?vx\u003eIc$vqEJ9y?WD#Bs?iCeN-g2A+frkeN-EieN@ZpzE)s1x(v)geOo3wz7P\u003cywI4zdz/]Oxy\u0026r-)eN\u0026d8vqYN^AXhuzwO\u003c2vz.kEqzdLqhA=k!DBzbkqB75]%eOnNreOPeQvpS[?wPI{7B1W(hwO95$wPRo[A42:rAv-kxy?WD#ByeD!wo6aW3lQDlaARTHiTM#LarR^HarR)KxjVfcvpKz4vqE62A3f7haA.:pAV/NtwO@S1wOt^}wft=5x(ne5arR^HarR^HA+funA=91uwPp{{wPotpzE^s6c)z+BmSir\u003evrb)\u0026wgZn?AYLx[as!M?t).X%arUluv}xR3avQJ+wPh:9z/cXaB0b3P3lQDlarR^HaAz4nB-Ivxv@b\u003c\u003czGGk]wmPZ+fKk1)3s)ZWazkncuVoB]vqQ6lA+fktiTM#LarUxgaz+Rbc#@)stqozoB8U@fBsns$a$j@-juT/wiTM#Lao", "ln": 1679, "col": 25, "line": 50 }, { "b": "e]$#Fx(\u003e:Eko.KXf\u003cLbearR!Cvrb^[B09Q*wmYvYB.(egx\u003e8lkB98BK3lQDlazbLjaB22yzxJCczGGDcByeD*By/G1ADL\u0026lBzkVhuU%j(yC6WEy?W#ta%[G.iTM#LarR^HarU=DC@=oParR^HarR^HarR^PyB\u003cSTauZ\u0026(e]$#Fx(\u003e:EjT8rZarR^HarR^HarQ", "ln": 2491, "col": 41, "line": 79 }, { "b": "A+fkway/k4wO#P%vpS[?dlm!UarR!vw/$]3zyxKpAvA1)atV4=arR^HarR^HA+funA=90{z/fa[arR^HA+funA=91D3lQDlarR^Har\u003e=kA:-*ab03\u0026VwPRo#vrb^[B0#6uAvABCarR^HarR^Hb6m:swO@XMazkncuTX80xM4{9Dsp]fz/c$zwPodI3lQDlarR^", "ln": 2747, "col": 15, "line": 90 }, { "b": "uUKEcA+fkway/k4wO#P%vpS[?dj+/GarR^HarR^JBZVEPazkncuUj1)B97=ivjlecAvABCarR^HarR^Hb4$[oBrS:*xjVf(xM4%lc#@)sdgdguarV7t3jprPw/#qrx()][v@C)?c$vgawHPUEarR^Hx\u003ewF$z!9A4jV%]yfFCJ{arR^HarR^HA+funA=90znk@L+fek7latLS8awUTnA:iGa3lQDlazCBgv@C)?au.\u003egg+Z:E3lQDlarR^HaAz4nB-Ivxb1LWjp+KKQf^5qbg:2K?r3jUarzC}!A:iGa3lQDlazCBgv@C)?au.\u003egg+ZZD3lQDlarR^HaAz4nB-Ivxb1LWjp+KKQf^5qbgAYd.qBi@yl}6\u003cQA:iGa3lQDlazCBgv@C)?au.\u003egh83ZB3lQDlarR^HaAz4nB-Ivxb1LWjp+KKQf^5tcfD-}Zr7fXWk$\u0026z1mn^ePqxOzaqCQg}A:iGa3lQDlazCBgv@C)?au.\u003eggCyNB3lQDlarR^HaAz4nB-Ivxb1LWjp+KKQf^5nag9x4ZrzC}!A:iGa3lQDlaAz4nB-Ivxb1LWjp+KKQf^5k9g:2K?avw}1r7fLYtYK7!a{[U:lR*AJpFLm/ml%sgqD1Y3aBsCrarR^Jq!o#)wPw$Qar\u003c-$z/)BGaz++lBzLIhAcVLsz/cXswPz%9AV$\u003cs3jmbJwO96eA+PSbuUB1VwmY^fxK$Q.wPz\u0026viTM#LarUYoB9hqvauZ?\u003ea{]CnarU9ey*Q\u003c!vpS}\u0026B09Q*DNZHjpFBLVpg3KXk$1dtq.f4vdRJy4wmY!5Ef}8tarUomAV/cux(k54y\u00260D(wNPaXA=TnGarR^HarR^HA+frmy\u0026*^IjS\u003e{{B2\u003eA\u0026B6J-\u003czxZhHasI1RayP85uUB1VwmY!5twEH%A+fiavpJ\u003c%b3Xw[a$K\u0026XtYI2qe]\u003eJxy***+c)z]3zxZROb3Y1fdjCPDarR!EwPS6nzxJ$hB9hqv3jmbJwO95$wO#71vru6/zE[30vrDW9z/PMrvruj4zyxKpAvA{QarR^HA+funA=91mCxtDGzEWP}wHI)MBzkP6cPSw:zGEpGx(dAlBzkP6c[cO@asznHyH}xhiV@DOAA:Sez!\u0026{4b3/QFaAIamC4CY3B7F\u003c4wPRo{wQb*HvqGN{A+PSez9omqq.*i*cN/xf", "ln": 2913, "col": 18, "line": 96 } ], "depth": 1, "facts": { "imp": [ [ "", "str" ], [ "", "uuid.uuid4" ], [ "", "str" ], [ "", "uuid.uuid4" ], [ "", "str" ], [ "", "uuid.uuid4" ], [ "", "str" ], [ "", "uuid.uuid4" ], [ "", "parse_req" ], [ "", "write_code" ], [ "", "str" ], [ "", "uuid.uuid4" ], [ "", "func" ], [ "", "write_code" ], [ "", "generate_new_authorization.decode" ], [ "", "generate_new_authorization" ], [ "", "write_header" ], [ "", "print" ], [ "", "write_code" ], [ "", "write_header" ], [ "", "req.index" ], [ "", "jwt.decode" ], [ "", "i.split" ], [ "", "print" ], [ "", "req.index" ], [ "", "print" ], [ "", "req.index" ], [ "", "print" ], [ "", "req.index" ], [ "", "len" ], [ "", "defaultdict" ], [ "", "content_after_question_mark.split" ], [ "", "x.split" ], [ "", "print" ], [ "", "len" ], [ "", "get_params" ], [ "", "get_authorization" ], [ "", "get_ip" ], [ "", "get_first_ua" ], [ "", "get_host" ], [ "", "jwt.encode" ], [ "", "int" ], [ "", "time.time" ], [ "", "collections" ], [ "", "defaultdict" ], [ "", "jwt" ], [ "", "os" ], [ "", "time" ], [ "", "uuid" ] ], "mbr": [ "content_after_question_mark.split", "generate_new_authorization.decode", "i.split", "jwt.decode", "jwt.decode.token", "jwt.encode", "parse_request.token", "req.index", "req.token", "time.time", "uuid.uuid4", "x.split" ], "tgt": [ "content_after_question_mark.split", "defaultdict", "func", "generate_new_authorization", "generate_new_authorization.decode", "get_authorization", "get_first_ua", "get_host", "get_ip", "get_params", "i.split", "int", "jwt.decode", "jwt.encode", "len", "parse_req", "print", "req.index", "str", "time.time", "uuid.uuid4", "write_code", "write_header", "x.split" ], "funcs": [ [ "make_response", 454 ], [ "wrapper", 483 ], [ "get_authorization", 1339 ], [ "get_host", 1685 ], [ "get_first_ua", 1819 ], [ "get_ip", 2174 ], [ "get_params", 2376 ], [ "parse_req", 2733 ], [ "write_code", 3007 ], [ "write_header", 3460 ], [ "generate_new_authorization", 3692 ] ], "metrics": { "ast": { "op.add": 16, "op.lor": 1, "op.mod": 2, "max_depth": 17, "call_count": 47, "node_count": 1164, "member_count": 12, "max_array_len": 2, "op_density.add": 0.01, "op_density.lor": 0, "op_density.mod": 0, "max_concat_chain": 4, "member_depth_max": 3, "self_compare_count": 1 }, "file": { "size": 3841, "entropy": 4.77 }, "text": { "lines": 131, "top_char": 101, "max_ws_run": 1, "digit_ratio": 0.03, "space_count": 906, "char_entropy": 4.77, "unique_chars": 81, "top_char_null": 0, "string_density": 0.39, "top_char_ratio": 0.08, "avg_line_length": 28.32, "max_line_length": 166, "empty_line_ratio": 0.14, "last_line_length": 110, "long_token_count": 1, "whitespace_ratio": 0.27, "identifier_density": 1.44, "line_length_stddev": 26.1, "normalized_string_count": 4.46, "repeated_char_sequences": 18, "suspicious_identifier_ratio": 0.1, "normalized_unique_identifiers": 6.97 }, "binds": { "count": 18 }, "binary": { "peak_region_bytes": 769, "peak_region_entropy": 5.12 }, "source": { "function_count": 11 }, "imports": { "count": 6, "stdlib_count": 4, "stdlib_ratio": 0.67, "third_party_count": 2, "third_party_ratio": 0.33 }, "strings": { "bytes": 650, "count": 51, "avg_length": 12.75, "max_length": 272, "avg_entropy": 2.21, "empty_count": 6, "entropy_stddev": 1.31 }, "comments": { "chars": 239, "count": 3, "lines": 3, "to_code_ratio": 0.02, "url_in_comments": 1 }, "functions": { "count": 11, "nested": 1, "density": 8.4, "avg_params": 1.27, "code_ratio": 0.86, "max_params": 2, "length_stddev": 5.82, "avg_name_length": 11.82, "avg_length_lines": 10.27, "max_length_lines": 22, "min_length_lines": 2, "avg_nesting_depth": 0.09, "max_nesting_depth": 1, "high_entropy_names": 1, "avg_param_name_length": 5.14 }, "identifiers": { "count": 188, "unique": 49, "avg_length": 7.82, "max_length": 27, "min_length": 1, "avg_entropy": 2.29, "reuse_ratio": 0.26, "length_stddev": 5.62, "has_digit_ratio": 0.02, "sequential_names": 5, "single_char_count": 5, "single_char_ratio": 0.1, "high_entropy_count": 2, "high_entropy_ratio": 0.04, "all_lowercase_ratio": 0.94, "all_uppercase_ratio": 0.02, "numeric_suffix_count": 1 } } }, "id": 58, "mol": "H₂(Cm₅Db)", "path": "github.com-wectf-2020-v0.0.0-20210205182610-7448c56d2f34.zip!!github.com/wectf/2020@v0.0.0-20210205182610-7448c56d2f34/url_longener/utils.py", "pid": 0, "risk": 3, "sha": "3154ec71e0caa6ebaf73e1d74e191ca1fef788a8020ebeef1a06ae9b21aef05f", "size": 3841, "traits": [ { "id": "metadata/lang/natural::lang-english--atom-1", "conf": 0.8, "crit": 1, "desc": "English function-word token \"the\"", "spans": [ [ 1871, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-2", "conf": 0.8, "crit": 1, "desc": "English function-word token \"and\"", "spans": [ [ 379, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-3", "conf": 0.8, "crit": 1, "desc": "English function-word token \"that\"", "spans": [ [ 193, 0 ] ] }, { "id": "metadata/lang/natural::lang-english--atom-5", "conf": 0.8, "crit": 1, "desc": "English function-word token \"for\"", "spans": [ [ 288, 0 ] ] }, { "id": "micro-behaviors/communications/http/header/custom::x-forwarded-for", "atk": "T1071.001", "mbc": "C0002", "conf": 0.7, "crit": 3, "desc": "X-Forwarded-For proxy header", "spans": [ [ 2293, 15 ] ] }, { "id": "micro-behaviors/communications/http/message::host-header-line-token", "conf": 0.85, "crit": 3, "desc": "HTTP Host header name token", "spans": [ [ 1743, 5 ] ] }, { "id": "micro-behaviors/communications/http/message::user-agent-header-line-token", "conf": 0.85, "crit": 3, "desc": "HTTP User-Agent header name token", "spans": [ [ 1925, 11 ] ] }, { "id": "micro-behaviors/communications/http/response::http-204-protocol-status", "conf": 0.9, "crit": 3, "desc": "HTTP 204 No Content status line", "spans": [ [ 3362, 23 ] ] }, { "id": "micro-behaviors/communications/http/response::http-403-forbidden", "conf": 0.75, "crit": 3, "desc": "HTTP 403 forbidden response text", "spans": [ [ 3195, 13 ] ] }, { "id": "micro-behaviors/communications/http/response::http-versions", "conf": 0.75, "crit": 3, "desc": "HTTP protocol version strings", "spans": [ [ 3065, 8 ] ] }, { "id": "micro-behaviors/communications/http/response::wire-http-200-status", "atk": "T1190", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "HTTP response line returns status 200", "spans": [ [ 3065, 12 ] ] }, { "id": "micro-behaviors/communications/http/url/encoded::long-base64-like-path-segment", "conf": 0.9, "crit": 3, "desc": "Path has long Base64-like segment", "spans": [ [ 2035, 138 ] ] }, { "id": "micro-behaviors/communications/url/reference::python-comment-url-reference", "conf": 0.9, "crit": 3, "desc": "Python comment contains a URL", "spans": [ [ 2006, 11 ] ] }, { "id": "micro-behaviors/data/serialize/envelope::result-assignment-key", "conf": 0.4, "crit": 1, "desc": "Result field or assignment key", "spans": [ [ 522, 0 ] ] }, { "id": "micro-behaviors/data/serialize/schema-object::host-field-key", "conf": 0.9, "crit": 3, "desc": "JSON-like host identity field", "spans": [ [ 2977, 7 ] ] }, { "id": "micro-behaviors/communications/http/message::host-user-agent-header-pair", "conf": 0.94, "crit": 3, "desc": "Co-located Host and User-Agent headers", "uses": [ 5, 6 ], "spans": [ [ 1743, 5 ], [ 1925, 11 ] ] } ], "type": "python" }, { "ctx": [ { "b": "arR1/k#QY-pF%O6jS\u003e}eA7j\u003e/lQ=oexlcBHvpz-nzb.X^3jprPw/$O%wN/H7B7Gf0zFslguVfy*efFRAB95\u0026(3lQDlay/LmA+fcguUBw0BrAZ?w*g]gBz#pZfe3*NA:\u003c5$e[nGDa{]CnarU-py?mG#B.$G7vRNJdwPPtgB-IIlzGGl0z/Z1H3lQDlaAIagwO#j8zc}i\u003cya-}9wm5?+z!\u003c5#d0)sVvqPN6iV]!UwnM3#uVZj4wO@\u003eDasztvy\u0026%qpiV}l+q=u:[qBA5UcVAHoxEt?-cOD\u0026}dgc", "ln": 0, "col": 1, "line": 1 } ], "depth": 1, "facts": { "imp": [ [ "", "selenium_obj.get" ], [ "", "selenium_obj.add_cookie" ] ], "mbr": [ "selenium_obj.add_cookie", "selenium_obj.get" ], "tgt": [ "selenium_obj.add_cookie", "selenium_obj.get" ], "funcs": [ [ "check", 38 ] ], "metrics": { "ast": { "max_depth": 9, "call_count": 2, "node_count": 79, "member_count": 2, "member_depth_max": 2 }, "file": { "size": 230, "entropy": 5.17 }, "text": { "lines": 8, "top_char": 101, "max_ws_run": 1, "digit_ratio": 0.01, "space_count": 25, "char_entropy": 5.17, "unique_chars": 50, "top_char_null": 0, "string_density": 0.88, "top_char_ratio": 0.07, "avg_line_length": 27.75, "max_line_length": 84, "empty_line_ratio": 0.38, "last_line_length": 84, "whitespace_ratio": 0.14, "identifier_density": 1.38, "line_length_stddev": 26.41, "normalized_string_count": 2.47, "trailing_whitespace_lines": 1, "normalized_unique_identifiers": 2.33 }, "binds": { "count": 2 }, "binary": { "peak_region_bytes": 230, "peak_region_entropy": 5.17 }, "source": { "function_count": 1 }, "strings": { "bytes": 62, "count": 7, "url_count": 1, "avg_length": 8.86, "max_length": 19, "avg_entropy": 2.42, "entropy_stddev": 1.2 }, "functions": { "count": 1, "density": 12.5, "avg_params": 2, "code_ratio": 0.5, "max_params": 2, "avg_name_length": 5, "avg_length_lines": 4, "max_length_lines": 4, "min_length_lines": 4, "avg_param_name_length": 8 }, "identifiers": { "count": 11, "unique": 7, "avg_length": 7.71, "max_length": 12, "min_length": 3, "avg_entropy": 2.55, "reuse_ratio": 0.64, "length_stddev": 3.49, "all_lowercase_ratio": 0.86, "all_uppercase_ratio": 0.14 } } }, "id": 59, "mol": "O₂(CAs)H₂(CmDb)", "path": "github.com-wectf-2020-v0.0.0-20210205182610-7448c56d2f34.zip!!github.com/wectf/2020@v0.0.0-20210205182610-7448c56d2f34/uv_worker/corbra.py", "pid": 0, "risk": 35, "sha": "2ccaac8cb4247be7c8c1edda9f0c1f2fa07a22b0fe25ca9bad77869942c59e14", "size": 230, "traits": [ { "id": "micro-behaviors/communications/http/browser-automation::cookie-insertion-api-call", "atk": "T1539", "conf": 0.96, "crit": 3, "desc": "Browser automation cookie insertion call", "spans": [ [ 149, 23 ] ] }, { "id": "objectives/anti-static/obfuscation/payload/encrypted::py-passphrase-literal-assign", "atk": "T1027.013", "mbc": "B0032", "conf": 0.85, "crit": 3, "desc": "Python secret or cipher key literal", "spans": [ [ 3, 32 ] ] }, { "id": "micro-behaviors/data/parse/vocabulary::password-key-value-pair", "conf": 0.8, "crit": 3, "desc": "password/passwd key with inline value", "spans": [ [ 3, 32 ] ] }, { "id": "objectives/command-and-control/infrastructure/domain/tld::tld-cf", "atk": "T1071", "conf": 0.8, "crit": 4, "desc": ".cf domain (free)", "spans": [ [ 90, 18 ] ] }, { "id": "objectives/command-and-control/infrastructure/domain/tld::free-tld", "atk": "T1071", "conf": 0.8, "crit": 4, "desc": "Free/abused top-level domain", "uses": [ 3 ], "spans": [ [ 90, 18 ] ] }, { "id": "objectives/command-and-control/infrastructure/domain/tld::suspicious-tld", "atk": "T1071", "conf": 0.75, "crit": 3, "desc": "Suspicious top-level domain", "uses": [ 4 ], "spans": [ [ 90, 18 ] ] } ], "type": "python" }, { "id": 60, "mol": "H(Cm)", "sha": "4bacdc1f48fc1853657a5767445f0583c0bb793bf2b85beae2e15634060f9e61", "path": "github.com-wectf-2020-v0.0.0-20210205182610-7448c56d2f34.zip!!github.com/wectf/2020@v0.0.0-20210205182610-7448c56d2f34/uv_worker/customer_service.py", "risk": 1, "size": 225, "type": "python", "depth": 1 }, { "id": 61, "mol": "H(Cm)", "sha": "47cac07b27e2657e24f44b6e37792b41db83746feaaab85bc46c59e27c809270", "path": "github.com-wectf-2020-v0.0.0-20210205182610-7448c56d2f34.zip!!github.com/wectf/2020@v0.0.0-20210205182610-7448c56d2f34/uv_worker/note_app_2.py", "risk": 1, "size": 217, "type": "python", "depth": 1 }, { "id": 62, "mol": "H(Cm)", "sha": "ec3c93610791d335eb5220c2520f9ca6f1bf63fd305b6ca7b95f33c84ad82ec9", "path": "github.com-wectf-2020-v0.0.0-20210205182610-7448c56d2f34.zip!!github.com/wectf/2020@v0.0.0-20210205182610-7448c56d2f34/uv_worker/note_app_3.py", "risk": 2, "size": 367, "type": "python", "depth": 1 }, { "id": 63, "mol": "K(Li)H(Cm)", "sha": "9d01cc95d0977589b1ca75024f4eb67787e224dda953638df88df1363f7b7768", "path": "github.com-wectf-2020-v0.0.0-20210205182610-7448c56d2f34.zip!!github.com/wectf/2020@v0.0.0-20210205182610-7448c56d2f34/uv_worker/url_longener.py", "risk": 2, "size": 666, "type": "python", "depth": 1 }, { "id": 64, "sha": "8a43dc322c4271f7112a1da2d93069cfa453b49cb75121211223ba2b773b1da2", "path": "express@5.2.1.registry.json", "size": 890, "type": "registry", "depth": 2 }, { "id": 65, "sha": "6dc3f9385b4cbcb6064e6ece84333b2a787d06993bdbe7ef729e9480609077ba", "path": "github.com_wectf_2020@v0.0.0-20210205182610-7448c56d2f34.registry.json", "size": 810, "type": "registry", "depth": 1 } ], "omitted_files": 35, "rev": "479f3", "v": "8" } }